PCSL 可疑恶意网站每日分析 20081022

lanvin

1. http://www.vivotorpedo.us/sms/foto/torpedo/macromediaflashinstall.exe
   
2. http://www.txjsrf.com/img/1x1_pix.gif
   
3. http://a158158.googlepages.com/AbsoluteSoundRecorderarbic.exe
   
4. http://myweb.saudi.net.sa/l33t/omg.exe
   
5. http://www.free-winks.info/data/msgthemes_worldcup.exe
   
6. http://cj.366ent.com/news/user/setup1438.txt
   
7. http://2008.366ent.com/2008/soft/upsetup.exe
   
8. http://cj.366ent.com/news/update.txt
   
9. http://www.free-winks.info/downloads/free-msn-emoticons-pack-02-setup.exe
   
10. http://www.free-winks.info/downloads/free-msn-emoticons-pack-01-setup.exe

复制代码

c5132902

AVG-Webshield Kill  all

大部分是AD

1。3下不来

[ 本帖最后由 c5132902 于 2008-10-22 14:10 编辑 ]

zjsxsycj

打包
附件超出了上传限止
,网盘上传
点击下载样本
驱逐舰报3个


[ 本帖最后由 zjsxsycj 于 2008-10-22 16:27 编辑 ]

mofunzone

http://cj.366ent.com/news/user/setup1438.txt
http://cj.366ent.com/news/update.txt
两个明显不是病毒
剩下的avira全灭
avg全灭的那位，不会是连txt都灭掉了吧
Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\upsetup.exe'
C:\TDDOWNLOAD\
  upsetup.exe
    [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\1x1_pix.gif'
C:\TDDOWNLOAD\
  1x1_pix.gif
    [DETECTION] Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\AbsoluteSoundRecorderarbic.exe'
C:\TDDOWNLOAD\
  AbsoluteSoundRecorderarbic.exe
    [DETECTION] Is the TR/Drop.Agent.qwy.10 Trojan
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\free-msn-emoticons-pack-01-setup.exe'
C:\TDDOWNLOAD\
  free-msn-emoticons-pack-01-setup.exe
    [DETECTION] Contains recognition pattern of the ADSPY/180solutions.AS adware or spyware
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\free-msn-emoticons-pack-02-setup.exe'
C:\TDDOWNLOAD\
  free-msn-emoticons-pack-02-setup.exe
    [DETECTION] Contains recognition pattern of the ADSPY/180solutions.AS adware or spyware
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\macromediaflashinstall.exe'
C:\TDDOWNLOAD\
  macromediaflashinstall.exe
    [DETECTION] Is the TR/Dldr.Delphi.Gen Trojan
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\msgthemes_worldcup.exe'
C:\TDDOWNLOAD\
  msgthemes_worldcup.exe
    [DETECTION] Contains recognition pattern of the ADSPY/180solutions.AM.1 adware or spyware
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\omg.exe'
C:\TDDOWNLOAD\
  omg.exe
    [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    [NOTE]      The file was deleted!
Begin scan in 'C:\TDDOWNLOAD\setup1438.txt'
C:\TDDOWNLOAD\
  setup1438.txt
Begin scan in 'C:\TDDOWNLOAD\update.txt'
C:\TDDOWNLOAD\
  update.txt


End of the scan: 2008年10月22日  01:42
Used time: 00:06 Minute(s)

The scan has been done completely.

      0 Scanning directories
     10 Files were scanned
      8 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      8 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      0 Archives were scanned
      0 Warnings
      8 Notes

aerbeisi

D:\7\free-msn-emoticons-pack-01-setup.exe - Win32/Adware.180Solutions 应用程序
D:\7\free-msn-emoticons-pack-02-setup.exe - Win32/Adware.180Solutions 应用程序
D:\7\msgthemes_worldcup.exe - Win32/Adware.180Solutions 应用程序
D:\7\omg.exe - 可能是 IRC/SdBot 特洛伊木马 的变种
D:\7\upsetup.exe - 可能是 Win32/TrojanDownloader.Flux 特洛伊木马 的变种
已扫描的对象数: 8
发现的威胁数: 5

Palkia

金山 miss 4

尤金卡巴斯基

2008/10/22 21:36:27        已清除        广告软件 not-a-virus:AdWare.Win32.180Solutions.am        G:\Temp\Virus\7.rar/msgthemes_worldcup.exe//UPX               
2008/10/22 21:36:27        已清除        广告软件 not-a-virus:AdWare.Win32.180Solutions.as        G:\Temp\Virus\7.rar/free-msn-emoticons-pack-02-setup.exe//UPX               
2008/10/22 21:36:27        已清除        广告软件 not-a-virus:AdWare.Win32.180Solutions.as        G:\Temp\Virus\7.rar/free-msn-emoticons-pack-01-setup.exe//UPX               
2008/10/22 21:36:27        已清除        木马程序 Backdoor.Win32.Popwin.byw        G:\Temp\Virus\7.rar/upsetup.exe//PE_Patch//UPack