|
|
发表于 2004-12-15 15:22:18
|
显示全部楼层
ViRUS NAME ：JS_BAIDU.A6 C3 i- o" [+ ~
( a9 G) t! z4 ?4 J3 w7 U$ G
$ M# h3 t' Z- y* r
QUICK LINKS Solution | Understanding New Pattern Format
$ Y% Q1 _: X: g7 r4 D. B" \$ B- E
# x3 D; [ P3 k+ L5 b% R9 Q--------------------------------------------------------------------------------8 ~1 ?. F! K8 h I5 V- i
8 f, {9 ]& E/ f& x
Virus type: JavaScript # O+ W. b( h7 P; r
$ g2 @* Y! X3 y h- u
Destructive: No
- ~( J3 n' f5 W. O
% F% T& T0 Q5 |( p5 y& X5 ^Pattern file needed: 2.292.08 9 q* d* Q0 Y! L C
6 v5 r" Y1 D$ |4 w+ W% q
Scan engine needed: 6.810 2 Z) v& U; O6 r/ y
& L3 Q6 q9 `! |5 Y E1 j3 u Overall risk rating: Very Low 7 I3 _0 m& [. F% T' q6 p
0 E8 V! H* w% \# }
--------------------------------------------------------------------------------
^* w7 h! J w: f# b( _
& r6 I3 V$ Z; j+ B. ~$ m& W, v" LReported infections: Low T0 Q1 j7 ?8 y3 C% q
" s$ X p4 S3 ]0 w6 X, ZDamage Potential: Low
& J8 }' `9 S8 \: n ) u( Z% ~5 f" [, P5 z
Distribution Potential: Low
! r+ p- q4 {6 d. Z0 o5 K0 | & n0 \3 ~$ Q9 Q5 D
" m& Q, |: K. X7 | L
6 g o3 a1 G# i7 U2 l- R( H7 }--------------------------------------------------------------------------------
0 r* \, j0 m; q M
3 d' R; E( t% S' t& XDescription:. k, K$ _8 y4 V; F4 }
$ j: u' \9 i# z& p9 q* T
4 ~9 _( S0 L0 ~8 L6 M6 E- m/ B6 T! i! o5 K; k B6 J v8 s8 T
This malicious JS script may reside in an HTML file or in a malicious Web site.
6 i2 T) R+ \& M) M- O) s; U4 c! s
Upon execution, this JS script automatically downloads from the URL http://barai<BLOCKED>.com/update/Search.cab. : i# o8 M* k/ K, @9 ~, x4 X/ H
: G! @: n7 A) S$ P& W! ~
It exploits a codebase vulnerability in Internet Explorer, which allows automatic execution of files. % c5 c( D* Q$ _
3 r, o- F' j, P" V) N8 Y; lIt runs on Windows 95, 98, ME, NT, 2000, and XP. |
|
楼主