要找网马，还是中国网站最方便

solcroft

到百度上搜索后乱点，不到十个就出现一个毒网

http://www.v180.net/mm/mm.exe

The EQs

百毒还差不多。。。。

troika

汗,这个病毒我刚才刚刚上报,这也太巧了吧

foxhound

是上 现在上网络搜点东西不容易啊~~~

Kaspersky Internet Security 7.0The requested URL http://www.v180.net/mm/mm.exe is infected with Trojan-PSW.Win32.Delf.qc virus

[ 本帖最后由 foxhound 于 2007-5-28 02:33 编辑 ]

aoyang

The EQs

刚刚搜了搜，还是找不到挂马的网站

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\mm.exe'
C:\TDDOWNLOAD\
  mm.exe
      [DETECTION] Is the Trojan horse TR/PSW.Steal.27014
      [INFO]      The file was deleted!

worker321

蜘蛛

mm.exe;C:\Documents and Settings\Administrator\桌面;Trojan.PWS.Gamania.origin;;

jlennon

Processes:
PID        ParentPID        User        Path       
--------------------------------------------------

Ports:
Port        PID        Type        Path       
--------------------------------------------------

Explorer Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.vxd                       

IE Dlls:
DLL Path        Company Name        File Description       
--------------------------------------------------
No changes Found                       

Loaded Drivers:
Driver File        Company Name        Description       
--------------------------------------------------

Monitored RegKeys
Registry Key        Value       
--------------------------------------------------

Kernel31 Api Log
       
--------------------------------------------------
***** Installing Hooks *****       
71a270df     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)       
71a27cc4     RegOpenKeyExA (Protocol_Catalog9)       
71a2737e     RegOpenKeyExA (000000F3)       
71a2724d     RegOpenKeyExA (Catalog_Entries)       
71a278ea     RegOpenKeyExA (000000000001)       
71a278ea     RegOpenKeyExA (000000000002)       
71a278ea     RegOpenKeyExA (000000000003)       
71a278ea     RegOpenKeyExA (000000000004)       
71a278ea     RegOpenKeyExA (000000000005)       
71a278ea     RegOpenKeyExA (000000000006)       
71a278ea     RegOpenKeyExA (000000000007)       
71a278ea     RegOpenKeyExA (000000000008)       
71a278ea     RegOpenKeyExA (000000000009)       
71a278ea     RegOpenKeyExA (000000000010)       
71a278ea     RegOpenKeyExA (000000000011)       
71a278ea     RegOpenKeyExA (000000000012)       
71a278ea     RegOpenKeyExA (000000000013)       
71a22623     WaitForSingleObject(7a0,0)       
71a283c6     RegOpenKeyExA (NameSpace_Catalog5)       
71a2737e     RegOpenKeyExA (00000004)       
71a27f5b     RegOpenKeyExA (Catalog_Entries)       
71a280ef     RegOpenKeyExA (000000000001)       
71a280ef     RegOpenKeyExA (000000000002)       
71a280ef     RegOpenKeyExA (000000000003)       
71a22623     WaitForSingleObject(798,0)       
71a11afa     RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)       
71a11996     GlobalAlloc()       
7c80b689     ExitThread()       
414bf8     LoadLibraryA(KERNEL32.DLL)=7c800000       
414bf8     LoadLibraryA(advapi32.dll)=77da0000       
414bf8     LoadLibraryA(gdi32.dll)=77ef0000       
414bf8     LoadLibraryA(oleaut32.dll)=770f0000       
414bf8     LoadLibraryA(shlwapi.dll)=77f40000       
414bf8     LoadLibraryA(user32.dll)=77d10000       
403ff8     GetCommandLineA()       
404a8f     CreateFileA(C:\Documents and Settings\Administrator\桌面\mm.exe)       
404ab8     ReadFile()       
404b04     ReadFile()       
404708     CreateFileA(C:\Documents and Settings\Administrator\桌面\mm.exe)       
40472f     ReadFile()       
40477b     ReadFile()       
404f0a     Copy(C:\Documents and Settings\Administrator\桌面\mm.exe->C:\Program Files\Common Files\Microsoft Shared\MSINFO\system42.rar)       
7c8283f4     WriteFile(h=7a4)       
7c8283f4     WriteFile(h=788)       
404592     CreateFileA(C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.vxd)       
4045b8     WriteFile(h=7a4)       
4045d8     WriteFile(h=7a4)       
e14144     GetCommandLineA()       
e15ace     GetCurrentProcessId()=692       
404ff8     LoadLibraryA(C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.vxd)=e10000       
746826aa     GetVersionExA()       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\Compatibility\mm.exe)       
746830a7     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\SystemShared\)       
7468245b     CreateMutex(CTF.LBES.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Compart.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Asm.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.Layouts.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7468245b     CreateMutex(CTF.TMD.MutexDefaultS-1-5-21-1060284298-1214440339-682003330-500)       
746830a7     RegOpenKeyExA (HKCU\Keyboard Layout\Toggle)       
7468260a     RegOpenKeyExA (HKLM\SOFTWARE\Microsoft\CTF\)       
74684683     GetCurrentProcessId()=692       
7468245b     CreateMutex(CTF.TimListCache.FMPDefaultS-1-5-21-1060284298-1214440339-682003330-500MUTEX.DefaultS-1-5-21-1060284298-1214440339-682003330-500)       
7469d232     WaitForSingleObject(77c,1388)       
746b556a     GetCurrentProcessId()=692       
7c816513     WaitForSingleObject(774,64)       
73658f33     GetVersionExA()       
73665225     GetVersionExA()       
7365d4f4     LoadLibraryA(C:\windows\system32\ole32.dll)=76990000       
4047c0     RegCreateKeyExA (HKCR\CLSID\{90BC520C-9175-470E-94B8-10FD869D170B},(null))       
4047da     RegSetValueExA ()       
4047c0     RegCreateKeyExA (HKCR\CLSID\{90BC520C-9175-470E-94B8-10FD869D170B}\InProcServer32,(null))       
4047da     RegSetValueExA (ThreadingModel)       
4047c0     RegCreateKeyExA (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks,(null))       
4047da     RegSetValueExA ({90BC520C-9175-470E-94B8-10FD869D170B})       

DirwatchData
       
--------------------------------------------------
WatchDir Initilized OK       
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp       
Watching C:\windows       
Watching C:\Program Files       
Created: C:\windows\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf       
Modifed: C:\windows\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf       
Created: C:\Program Files\Common Files\Microsoft Shared\MSInfo\system42.rar       
Modifed: C:\Program Files\Common Files\Microsoft Shared\MSInfo\system42.rar       
Created: C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysInfo.vxd       
Modifed: C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysInfo.vxd       
Modifed: C:\Program Files\Common Files\Microsoft Shared\MSInfo       
Created: C:\windows\Prefetch\MM.EXE-13372296.pf       
Modifed: C:\windows\Prefetch\MM.EXE-13372296.pf       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JETC4E2.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JETD.tmp       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JETD.tmp       
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9C28.tmp       
Modifed: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9C28.tmp       
Created: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Modifed: C:\windows\Prefetch\PROC_ANALYZER.EXE-3974E660.pf       
Deteled: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9C28.tmp

tracydk

原帖由 EQ2 于 2007-5-28 02:25 发表
刚刚搜了搜，还是找不到挂马的网站

ANI的网站多的很..........