挺有意思的加密

显示全部楼层 · 发表于 2008-3-17 22:47:43

费尔报了

显示全部楼层 · 发表于 2008-3-17 23:05:58

红伞报了就好，系统安全啊。

显示全部楼层 · 发表于 2008-3-18 01:25:05

就这样被全灭了
Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\My Documents\123'
C:\Documents and Settings\Administrator\My Documents\123\
  csrss.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  gdisvc.jpg
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  HoneyDll.dll
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  HoneyMain.exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  HoneySys.dat
   [DETECTION] Contains detection pattern of the rootkit RKIT/HideFile.B
   [NOTE]    The file was deleted!
  ntserv.exe
[0] Archive type: Runtime Packed
--> Object
   [NOTE]    The file was deleted!
  top.jpg
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!
  top[1].exe
   [DETECTION] Is the Trojan horse TR/Dropper.Gen
   [NOTE]    The file was deleted!

End of the scan: 2008年3月17日  10:24
Used time: 00:04 min

The scan has been done completely.

   1 Scanning directories
   8 Files were scanned
   4 viruses and/or unwanted programs were found
   4 Files were classified as suspicious:
   8 files were deleted
   0 files were repaired
   0 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
   4 Files not concerned
   0 Archives were scanned
   0 Warnings
   8 Notes

显示全部楼层 · 发表于 2008-3-18 21:58:00

@33F5@49C9@AD41

这样的加密算法如何解?

显示全部楼层 · 发表于 2008-3-19 18:03:35

@替换成%u 也就是颠倒的16进制也叫shellcode
下面有定义的了

[已鉴定] 挺有意思的加密