小虾米前面发的毒网的分析结果 [md5略]

显示全部楼层 · 发表于 2007-7-9 01:22:45

前面在看云之彼端出去倒了杯水进来时就瞟到那个帖子

想只是简单分析下的…… 谁知道一开始…… 就犹如黑洞般升不见底……

这世道嗨~

发现作者们很喜欢管自己的孩子叫vip……晕菜…… 就不能有点创意么~

睡觉去了~这电脑没法管了……

分析过程在http://bbs.kafan.cn/viewthread.php?tid=105870&page=1&extra=page%3D1
（尤为壮观……||||）

样本鉴于很多人对于脚本的态度分为两类~各取所须吧……

come on~

显示全部楼层 · 发表于 2007-7-9 06:33:28

费尔

显示全部楼层 · 发表于 2007-7-9 07:18:29

Starting the file scan:

Begin scan in 'F:\病毒样本\exe.rar'
F:\病毒样本\exe.rar
  [0] Archive type: RAR
  --> exe\70.exe
   [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.ahj.652 Backdoor server programs
  --> exe\down.exe
   [DETECTION] Is the Trojan horse TR/Agent.19544
  --> exe\down2.exe
   [DETECTION] Is the Trojan horse TR/Dldr.Delf.bko.4
  --> exe\vip.exe
   [DETECTION] Is the Trojan horse TR/PSW.Delf.QC.53
  --> exe\vip2.exe
   [DETECTION] Is the Trojan horse TR/PSW.Steal.27415
   [INFO]    The file was deleted!
Begin scan in 'F:\病毒样本\script.rar'
F:\病毒样本\script.rar
  [0] Archive type: RAR
  --> script\1.htm
   [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.E.10
  --> script\70[1].htm
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> script\cs[1].htm
   [DETECTION] Contains signature of the HTML script virus HTML/iFrame.H
  --> script\exec.htm
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.JR.1
  --> script\hhss.htm
   [DETECTION] Contains signature of the Java script virus JS/Psyme.D
  --> script\kehu0774[2].htm
   [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agent.FG
  --> script\vip[1].js
   [DETECTION] Contains signature of the Java script virus JS/Dldr.Agent.E.6
  --> script\www1[1].js
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.KA.4
  --> script\xjz2007[1].bmp
   [DETECTION] Contains signature of the exploits EXP/Ani.Gen
   [INFO]    The file was deleted!

End of the scan: 2007年7月9日  07:18
Used time: 00:10 min

The scan has been done completely.

   0 Scanning directories
   18 Files were scanned
   14 viruses and/or unwanted programs were found
   1 classified as suspicious:
   2 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   3 Files not concerned
   2 Archives were scanned
   0 Warnings
   0 Notes
   0 Hidden objects were found

显示全部楼层 · 发表于 2007-7-9 07:53:31

扫描进行于：2007/7/9 7:42:12
扫描日志
NOD32版本 2384 (20070708) NT
命令行： D:\virus\script.rar
C:\Program Files\Eset\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 9.7.2007 时间：07:42:13
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\virus\script.rar
D:\virus\script.rar >>RAR >>script\1.htm - 是正常的
D:\virus\script.rar >>RAR >>script\70[1].htm - 是正常的
D:\virus\script.rar >>RAR >>script\cs[1].htm - 是正常的
D:\virus\script.rar >>RAR >>script\exec.htm - 是正常的
D:\virus\script.rar >>RAR >>script\hhss.htm - 是正常的
D:\virus\script.rar >>RAR >>script\kehu0774[2].htm - 是正常的
D:\virus\script.rar >>RAR >>script\vip[1].js - 是正常的
D:\virus\script.rar >>RAR >>script\www1[1].js - 是正常的
D:\virus\script.rar >>RAR >>script\xjz2007[1].bmp - Win32/TrojanDownloader.Ani.Gen 木马的变种
D:\virus\script.rar:Zone.Identifier - 是正常的
已扫描的文件数目：10
已发现的病毒数目：1
完成时间： 07:42:14 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-7-9 07:53:54

扫描进行于：2007/7/9 7:42:37
扫描日志
NOD32版本 2384 (20070708) NT
命令行： D:\virus\exe.rar
C:\Program Files\Eset\nod32.exe - 是正常的
1 的MBR区.物理磁盘 - 是正常的
1 的启动引导区.物理磁盘 - 是正常的

日期： 9.7.2007 时间：07:42:38
已开启反隐藏功能.
已扫描的磁盘，文件夹及文件：D:\virus\exe.rar
D:\virus\exe.rar >>RAR >>exe\70.exe - 可能是 Win32/Agent.NEO 木马的一个变种
D:\virus\exe.rar >>RAR >>exe\down.exe - Win32/TrojanDownloader.Delf.NSA 木马的变种
D:\virus\exe.rar >>RAR >>exe\down2.exe - Win32/TrojanDownloader.Delf.BHO 木马的变种
D:\virus\exe.rar >>RAR >>exe\vip.exe - Win32/PSW.Delf.NHI 木马的变种
D:\virus\exe.rar >>RAR >>exe\vip2.exe - Win32/PSW.Delf.NHI 木马的变种
D:\virus\exe.rar:Zone.Identifier - 是正常的
已扫描的文件数目：6
已发现的病毒数目：5
完成时间： 07:42:39 总扫描时间：1 秒 (00:00:01)

显示全部楼层 · 发表于 2007-7-9 08:06:59

已检测到: 木马程序 Trojan-Downloader.JS.Agent.jr URL: http://bbs.kafan.cn/attachment.php?aid=98442//script/exec.htm
已检测到: 木马程序 Backdoor.Win32.Agent.ahj URL: http://bbs.kafan.cn/attachment.php?aid=98443//exe/70.exe

显示全部楼层 · 发表于 2007-7-9 08:08:59

kis两个？

显示全部楼层 · 发表于 2007-7-9 08:20:37

detected: Trojan program Trojan-Downloader.JS.Agent.jr File: C:\Documents and Settings\Owner\×ÀÃæ\script.rar/script\exec.htm
detected: Trojan program Trojan-Downloader.VBS.Agent.w File: C:\Documents and Settings\Owner\×ÀÃæ\script.rar/script\hhss.htm
detected: Trojan program Trojan-Downloader.JS.Psyme.gs File: C:\Documents and Settings\Owner\×ÀÃæ\script.rar/script\kehu0774[2].htm
detected: Trojan program Trojan-Downloader.JS.Agent.ka File: C:\Documents and Settings\Owner\×ÀÃæ\script.rar/script\www1[1].js
detected: malware Exploit.Win32.IMG-ANI.ac File: C:\Documents and Settings\Owner\×ÀÃæ\script.rar/script\xjz2007[1].bmp
detected: Trojan program Backdoor.Win32.Agent.ahj File: C:\Documents and Settings\Owner\×ÀÃæ\exe.rar/exe\70.exe
detected: virus Virus.Win32.AutoRun.z File: C:\Documents and Settings\Owner\×ÀÃæ\exe.rar/exe\down.exe
detected: Trojan program Trojan-Downloader.Win32.Delf.bko File: C:\Documents and Settings\Owner\×ÀÃæ\exe.rar/exe\down2.exe
detected: Trojan program Trojan-PSW.Win32.Delf.qc File: C:\Documents and Settings\Owner\×ÀÃæ\exe.rar/exe\vip.exe//UPX
detected: Trojan program Trojan-Spy.Win32.Delf.vr File: C:\Documents and Settings\Owner\×ÀÃæ\exe.rar/exe\vip2.exe//UPX

显示全部楼层 · 发表于 2007-7-9 08:29:41

刚去jotti扫了下 bd个变态~~~~~~`

显示全部楼层 · 发表于 2007-7-9 08:48:45

c:\ABC\ABC\exe\70.exe - Signature 'Trojan-PWS.Win32.Agent.BU' found
c:\ABC\ABC\exe\down.exe - Signature 'Backdoor.Win32.Agent.ahj' found
c:\ABC\ABC\exe\down2.exe - Signature 'Trojan-PWS.Win32.QQPass.pb' found
c:\ABC\ABC\exe\vip.exe - Signature 'Trojan-Spy.Win32.Delf.PG' found
c:\ABC\ABC\exe\vip2.exe - Signature 'Trojan.Delf.NEB' found
c:\ABC\ABC\script\1.htm
c:\ABC\ABC\script\70[1].htm
c:\ABC\ABC\script\cs[1].htm
c:\ABC\ABC\script\exec.htm
c:\ABC\ABC\script\hhss.htm - Signature 'Exploit.JS.ADODB.Stream.e#102' found
c:\ABC\ABC\script\kehu0774[2].htm
c:\ABC\ABC\script\vip[1].js
c:\ABC\ABC\script\www1[1].js - Signature 'Trojan-Downloader.JS.Agent.ka' found
c:\ABC\ABC\script\xjz2007[1].bmp - Signature 'Exploit.Win32.IMG-ANI.ac' found

14 Files scanned
(0 Archives with 0 files)
8 Signatures found
0 Suspect code-parts found
Used time: 0:00.297

[病毒样本] 小虾米前面发的毒网的分析结果 [md5略]

本帖子中包含更多资源

本帖子中包含更多资源