那顆爛蔥 專屬相簿

親朋好友專用



Home :: Upload file :: Login
Album list :: Last uploads :: Last comments :: Most viewed :: Top rated :: My Favorites :: Search

Home > 毒窟(研究用) Virus Trojan Resource

TITLE  +   - 
FILE NAME  +   - 
DATE  +   - 
POSITION  +   - 
Virtemp09.rar
Virtemp09.rar這一陣子看起來最扯的病毒.253 views中標途徑很簡單
開個網頁就中了,什麼警告訊息完全沒有
來源是對岸特地做出來的假無名站台
http://www.wretcn.cc/album/sky520sky
目前還未深入研究,因為電腦已經重灌了(就是我的電腦 Orz)
會直接"替換"掉系統重要檔案,So,萬一中了,請準備重灌..
讓我陰溝裡翻船啊 Orz
甚至是直接修改重要執行檔的DLL連結清單..請比較notepad.exe就知道了..
所以你所執行的程式,都有可能已被篡改
jokera
Virtemp08.rar
Virtemp08.rar頗糟糕的木馬..335 viewswintems.exe - infected by Email-Worm.Win32.Bagle.gi
hidn2.exe - infected by Email-Worm.Win32.Bagle.gm
m_hook.sys - infected by Email-Worm.Win32.Bagle.gm
re_file.exe - OK
flec006.exe - infected by Trojan-Downloader.Win32.Bagle.y
ixnkmdixmpva.exe - infected by Email-Worm.Win32.Bagle.gm
隨著Email傳播,會有一個加密壓縮檔外加一個圖檔
圖檔為壓縮檔的密碼
笨笨的會以為是重要檔案就解開來執行........
ixnkmdixmpva.exe為信件附檔解開來的原始木馬
其它為衍生物及復活檔
jokera
Virtemp07.rar
Virtemp07.rar340 views1.sfx.exe/data.rar\1.exe/UPack Trojan-PSW.Win32.Lineage.akx
1_.sfx.exe/data.rar\1.exe/UPack Trojan-PSW.Win32.Lineage.akx
d2_.exe/UPack Trojan-PSW.Win32.Delf.qm
hydll.dll Trojan-PSW.Win32.Delf.qm
hye1.exe Trojan-PSW.Win32.Delf.li
PDLL.dll Trojan-PSW.Win32.Lineage.akx
rundl132.exe Trojan-PSW.Win32.Delf.li
svchost.exe/UPack Trojan-PSW.Win32.Lineage.akx
svhost32.exe/UPack Trojan-PSW.Win32.Delf.qm
dlyy.dll 掃不到 XD
VirTEMP06.rar
VirTEMP06.rar292 viewsUSB.EXE - infected by Trojan-PSW.Win32.Lineage.ahv
dllf.dll - infected by Trojan-PSW.Win32.Lineage.aco
download.exe - infected by Trojan-PSW.Win32.Lineage.aco
g0ld.exe - infected by Trojan-PSW.Win32.Lineage.ahv
Kerne0223.dll - infected by Trojan-PSW.Win32.Gamania.eh
Kerne0223.exe - infected by Trojan-PSW.Win32.Gamania.eh
mssbupx.dll - infected by Trojan-PSW.Win32.Maran.o
server.exe - infected by Trojan-PSW.Win32.Maran.o
svhost32.exe - infected by Trojan-PSW.Win32.Lineage.aco
jokera
Virtemp05_.rar
Virtemp05_.rar335 viewsVirtemp05.rar的另一個壓縮版本
解開來的檔案都在
winlogin.exe
ciau38dll.dll
Anskya0.exe
Anskya1.exe
Anskya2.exe
dllf.dll
xwdll.dll
seal.exe
lineage.exe
fenggu.exe
svhost32.exe(兩個不同目錄且不同的檔案)
SV0H0ST.exe
1 commentsjokera
Virtemp05.rar
Virtemp05.rar290 viewsVirtemp05.rar/photo7.scr.vir/data.rar/winlogin.exe - infected by Trojan-PSW.Win32.Delf.qe
Virtemp05.rar/systemin.exe.vir/data.rar/winlogin.exe - infected by Trojan-PSW.Win32.Gamania.gf
Virtemp05.rar/photo6.scr.vir/data.rar/winlogin.exe - infected by Trojan-PSW.Win32.Gamania.gf
卡巴斯基線上掃描竟然會漏掉systemin.scr.vir
掃描日期20060913 10:10p
木馬來源網站
http://www.gamanir.com/
都是rar自解檔偽裝
中標時會自動從該網站上下載另外三個檔案
http://www.gamanir.com/exe/lineage.exe
http://www.gamanir.com/exe/seal.exe
http://www.gamanir.com/exe/fenggu.exe
jokera
chaoshunvir.rar
chaoshunvir.rar從某立委服務處電腦抓出來的..504 viewsxiw828isidll.dll.vir - infected by Trojan-PSW.Win32.Lineage.afi
iexplore.exe.vir - infected by Trojan-PSW.Win32.Lineage.afi
msyagi.com.vir - infected by Backdoor.Win32.Beastdoor.av
虧他們還有裝趨勢...
這類盜取帳號鍵盤記錄的最大特徵
開個cmd視窗,打字速度會異常的慢..
目前遇到的,沒有例外.
jokera
060813Troj.rar
060813Troj.rar060813 盜取帳號按鍵記錄947 views會中這隻,真的應該去死一死算了
因為只有色情變態才會中.
卡巴當然掃不到(0814)
會在Windows目錄生成svchost.exe
在system32裡放個PDLL.dll
大概看了一下二進位內容
應該還是盜用橘子帳號為主
並會自動將結果發信至某處
經典激情圖片.com.vir為透過信件傳播的本體
為Winrar自解執行
內有1.sfx.exe為正體,經過upx壓縮
4 commentsjokera
VirTEMP03.rar
VirTEMP03.rarVirusTEMP 03528 views主要是號稱為 楓之谷 外掛
甚至卡巴斯基有檔案掃不到的...
此壓縮檔裡面的幾乎可以確定都是木馬
線上掃瞄日期:2006/08/03
fSdll.dll - infected by Trojan-PSW.Win32.Lineage.adg
hmmapi.dll - OK
iedw.exe - OK
rundl132.exe - infected by Trojan-PSW.Win32.Gamania.en
svchost.exe - infected by Trojan-PSW.Win32.Gamania.el
svhost32.exe - infected by Trojan-PSW.Win32.Lineage.aco
2/d1.dat - OK
2/d2_.exe - infected by Trojan-PSW.Win32.Lineage.aco
2/dllf.dll - infected by Trojan-PSW.Win32.Lineage.aco
2/dlyy.dll - infected by Trojan-PSW.Win32.Gamania.em
2/e1.dat - OK
2/e1.exe - infected by Trojan-PSW.Win32.Lineage.adg
2/fS.dat - OK
2/fS.exe - infected by Trojan-PSW.Win32.Gamania.en
2/PDLL.dll - infected by Trojan-PSW.Win32.Delf.nl
2/rundll32.exe - infected by Trojan-PSW.Win32.Mefs.f
2/svhost32.exe - infected by Trojan-PSW.Win32.Lineage.aco
af.dat - OK
af.exe - infected by Trojan-PSW.Win32.Gamania.en
d1.dat - OK
d2_.exe - infected by Trojan-PSW.Win32.Delf.of
e1.dat - OK
e1.exe - infected by Trojan-PSW.Win32.Mefs.f

老話一句
愛用就找死吧
VirTemp02.rar
VirTemp02.rar病毒暫存02 Trojan-PSW367 views清一色為Trojan-PSW
WinAF.tmp.exe.exe - Win32.Lineage.my
Kerne141.exe - Win32.Lineage.my
microsoftie41.dll - Win32.Gamania.ba
pbdll.dll - Win32.Gamania.as
rodll.dll - Win32.Delf.fz
rundll132.exe - Win32.Delf.fz
svchost.exe - Win32.Lineage.ach
jokera
Virtemp01.rar
Virtemp01.rar病毒暫存01353 viewsrundll32.exe Trojan-PSW.Win32.Lineage.abd
svchost.exe Trojan-PSW.Win32.Delf.nl
svhost32.exe Trojan-PSW.Win32.Delf.no
jokera
VirTEMP04.rar
VirTEMP04.rarDangerFiles268 viewsVirTEMP04.rar/shawo877kdll.dll.vir - infected by Trojan-PSW.Win32.Lineage.xg
VirTEMP04.rar/IEXPLORE.exe.vir - infected by Trojan-PSW.Win32.Lineage.xg
VirTEMP04.rar/3OUP96.DLL.VIR - infected by Trojan-PSW.Win32.Lineage.zl
192 files on 10 page(s) 10