搜游戏，中病毒……ess报！

傻猪猪米走鸡

难得有心情想下载个《天旋地转3》来玩玩，结果没上去就报毒了。
http://www.chuansuo.net/58/51/07/9020/
ESS值得骄傲！

报告内容：
2007-4-15 16:11:12
ePfw-Http
file http://i.ads8.com/pds_k/view.php?id=1996&uid=18581&rePlace=0&visits=1&a_width=0&a_height=0&a_class=9&a_pic_url=&ed_str=http://www.chuansuo.net/58/51/07/9020/&ed_ads_open_class=0&ed_ads_logo=0&ed_ads_tempstop=&ed_ads_webtest=0&ed_ads_group= JS/TrojanDownloader.IstBar.G trojan
connection terminated

金剑

var click_string='31383538312c313939362c313137363632363232332c687474703a2f2f7777772e636875616e73756f2e6e65742f35382f35312f30372f393032302f2c392c302c302c30'; var blankurl='http://i.ads8.com/'; var ads_click_test='8251a88654a70a482182533e40e4754b'; ed_ads_open_class='0'; AdsID='1996'; var totmp=0; if(totmp!=1){ //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// var paypopupURL = ""+blankurl+"/pds_k/click.php?click_string="+click_string+"&ads_click_test=8251a88654a70a482182533e40e4754b"; var usingActiveX = true; function blockError(){return true;} window.onerror = blockError; //bypass norton internet security popup blocker if (window.SymRealWinOpen){window.open = SymRealWinOpen;} if (window.NS_ActualOpen) {window.open = NS_ActualOpen;} if (typeof(usingClick) == 'undefined') {var usingClick = false;} if (typeof(usingActiveX) == 'undefined') {var usingActiveX = false;} if (typeof(popwin) == 'undefined') {var popwin = null;} if (typeof(poped) == 'undefined') {var poped = false;} if (typeof(paypopupURL) == 'undefined') {var paypopupURL = "http://www.ads8.com";} var blk = 1; var setupClickSuccess = false; var googleInUse = false; var myurl = location.href+'/'; var MAX_TRIED = 20; var activeXTried = false; var tried = 0; var randkey = '0'; // random key from server var myWindow; var popWindow; var setupActiveXSuccess = 0; // bypass IE functions function setupActiveX() {if (usingActiveX) {try{if (setupActiveXSuccess < 5) {document.write('');popWindow=window.createPopup();popWindow.document.body.innerHTML='
';document.write('');popIframe.document.write('');setupActiveXSuccess = 6;}}catch(e){if (setupActiveXSuccess < 5) {setupActiveXSuccess++;setTimeout('setupActiveX();',500);}else if (setupActiveXSuccess == 5) {activeXTried = true;setupClick();}}}} function tryActiveX(){if (!activeXTried && !poped) {if (setupActiveXSuccess == 6 && googleInUse && popWindow && popWindow.document.getElementById('getParentDiv') && popWindow.document.getElementById('getParentDiv').object && popWindow.document.getElementById('getParentDiv').object.parentWindow) {myWindow=popWindow.document.getElementById('getParentDiv').object.parentWindow;}else if (setupActiveXSuccess == 6 && !googleInUse && popIframe && popIframe.getParentFrame && popIframe.getParentFrame.object && popIframe.getParentFrame.object.parentWindow){myWindow=popIframe.getParentFrame.object.parentWindow;popIframe.location.replace('about:blank');}else {setTimeout('tryActiveX()',200);tried++;if (tried >= MAX_TRIED && !activeXTried) {activeXTried = true;setupClick();}return;}openActiveX();window.windowFired=true;self.focus();}} function openActiveX(){if (!activeXTried && !poped) {if (myWindow && window.windowFired){window.windowFired=false;document.getElementById('autoHit').fireEvent("onkeypress",(document.createEventObject().keyCode=escape(randkey).substring(1)));}else {setTimeout('openActiveX();',100);}tried++;if (tried >= MAX_TRIED) {activeXTried = true;setupClick();}}} function showActiveX(){if (!activeXTried && !poped) {if (googleInUse) {window.daChildObject=popWindow.document.getElementById('objectRemover').children(0);window.daChildObject=popWindow.document.getElementById('objectRemover').removeChild(window.daChildObject);}newWindow=myWindow.open(paypopupURL,'abcdefg');if (newWindow) {newWindow.blur();self.focus();activeXTried = true;poped = true;}else {if (!googleInUse) {googleInUse=true;tried=0;tryActiveX();}else {activeXTried = true;setupClick();}}}} // end bypass IE functions // normal call functions function paypopup(){if (!poped) {if(!usingClick && !usingActiveX) {popwin = window.open(paypopupURL,'abcdefg');if (popwin) {poped = true;}self.focus();}}if (!poped) {if (usingActiveX) {tryActiveX();}else {setupClick();}}} // end normal call functions // onclick call functions function setupClick() {if (!poped && !setupClickSuccess){if (window.Event) document.captureEvents(Event.CLICK);prePaypopOnclick = document.onclick;document.onclick = gopop;self.focus();setupClickSuccess=true;}} function gopop() {if (!poped) {popwin = window.open(paypopupURL,'abcdefg');if (popwin) {poped = true;}self.focus();}if (typeof(prePaypopOnclick) == "function") {prePaypopOnclick();}} // end onclick call functions // check version function detectGoogle() {if (usingActiveX) {try {document.write('

');googleInUse|=(typeof(document.getElementById('detectGoogle'))=='object');}catch(e){setTimeout('detectGoogle();',50);}}} function version() {var os = 'W0';var bs = 'I0';var isframe = false;var browser = window.navigator.userAgent;if (browser.indexOf('Win') != -1) {os = 'W1';}if (browser.indexOf("SV1") != -1) {bs = 'I2';}else if (browser.indexOf("Opera") != -1) {bs = "I0";}else if (browser.indexOf("Firefox") != -1) {bs = "I0";}else if (browser.indexOf("Microsoft") != -1 || browser.indexOf("MSIE") != -1) {bs = 'I1';}if (top.location != this.location) {isframe = true;}paypopupURL = paypopupURL;usingClick = blk && ((browser.indexOf("SV1") != -1) || (browser.indexOf("Opera") != -1) || (browser.indexOf("Firefox") != -1));usingActiveX = blk && (browser.indexOf("SV1") != -1) && !(browser.indexOf("Opera") != -1) && ((browser.indexOf("Microsoft") != -1) || (browser.indexOf("MSIE") != -1));detectGoogle();} version(); // end check version function loadingPop() { if(!usingClick && !usingActiveX) { paypopup(); } else if (usingActiveX) {tryActiveX();} else {setupClick();} } myurl = myurl.substring(0, myurl.indexOf('/',8)); if (myurl == '') {myurl = '.';} setupActiveX(); loadingPop(); self.focus(); //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //document.writeln(" "); } //document.writeln(""); //document.writeln("");

金剑

好像是误报

mofunzone

ess的误报值得骄傲

The EQs

avira的误报那才叫做爽。。。。。系统文件稍微加壳就给你杀壳了。。。哈哈

mofunzone

原帖由 EQ2 于 2007-4-15 01:05 发表
avira的误报那才叫做爽。。。。。系统文件稍微加壳就给你杀壳了。。。哈哈

可惜的是没有正常系统文件加壳的

The EQs

你确定？？？？UPX和ASPACK不是正常的加壳工具？？搞笑了。。。

KAV-Longhorn

那EQ兄你就给系统的explorer.exe加个UPX，再发上来给我测试一下看看吧

zzh161

打开这个页面费尔就报广告程序

jy416

ESS在样本区表现不好啊！