今天分析的几个!

fsl

Log is generated by FreShow.
[wide]http://www.sllenmb.cn/zzll/1.htm
    [frame]http://sllwbd10.cn/a154/fxx.htm
        [frame]http://sllwbd10.cn/a154/fx.htm
        [frame]http://sllwbd10.cn/a154/ss.html
        [frame]http://sllwbd10.cn/a154/MS06014.htm
            [object]http://www.baikec.cn/new/a154.css
        [frame]http://sllwbd10.cn/sina.htm
        [frame]http://sllwbd10.cn/UU.htm
        [frame]http://sllwbd10.cn/a154/Thunder.html
            [object]http://sllwbd10.cn/a154/Thunder.html
                [object]http://down.hs7yue.cn/down/ko.cs
        [frame]http://sllwbd10.cn/a154/real.htm
        [frame]http://sllwbd10.cn/a154/GLWORLD.html
        [frame]http://sllwbd10.cn/a154/Real.html
            [object]http://www.baikec.cn/new/u316154.css
            [object]http://www.baikec.cn/new/u316154.css
            [object]http://www.baikec.cn/new/u316154.css
            [object]http://www.baikec.cn/new/a1.css

fsl

http://sss.root1234.cn/ccdd/cc.css
http://xxx.hfdy2929.net/bak.css
http://www.oiuytr.net/new/a1.css
http://www.baikec.cn/new/a185.css
http://www.baikec.cn/new/u316185.css
http://www.baikec.cn/new/u316185.css
http://www.baikec.cn/new/u316154.css
http://www.baikec.cn/new/a1.css
http://down.hs7yue.cn/down/ko.cs
http://www.baikec.cn/new/a154.css
http://www.oiuytr.net/new/a320.css
http://baidu.bbtu001.com/wl.css

fsl

http://down.hs7yue.cn/down/ko.css

lingbo110120

NOD拦截了 全部没有下载成功

Palkia

下到的打包

2008-12-2 18:23:34 检测到威胁: Backdoor.Win32.Agent.uxz C:\Documents and Settings\Administrator\桌面\cc.css  
2008-12-2 18:23:34 检测到威胁: Exploit.Win32.IMG-WMF.fx C:\Documents and Settings\Administrator\桌面\bak.css  
2008-12-2 18:23:36 检测到威胁: Trojan-Downloader.Win32.Agent.wps C:\Documents and Settings\Administrator\桌面\wl.css/PE_Patch/UPack  
2008-12-2 18:23:36 检测到威胁: Exploit.Win32.IMG-WMF.fx C:\Documents and Settings\Administrator\桌面\bak.css  


TO KL

leonfg

原帖由 tvuser2007 于 2008-12-2 18:24 发表
下到的打包

2008-12-2 18:23:34 检测到威胁: Backdoor.Win32.Agent.uxz C:\Documents and Settings\Administrator\桌面\cc.css  
2008-12-2 18:23:34 检测到威胁: Exploit.Win32.IMG-WMF.fx C:\Documents and Se ...

全K
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » cc.css - a variant of Win32/TrojanDownloader.Agent.OMQ trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » bak.css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » a1.css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » a185.css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » a1(1).css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » a154.css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » a320.css - probably a variant of Win32/Genetik trojan
C:\Documents and Settings\GUNDAM\桌面\桌面.rar » RAR » wl.css - a variant of Win32/TrojanDownloader.Agent.OBQ trojan

kingmuro

mofunzone

Starting the file scan:

Begin scan in 'C:\Users\morgan\Desktop\桌面'
C:\Users\morgan\Desktop\桌面\
  a1(1).css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  a1.css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  a154.css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  a185.css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  a320.css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  bak.css
    [0] Archive type: Runtime Packed
    --> Object
    [NOTE]      The file was deleted!
  cc.css
    [0] Archive type: Runtime Packed
      --> Object
        [1] Archive type: RSRC
        --> Object
          [DETECTION] Is the TR/Agent.51200.1 Trojan
          [WARNING]   Infected files in archives cannot be repaired!
    [NOTE]      The file was deleted!
  wl.css
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!


End of the scan: 2008年12月2日  17:36
Used time: 00:06 Minute(s)

The scan has been done completely.

      1 Scanning directories
      8 Files were scanned
      8 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      8 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      1 Warnings
      8 Notes

22680506

eset  3.0
9个！