|
|
发表于 2004-12-15 15:22:18
|
显示全部楼层
ViRUS NAME ：JS_BAIDU.A
R9 A) V5 ~/ z1 r2 C
7 Q8 h2 O: I0 X3 J0 v8 q4 R# |. z t5 V% s8 }. I
QUICK LINKS Solution | Understanding New Pattern Format
e9 L* L; J0 q C8 [$ }
; A6 `- v D8 z( q5 @/ x--------------------------------------------------------------------------------9 v7 E. l' O! |
0 N; b! o. n' @5 @! x
Virus type: JavaScript
8 V$ r2 }; |7 q
* r- v5 Q: u/ B5 D8 m, RDestructive: No , i7 e3 W, R! L5 {6 N, Q( J
3 @# u+ i$ D) x4 I
Pattern file needed: 2.292.08
- X! d7 s# o! G, O! j5 t
: i. Z5 T+ g4 m+ bScan engine needed: 6.810
+ F! U3 y# {. A, Z6 P" A
( C2 X( v, {% ?: g* S5 f( I Overall risk rating: Very Low 3 W% h5 l& L: q, X6 e2 W& l
/ ?% j% B6 x- L5 b% q0 k
--------------------------------------------------------------------------------$ q) A& }6 {6 r3 f
2 l, |" I. N' @2 G4 eReported infections: Low
8 L+ ~. E: c. R+ `- Z0 S
3 M2 j/ `. l- D7 dDamage Potential: Low & U) H0 i# ^+ T7 m0 R
. {5 x. m x: W1 d% u+ U
Distribution Potential: Low
8 T1 y5 V2 r# Q4 [5 P& J( y
9 t/ y# L4 f' Q n - K* X* b0 m# B J# r
/ l, i! [3 z) e' E# b) h' |# d4 g! ~--------------------------------------------------------------------------------
) E z8 N, I4 l0 H. @+ [" K 9 H% L5 W' M/ p+ L: W2 w/ W# Y
Description:7 O: M' \4 f3 k4 m. F% e* |% c& q
/ O8 \) F' z) D( l# }
4 S( r3 u2 s9 d! f3 n) h# ?2 w; X+ s! c4 z. y; c2 I
This malicious JS script may reside in an HTML file or in a malicious Web site. ' x+ r, o$ H9 S' R2 ^
- J8 c2 z" f2 S/ x; nUpon execution, this JS script automatically downloads from the URL http://barai<BLOCKED>.com/update/Search.cab. - i, o0 j2 k. k- w% C) m( O, m( p
5 }8 K) Z6 d- `) q0 }It exploits a codebase vulnerability in Internet Explorer, which allows automatic execution of files. 9 q: Q+ |+ J8 B& v7 v
' \) ?2 y3 k* i8 M/ AIt runs on Windows 95, 98, ME, NT, 2000, and XP. |
|
楼主