泛滥了-。-

秋叶濛濛

来源：卡卡安全社区

Log is generated by FreShow.
[wide]http://my.ziqu.com/bbs/665293/messages/74997.html
    [frame]http://my.ziqu.com/bbs/665293/messages/*.html
        [frame]http://pp.cool0.biz/bmw/am2.htm?02
            [frame]http://pp.cool0.biz/ax14.htm
                [object]http://dm.htifns.com.cn/vv.exe
            [frame]http://pp.cool0.biz/re10.htm
            [frame]http://www.tongji123.org/axfs.htm
                [object]http://dm.htifns.com.cn/vv.exe
                [object]http://www.tongji123.org/4561.swf
                    [object]http://www.tongji123.org/4562.swf（老朋友了 就不看了）
            [frame]http://pp.cool0.biz/axlz.htm
                [object]http://dm.htifns.com.cn/vv.exe
            [frame]http://pp.cool0.biz/re11.htm
                [object]http://dm.htifns.com.cn/vv.exe
        [script]http://ad.netsh.com/js/hp.js
            [script]http://smjs.allyes.com/sm.js
                [object]http://smcreative.allyes.com/smcreative/newff/flashpop2_div.js
                [object]http://smcreative.allyes.com/smcreative/newff/flashpop2.js

这两个不会解了...求教下

附样本：

vv.exe vv.rar (22.09 KB, 下载次数: 116)

2008-5-31 00:57 上传

点击文件名下载附件
MD5:3DEB94FAC3EEA65323B8A17C208330B2
Size:22,548byte

Kaspersky
已检测到: 木马程序 Trojan-Downloader.Win32.Losabel.nx

秋叶濛濛

附上               
[object]http://smcreative.allyes.com/smcreative/newff/flashpop2_div.js
[object]http://smcreative.allyes.com/smcreative/newff/flashpop2.js

解遍evel后的代码...求指点

function setCookie(name,value,expires){document.cookie=name+"="+escape(value)+"; expires="+expires.toGMTString()+"; path=/"}function getfocusepop(){if(temflag!=2){var pluto=opener;oPopup.show(screen.width-popwidth-toleftwid,screen.height-popheight-tobottomhei,popwidth,popheight)}else{oPopup.hide()}}if(window.Node){Node.prototype.removeNode=function(removeChildren){if(removeChildren)return this.parentNode.removeChild(this);else{var range=document.createRange();range.selectNodeContents(this);return this.parentNode.replaceChild(range.extractContents(),this)}}}function disdiv(){if(navigator.userAgent.indexOf("MSIE")>-1){oPopup.document.getElementById("hotson").removeNode(true);oPopup.hide();temflag=2}else{clearInterval(tttt);document.getElementById("hotson").removeNode(true);document.getElementById("imgcoltem").removeNode(true);document.getElementById("divnameimgdis").removeNode(true);document.getElementById("divname1").removeNode(true)}}function load100(){if(temloadyes==1){if(oPopup.document.getElementById("hotson").PercentLoaded()!=100){setTimeout('load100()',50)}else{creativeCookie();setTimeout('popshow()',50)}}else{setTimeout('popshow()',50)}}function creativeCookie(){if(!AllyesviewtvCookieVal)AllyesviewtvCookieVal=1;setCookie(tem11,AllyesviewtvCookieVal,AllyesviewtvExpDate)}function rand(num){return Math.floor(Math.random()*num)+1}var inteval="";var mytime="";function popshow(){if(popTop>920){}else if(popTop<=popheight){oPopup.show(screen.width-popwidth-toleftwid,screen.height,popwidth,popTop)}else if(popTop>popheight){inteval=window.setInterval("getfocusepop()",100)}popTop+=10;mytime=setTimeout("popshow();",flash_settimevalue)}var temopenflag=true;if(navigator.userAgent.indexOf("MSIE")>-1){var oPopup=window.createPopup()}if(!kuantongtitle){kuantongtitle="SmartCreative"}function movelook(){if(navigator.userAgent.indexOf("MSIE")>-1){var temscrolltop=temdocument.scrollTop;var temscrollleft=temdocument.scrollLeft}else{var temscrolltop=window.pageYOffset;var temscrollleft=window.pageXOffset}if(temmoveflag==1){var flash_left2006=temdocument.clientWidth-(popwidth+temleftdeff);var flash_top2006=temdocument.clientHeight-(popheight+temtopdeff);document.getElementById("divname1").style.top=flash_top2006+temscrolltop+"px";if(!document.getElementById("divname1")){document.getElementById("imgcoltem").removeNode(true);document.getElementById("hotson").removeNode(true);return}document.getElementById("divname1").style.left=flash_left2006+temscrollleft+"px";document.getElementById("divnameimgdis").style.top=(flash_top2006+tclosegify)+temscrolltop+"px";document.getElementById("divnameimgdis").style.left=(flash_left2006+popwidth-tclosegifx)+temscrollleft+"px"}else{var flash_left2006=temdocument.clientWidth-(popwidth+temleftdeff);var flash_top2006=temdocument.clientHeight-(popheight+temtopdeff);document.getElementById("divname1").style.top=flash_top2006+"px";if(!document.getElementById("divname1")){document.getElementById("imgcoltem").removeNode(true);document.getElementById("hotson").removeNode(true);return}document.getElementById("divname1").style.left=flash_left2006+"px";document.getElementById("divnameimgdis").style.top=(flash_top2006+tclosegify)+"px";document.getElementById("divnameimgdis").style.left=(flash_left2006+popwidth-tclosegifx)+"px"}}function dohtmlshow(){var openWinCode="";try{temopenflag=videoWin=window.open(openWinCode,"newwin","top="+winTop20060609191217+",left="+winLeft20060609191217+",height="+popheight+",width="+popwidth+",status=no,toolbar=no,menubar=no,location=no,resizable=0,scrollbars=0",false)}catch(e){temopenflag=false}if(temopenflag&&temopenflag!="null"){if(typeof(temopenflag["name"])=="string"){creativeCookie();try{temopenflag.document.write("<html>");temopenflag.document.writeln("<head>");temopenflag.document.writeln("<title>"+kuantongtitle+"</title>");temopenflag.document.writeln("<meta http-equiv='Content-Type' content='text/html; charset=gb2312'>");temopenflag.document.writeln("</head>");temopenflag.document.writeln("<script language=JavaScript>");temopenflag.document.writeln("var ie = "+ie+";");temopenflag.document.writeln("var fvarList = '"+parent.flash_var_list+"';");temopenflag.document.writeln("var flvadd = '"+flvadd+"';");temopenflag.document.writeln("var winLeft = '"+winLeft20060609191217+"';");temopenflag.document.writeln("var winTop = '"+winTop20060609191217+"';");temopenflag.document.writeln("var winWidth = '"+popwidth+"';");temopenflag.document.writeln("var winHeight = '"+popheight+"';");temopenflag.document.writeln("var toolbarHeight = '"+toolbarHeight20060609191217+"';");temopenflag.document.writeln("var toolbarWidth = '"+toolbarWidth20060609191217+"';");temopenflag.document.writeln("var winMove = '40';");temopenflag.document.writeln("var winInterval = "+flash_settimevalue+";");temopenflag.document.writeln("var srcHeight = '"+winLeft20060609191217+"';");temopenflag.document.writeln("var popheight = '"+popheight+"';");temopenflag.document.writeln("var bannerswfadd = '"+bannerswfadd+"';");temopenflag.document.writeln("var temclickadd = '"+temclickadd+"';");temopenflag.document.writeln("var ADFUSERBannerIDAllyes = '"+temclickadd+"';");temopenflag.document.writeln("var ADFHOSTBannerIDAllyes = '"+temadfhost+"';");temopenflag.document.writeln("var adftrack_ref = '"+adftrack_ref+"';");temopenflag.document.writeln("var targetflag = '_blank';");temopenflag.document.writeln("var stopflag = 'stop';");temopenflag.document.writeln("if(ie==true){var temietop=window.screenTop;var temieleft=window.screenLeft;}else{var temietop=window.screenY;var temieleft=window.screenX;}");temopenflag.document.writeln("var cmpWidth = temieleft - winLeft;");temopenflag.document.writeln("var cmpHeight = temietop - winTop;");temopenflag.document.writeln("var intervalHdl;");temopenflag.document.writeln("");temopenflag.document.writeln("var switchFlag = 0;");temopenflag.document.writeln("function fnEffect()");temopenflag.document.writeln("{");temopenflag.document.writeln("if(ie==true){var temietop=window.screenTop;}else{var temietop=window.screenY;}");temopenflag.document.writeln("   if (temietop < screen.height - parseInt(winHeight) - parseInt(toolbarHeight))");temopenflag.document.writeln("   {");temopenflag.document.writeln("    clearTimeout(intervalHdl);");temopenflag.document.writeln("    endWinTop = screen.height - toolbarHeight - winHeight - cmpWidth;");temopenflag.document.writeln("    endWinLeft = winLeft;");temopenflag.document.writeln("    return;");temopenflag.document.writeln("   }else");temopenflag.document.writeln("   {");temopenflag.document.writeln("   try{window.moveTo(winLeft, temietop - winMove);}");temopenflag.document.writeln("   catch(e) {}}");temopenflag.document.writeln("}");temopenflag.document.writeln("</scr"+"ipt>");temopenflag.document.writeln("<body leftmargin=0 topmargin=0 scroll=no>");temopenflag.document.writeln("<IFRAME name=frmdownload src=''style='display:none'></IFRAME>");temopenflag.document.writeln("<script language=JavaScript>window.focus();");temopenflag.document.writeln("function loadload100(){try{");temopenflag.document.writeln("if(document.getElementById('button690').CurrentFrame()>0){");temopenflag.document.writeln("window.setInterval('fnEffect()', winInterval);}else{");temopenflag.document.writeln("setTimeout('loadload100()', 50);}}catch(e){");temopenflag.document.writeln("setTimeout('loadload100()', 50);}}window.setInterval('fnEffect()', winInterval);</SC"+"RIPT>");temopenflag.document.writeln("<SCRIPT SRC='"+flashpop1add+"'></SC"+"RIPT></body></html>")}catch(e){}}else{if(navigator.userAgent.indexOf("MSIE")>-1){popmsg();oPopup.document.onmousedown=function(){if(!oPopup.document.hasFocus())oPopup.document.focus()}}else{divpopmsg()}}}else{if(navigator.userAgent.indexOf("MSIE")>-1){popmsg();oPopup.document.onmousedown=function(){if(!oPopup.document.hasFocus())oPopup.document.focus()}}else{divpopmsg()}}}

mofunzone

Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\vv.rar'
C:\Documents and Settings\morgan\My Documents\
  vv.rar
    [0] Archive type: RAR
      --> vv.exe
        [1] Archive type: Runtime Packed
        --> Object
          [2] Archive type: OVL
          --> Object
            [3] Archive type: OVL
            --> Object
                [DETECTION] Contains detection pattern of the rootkit RKIT/Agent.PN
                [WARNING]   Infected files in archives cannot be repaired!
      [NOTE]      The file was deleted!

醉一生爱妍

cmd download..

会有收获的

同时我也看到了一个熟悉的字眼..

beep.sys

61181583

我的kis2009 竟然不报

palfan

最近这几个名字我都看烦了

电影结束了

扫描系统区域...
扫描所选择的目录和文件...
对象: vv.exe
        在压缩档案里: F:\vv.rar
        Status: 已发现病毒
        病毒: Generic.Malware.P!BPk!g.D9DFB676 (BD 引擎)

快乐男孩6

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Dropper.Win32.Agent.gcx  

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.46.50

深红的雪

广告就不用管它了吧
调试了一下，发现有些变量没有声明就使用，不玩了