小毒，刷流量的[MD5: FB23CF B73582 FC4D72 9B4C7E]

promised

C:\ABC\1\july4.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\1\mscol.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现
C:\ABC\1\sv.exe
C:\ABC\1\wordict.exe - 特征码 'Backdoor.Win32.Agent.ahj' 被发现

[ 本帖最后由 promised 于 2007-12-7 20:03 编辑 ]

promised

http://004*6^11$25
http://www.qqxpp.com.cn/*33^199
http://www.olmj.com.cn/*48^400
http://www.dm38.cn/*18^211
http://www.39it.cn/*12^207
http://www.qqload.cn/*58^150
http://www.okok2.com.cn/*7^514
http://www.yvyo.com.cn/a/yvyo/index.html*32^213
http://www.youxihe.com.cn/a/youxihe/index.html*83^261
http://www.16qu.com/a/16qu/index.html*0^150
http://www.gamezhe.com.cn*380^569
http://www.sanbaa.cn/*26^445
http://www.uhand.cn/*97^386
http://www.7txt.com.cn/*22^266
http://www.atxt.com.cn/*24^270
http://news.chu1.com.cn/*0^110
http://vod.39it.cn/*75^134
http://read.chu1.com.cn/*16^265
http://www.uucuu.com.cn/*68^165
http://www.ieiee.com.cn/*80^255
http://music.chu1.com.cn/*0^121
http://move.youxihe.com.cn/*76^135
http://bt.youxihe.com.cn/*2^170
http://zazhi.yvyo.com.cn/*26^121
http://book.39it.cn*17^266
http://news.yvyo.com.cn/*0^76
http://www.139358.com.cn/*1^111
http://ent.uhand.cn/*172^453
http://www.pemp.com.cn/*0^110
http://www.e686.com.cn/*136^265
http://www.olegame.cn/*80^251
http://www.selamoon.cn/*37^250

Graybird

Starting the file scan:

Begin scan in 'E:\样本.rar'
E:\样本.rar
  [0] Archive type: RAR
  --> mscol.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> wordict.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> july4.exe
      [DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen
  --> sv.exe
      [DETECTION] Contains suspicious code HEUR/Malware
      [INFO]      The file was deleted!

promised

http://15$20*1-2,3
http://union.pomoho.com/show.asp ... geid=~&_topref= #http://www.youxihe.com.cn^ju1$http://www.youxihe.com.cn/a/youxihe/
0
http://u.keyrun.com/code/kpcode. ... 9&adid_ary=2735||4||&ad_replace=0&width=468&height=60&codetype=0&thistype=undefined&top_title=39手机资讯网-手机资讯|手机新品|手机（MOBI)|3G手机|行业动态|购机指南|厂商人物|手机评测|手机专题|行业技术 手机配件|手机技巧|手机游戏|手机软件|智能手机|音乐手机&krview=&referrer= `var n=new Date();var m=n.getMinutes();var s=n.getSeconds();var ms=n.getMilliseconds();var a=Math.floor(Math.random()*3);document.T_FORM.m5.value=a;document.T_FORM.m1.value=Math.floor(Math.random()*466+2);document.T_FORM.m2.value=Math.floor(Math.random()*4+56);if (a>0){s-=Math.floor(Math.random()*5+4);if (s<0){s+=60;m=(m+59)%60;}document.T_FORM.m9.value=m+'.'+s+'.'+Math.floor(Math.random()*1000);document.T_FORM.m6.value=a;document.T_FORM.m3.value=Math.floor(Math.random()*466+2);document.T_FORM.m4.value=Math.floor(Math.random()*37+45);}s-=Math.floor(Math.random()*4+3);if (s<0){s+=60;m=(m+59)%60;}document.T_FORM.m8.value=m+'.'+s+'.'+Math.floor(Math.random()*1000);s-=Math.floor(Math.random()*36+17);if (s<0){s+=60;m=(m+59)%60;}document.T_FORM.m11.value=m+'.'+s+'.'+Math.floor(Math.random()*1000);#http://www.39it.cn/@yuanshaoli_total.asp?ad_name=ju1^yuanshaoli_ad.asp?ad_name=ju1$http://www.39it.cn/
0300154541346

wangjay1980

detected: virus Heur.Trojan.Generic (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/july4.exe//NSPack
detected: Trojan program Trojan-Downloader.Win32.Delf.dgl        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\&Ntilde;ù±&frac34;.rar/sv.exe

wangjay1980

Hello,

july4.exe, mscol.exe - Trojan.Win32.Delf.aog,
wordict.exe - Trojan.Win32.Delf.aoh

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

啊弥陀佛

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\WORDICT.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

木马名称:未知木马
程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\样本\MSCOL.EXE
是木马程序!
已成功阻止其运行,是否要删除此文件?

sv.exe驻留内存,无其他程序行为

zwl2828

Miss