无意之中得到的，有恶意行为

chinadyj

突然发现e盘目录下有这东西，双击后360都提示有篡改行为，同时eset报
2010-1-4 22:14:06 HTTP 過濾器 檔案 hxxp://www.525252.info/109927/good.exe Win32/StartPage.NPD 木馬 連線中止 - 已隔離 PC-200911251325\wesley 存取 Web 時應用程式偵測到威脅： C:\WINDOWS\system32\wscript.exe.
之后就没反应了，eset在扫c盘也扫不出东西，但windows清理助手扫出

请高手分析行为。。。

jason_jiang

ttp://www.525252.info/109927/good.exe
ttp://www.53kkk1.info/dy/old.exe

wliao

Files added: 14
--------------------
C:\Documents and Settings\WLIAO\Local Settings\Temp\Rar$DI00.938\百度.vbs
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\1.bat
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\1.reg
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\a.bat
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\b.bat
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\Internet Explorer.lnk
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\Internet Explorer.url
C:\Documents and Settings\WLIAO\Local Settings\Temp\RarSFX0\qbgwxowa.vbs
C:\Documents and Settings\WLIAO\Local Settings\Temporary Internet Files\Content.IE5\0DQ3SH6J\good[1].exe
C:\Documents and Settings\WLIAO\Favorites\精彩小游戏.url
C:\Documents and Settings\WLIAO\Favorites\淘宝购物.url
C:\Documents and Settings\WLIAO\Favorites\精彩电影.url
C:\Documents and Settings\WLIAO\Favorites\上网导航.url
C:\Program Files\good.exe

harrystopet

RIS10:Trojan.DL.Script.VBS.Agent.in

hxjhe

Virus: VBS:Obfuscated-gen [Trj] (Engine B)

dreams521

Hello,
##.vbs_ - Trojan-Downloader.VBS.Small.ir,
good.exe.qbgwxowa.vbs_, good.exe_ - Trojan.VBS.StartPage.dv
New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.
good.exe.1.bat_, good.exe.1.reg_, good.exe.a.bat_, good.exe.b.bat_, good.exe.InternetExplorer.lnk, good.exe.InternetExplorer.url
No malicious code were found in these files.
Please quote all when answering.
The answer is relevant to the latest bases from update sources.

hddu

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\精彩小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\精彩小游戏.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\淘宝购物.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\淘宝购物.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\精彩电影.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\精彩电影.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\上网导航.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:46    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Documents and Settings\Administrator\Favorites\上网导航.url
触发规则:所有程序规则->Documents and Settings文件夹设置->?:\Documents and Settings\*\Favorites\*.url

2010-01-04 22:33:49    加载库文件      操作:允许
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\WINDOWS\system32\dnsapi.dll
触发规则:应用程序规则->联网操作->%windir%\*->%windir%\system32\dnsapi.dll

2010-01-04 22:33:50    创建文件      操作:阻止并结束进程
进程路径:C:\WINDOWS\system32\wscript.exe
文件路径:C:\Program Files\good.exe
触发规则:所有程序规则->%ProgramFiles%文件夹设置->%ProgramFiles%\*

kingmuro

AVG     0

牧羊老汉

Files added: 14
--------------------
C:\Documents and Settings\WLIAO\Local Settings\Temp\Rar$DI00. ...
wliao 发表于 2010-1-4 22:28

只运行到一半就终止程序， bat、reg、vbs最后全被它自己删除了


Files added: 17
--------------------
C:\Documents and Settings\用户名\Local Settings\Temporary Internet Files\Content.IE5\ZIG2IM46\good[1].exe
C:\Documents and Settings\用户名\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\old[1].exe
C:\Documents and Settings\用户名\桌面\Internet  Explorer.lnk
C:\Documents and Settings\用户名\Favorites\精彩小游戏.url
C:\Documents and Settings\用户名\Favorites\淘宝购物.url
C:\Documents and Settings\用户名\Favorites\精彩电影.url
C:\Documents and Settings\用户名\Favorites\上网导航.url
C:\Documents and Settings\用户名\「开始」菜单\Internet  Explorer.lnk
C:\Documents and Settings\用户名\「开始」菜单\程序\Internet  Explorer.lnk
C:\Documents and Settings\用户名\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet  Explorer 浏览器.lnk
C:\Documents and Settings\用户名\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet  Explorer.lnk
C:\WINDOWS\system32\Internet Explorer.url

C:\黄色电影.exe
C:\Program Files\good.exe
C:\Program Files\old.exe
D:\在线A片.exe
E:\黄色图片.exe

HKEY_CURRENT_USER\software\Microsoft\Internet Explorer\Main
  Old: (SZ) Start Page =about:blank
  New: (SZ) Start Page =http://www.109927.com/?x

langzi2009

  微点未发现异常