一个可能是05年的蠕虫,但VirSCAN认不出来

328397663

Hello,


winhost.exe - Trojan.Win32.Agent.bsye

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

fortinet_kyle

Hi Kyle

Thank you for submitting the sample to us. We have analyzed the sample you provided and developed the pattern to catch it. We will add detection for this sample in the next regular update.

The sample you submitted will be detected as follow:

winhost.vxe - W32/Agent.MNB!tr

Best Regards,
AV Lab - wkdu

To submit a suspicious file to Fortinet:
http://www.fortinet.com/FortiGuardCenter/virus_scanner.html

wrq

2009-3-2 18:10:49        已删除: Trojan.Win32.Agent.bsye        C:\Documents and Settings\Administrator\桌面\winhost.rar/winhost.exe

Palkia

to rs

mikzh

有以下连接，很乱。没有分析出去做什么，就是不停的去扫描，下载一些网站的源码，没什么实际的东西：

a.114org.com/a9.htm,www.21codes.com/gook.asp;www.21codes.com/ref.asp;0,rgmrcz1.wa083.bootchina.com/list.asp,www.soogame.com.cn,www.baiduzone.com.cn,qwopaskl18.164.53dns.com/268001/2,w.ptvip.cn/2008/b7.asp,click.ha99y.cn/linkredirect1/link1.asp,www.mli365.cn,www.gosoo.com.cn,w.ptvip.cn/2008/ccte.asp,www.277400.com.cn/sxhbjncn.asp,rgmrcz2.web205.bootchina.com/list.asp,www.81488.com.cn/sx.asp,w.ptvip.cn/2008/cappma.asp,www.ptvip.cn/2008/ok20.asp,w.ptvip.cn/2008/dvbcn.asp,askways.net.cn/html/inde.html,www.focusvisit.com/404.htm,www.autono1.com/leadbuy/,www.ptvip.cn/mglod.asp,w.ptvip.cn/2008/ccte.asp,w.ptvip.cn/2008/cima.asp,w.ptvip.cn/2008/b7.asp,edu.dm-ok.com/index1.asp,ll.fadacai8.cn,w.ptvip.cn/2008/3jjj.asp,www.jzjyzy.cn,xian.029bxw.com,www.zg12366.com/404.htm,www.atcer.cn/haoqq123.php,www.atcer.cn/boqee.php,www.yn15.net.cn/ctzl/car.php,114.jdz.jx.cn,www.te120.com,www.liyi123.cn,www.c8866.com.cn/changsha.php,www.atcer.cn/jiajia.php,www.atcer.cn/dushu168.php,leauty.net.cn/news/index.html,www.epe8.com/index1.asp,www.15zone.cn,www.atcer.cn/qltj.php,www.yn15.net.cn/ctzl/zjol5.php,www.atcer.cn/zjut.php,www.atcer.cn/e37.php,w.ptvip.cn/2008/tvsc.asp,www.yn15.net.cn/ctzl/hangzhou5.php,www.atcer.cn/99caipu.php,www.feixuevip.cn/ad2.htm,www.atcer.cn/dooba.php,www.atcer.cn/qp138.php,www.atcer.cn/dqcar.php,www.atcer.cn/qingtiecn.php,www.0798.cc,www.agga.cn,www.liyi123.cn,www.54zz.cn,www.atcer.cn/5azp.php,www.95z.cn,www.atcer.cn/shuchina.php,www.ok027.com,www.atcer.cn/laitour.php,www.atcer.cn/0594wz.php,www.desktx.com,www.atcer.cn/xmzh.php,www.tzstudent.com,www.asmlw.cn,www.hgdaily.com,www.whjsr.com,www.81118.net,www.atcer.cn/zznuc.php,www.atcer.cn/cniso.php,www.100wdy.com,www.aisoo8.cn,www.atcer.cn/sinotrips.php,www.atcer.cn/hxspace.php,www.yn15.net.cn/ctzl/gz0281.php,www.mndi.cn/indexsasa.php,www.gphao.com/sx345.asp,www.phach.cn/phopc.php,www.atcer.cn/135f.php,www.nihao8.com,www.kaotiji.com,www.baidu55.cn,www.chongqu.com,www.esunall.com,www.mytaiw.com,www.3litun.cn,www.zhwlw.com.cn,www.3mobile.com.cn,www.mumayi.com,www.lzeweb.com/html/index.html,www.atcer.cn/0415w.php,sogoua01.3322.org,www.duiwaimaoyi.com.cn/default.asp,www.ccboss.com/news_Files/shangw ... 863016362193444.htm,4.52qth.com,www.atcer.cn/wnhw.php,www.szfs99.com/gook.asp,5.52qth.com,www.uzjh.cn/indesas88.php,6.52qth.com,mail.showchina.org/indexh.asp,7.52qth.com,www.99fu.com.cn/sxas800so.asp,www.93ks.com,www.hoto777.com,www.jw173.com,www.yn15.net.cn/ctzl/dgnews5.php,www.yn15.net.cn/ctzl/ledhp5.php,bbs.bbfc.cn,new.ssrcn.com/index1.asp,new.ssrcn.com/index2.asp,www.duiwaimaoyi.com.cn/default1.asp,www.yn15.net.cn/ctzl/pprd561.php,www.atcer.cn/gwyksw.php,www.atcer.cn/d9it.php,www.atcer.cn/zcdown.php,www.atcer.cn/lyweb.php,www.atcer.cn/kannba.php,www.atcer.cn/010peixun.php,www.atcer.cn/hgeb.php,www.atcer.cn/028class.php,www.atcer.cn/fibreadd.php,10.52qth.com,12.52qth.com,www.21kx.com,www.21cv.net,www.vzvz.com,13.52qth.com,ptp.shoopay.com/ptp/ptp.asp,www.qyxk.net,www.atcer.cn/xuan2.php,www.57pxw.cn,www.76u.net,www.zrit.com,www.qchw.sd.cn/indexsaxs.php,bbs.0793f.com,medicalbook.cn,www.atcer.cn/buttonnet.php,www.wm8.cn,www.etjy.org,www.bylw8.com,www.365ho.cn,www.zufang56.com,3.52qth.com,2.52qth.com,1.52qth.com,www.ytbaiyi.com/index1.asp,www.atcer.cn/qddaxin.php,www.stocksea.com.cn,www.bizhi5.com,www.atcer.cn/kankantu.php,9.52qth.com,8.52qth.com,www.91yiliao.cn/fk910liu.asp,www.our0538.cn/06yk/inde.html,www.keep520.com/Html/Index.html,www.atcer.cn/jiankangw.php,11.52qth.com,www.mrmhw.com/tz.asp,www.atcer.cn/wateradd.php,www.c0798.com,www.winechina.net,www.35dx.com,www.noook.com,www.cnlong.net.cn/click2.html,bbs.ackworld.com,www.xj7x.com,www.chuchenchina.cn/index1.asp,www.zhuzaochina.cn/index1.asp,www.haosfla.com,16.52qth.com,15.52qth.com,14.52qth.com,www.pmmachina.com/index1.asp,www.366y.com,www.rizhaosky.cn,www.zp789.com,17.52qth.com,www.atcer.cn/022peixun.php,21.52qth.com,20.52qth.com,19.52qth.com,18.52qth.com,www.weldshop.com.cn/indexll.asp,23.52qth.com,22.52qth.com,www.atcer.cn/aiucn.php,www.860798.com,www.518h.cn/pv404.asp,www.ap366.com,www.dingfang.org,24.52qth.com,25.52qth.com,a.114org.com/i9.htm,|24|3.7|3|ls.china-cash.com|42|no|ok|,dw324.cn,riversong.cn,love2068.cn,sll9026.cn,nj-sp.com.cn,dddddsaa.cn,cqfywg.cn,jltao8.com,xxaa19.cn,aaxx20.cn,sll6890.cn,jjjaaa1.cn,parkhtl.com,go.7766.org,za-hotel.com,hhhjjjj.cn,slll4j.cn,kghh3.cn,kghh4.cn,kghh2.cn,kghh1.cn,kghh6.cn,kghh7.cn,kghh8.cn,fgjg4.cn,zyu8.com,zhkky.cn,zhangxiu.com,zgynkmp.cn,zgynkmg.cn,zgynkmf.cn,zghncsz.cn,zghncsv.cn,zghncsm.cn,zgcgssllf.cn,zgcgsslla.cn,yueshou.net,yidkj.com,yhn6nhh.cn,yesky.com,ycdx.hapt03.cn,xinyikeji.com,xieker.com,wxsbw.com,www.tj520.net.cn,ww4.keyrun.com,wsjol.com,woaichuanqihaha.com,web.souxun.com,wauee.com,wanliuliang.com,vzhun.com,vv7vv.com,vuf51578.cn,vhahaw.cn,vfesa.cn,v2233.com,toyouo130.cn,touba3.cn,tj520.net.cn,tianqi123.com,thinkmedia.cn,thahau.cn,ssssdddff.cn,sllwrnm9.cn,sllwrnm8.cn,sllwrnm7.cn,sllwrnm6.cn,sllwrnm5.cn,sllwrnm4.cn,sllwrnm3.cn,sllwrnm2.cn,sllwrnm14.cn,sllwrnm13.cn,sllwrnm12.cn,sllwrnm11.cn,sllwrnm10.cn,sllwrnm1.cn,sllwbd9.cn,sllwbd19.cn,sllwbd18.cn,sllwbd17.cn,sllwbd16.cn,sllwbd15.cn,sllwbd14.cn,sllwbd13.cn,sllwbd12.cn,sllwbd11.cn,sllwbd10.cn,slliqsb.cn,sllinmb.cn,sllhqsb.cn,sllhnmb.cn,sllgqsb.cn,sllgnmb.cn,slleqsb.cn,sllbqsb.cn,sllanmb.cn,sl4llj.cn,sjwxdl.com,shm.com.cn,sh.xinhuanet.com,sdfg74.cn,s4lllj.cn,rxgsslln.cn,rxgssllm.cn,rxgssllj.cn,rxgssllh.cn,rxgssllf.cn,rrrryyyaa.cn,rrrrpppkk.cn,royoso128.cn,qqsafe-qqservicesyydswfhuw8ysjftwf.com,qqqqkkkss.cn,qinghainet.com,qiao7.com,qhahai.cn,procto.cn,pr9.cn,pppphhhss.cn,openv.tv,ohahap.cn,nhahao.cn,news.xintv.com,nbqqqq.cn,name8.cn,mumayi.net,msn.sh.cn,moleke.com,mmmbbcc.cn,mimi223.cn,mi5663.cn,lzdm.net,lovechina.tw.cn,longzaitian8899.com,ljsll4.cn,ljsl4l.cn,lj4sll.cn,lhaham.cn,laoyang6.cn,laoyang5.cn,laoyang4.cn,kkkuuuk.cn,kkeekrkr.cn,kghh5.cn,k651.com,jujii.cn,js.stockcity.cn,jltao8.com,jhh455.cn,jggddg.cn,jggdda.cn,iuuu9.com,itsun.com,itopnetworks.com,is686.com,ip88.com.cn,iow.cn,inpai.com.cn,injinyun.com,ikcode.baidu.com,hyccy.cn,hryspad.cn,hngame.cn,hhh345.cn,haocpc.net,hao91.cn,hami168.net,gotostone.com,googlesyndieation.cn,googlesynadintion.cn,googlesynadietion.cn,google-anlaba.cn,ghahah.cn,gamall.net,fotoever.com,fj36.com,ffdsdssss.cn,fengj.com,falalixx.cn,falaliww.cn,falalibb.cn,edcds.cn,eahahf.cn,e5ff005.cn,e0438.com,dyplayer.com,duoduody.com,dsfso.cn,dnparking.com,dlltj.cn,diaolv.com,dhahac.cn,daliuliang6.cn,daliuliang5.cn,daliuliang4.cn,daliuliang3.cn,daliuliang2.cn,daliuliang1.cn,d6ee006.cn,d5ee005.cn,d4ee004.cn,cvx007.cn,cryule.com,creatus.com.cn,communicatte.com,co.rhvacnet.com,cnxad.com,cnw.cn,cnaz.com,ci123.com,china-baby.org,chiani.cn,chajian04.cn,ce.cn,cc4y7.cn,cc4y5.cn,cc4y3.cn,cc-006.cn,cbsysx.com,bokile.com,bnet.com.cn,blog.sohu.com,blog.sina.com.cn,bengchirr.cn,bengchiii.cn,bcbcbcbccbcb.cn,bbtu06.cn,bbs.stockcity.cn,bbbfffqqq.cn,baiduyuxirebn.cn,baiduybaidngazc.cn,baiduybaidbrqlm.cn,baidutj.net,baidu-opop5.cn,baidu-opop4.cn,baidu-opop3.cn,baidu-opop2.cn,baidujkjkua.cn,baiduduyou9.cn,baiduduyou8.cn,baiduduyou7.cn,baiduduyou6.cn,baiduduyou5.cn,baiduduyou4.cn,baidu-dudouai7.cn,baidu-dudouai2.cn,baidudskllkjl.cn,baidu-baiguo9.cn,baidu-baiduyi4.cn,baidu-baiduyi.cn,bai9ud.cn,bai8ud.cn,bai7ud.cn,bai6ud.cn,bai5ud.cn,bai4ud.cn,bai3ud.cn,bai2ud.cn,bai1ud.cn,amazon.cn,alimoma.com,aiqianming.cn,ahhn.cn,ahahaz.cn,abcrot.cn,abcdec.cn,abadef.cn,9lianmeng.com,92eu.com,91.cn,8866.org,800228.com,8001688.com,73.86.6,719sese.cn,718sese.cn,717sese.cn,716sese.cn,715sese.cn,714sese.cn,713sese.cn,712sese.cn,711sese.cn,710sese.cn,709sese.cn,707sese.cn,706sese.cn,705sese.cn,66166.org,5d6d.com,591sc.com,58266shop.com,5566.net,52.214.194,52.214.193,51traffic.com,4ljsll.cn,4c.com.tw,4519.com,44.49.62,414567.com,34.216.92,34.216.100,3322.org,265.com,23mh.com,233game.cn,21cn.com,20-12.cn,2009qqqq.cn,2009mmmm.cn,2009ffff.cn,2009aaaa.cn,2008.ku6.com,153.3.42:86,15.245.156,144.132.116,128ads.com,123bx.com,120ws.com,|14|tfol.com,vnet.cn,cnbb.com.cn,opendns.com,cnc114dns.com.cn:8080|30|ok

用NOD32杀毒情况如下：
C:\Documents and Settings\Administrator\winhost.rar > RAR > winhost.exe - 可能是 Win32/TrojanClicker.VB.COJ 特洛伊木马 的变种

[ 本帖最后由 mikzh 于 2009-3-2 19:02 编辑 ]

flowerpig

http://www.virscan.org/report/9c ... 7012c6402f4e10.html
看到卡吧更新了。

嘉和

ZAV R9  沒發現威脅

328397663

Filename Result
winhost.exe  MALWARE

The file 'winhost.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Agent.bsye. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

fandely

微点一解压就杀了

sam.to

https://www.virustotal.com/anali ... 5fe4a003ac2af41992e
报的不少....

[ 本帖最后由 sam.to 于 2009-3-3 08:53 编辑 ]