N多病毒等你拿

显示全部楼层 · 发表于 2007-1-14 17:28:19

http://www.zlyd.com/article/htmledit/images/2.exe
http://www.zlyd.com/article/htmledit/images/3.exe
http://www.zlyd.com/article/htmledit/images/4.exe
http://www.wulin7.cn/sys/1.exe
http://www.tm24k.com/test/down.exe

[:14:]

[ 本帖最后由绅博周幸于 2007-1-14 17:32 编辑 ]

显示全部楼层 · 发表于 2007-1-14 17:29:34

卡巴不报的麻烦大家了

显示全部楼层 · 发表于 2007-1-14 17:40:50

最后那个卡巴没报啊

显示全部楼层 · 发表于 2007-1-14 17:43:40

AntiVir  Found HEUR/Crypted
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found MemScan:Trojan.Downloader.Cryptic.D
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found W32/Downloader.gen10
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found a variant of Win32/TrojanDownloader.VB.APY
Norman Virus Control  Found W32/DLoader.BEIC
VirusBuster  Found Trojan.DL.Cryptic.Gen
VBA32  Found Trojan-Downloader.Win32.Cryptic.cn

最后那个DOWN.EXE，像是针对卡巴了

显示全部楼层 · 发表于 2007-1-14 18:06:59

down
2
4
上报完成
等待结果

显示全部楼层 · 发表于 2007-1-14 18:52:22

2.exe分析结果
类型：木马
是否添加服务：是
服务名：fish(貌似是钓鱼？？？)
主要核心文件：%windir%\system32\SVCH0ST.EXE(中间那个是数字0）
是否钩子行为：有

分析日志

Parent process:
Path: C:\WINDOWS\explorer.exe
PID: 1604
Information: Windows Explorer (Microsoft Corporation)
Child process:
Path: Z:\up\3.exe
Command line:"Z:\up\3.exe"
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Parent process:
Path: C:\WINDOWS\system32\svchost.exe
PID: 776
Information: Generic Host Process for Win32 Services (Microsoft Corporation)
Child process:
Path: C:\WINDOWS\system32\wbem\wmiadap.exe
Information: WMI (Microsoft Corporation)
Command line:wmiadap.exe /F /T
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: Type
Type: REG_DWORD
Value: 00000110
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: Start
Type: REG_DWORD
Value: 00000002
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: ErrorControl
Type: REG_DWORD
Value: 00000000
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: ImagePath
Type: REG_EXPAND_SZ
Value: C:\WINDOWS\system32\SVCH0ST.EXE
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: DisplayName
Type: REG_SZ
Value: Fish
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish\Security
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish\Security
Registry value: Security
Type: REG_BINARY
Value: 01001480900000009C00000014000000...
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: ObjectName
Type: REG_SZ
Value: LocalSystem
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: ObjectName
Type: REG_SZ
Value: LocalSystem
Process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Registry Group:
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Fish
Registry value: Description
Type: REG_SZ
Value: Fish
Parent process:
Path: C:\WINDOWS\system32\services.exe
PID: 404
Information: Services and Controller app (Microsoft Corporation)
Child process:
Path: C:\WINDOWS\system32\SVCH0ST.EXE
Command line:C:\WINDOWS\system32\SVCH0ST.EXE
Process:
Path: C:\WINDOWS\system32\SVCH0ST.EXE
PID: 1840
Library:
Path: C:\WINDOWS\system32\Hook.dll
The hook type: WH_GETMESSAGE (monitors messages posted to a message queue).

复制代码

显示全部楼层 · 发表于 2007-1-14 20:16:42

1是VB写的，估计是VB木马
2是瑞星报Trojan.PSW.WlOnline.bv，我没有这个样本，无法分析
3分析结果是灰鸽子
4和2是同一种病毒
down分析是代理木马，UPX加壳

显示全部楼层 · 发表于 2007-1-14 20:18:12

看了楼上的分析，多谢

显示全部楼层 · 发表于 2007-1-14 21:44:57

统统“惨遭” 东方微点杀害！

显示全部楼层 · 发表于 2007-1-14 23:44:07

我的NOD32全部都报了

[病毒样本] N多病毒等你拿

评分

评分