挂马简报~

ranguangning

最初出处：http://www.scanw.com/blog/archives/331

hxxp://user666.66-18.net/a01.css
hxxp://user666.66-18.net/for.css
hxxp://user666.66-18.net/lz.css
hxxp://user666.66-18.net/sms.css
hxxp://user666.66-18.net/no.css
hxxp://user666.66-18.net/bfyy.css
hxxp://user666.66-18.net/re10.css
hxxp://user666.66-18.net/re11.css
hxxp://d.bc-s350.cn/down/gr.exe
hxxp://d.bc-s350.cn/new/a1.css
hxxp://qq.18i16.net/exe1/ce.css
hxxp://qq.18i16.net/sina.css
hxxp://qq.18i16.net/baidu.cab
hxxp://qq.18i16.net/exe1/ms.css
hxxp://qq.18i16.net/exe1/b06.css
hxxp://qq.18i16.net/exe1/bf.css
hxxp://qq.18i16.net/exe1/re.css
hxxp://121.12.173.218/exe1/cx.css

qigang

hxxp://user666.66-18.net/*最近很流行！

qianwenxiang

upload

qianwenxiang

Scan Started Wed Jan 14 18:46:32 2009
-------------------------------------------------------------------------------


C:\Test\0901\14\sms_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\a01_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\b06_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\baidu_0.cab: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\bf_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\bfyy_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\ce_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\cx_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\for_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\lz_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\ms_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\no_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\re10_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\re11_0.css: Trojan.Spy-13381 FOUND
C:\Test\0901\14\re_0.css: Trojan.Downloader-61873 FOUND
C:\Test\0901\14\sina_0.css: Trojan.Downloader-61873 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 485054
Engine version: 0.93
Scanned directories: 0
Scanned files: 18
Infected files: 16

Data scanned: 2.62 MB
Time: 17.610 sec (0 m 17 s)
--------------------------------------
Completed
--------------------------------------

granthill

ess 3.0

无尽藏海

Begin scan in 'F:\VIRUS\14_3.rar'
F:\VIRUS\14_3.rar
    [0] Archive type: RAR
      --> gr_0.exe
          [DETECTION] Is the TR/Spy.Gen Trojan
      --> baidu_0.cab
        [1] Archive type: CAB (Microsoft)
        --> baidu.exe
          [DETECTION] Is the TR/Spy.Gen Trojan
      --> a1_0.css
          [DETECTION] Is the TR/Spy.Gen Trojan
      --> b06_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> bf_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> ce_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> cx_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> ms_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> re_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
      --> sina_0.css
          [DETECTION] Is the TR/Crypt.XDR.Gen Trojan
    [WARNING]   The file was ignored!


End of the scan: 2009年1月14日 星期三  19:31
Used time: 00:12 Minute(s)

The scan has been done completely.

      0 Scanning directories
     20 Files were scanned
     18 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      2 Archives were scanned
      1 Warnings
      0 Notes

fzz8848

allinwonderi

[Scanning : C:\Test]


C:\Test\14_3.rar<RAR>:baidu_0.cab<CAB>:baidu.exe <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:bf_0.css<UPX>:bf_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:ce_0.css<UPX>:ce_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:cx_0.css<UPX>:cx_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:ms_0.css<UPX>:ms_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:re_0.css<UPX>:re_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3.rar<RAR>:sina_0.css<UPX>:sina_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\baidu_0.cab<CAB>:baidu.exe <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\bf_0.css<UPX>:bf_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\ce_0.css<UPX>:ce_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\cx_0.css<UPX>:cx_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\ms_0.css<UPX>:ms_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\re_0.css<UPX>:re_0.css <- Trojan.Dropper.Agent.Abku : No action
C:\Test\14_3\sina_0.css<UPX>:sina_0.css <- Trojan.Dropper.Agent.Abku : No action



Scanned objects : 108

Infected objects : 14

allinwonderi