召唤解密高手

显示全部楼层 · 发表于 2008-1-19 20:14:49

http://76.31.240.224->http://76.31.240.224/cgi-bin/in.cgi?p=user1
代码见附件，代码发送到论坛后自动屏蔽了，汗

[ 本帖最后由 qianwenxiang 于 2008-1-19 20:16 编辑 ]

显示全部楼层 · 发表于 2008-1-19 20:52:13

arguments.callee.toString()...
tmd...
不能直接用c++程序执行了

显示全部楼层 · 发表于 2008-1-19 21:42:52

呀?里面什么内容?网址打不开,样本也没发现异常

显示全部楼层 · 发表于 2008-1-19 21:56:16

V~_eidmb_(i)2_XT?qX<B7I;efvtUb)e8,qV=$k@?Vmei]n_vh)aU\uVg#omGd{Zp\#'"bnanV^ceH1\'%7eqJknYbLRuZ#'/fjc"b]lJ%;YC+6tUb)56,bdj'oX=k\pRSvjPV*&Fe8,qV=$k@0a`l[dq,xVmdf>Ze),jm+Rtiq)&TFhd`;DgcgIKiUcD<_1^nh"6mpUi1=[jp4=(i[q5ZWF!=9/5[V(h\70)&D56,bdj'oX- $IKiUcD<_O4=(i[q5ZWf.20q_fvSpK00\1?.30amfM%9\at+Vp.3'398$@Xhk2d[+M%9\at+Vp/@2,'kvSpK00\1?.*b]lJ%;YC+9<2!2O*h`bF>#j61$%H$;-30-"<)6/+'/Vxc*dSFBI@B:M8./_a9PN2O,HE#7+6mL8WJ9F3V-M%9\at+Vp4y?G‚gfVJ?UKxIJCT5E(aF)2eZf@WiR8&?G‚gfVJ?UKxIJCT5E(aN`b]lJ%;YC+$9]V)MLttXQX2cPjV<>b(S-S)8$@Xhk2d[M)-"%$o;`jxY\M5Qd`Z=IW+AAI-9/5[V(h\X)1$;*6.15&)?,rxnj%rT6&gw1$;*6.15&)>,hdm&aRwG7'c?*-9,oWiT)"q281]vVd~FZ+19aRwG7'c?*4}eq3]S="nn8IKiUcD<_Oyg7^^2%\‚Ov+2tL9=SQ#^fUbL`fZ<r]k_X*-f5&2('03QN1rk0gW$:]{396:'9,20%%2,k\p7

显示全部楼层 · 发表于 2008-1-20 01:03:22

直接杀了了事，解密什么
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\1111.rar'
C:\Documents and Settings\Administrator\My Documents\
  1111.rar
[0] Archive type: RAR
--> 1111.txt
      [DETECTION] Contains suspicious code HEUR/HTML.Malware
      [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-20 10:37:21

connect to ... http://76.31.240.224/olb/

显示全部楼层 · 发表于 2008-1-20 10:39:15

C:\Users\Administrator\Downloads\1111.rar
  [0] Archive type: RAR
  --> 1111.txt
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML

显示全部楼层 · 发表于 2008-1-20 11:16:57

detected: Trojan program Trojan-Downloader.JS.Agent.ayk URL: http://bbs.kafan.cn/attachment.php?aid=186458//1111.txt

显示全部楼层 · 发表于 2008-1-20 17:14:48

不懂学习

显示全部楼层 · 发表于 2008-1-21 11:50:42

直接打开出错了，而那个网站上不到……

[已鉴定] 召唤解密高手