PCSL 可疑恶意网站每日分析 20081019

显示全部楼层 · 发表于 2008-10-19 15:44:52

http://02c1cb8.netsolhost.com/pesa.exe
http://www.administrafacil.com.br/administrafacil.exe
http://downloads.5star-network.com/Internet/amazon.exe
http://downloads.5star-network.com/Internet/wg20.exe
http://downloads.5star-network.com/Utilities/cs_mary.exe
http://download.a-a-v-2008.com:8080/AAVSetup.exe
http://free-stream-videos-here.com/soft/install-299.exe
http://free-stream-videos-here.com/soft/install-301.exe

复制代码

显示全部楼层 · 发表于 2008-10-19 15:54:30

支持一下..

这些东西分别是从哪些界面解出来的？

我想练练解网马

显示全部楼层 · 发表于 2008-10-19 15:56:43

压缩包
点击下载样本

virus

[ 本帖最后由 zjsxsycj 于 2008-10-19 16:38 编辑 ]

显示全部楼层 · 发表于 2008-10-19 17:15:02

kaspersky 2009miss2
AVira miss 4

显示全部楼层 · 发表于 2008-10-19 17:35:53

S:\8ge\pesa.exe
S:\8ge\AAVSetup.exe - 特征码 'Generic.Win32.Malware.Antivirus2008' 被发现
S:\8ge\cs_mary.exe - 特征码 'Trojan-Spy.Win32.Delf.FK' 被发现
S:\8ge\wg20.exe
S:\8ge\administrafacil.exe - 特征码 'Trojan-PWS.Win32.OnLineGames.dm' 被发现
S:\8ge\amazon.exe
S:\8ge\install-299.exe
S:\8ge\install-301.exe

8 文件被扫描
(3 压缩档 0 文件)
3 特征码被侦测
0 可疑代码段被发现
耗时: 0:00.281

显示全部楼层 · 发表于 2008-10-19 17:40:21

Virus check with G DATA AntiVirus
Version 18.7.8155.555
Virus signature dated 10/19/2008
Start time: 10/19/2008 17:39
Engine(s): Engine A (AVK 19.1103), Engine B (BD 19.688)
Heuristics: On
Archive: On
System areas: Off

Check the following directories and files:
S:\8ge\

Object: aav.exe
In archive: S:\8ge\AAVSetup.exe
Status: Virus detected
Virus: not-a-virus:FraudTool.Win32.AdvancedAntivirus.b (Engine A)
Object: AAVSetup.exe
Path: S:\8ge
Status: Virus detected
Virus: Dropped:Trojan.Fakeav.BC (Engine B)
Object: Realtime.dll
In archive: S:\8ge\cs_mary.exe
Status: Virus detected
Virus: Trojan-Spy.Win32.Delf.fk (Engine A)
Object: cs_mary.exe
Path: S:\8ge
Status: Virus detected
Virus: Trojan-Spy.Win32.Delf.fk (Engine A), Trojan.Generic.330537 (Engine B)
Object: administrafacil.exe
Path: S:\8ge
Status: Virus detected
Virus: Trojan-Downloader.Win32.Banload.ans (Engine A), Trojan.Downloader.Banload.NQF (Engine B)
Object: stream data0004
In archive: S:\8ge\amazon.exe
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.SearchIt.f (Engine A)
Object: amazon.exe
Path: S:\8ge
Status: Virus detected
Virus: not-a-virus:AdWare.Win32.SearchIt.f (Engine A), Dropped:Adware.Toolbar.Searchit.F (Engine B)

Analysis performed in full: 10/19/2008 17:39
8 files checked
4 infected files detected
0 suspicious files found

显示全部楼层 · 发表于 2008-10-19 17:47:13

16M 那么大放弃...

显示全部楼层 · 发表于 2008-10-19 19:25:00

4 files left
Begin scan in 'C:\Users\TOSHIBA\Downloads\8ge'
C:\Users\TOSHIBA\Downloads\8ge\AAVSetup.exe
[0] Archive type: ZIP SFX (self extracting)
--> aav.cpl
   [DETECTION] Is the TR/Fakealert.ahy.5 Trojan
--> aav.exe
   [DETECTION] Contains recognition pattern of the PHISH/Fraud.AdvancedAntivirus.B phishing file/email
[DETECTION] Contains recognition pattern of the DR/Fraud.AdvancedAntivirus.B dropper
[NOTE]    A backup was created as '4951192b.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\8ge\administrafacil.exe
[DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
[NOTE]    A backup was created as '4968194e.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\8ge\cs_mary.exe
[DETECTION] Contains recognition pattern of the DR/Spy.Delf.FK.1 dropper
[NOTE]    A backup was created as '495a195d.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Users\TOSHIBA\Downloads\8ge\wg20.exe
[0] Archive type: RSRC
   --> Object
      [1] Archive type: ZIP
      --> sys._xe
      [DETECTION] Contains recognition pattern of the SPR/WinGuardian.A.1 program
      --> keyhook._ll
      [DETECTION] Contains recognition pattern of the SPR/WinGuardian.A program
      --> unchap.exe
      [DETECTION] Contains recognition pattern of the SPR/WinGuardian.B program
[NOTE]    A backup was created as '492d1951.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2008年10月19日  19:24
Used time: 00:05 Minute(s)

The scan has been done completely.

   1 Scanning directories
   24 Files were scanned
   8 viruses and/or unwanted programs were found
   0 Files were classified as suspicious:
   4 files were deleted
   0 files were repaired
   4 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   16 Files not concerned
   2 Archives were scanned
   0 Warnings
   4 Notes

显示全部楼层 · 发表于 2008-10-19 20:11:47

看来已经搞定。。。

显示全部楼层 · 发表于 2008-10-19 22:54:00

Hello,

pesa.exe_,

No malicious code were found in these files.

wg20.exe_ - not-a-virus:Monitor.Win32.WinGuardian.c

This file is already detected by our extended bases as a potentially risk program.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

[已鉴定] PCSL 可疑恶意网站每日分析 20081019

评分