分享：样本（内有“乾坤”）

小邪邪

内里暗藏“玄机”

[ 本帖最后由 小邪邪 于 2007-3-16 15:11 编辑 ]

The EQs

解压后只看到一个雷之源。。。。。

The EQs

Scan taken on 16 Mar 2007 07:14:19 (GMT)  
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found Trojan-Downloader.Win32.Agent.arm, not-a-virus:AdWare.Win32.Dm.ab (4, 1, 400), Trojan.Win32.Qhost.ir, Trojan.VBS.RotNet.a, not-a-virus:AdWare.Win32.AdMedia.k (4, 1, 400)  
Fortinet  Found nothing
Kaspersky Anti-Virus  Found Trojan-Downloader.Win32.Agent.arm, not-a-virus:AdWare.Win32.Dm.ab, Trojan.Win32.Qhost.ir, Trojan.VBS.RotNet.a, not-a-virus:AdWare.Win32.AdMedia.k  
NOD32  Found nothing
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing

allenhippo

我来解这个玄机吧

里面有个lservice.exe有问题

当然，还有cnnic，就不发了

[ 本帖最后由 allenhippo 于 2007-3-16 15:35 编辑 ]

allenhippo

hoho，使用inno setup做的安装程序，正好手头上有，打开脚本看看：

1. [Setup]
   
2. AppName=雷之源 2.0.11.13
   
3. AppVerName=雷之源 2.0.11.13
   
4. DefaultDirName={pf}\苍穹工作室\雷之源
   
5. OutputBaseFilename=lzy2.0.11.13
   
6. Compression=lzma
   
7. LicenseFile=embedded\License.txt
   
8. WizardImageFile=embedded\WizardImage.bmp
   
9. WizardSmallImageFile=embedded\WizardSmallImage.bmp
   
10. [Files]
    
11. Source: "{app}\雷之源.exe"; DestDir: "{app}"; Components: "instmain"; Flags: ignoreversion
    
12. Source: "{app}\lservice.exe"; DestDir: "{app}"; Components: "instmain"; Flags: ignoreversion
    
13. Source: "{app}\Rar.exe"; DestDir: "{app}"; Components: "instmain"; Flags: ignoreversion
    
14. Source: "{app}\config.ini"; DestDir: "{app}"; Components: "instmain"; Flags: ignoreversion
    
15. Source: "{app}\ReadMe.txt"; DestDir: "{app}"; Flags: ignoreversion
    
16. Source: "{app}\ChangeLog.txt"; DestDir: "{app}"; Flags: ignoreversion
    
17. Source: "{app}\Data\Download.dat"; DestDir: "{app}\Data"; Components: "instmain"; Flags: ignoreversion
    
18. Source: "{app}\Data\Online.dat"; DestDir: "{app}\Data"; Components: "instmain"; Flags: ignoreversion
    
19. Source: "{app}\Skin\Apple.skn"; DestDir: "{app}\Skin"; Components: "instmain"; Flags: ignoreversion
    
20. Source: "{app}\Skin\Briefness.skn"; DestDir: "{app}\Skin"; Components: "instmain"; Flags: ignoreversion
    
21. Source: "{app}\Skin\Engine.skn"; DestDir: "{app}\Skin"; Components: "instmain"; Flags: ignoreversion
    
22. Source: "{app}\RRToday.dll"; DestDir: "{app}"; Components: "instmain"; Flags: ignoreversion
    
23. Source: "embedded\License,1.txt"; DestDir: "embedded"; DestName: "License.txt";
    
24. Source: "embedded\WizardImage,1.bmp"; DestDir: "embedded"; DestName: "WizardImage.bmp";
    
25. Source: "embedded\WizardSmallImage,1.bmp"; DestDir: "embedded"; DestName: "WizardSmallImage.bmp";
    
26. Source: "{app}\CNNIC.exe"; DestDir: "{app}"; Components: "instcnnic"; Flags: ignoreversion
    
27. Source: "{app}\lh02.exe"; DestDir: "{app}"; Components: "instcnnic"; Flags: ignoreversion
    
28. [Registry]
    
29. Root: HKCU; Subkey: "Software\Microsoft\Internet Explorer\Main"; ValueName: "Start Page"; ValueType: String; ValueData: "http://www.2345.com/indexlzy.htm"; Components: "inst2345";
    
30. Root: HKLM; Subkey: "Software\Microsoft\Internet Explorer\Main"; ValueName: "Start Page"; ValueType: String; ValueData: "http://www.2345.com/indexlzy.htm"; Components: "inst2345";
    
31. [Icons]
    
32. Name: "{group}\运行雷之源"; Filename: "{app}\雷之源.exe";
    
33. Name: "{group}\卸载雷之源"; Filename: "{uninstallexe}";
    
34. Name: "{userdesktop}\雷之源"; Filename: "{app}\雷之源.exe"; Tasks: "desktopicon";
    
35. [Tasks]
    
36. Name: "desktopicon"; Description: "桌面上创建一个图标(&D)"; GroupDescription: "添加图标：";
    
37. [Components]
    
38. Name: "instmain"; Description: "雷之源主程序"; Types: "full";
    
39. Name: "instcnnic"; Description: "支持雷之源，请安装中文上网"; Types: "full";
    
40. Name: "inst2345"; Description: "雷之源实用网址导航"; Types: "full";
    
41. [Types]
    
42. Name: "full"; Description: "安装组件";
    
43. [CustomMessages]
    
44. default.NameAndVersion=%1 版本 %2
    
45. default.AdditionalIcons=附加快捷方式:
    
46. default.CreateDesktopIcon=创建桌面快捷方式(&D)
    
47. default.CreateQuickLaunchIcon=创建快速运行栏快捷方式(&Q)
    
48. default.ProgramOnTheWeb=%1 网站
    
49. default.UninstallProgram=卸载 %1
    
50. default.LaunchProgram=运行 %1
    
51. default.AssocFileExtension=将 %2 文件扩展名与 %1 建立关联(&A)
    
52. default.AssocingFileExtension=正在将 %2 文件扩展名与 %1 建立关联...
    
53. [Languages]
    
54. ; These files are stubs
    
55. ; To achieve better results after recompilation, use the real language files
    
56. Name: "default"; MessagesFile: "embedded\default.isl";

复制代码

allenhippo

又看了下，发现还有个木马

就是那个lh02解压缩出来的，居然图标就是个马

[ 本帖最后由 allenhippo 于 2007-3-16 15:42 编辑 ]

allenhippo

sms里面有个vbs，还有个替换系统正常的hosts文件

norton都报毒的

[ 本帖最后由 allenhippo 于 2007-3-16 15:52 编辑 ]

The EQs

Scan performed at: 2007-3-16 15:54:36
Scanning Log
NOD32 version 2118 (20070316) NT
Command line: C:\Documents and Settings\EQ2\桌面\lservice.rar
Operating memory - is OK

Date: 16.3.2007  Time: 15:54:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\lservice.rar
C:\Documents and Settings\EQ2\桌面\lservice.rar ?RAR ?lservice.exe - Win32/TrojanDownloader.Agent.ARM trojan - was a part of the deleted object
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 15:54:41 Total scanning time: 0 sec (00:00:00)

The EQs

Scan performed at: 2007-3-16 15:55:37
Scanning Log
NOD32 version 2118 (20070316) NT
Command line: C:\Documents and Settings\EQ2\桌面\hosts.rar
Operating memory - is OK

Date: 16.3.2007  Time: 15:55:41
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\hosts.rar
C:\Documents and Settings\EQ2\桌面\hosts.rar ?RAR ?hosts - Win32/Qhost.IR trojan - was a part of the deleted object
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 15:55:41 Total scanning time: 0 sec (00:00:00)

The EQs

Scan performed at: 2007-3-16 15:55:59
Scanning Log
NOD32 version 2118 (20070316) NT
Command line: C:\Documents and Settings\EQ2\桌面\sms.rar
Operating memory - is OK

Date: 16.3.2007  Time: 15:56:03
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\sms.rar
C:\Documents and Settings\EQ2\桌面\sms.rar ?RAR ?sms.exe ?NSIS ?hosts - Win32/Qhost.IR trojan - was a part of the deleted object
Number of scanned files: 5
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 15:56:05 Total scanning time: 2 sec (00:00:02)