PCSL 可疑恶意网站每日分析 20080915

lanvin

1. http://91.203.92.25/hvha626/s6c4n6s.exe
   
2. http://91.203.92.25/hvha123/ex32de.exe
   
3. http://ksn.a.wrs.mcboo.com/17PHolmes.cmt
   
4. http://ksn.a.wrs.flutix.com/meane.stf
   
5. http://lolika.cn/docs/tips.txt (MZ)

复制代码

hj5abc

打包.

pcsl.rar (581.66 KB, 下载次数: 143)

2008-9-15 12:55 上传

点击文件名下载附件

G:\pcsl\pcsl\17PHolmes.cmt
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.agcd
      [NOTE]      The file was deleted!
G:\pcsl\pcsl\ex32de.exe
      [DETECTION] Is the Trojan horse TR/Dropper.Gen
      [NOTE]      The file was deleted!
G:\pcsl\pcsl\meane.stf
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.agcd
      [NOTE]      The file was deleted!
G:\pcsl\pcsl\s6c4n6s.exe
      [DETECTION] Is the Trojan horse TR/Dldr.FraudLoad.vbpp
      [NOTE]      The file was deleted!
G:\pcsl\pcsl\tips.txt
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [NOTE]      The file was deleted!

[ 本帖最后由 hj5abc 于 2008-9-15 12:58 编辑 ]

hzyw

傻猪猪米走鸡

F:\virus\pcsl.rar » RAR » 17PHolmes.cmt - Win32/TrojanDownloader.Agent.AGCD trojan - was a part of the deleted object
F:\virus\pcsl.rar » RAR » ex32de.exe - Win32/TrojanDownloader.Wigon.AE trojan - was a part of the deleted object
F:\virus\pcsl.rar » RAR » meane.stf - Win32/TrojanDownloader.Agent.AGCD trojan - was a part of the deleted object
F:\virus\pcsl.rar » RAR » s6c4n6s.exe - Win32/Adware.Antivirus2008 application - was a part of the deleted object
F:\virus\pcsl.rar » RAR » tips.txt - a variant of Win32/Nuwar.DH worm - was a part of the deleted object

卡巴8.0.0.454检测出6个

v_ww

ess3.0
E:\Sandbox\wei\virus\user\current\桌面\pcsl.rar > RAR > 17PHolmes.cmt - Win32/TrojanDownloader.Agent.AGCD 特洛伊木马
E:\Sandbox\wei\virus\user\current\桌面\pcsl.rar > RAR > ex32de.exe - Win32/TrojanDownloader.Wigon.AE 特洛伊木马
E:\Sandbox\wei\virus\user\current\桌面\pcsl.rar > RAR > meane.stf - Win32/TrojanDownloader.Agent.AGCD 特洛伊木马
E:\Sandbox\wei\virus\user\current\桌面\pcsl.rar > RAR > s6c4n6s.exe - Win32/Adware.Antivirus2008 应用程序
E:\Sandbox\wei\virus\user\current\桌面\pcsl.rar > RAR > tips.txt - Win32/Nuwar.DH 蠕虫 的变种

lllhg1234

NIS2009
Resolved Threats:
Downloader
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
2 Files
f:\pcsl\17pholmes.cmt - Deleted
f:\pcsl\meane.stf - Deleted


Trojan Horse
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
1 File
f:\pcsl\ex32de.exe - Deleted


Downloader.MisleadApp
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
1 File
f:\pcsl\s6c4n6s.exe - Deleted


Trojan.Galapoper.A
Type: Anomaly
Risk: High (High Stealth, High Removal, High Performance, High Privacy)  
Categories: Virus
Status: Fully Resolved
-----------
1 File
f:\pcsl\tips.txt - Deleted

rest1min

江民杀毒软件报告文件

        北京江民新科技术有限公司

        扫描引擎 11.00.800
        病毒库日期 2008-09-15
        更新日期 2008-09-15

扫描目标 H:\Documents and Settings\Administrator\桌面\pcsl.rar

开始时间 2008-09-15 17:39:26

在 H:\Documents and Settings\Administrator\桌面\pcsl.rar->17PHolmes.cmt 中发现 TrojanDownloader.Agent.afnp 病毒, 已删除
在 H:\Documents and Settings\Administrator\桌面\pcsl.rar->ex32de.exe 中发现 TrojanDownloader.Mutant.ga 病毒, 已删除
在 H:\Documents and Settings\Administrator\桌面\pcsl.rar->meane.stf 中发现 TrojanDownloader.Agent.afnp 病毒, 已删除
在 H:\Documents and Settings\Administrator\桌面\pcsl.rar->s6c4n6s.exe 中发现 TrojanDownloader.FraudLoad.da 病毒, 已删除
正常结束。

扫描结果:
                 文件数 :7                                   病毒体 :4         
                   删除 :4                                     解毒 :0         
    扫描速度(千字节/秒) :1187                              扫描时间 :00:00:01
    扫描文件速度(个/秒) :7

尤金卡巴斯基

2008/9/15 19:05:03        已清除        木马程序 Trojan-Downloader.Win32.FraudLoad.vbpp        G:\Temp\Virus\pcsl.rar/s6c4n6s.exe//PE_Patch.PECompact//PecBundle//PECompact               
2008/9/15 19:05:03        已清除        木马程序 Trojan-Downloader.Win32.Agent.agcd        G:\Temp\Virus\pcsl.rar/meane.stf//PE_Patch.UPX//UPX               
2008/9/15 19:05:03        已清除        木马程序 Trojan-Downloader.Win32.Mutant.aqt        G:\Temp\Virus\pcsl.rar/ex32de.exe               
2008/9/15 19:05:03        已清除        木马程序 Trojan-Downloader.Win32.Agent.agcd        G:\Temp\Virus\pcsl.rar/17PHolmes.cmt//PE_Patch.UPX//UPX               
2008/9/15 19:05:03        已清除        病毒 Email-Worm.Win32.Zhelatin.agg        G:\Temp\Virus\pcsl.rar/tips.txt

真中淳平

金山报4个病毒
C:\Documents and Settings\Administrator\桌面\pcsl.rar\tips.txt
Win32.Troj.ZhelatinT.ax.8192                           清除成功  
C:\Documents and Settings\Administrator\桌面\pcsl.rar\meane.stf
Win32.TrojDownloader.Agent.278528               清除成功  
C:\Documents and Settings\Administrator\桌面\pcsl.rar\ex32de.exe
Win32.TrojDownloader.Mutant.14336               清除成功
C:\Documents and Settings\Administrator\桌面\pcsl.rar\17PHolmes.cmt
Win32.TrojDownloader.Agent.278528              清除成功

[ 本帖最后由 真中淳平 于 2008-9-15 19:55 编辑 ]