Hunter Work：酷狗音乐首页隐蔽挂马详细分析+72只马

qianwenxiang

那个貌似是5Lyes不是51yes..

jimmyleo

[ Mon Jun 23 09:20:56 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX1.EXE
[ Mon Jun 23 09:20:57 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX10.EXE
[ Mon Jun 23 09:20:59 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX11.EXE
[ Mon Jun 23 09:21:02 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX12.EXE
[ Mon Jun 23 09:21:05 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX13.EXE
[ Mon Jun 23 09:21:06 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX14.EXE
[ Mon Jun 23 09:21:08 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX15.EXE
[ Mon Jun 23 09:21:11 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX16.EXE
[ Mon Jun 23 09:21:13 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX17.EXE
[ Mon Jun 23 09:21:16 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX18.EXE
[ Mon Jun 23 09:21:18 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX19.EXE
[ Mon Jun 23 09:21:20 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX2.EXE
[ Mon Jun 23 09:21:22 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX20.EXE
[ Mon Jun 23 09:21:24 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX21.EXE
[ Mon Jun 23 09:21:26 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX22.EXE
[ Mon Jun 23 09:21:28 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX23.EXE
[ Mon Jun 23 09:21:30 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX24.EXE
[ Mon Jun 23 09:21:31 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX25.EXE
[ Mon Jun 23 09:21:31 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX26.EXE
[ Mon Jun 23 09:21:31 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX27.EXE
[ Mon Jun 23 09:21:31 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX28.EXE
[ Mon Jun 23 09:21:31 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX29.EXE
[ Mon Jun 23 09:21:33 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX3.EXE
[ Mon Jun 23 09:21:34 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX30.EXE
[ Mon Jun 23 09:21:34 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX31.EXE
[ Mon Jun 23 09:21:34 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX32.EXE
[ Mon Jun 23 09:21:37 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX4.EXE
[ Mon Jun 23 09:21:39 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX5.EXE
[ Mon Jun 23 09:21:41 2008 ] Suspicious file        D:\Download\S\MM\MM\MAX6.EXE
[ Mon Jun 23 09:21:43 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX7.EXE
[ Mon Jun 23 09:21:45 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX8.EXE
[ Mon Jun 23 09:21:47 2008 ] Generic Malware        in D:\Download\S\MM\MM\MAX9.EXE
[ Mon Jun 23 09:21:48 2008 ] Generic Malware        in D:\Download\S\MM\MM\N14.EXE
[ Mon Jun 23 09:21:50 2008 ] Generic Malware        in D:\Download\S\MM\MM\O15.EXE
[ Mon Jun 23 09:21:51 2008 ] Generic Malware        in D:\Download\S\MM\MM\O24.EXE
[ Mon Jun 23 09:21:52 2008 ] Suspicious file        D:\Download\S\MM\MM\P21.EXE
[ Mon Jun 23 09:21:52 2008 ] Trj/QQPass.AZS         in D:\Download\S\MM\MM\P35.EXE
[ Mon Jun 23 09:21:52 2008 ] Suspicious file        D:\Download\S\MM\MM\R2.EXE
[ Mon Jun 23 09:21:54 2008 ] Generic Malware        in D:\Download\S\MM\MM\R7.EXE
[ Mon Jun 23 09:21:56 2008 ] Generic Malware        in D:\Download\S\MM\MM\T20.EXE
[ Mon Jun 23 09:21:57 2008 ] Suspicious file        D:\Download\S\MM\MM\U29.EXE
[ Mon Jun 23 09:21:58 2008 ] Suspicious file        D:\Download\S\MM\MM\U33.EXE
[ Mon Jun 23 09:21:59 2008 ] Generic Malware        in D:\Download\S\MM\MM\V27.EXE
[ Mon Jun 23 09:22:00 2008 ] Suspicious file        D:\Download\S\MM\MM\X22.EXE
[ Mon Jun 23 09:22:00 2008 ] Suspicious file        D:\Download\S\MM\MM\X9.EXE
[ Mon Jun 23 09:22:02 2008 ] Suspicious file        D:\Download\S\MM\MM\Y5.EXE
[ Mon Jun 23 09:22:04 2008 ] Suspicious file        D:\Download\S\MM\MM\Z12.EXE

沙加

赛门铁克SEP报了49个

shi007

Check system areas...
Check selected directories and files...
Object: a3.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: b11.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Agent.amb (KAV Engine)
Object: b25.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.asdi (KAV Engine)
Object: b31.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: c19.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.ZAY (Avast or BD Engine)
Object: c32.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apqj (KAV Engine)
Object: e1.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: e26.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqeh (KAV Engine)
Object: f34.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Backdoor.Win32.Popwin.bfu (KAV Engine)
Object: g16.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.ZAY (Avast or BD Engine)
Object: gd.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Suspected virus
        Virus: BehavesLike:Win32.AV-Killer (Avast or BD Engine)
Object: google.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Worm.Win32.Downloader.pu (KAV Engine)
Object: h30.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: i8.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: j17.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: j4.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.asbu (KAV Engine)
Object: l10.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apms (KAV Engine)
Object: l18.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: m13.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqna (KAV Engine)
Object: m23.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: m28.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: m6.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: max.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-Downloader.Win32.Agent.tyc (KAV Engine)
Object: max1.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aphm (KAV Engine)
Object: max10.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: max11.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqfs (KAV Engine)
Object: max12.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: max13.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqna (KAV Engine)
Object: max14.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apms (KAV Engine)
Object: max15.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apqj (KAV Engine)
Object: max16.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: max17.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apil (KAV Engine)
Object: max18.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqeh (KAV Engine)
Object: max19.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqgp (KAV Engine)
Object: max2.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apms (KAV Engine)
Object: max20.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apnd (KAV Engine)
Object: max21.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZJ (Avast or BD Engine)
Object: max22.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aphm (KAV Engine)
Object: max23.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aplq (KAV Engine)
Object: max24.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqmr (KAV Engine)
Object: max25.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.argz (KAV Engine)
Object: max26.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Nilage.cnd (KAV Engine)
Object: max27.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.asbw (KAV Engine)
Object: max28.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.asdx (KAV Engine)
Object: max29.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.amey (KAV Engine)
Object: max3.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apms (KAV Engine)
Object: max30.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.Agent.amb (KAV Engine)
Object: max31.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aoem (KAV Engine)
Object: max32.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.arpk (KAV Engine)
Object: max35.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.QQPass.cjn (KAV Engine)
Object: max4.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apil (KAV Engine)
Object: max5.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apil (KAV Engine)
Object: max6.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.arwu (KAV Engine)
Object: max7.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.asbu (KAV Engine)
Object: max8.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apil (KAV Engine)
Object: max9.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aphm (KAV Engine)
Object: n14.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apil (KAV Engine)
Object: o15.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqay (KAV Engine)
Object: o24.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.appy (KAV Engine)
Object: p21.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.apqd (KAV Engine)
Object: p35.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.QQPass.ciu (KAV Engine)
Object: r2.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: r7.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqbq (KAV Engine)
Object: t20.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqgp (KAV Engine)
Object: u29.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.ZAY (Avast or BD Engine)
Object: u33.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.ZAY (Avast or BD Engine)
Object: UUSEEM~1.EXE
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Generic.Malware.dld!!.6D4DFBC6 (Avast or BD Engine)
Object: v27.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aphm (KAV Engine)
Object: x22.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.ZAY (Avast or BD Engine)
Object: x9.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan.PWS.OnlineGames.YZL (Avast or BD Engine)
Object: y5.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.arwc (KAV Engine)
Object: z12.exe
        Path: C:\Documents and Settings\Administrator\桌面\mm\mm
        Status: Virus detected
        Virus: Trojan-PSW.Win32.OnLineGames.aqfs (KAV Engine)
Analysis complete: 6/23/2008
    72 files checked
    71 infected files detected
    1 suspected files detected

ryota

  的确是5lyes  
我一直以为是51yes呢  
谢谢指正

ryota

PS.昨天上报酷狗官方后，现在已经解决了   :-)

lanvin

支持某人的辛苦解码

尽在不言中

瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Trojan.PSW.Win32.GameOL.ofr
病毒： Trojan.PSW.Win32.GameOL.oek
病毒： Trojan.PSW.Win32.GameOL.nvl
病毒： Trojan.PSW.Win32.ZhengTu.ynv
病毒： Trojan.PSW.Win32.GameOL.oci
病毒： Trojan.IMMSG.Win32.TBMSG.lj
病毒： Trojan.Win32.Undef.igu   
病毒： Trojan.Win32.AntiAV.aj   
病毒： Trojan.PSW.Win32.GameOL.odt
病毒： Trojan.PSW.Win32.ZhuXian.hx
病毒： RootKit.Win32.Agent.bcj  
病毒： RootKit.Win32.Agent.bcj  
病毒： Trojan.PSW.Win32.ZeroOnline.dv
病毒： Trojan.PSW.Win32.Mapdimp.a
病毒： Trojan.PSW.Win32.GameOL.nve
病毒： RootKit.Win32.RESSDT.bf  
病毒： Trojan.PSW.Win32.GameOL.nxf
病毒： Trojan.PSW.Win32.GameOL.nwk
病毒： Trojan.PSW.Win32.GameOL.nzp
病毒： Trojan.PSW.Win32.GameOL.ods
病毒： Trojan.PSW.Win32.GameOL.ocy
病毒： Trojan.PSW.Win32.GameOL.odw
病毒： Trojan.PSW.Win32.RocOnline.lf
病毒： Worm.Win32.PaBug.hq      

MAC 地址：00:0E:1F:51:5B:16

用户来源：局域网

软件版本：20.50

aqsa

被雷到了，这么多马啊！我晕

FBAV

原帖由 swordlea 于 2008-6-23 07:18 发表
[d:\Virus1\mm\mm\max1.exe]
                    …………发现Spy！报告:[1] Win32.F/S.ByDwing
文件信息:  大小:17707  MD5:2c0b01e1c3ef5650e4c1cf033119aadb

这一个扫描结果是否在“[1] 文件启发式引擎”启 ...

的确是
我天天在黑盟转
找新壳……