Trojan VBSx2及其他货色不等(继续挖掘ing)

schumi小粉

学校机房再次挖到货色，2个VBS，质量不错，报的也不多~

[ 本帖最后由 schumi小粉 于 2009-5-12 11:38 编辑 ]

kingsheet

卡巴
检测到：木马程序 Trojan-Downloader.VBS.Small.ib        文件: D:\2\2\spoolsv.vbe

foxzhou1983

强大的BD2009秒之～～～ [:01:] [:01:]

Sebastian

Starting the file scan:

Begin scan in 'D:\kafan\2'
D:\kafan\2\1.vbe
    [DETECTION] Contains recognition pattern of the VBS/EncBat.291 VBS script virus
    [NOTE]      The file was deleted!
D:\kafan\2\spoolsv.vbe
    [DETECTION] Is the TR/Drop.Mudrop.ABG Trojan
    [NOTE]      The file was deleted!
Begin scan in 'D:\kafan\2.bat'
Begin scan in 'D:\kafan\0891.exe'
D:\kafan\0891.exe
  [0] Archive type: RAR SFX (self extracting)
    --> zzp.exe
      [DETECTION] Is the TR/Dldr.Agent.bsfp.1 Trojan
    --> 9009.exe
      [1] Archive type: RSRC
      --> Object
        [DETECTION] Is the TR/Zlob.45038 Trojan
    [NOTE]      The file was deleted!


End of the scan: 2009年5月12日  10:06
Used time: 00:01 Minute(s)

The scan has been done completely.

      1 Scanned directories
      6 Files were scanned
      4 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      3 files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      0 Warnings
      3 Notes

kingmuro

2009-05-12 10:25:16        gxf        2124        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\0891.exe\zzp.exe" file.  
2009-05-12 10:25:19        gxf        2124        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\0891.exe\9009.exe\[Embedded_R#0c3f0]" file.

webweb

2.zip是加密过的脚本
谁能 解下
看看下载地址是哪里

kingmuro

2009-05-12 12:39:33        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\0891.exe\zzp.exe" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\0891.exe\9009.exe\[Embedded_R#0c3f0]" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\virus\18.exe\[UPX]\[Embedded_Ra#04110]\[Embedded_Ia#d0a0]" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\virus\19.exe\[UPX]\[Embedded_Ra#04110]\[Embedded_Ia#d0a0]" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\virus\20.exe\[UPX]\[Embedded_Ra#04110]\[Embedded_Ia#d0a0]" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\virus\4.exe\[UPX]\[Embedded_Ra#04110]\[Embedded_Ia#d0a0]" file.  
2009-05-12 12:39:37        gxf        3240        Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\gxf\桌面\110\2\virus\7.exe\[UPX]\[Embedded_Ra#04110]\[Embedded_Ia#d0a0]" file.

burt2008

F:\TDDOWNLOAD\virus.rar>>virus\7.exe,        Trojan-Downloader.Win32.Geral.ac,        未处理
2009-05-12 12:42:49        F:\TDDOWNLOAD\virus.rar>>virus\4.exe,        Trojan-Downloader.Win32.Geral.ab,        未处理
2009-05-12 12:42:49        F:\TDDOWNLOAD\virus.rar>>virus\20.exe,        Trojan-Downloader.Win32.Geral.aa,        未处理
2009-05-12 12:42:49        F:\TDDOWNLOAD\virus.rar>>virus\19.exe,        Trojan-Downloader.Win32.Geral.z,        未处理
2009-05-12 12:42:49        F:\TDDOWNLOAD\virus.rar>>virus\18.exe,        Trojan-Downloader.Win32.Geral.y,        未处理



微點殺毒軟件

BING126

不报就to McAfee

haoge868

author:pengfei@www.cn-dos.net