某政府网站被加入自动下载病毒文件的代码(第2版)

王朝other·作者佚名  2006-01-10
窄屏简体版  字體: |||超大  

endurer原创

2005.12.14第2版 添加了瑞星的回复及多反病毒引擎扫描的结果。

2005.12.13第1版

注:文中的病毒来源IP地址均用XX代替。

今天在浏览某政府网站首页时,有病毒文件被自动下载。

分析了一下:

在该网站的首页index.htm首部和中部被加入了通过<iframe>的引入网页hxxp://xx.xxx.xx.xx/7/7.htm的代码。

被引入的网页7.htm自动下载病毒文件yudi.js:

7.htm的内容为:

<script language="java-script" src="yudi.js"></script>

Kaspersky将yudi.js报为Exploit.HTML.Mht

*2005.12.14第2版补充: 添加了瑞星的回复及多反病毒引擎扫描的结果。

主题:

瑞星客户服务中心__关于病毒上报问题的分析结果C8=F0=D0=C7=BF=CD=BB=A7=B7=FE=CE=F1=D6=D0=D0=C4__=B9=D8=D3=DA=B2=A1=B6=BE=C9=CF=B1=A8=CE=CA=CC=E2=B5=C4=B7=D6=CE=F6=BD=E1=B9=FB?=

发件人:

send@rising.net.cn

发送时间:2005-12-14 16:05:29

尊敬的客户,您好!

您的邮件已经收到,感谢您对瑞星的支持。

我们已经详细分析过您的问题和文件,以下是您上传的文件的分析结果:

1.文件名:yudi[1].js

不是病毒

提 醒:为保证收到您的来信,请勿直接回复本邮件!!!

-------------------------------------------------------------

服务单位:瑞星·客户服务中心

工 程 师:CSC033

电话服务:(010)82678800

发送邮件:请用IE等浏览器访问网址 http://csc.rising.com.cn

-------------------------------------------------------------

多引擎扫描上传文件1 http://virusscan.jotti.org/ 扫描的结果:

File:

yudi[1].js

Status:

INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)

MD5

f9fecf19b99d944f751dcec9ffa915a2

Packers detected:

-

Scanner results

AntiVir

Found Exploit/MHT exploit

ArcaVir

Found Trojan.Exploit.Html.Mht

Avast

Found nothing

AVG Antivirus

Found nothing

BitDefender

Found nothing

ClamAV

Found nothing

Dr.Web

Found Exploit.MhtRedir

F-Prot Antivirus

Found nothing

Fortinet

Found HTML/Mht-exploit

Kaspersky Anti-Virus

Found Exploit.HTML.Mht

NOD32

Found nothing

Norman Virus Control

Found nothing

UNA

Found nothing

VBA32

Found nothing

多引擎扫描上传文件2 http://www.virustotal.com/xhtml/index_en.html 的扫描结果

This is a report processed by VirusTotal on 12/14/2005 at 14:03:37 (CET) after scanning the file "yudi_1_.js" file. Antivirus

Version

Update

Result

AntiVir

6.33.0.61

12.14.2005

EXP/MHT

Avast

4.6.695.0

12.13.2005

no virus found

AVG

718

12.08.2005

no virus found

Avira

6.33.0.61

12.14.2005

EXP/MHT

BitDefender

7.2

12.14.2005

no virus found

CAT-QuickHeal

8.00

12.13.2005

no virus found

ClamAV

devel-20051108

12.12.2005

no virus found

DrWeb

4.33

12.14.2005

Exploit.MhtRedir

eTrust-Iris

7.1.194.0

12.14.2005

no virus found

eTrust-Vet

12.3.3.0

12.14.2005

no virus found

Fortinet

2.54.0.0

12.14.2005

HTML/Mht-exploit

F-Prot

3.16c

12.13.2005

no virus found

Ikarus

0.2.59.0

12.14.2005

no virus found

Kaspersky

4.0.2.24

12.14.2005

Exploit.HTML.Mht

McAfee

4649

12.13.2005

no virus found

NOD32v2

1.1321

12.13.2005

no virus found

Norman

5.70.10

12.14.2005

no virus found

Panda

8.02.00

12.13.2005

no virus found

Sophos

4.00.0

12.14.2005

no virus found

Symantec

8.0

12.14.2005

no virus found

TheHacker

5.9.1.055

12.14.2005

no virus found

VBA32

3.10.5

12.13.2005

no virus found

VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

> Go to: Home Contact En español

www.virustotal.com :: ©Hispasec Sistemas 2004,05 :: e-mail info@virustotal.com

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有  導航