endurer 原创
2006.02.15 第3版 江民KV2006将yudi[1].js报为Exploit.MhtRedir.mzj。
2005.12.14 第2版 添加了瑞星的回复及多反病毒引擎扫描的结果。
2005.12.13 第1版
注：文中的病毒来源IP地址均用XX代替。
今天在浏览某政府网站首页时，有病毒文件被自动下载。
分析了一下：
在该网站的首页index.htm首部和中部被加入了通过＜ｉｆｒａｍｅ＞的引入网页hxxp://xx.xxx.xx.xx/7/7.htm的代码。
被引入的网页7.htm自动下载病毒文件yudi.js：
7.htm的内容为：
＜script language="java-script" src="yudi.js"＞＜/script＞
Kaspersky将yudi.js报为Exploit.HTML.Mht
*2006.05.15 第3版 江民KV2006将yudi[1].js报为Exploit.MhtRedir.mzj。
*2005.12.14 第2版补充： 添加了瑞星的回复及多反病毒引擎扫描的结果。
主 题：瑞星客户服务中心__关于病毒上报问题的分析结果C8=F0=D0=C7=BF=CD=BB=A7=B7=FE=CE=F1=D6=D0=D0=C4__=B9=D8=D3=DA=B2=A1=B6=BE=C9=CF=B1=A8=CE=CA=CC=E2=B5=C4=B7=D6=CE=F6=BD=E1=B9=FB?= 发件人：send@rising.net.cn 发送时间：2005-12-14 16:05:29
<script language="java-script" src="yudi.js" type="text/javascript"></script> 尊敬的客户，您好！ 您的邮件已经收到，感谢您对瑞星的支持。 我们已经详细分析过您的问题和文件，以下是您上传的文件的分析结果： 1.文件名：yudi[1].js 不是病毒提 醒：为保证收到您的来信，请勿直接回复本邮件!!!-------------------------------------------------------------服务单位：瑞星·客户服务中心工 程 师：CSC033电话服务：（010）82678800发送邮件：请用IE等浏览器访问网址 http://csc.rising.com.cn -------------------------------------------------------------
多引擎扫描上传文件1 http://virusscan.jotti.org/ 扫描的结果：
File: yudi[1].js Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 f9fecf19b99d944f751dcec9ffa915a2 Packers detected: - Scanner results AntiVir Found Exploit/MHT exploit ArcaVir Found Trojan.Exploit.Html.Mht Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found Exploit.MhtRedir F-Prot Antivirus Found nothing Fortinet Found HTML/Mht-exploit Kaspersky Anti-Virus Found Exploit.HTML.Mht NOD32 Found nothing Norman Virus Control Found nothing UNA Found nothing VBA32 Found nothing多引擎扫描上传文件2 http://www.virustotal.com/xhtml/index_en.html 的扫描结果
This is a report processed by VirusTotal on 12/14/2005 at 14:03:37 (CET) after scanning the file " yudi_1_.js" file.AntivirusVersionUpdateResultAntiVir6.33.0.6112.14.2005EXP/MHTAvast4.6.695.012.13.2005no virus foundAVG71812.08.2005no virus foundAvira6.33.0.6112.14.2005EXP/MHTBitDefender7.212.14.2005no virus foundCAT-QuickHeal8.0012.13.2005no virus foundClamAVdevel-2005110812.12.2005no virus foundDrWeb4.3312.14.2005Exploit.MhtRedireTrust-Iris7.1.194.012.14.2005no virus foundeTrust-Vet12.3.3.012.14.2005no virus foundFortinet2.54.0.012.14.2005HTML/Mht-exploitF-Prot3.16c12.13.2005no virus foundIkarus0.2.59.012.14.2005no virus foundKaspersky4.0.2.2412.14.2005Exploit.HTML.MhtMcAfee464912.13.2005no virus foundNOD32v21.132112.13.2005no virus foundNorman5.70.1012.14.2005no virus foundPanda8.02.0012.13.2005no virus foundSophos4.00.012.14.2005no virus foundSymantec8.012.14.2005no virus foundTheHacker5.9.1.05512.14.2005no virus foundVBA323.10.512.13.2005no virus found
VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. > Go to: Home <script type="text/javascript"></script> Contact En español
