a1234567mdy的专栏

<br />1、关于DLL注入的问题<br />2、关于下载新样本的问题

SELECT DISTINCT country FROM geoipcountrywhois where country NOT IN (SELECT cc FROM cc ORDER BY cc)SELECT geoipcountrywhois.`start`,geoi

#include int main(){system("perl D:\\work\\botsig.pl");}

类型为datetime和varchar的区别datetime：2011-12-05 和 2011-12-5 相同varchar：   2011-12-05 和 2011-12-5 不同做个记录。MySQL数据库中的Date,DateTime和TimeStamp类型http://tech.ddvip.com/2008-01/120060777640649.ht

use Net::Ping; $pinghost = Net::Ping->new("tcp");#Protocol for ping must be "icmp", "udp", "tcp", "syn", "stream", or "external" $domain = "sohu.com"; $ip = "184.22.37.92";# if ($pinghost->ping

1.GIF格式内嵌php，asp等脚本的研究2、提取脚本式bot地址参考gif格式分析【转载】 http://blog.csdn.net/friendwaters/article/details/2737328

#windows下的版本 遍历指定目录#!/usr/bin/perl -wuse warnings;my $dir_path = "C:\\pbotnew"; # 注意"\\"的写法opendir DH, $dir_path or die "Can not open \n";@filelist = readdir DH;foreach $file (@filelist) {

先定位目录，再计算cd /home/anchiva/runbot_deep/samplesls -lR|grep "^-"|wc -l

Adware/Referrer.0BDF:3:*:3d646f63756d656e742e72656665727265723b{-100}2e696e6465786f6628{-80}2e6c6f636174696f6e3d687474703a2f2f    var url1 = document.referrer;     if(url1.indexOf('so.com')>-1

IMJEAXGGMERSSHEHCXSJCCGSA1PMMFTLIsle of ManJerseyAland IslandsGuernseyMontenegroSerbiaSaint He

内网IP10.0.0.0 - 10.255.255.255 172.16.0.0 - 172.31.255.255 192.168.0.0 - 192.168.255.555 还有些要排除127.0.0.1本机0.0.0.0代表本机所有地址224.0.0.0~2

如题！

公司站点：http://172.16.11.2/avlab/index.phphttp://172.16.11.60/index.phphttp://172.16.11.10/crossscan/index.phphttp://172.16.11.5/Main.phphttp://172.16.13.113/blog/研究站点http://kafan.cn/http://bbs.pediy.com/http://unpack.cn/http://anchiva.com/virushttp://home.ie

<br />submit_time>'2011-04-01' and submit_time<'2011-04-12 16' and (Kaspersky like '%bot%' or McAfee like '%bot%' or Symantec like '%bot%' or Trendmicro like <br /><br />'%bot%' or Antivir like '%bot%' or Rising like '%bot%' or Sophos like '%bot%' or N

<br /><br />vendor---trendmicro-----<br />TROJ_FAKEAV.WMI 4647<br />TSPY_MAGANIA.SMZ 1243<br />WORM_ALLAPLE.IK 1036<br />TROJ_DROPPER.SUE 849<br />TROJ_FAKEAV.SM2 827<br />PTCH_LOAD.SM 769<br />PE_DOWN.D 756<br />TROJ_FAKEAV.SM2 442<br />

1 Cycbot   网页请求任务，下载任务文件（包含指令），下载加密PE样本到本地解密（一般也是相似的样本，这样，可以更新，传播到一定范围，可以批量控制肉鸡），上传信息到C&C（可能是为了让服务器统计肉鸡数量）,大小一般在100K至200K之间样本：ee5bbaed15d4067851bd31784c2af8492 没想好名字那特点：下载样本运行或代码到内存执行        

利用VM安装目录自带的vmrun.exe可以实现VMware® Workstation版本：VM 7.0.0 build-203739 vmrun -T ws revertToSnapshot "E:/virtual/CloneCHS/Windows XP Professional.vmx" myshotvmrun -T ws start "E:/virtual/CloneCH

cycbot_vm.cpp/* 虚拟机中的程序 */#include "md5.h"#include //#include void Copy_dwm();void Copy_csrss();void Copy_conho

ip_address like '%112.175%'   chatter_example like "%NICK%" chatter_example like '%.bin%'   request_time>'2011-07-27 14:26:2

详细解析fedora10 snort安装（含安装所需包下载）http://www.360doc.com/content/11/0403/00/3810344_106829773.shtml详细解析fedora10 snort安装（含安装所需包下载）http://tzsky.blog.51cto.com/1062094/253460