东方卫士更新了

显示全部楼层 · 发表于 2007-5-31 10:22:56

什么都不说了 www.i110.com

显示全部楼层 · 发表于 2007-5-31 10:28:27

Kaspersky Anti-Virus 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=78775 is infected with Exploit.Win32.IMG-ANI.gen virus

显示全部楼层 · 发表于 2007-5-31 10:30:04

亲自上了

显示全部楼层 · 发表于 2007-5-31 10:31:04

Avast报是 CVE-2007-0038.

显示全部楼层 · 发表于 2007-5-31 10:31:12

除了那个html，铁壳都报了。html里面的那个a.exe也报了，看来那人水平一般般

显示全部楼层 · 发表于 2007-5-31 10:46:08

扫描开始时间: 2007-5-31 10:46:24
扫描日志
NOD32 版本 2299 (20070530) NT
命令行: F:\4.zip

日期: 2007年5月31日时间: 10:46:25
反 Rookits 技术已启用。
已扫描磁盘、文件夹和文件: F:\4.zip
F:\4.zip ?ZIP ?ah[1].c<病毒 - Win32/TrojanDownloader.Ani.Gen 木马变种>
F:\4.zip ?ZIP ?NewInfo.bmp<病毒 - Win32/PSW.Delf.NHI 木马变种>
F:\4.zip ?ZIP ?rising915.exe<病毒 - Win32/PSW.Delf.NHI 木马变种>
已扫描文件数量: 4
已发现病毒数量: 3
完成时间: 10:46:25 总共扫描时间: 0 秒 (00:00:00)

显示全部楼层 · 发表于 2007-5-31 11:38:51

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\4.zip'
C:\Documents and Settings\morgan\My Documents\
  4.zip
[0] Archive type: ZIP
--> ah[1].c
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [WARNING] Infected files in archives cannot be repaired!
--> NewInfo.bmp
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.33
      [WARNING] Infected files in archives cannot be repaired!
--> rising915.exe
      [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.33
      [WARNING] Infected files in archives cannot be repaired!
--> vip2[1].htm
      [DETECTION] Contains suspicious code HEUR/Exploit.HTML
      [WARNING] Infected files in archives cannot be repaired!
      [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-31 12:17:18

果然，蜘蛛不会报htm。。。

[Scan path] C:\Documents and Settings\Administrator\桌面\4.zip
>C:\Documents and Settings\Administrator\桌面\4.zip\ah[1].c infected with Exploit.ANIFile
>C:\Documents and Settings\Administrator\桌面\4.zip\NewInfo.bmp infected with Trojan.PWS.Gamania
>>C:\Documents and Settings\Administrator\桌面\4.zip\rising915.exe infected with Trojan.PWS.Gamania
>>C:\Documents and Settings\Administrator\桌面\4.zip\vip2[1].htm\Script.0 - Ok
>>C:\Documents and Settings\Administrator\桌面\4.zip\vip2[1].htm\Script.1 - Ok
>C:\Documents and Settings\Administrator\桌面\4.zip\vip2[1].htm - Ok
C:\Documents and Settings\Administrator\桌面\4.zip - archive contains infected objects

-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 7
Infected objects found: 3
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 58 Kb/s
Scan time: 00:00:00

显示全部楼层 · 发表于 2007-5-31 12:22:27

Begin scan in 'D:\Documents and Settings\dell\桌面\4.zip'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\4.zip
  [0] Archive type: ZIP
  --> ah[1].c
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
   [WARNING] Infected files in archives cannot be repaired!
  --> NewInfo.bmp
   [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.33
   [WARNING] Infected files in archives cannot be repaired!
  --> rising915.exe
   [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.33
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!

[ 本帖最后由 scottxzt 于 2007-6-1 16:24 编辑 ]

显示全部楼层 · 发表于 2007-5-31 12:25:39

已检测到: 恶意程序 Exploit.Win32.IMG-ANI.gen (修改) URL: http://bbs.kafan.cn/attachment.php?aid=78775//ah[1].c

[病毒样本] 东方卫士更新了

本帖子中包含更多资源

本帖子中包含更多资源

vip2[1].htm启发