|
|
发表于 2004-12-15 15:22:18
|
显示全部楼层
ViRUS NAME ：JS_BAIDU.A; @0 {% V) O( K5 u
# \ S5 W/ O8 h. t. l C: M% ~
7 C, b. {$ y6 z; r2 PQUICK LINKS Solution | Understanding New Pattern Format ' K7 ]; v' T/ ] f% g
) |# h9 p' O3 S4 Z9 B, }" Z1 n--------------------------------------------------------------------------------+ O9 S! X. _3 W8 P. D, l% @4 ]
8 ~- Y2 t. O5 P9 F/ e+ E
Virus type: JavaScript
" H; g8 d* Q: \! ~. J* K * {* E4 ~- r# x/ a
Destructive: No
& N& G L W2 K$ p1 Q: f3 d/ `
. q! k1 m T% ?/ Z6 S9 M1 APattern file needed: 2.292.08 ( l& U+ {6 Z: p. r& }$ s) J
9 _. S8 ?4 f2 z# R3 F
Scan engine needed: 6.810 7 A/ @' e9 a7 q) b% B) H+ C5 T
! T" \$ T* V% }1 s0 f v( b Overall risk rating: Very Low
: g- W0 c% h, A: n# } m% Z$ h- T/ e' n7 B( y7 t
--------------------------------------------------------------------------------
0 e3 H; v; [% D. `1 B; ^9 D: s9 }
/ Z& c! y9 M1 zReported infections: Low ) y2 r! K9 ?; S9 b8 M4 R( }
/ m% o8 s% T. P# A, {# T4 l, {
Damage Potential: Low
: Q1 M' G' E% [ 8 `! {* \6 }7 t5 A) V
Distribution Potential: Low * t2 c5 ?- D. y' i/ ^4 k o# F2 @
9 ^1 @! w7 i; G& k* R
9 w3 G/ Z9 T5 I' {" l! T; o$ ~' x( z9 X' S
--------------------------------------------------------------------------------
! W% E! ` N5 ~ ; ^$ q% b2 d/ s6 m
Description:
, {- Z3 x) U# A8 }: L0 O+ O# x, B8 T6 @- u6 j9 c
! p, J+ L0 E- `
; `, t. ]: Q6 O
This malicious JS script may reside in an HTML file or in a malicious Web site. 8 j, h# b$ s; Y+ A/ P
* ?8 l, p/ _6 l$ s8 @5 [; [6 V
Upon execution, this JS script automatically downloads from the URL http://barai<BLOCKED>.com/update/Search.cab. . \1 g2 f r1 }! C# T Y
8 Q3 F6 U6 U9 g
It exploits a codebase vulnerability in Internet Explorer, which allows automatic execution of files. + Z6 ^, F( _, ]/ N9 U
. d1 L1 g; p7 u" s$ S- p5 x% YIt runs on Windows 95, 98, ME, NT, 2000, and XP. |
|
楼主