[病毒样本] bak

显示全部楼层 · 发表于 2008-6-20 20:13:44

Log is generated by FreShow.
[wide]http://b.nnbase.com/Html/tupian/index.html
[script]http://b.nnbase.com/Html/tupian/../../js/top.js
[script]http://b.nnbase.com/Html/tupian/../../js/data.js
[script]http://b.nnbase.com/Html/tupian/../../js/tongji.js
      [frame]http://www.bvbvvvd.cn/17.htm
         [frame]http://www.bvbvvvd.cn/us.html
            [object]http://user1.12-33.net/versionff.swf
            [object]http://user1.12-33.net/versionie.swf
            [object]http://user1.12-33.net/Baidu.cab
            [script]http://user1.12-33.net/ms06014.js
                  [object]http://user1.12-33.net/bak.css
            [frame]http://user1.12-33.net/GLWORLD.html
                  [object]http://dz.us.net/bak.css
            [script]http://user1.12-33.net/real.js
                  [object]http://dz.us.net/bak.css
            [frame]http://user1.12-33.net/Real.html
                  [object]http://dz.us.net/bak.css
            [frame]http://user1.12-33.net/Thunder.html
                  [object]http://dz.us.net/bak.css
         [script]http://js.users.51.la/1599790.js
      [script]http://count30.51yes.com/click.aspx?id=308106948&logo=6
         [frame]http://count30.51yes.com/sa.aspx?id=308106948'+yesdata+'

下载地址：

http://user1.12-33.net/bak.css

http://user1.12-33.net/Baidu.cab

http://user1.12-33.net/versionff.swf

http://user1.12-33.net/versionie.swf

http://dz.us.net/bak.css

显示全部楼层 · 发表于 2008-6-20 20:19:03

C:\Documents and Settings\Administrator\桌面\virus\Baidu.cab>>Baidu.exe Trojan.Cap861823.utyf 木马还未处理
C:\Documents and Settings\Administrator\桌面\virus\bak.css Trojan.Cap861823.utyf 木马还未处理

显示全部楼层 · 发表于 2008-6-20 20:24:04

http://125.83.89.62:53/12.gif
http://125.83.89.62:53/13.gif
http://125.83.89.62:53/4.gif
http://125.83.89.62:53/5.gif
http://125.83.89.62:53/6.gif
http://222.216.28.100:53/14.gif
http://222.216.28.100:53/15.gif
http://222.216.28.100:53/16.gif
http://60.191.223.11/test/1.gif
http://60.191.223.11/test/2.gif
http://60.191.223.11/test/3.gif
http://60.191.223.11/w.gif
http://60.191.239.191:53/10.gif
http://60.191.239.191:53/11.gif
http://60.191.239.191:53/7.gif
http://60.191.239.191:53/8.gif
http://60.191.239.191:53/9.gif
http://60.191.239.191:53/down.gif
http://sun.update999.cn:53/moon.gif

复制代码

http://user1.12-34.net/bak.css
http://user1.12-35.net/bak.css
http://user1.12-36.net/bak.css
。。。。。

复制代码

先预定着，以后会有用

[ 本帖最后由热血小T 于 2008-6-30 20:07 编辑 ]

显示全部楼层 · 发表于 2008-6-20 20:34:17

把相关网页和程序打包，1个失效，共10个

另外照楼上所说的，又逮到5个css，因此包内共15个

[ 本帖最后由 sbbdms 于 2008-6-20 20:36 编辑 ]

显示全部楼层 · 发表于 2008-6-20 20:35:10

卡巴杀8漏7

已删除：木马程序 Trojan-Downloader.JS.Agent.zaaa       文件　: D:\软件\其它\v\k\wangma.rar/GLWORLD.html
已删除：木马程序 Trojan-Downloader.JS.Agent.zaaa       文件　: D:\软件\其它\v\k\wangma.rar/Real.html
已删除：木马程序 Trojan-Downloader.JS.Agent.zaaa       文件　: D:\软件\其它\v\k\wangma.rar/Thunder.html
已删除：木马程序 Trojan-Downloader.Win32.Agent.rqj       文件　: D:\软件\其它\v\k\wangma.rar/bak(1).css//PE_Patch//UPack
已删除：木马程序 Trojan-Downloader.Win32.Small.xii       文件　: D:\软件\其它\v\k\wangma.rar/bak(2).css
已删除：木马程序 Trojan-Downloader.Win32.Small.xii       文件　: D:\软件\其它\v\k\wangma.rar/bak(3).css
已删除：木马程序 Trojan-Downloader.Win32.Small.xii       文件　: D:\软件\其它\v\k\wangma.rar/bak(4).css
已删除：木马程序 Trojan-Downloader.Win32.Small.xii       文件　: D:\软件\其它\v\k\wangma.rar/bak(5).css

TO KL

[ 本帖最后由 sbbdms 于 2008-6-20 20:36 编辑 ]

显示全部楼层 · 发表于 2008-6-20 20:44:35

D:\download\wangma.rar>>Baidu.cab>>Baidu.exe Trojan.Cap861823.utyf 木马还未处理
D:\download\wangma.rar>>ms06014.js JS.Decoder.v 病毒还未处理
D:\download\wangma.rar>>real.js JS.Decoder.v 病毒还未处理
D:\download\wangma.rar>>us.html JS.Decoder.v 病毒还未处理
D:\download\wangma.rar>>bak.css Trojan.Cap861823.utyf 木马还未处理
D:\download\wangma.rar>>bak(1).css TrojanDownloader.Nurech.bd.bmqk 木马还未处理
D:\download\wangma.rar>>bak(2).css TrojanAgent.4608.242.hmps 木马还未处理
D:\download\wangma.rar>>bak(3).css TrojanAgent.4608.242.hmps 木马还未处理
D:\download\wangma.rar>>bak(4).css TrojanAgent.4608.242.hmps 木马还未处理
D:\download\wangma.rar>>bak(5).css TrojanAgent.4608.242.hmps 木马还未处理

10

显示全部楼层 · 发表于 2008-6-20 20:48:41

[Found possible virus] <W32/Downloader-Sml-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->bak.css
[Found possible virus] <W32/Downloader-Sml-based!Maximus (not disinfectable)> C:\Documents and Settings\All Users\Documents\Test\virus.rar->Baidu.cab->Baidu.exe

---------------------------------------------------------------------
Scan ended: 2008-6-20, 20:48:27
Duration: 0:00:00

Scan result:

Scanned files:    6
Infected objects:    2
Disinfected objects:    0
Quarantined files:    0
---------------------------------------------------------------------

显示全部楼层 · 发表于 2008-6-20 20:53:28

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Script.JS.Agent.bd
病毒： Trojan.DL.Win32.Small.vtg
病毒： Trojan.DL.Win32.Mnless.aka

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.49.42

显示全部楼层 · 发表于 2008-6-20 22:47:27

11+1
Begin scan in 'C:\Documents and Settings\Administrator\桌面\新資料夾'
C:\Documents and Settings\Administrator\桌面\新資料夾\Baidu.cab
  [0] Archive type: CAB (Microsoft)
  --> Baidu.exe
   [DETECTION] Is the Trojan horse TR/Agent.4608.243
   [NOTE]    A backup was created as '48c4c314.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak(1).css
   [DETECTION] Is the Trojan horse TR/Dldr.Agent.rqj.1
   [NOTE]    A backup was created as '48c6c314.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak(2).css
   [DETECTION] Is the Trojan horse TR/Agent.4608.242
   [NOTE]    A backup was created as '4940b9e5.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak(3).css
   [DETECTION] Is the Trojan horse TR/Agent.4608.242
   [NOTE]    A backup was created as '48c6c316.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak(4).css
   [DETECTION] Is the Trojan horse TR/Agent.4608.242
   [NOTE]    A backup was created as '4940b9e7.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak(5).css
   [DETECTION] Is the Trojan horse TR/Dldr.Small.xii
   [NOTE]    A backup was created as '48c6c318.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\bak.css
   [DETECTION] Is the Trojan horse TR/Agent.4608.243
   [NOTE]    A backup was created as '4940b9e9.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\GLWORLD.html
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Agent.EX
   [NOTE]    A backup was created as '48b2c2ff.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\Real.html
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Dldr.Agent.EX
   [NOTE]    A backup was created as '48bcc318.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\real.js
   [DETECTION] Contains suspicious code HEUR/HTML.Malware
   [NOTE]    The fund was classified as suspicious.
   [NOTE]    A backup was created as '493ab9e9.qua'  ( QUARANTINE )
C:\Documents and Settings\Administrator\桌面\新資料夾\Thunder.html
   [DETECTION] Contains detection pattern of the HTML script virus HTML/Shellcode.Gen
   [NOTE]    A backup was created as '48d0c31b.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!
C:\Documents and Settings\Administrator\桌面\新資料夾\us.html
   [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Harsole
   [NOTE]    A backup was created as '4889c326.qua'  ( QUARANTINE )
   [NOTE]    The file was deleted!

End of the scan: 2008年6月20日  22:46
Used time: 00:02 min

The scan has been done completely.

   1 Scanning directories
   16 Files were scanned
   11 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   11 files were deleted
   0 files were repaired
   12 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   5 Files not concerned
   1 Archives were scanned
   0 Warnings
   12 Notes
25053274    ms06014.js    978 Byte    UNDER ANALYSIS
25053275    real.js    3.34 KB    UNDER ANALYSIS
25053276    versionff.swf    136 Byte    UNDER ANALYSIS
25053277    versionie.swf    136 Byte    UNDER ANALYSIS

显示全部楼层 · 发表于 2008-6-20 22:54:14

打包

[ 本帖最后由 tanlimo 于 2008-6-20 22:57 编辑 ]

[病毒样本] bak

本帖子中包含更多资源

本帖子中包含更多资源

F-Prot 4.4.4

18/6

本帖子中包含更多资源