瑞星网站每日安全播报(2009年7月6日) bbs.ikaka.com

networkedition - 2009-7-6 15:08:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不在分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://appl.eastday.com/(东方网)
2. http://book.shulu.net/(书路文学网)
3. http://club.joyes.com/(手机论坛_全球最大的手机之家_捉鱼手机论坛)
4 .http://read.southcn.com/( 南方书城华南最大党政网上书城南方网)

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

networkedition - 2009-7-6 15:08:00

关于:hxxp://appl.eastday.com/Enjoy/1/detail.asp?id=1882解密的日志(全体输出 - 10):

Level 0>http://appl.eastday.com/Enjoy/1/detail.asp?id=1882
Level 1>http://%33bomb.com/c.js
Level 1>http://3b%6fmb.com/c.js
Level 1>http://e6t.3322.org/c.js
Level 1>http://s581.3322.org/c.js
Level 1>http://3b3.org/c.js
Level 2>http://vip762.3322.org/aa/a100.htm
Level 3>http://vip762.3322.org/aa/index.htm
Level 4>http://vip762.3322.org/aa/go.jpg
Level 5>http://xin765.com/wm/svchost.exe ●

日志由 Redoce1.9第65次修正版于 2009-7-6 14:40:34 生成。

networkedition - 2009-7-6 15:09:00

关于:hxxp://book.shulu.net/files/article/html/21/21675/4020147.html解密的日志(全体输出 - 18):

Level 0>http://book.shulu.net/files/article/html/21/21675/4020147.html
Level 1>http://book.shulu.net/files/article/html/21/21675/index.html
Level 1>http://book.shulu.net/files/article/html/21/21675/4020146.html
Level 1>http://book.shulu.net/ad/middle.js
Level 1>http://book.shulu.net/files/article/html/21/21675/index.html
Level 1>http://book.shulu.net/files/article/html/21/21675/4020146.html
Level 1>http://qsex.3322.org/aa/b108.htm
Level 2>http://qsex.3322.org/aa/index.htm
Level 3>http://qsex.3322.org/aa/go.jpg
Level 4>http://xin765.com/wm/svchost.exe ●
Level 1>http://ad.shulu.net/pagebottom.js
Level 1>http://www.shulu.net/files/article/info/21/21675.htm
Level 1>http://ad.shulu.net/google.js
Level 1>http://ad.shulu.net/pagetop2.js
Level 1>http://www.shulu.net/files/article/info/21/21675.htm
Level 1>http://book.shulu.net/files/article/fulltext/21/21675.html
Level 1>http://ad.shulu.net/pagetop.js
Level 1>http://www.shulu.net/configs/article/page.css

日志由 Redoce1.9第65次修正版于 2009-7-6 14:41:36 生成。

networkedition - 2009-7-6 15:09:00

Log is generated by FreShow.
[wide]http://club.joyes.com/announce/announce.aspx?BoardID=813&ID=21418383
[script]http://club.joyes.com/announce/../js/main.js
[script]http://club.joyes.com/announce/../js/topic.js
[script]http://club.joyes.com/announce/../js/topicpost.js
[script]http://club.joyes.com/announce/editorol/shortReply.js
[script]http://club.joyes.com/ajaxpro/prototype.ashx
[script]http://club.joyes.com/ajaxpro/core.ashx
[script]http://club.joyes.com/ajaxpro/converter.ashx
[script]http://club.joyes.com/ajaxpro/joyesclub.announce.announce,joyesclub.ashx
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
[frame]http://www.12345wyt.cn
[frame]http://b.536link.com/gifhtm/779gif.jsp?h=2&w=6&th=840&tw=240&bgc=ffffff&bdc=ffffff&fc=E70808&fcfc=EFEFEF&type=1&username=kxdy8
[script]http://121.12.170.223:9090/779user.js
[script]http://count2.51yes.com/click.aspx?id=21477606&logo=6
[frame]http://n0m0n2.3322.org/aa/a4.htm?5
[frame]http://n0m0n2.3322.org/aa/index.htm
[script]http://n0m0n2.3322.org/aa/go.jpg
[object]http://xin765.com/wm/svchost.exe
[script]http://n0m0n2.3322.org/aa/\"http:\/\/js.tongji.linezing.com\/1081637\/tongji.js\"
[script]http://s6.cnzz.com/stat.php?id=1408285&web_id=1408285
[script]http://club.joyes.com/announce/../js/dynamic_assortboard.js
[script]http://club.joyes.com/announce/../js/createoption.js
[frame]http://ads.joyes.com/v.aspx?pos=557&c=js
[frame]http://ads.joyes.com/v.aspx?pos=558&c=js
[frame]http://ads.joyes.com/v.aspx?pos=559&c=js
[script]http://w.cnzz.com/c.php?id=30009966&l=1
[frame]http://c.joyes.com:6008/jcs?cururl='+escape(cururl)+'&preurl='+escape(preurl)+'&ua='+ua+'&sid='+sid+'
[frame]http://head.joyes.com/WebCount.htm
[script]http://w.cnzz.com/c.php?id=30009966&l=1
[frame]http://club.joyes.com/announce/../wap/simulator.aspx?w=139&h=150&pic=no&u=http%3a%2f%2fwap.joyes.com%2f813%2c21418383%2cclubtopicinfo%3fdiuv%3dT000000000joyes
[script]http://cpro.baidu.com/cpro/ui/cp.js

networkedition - 2009-7-6 15:09:00

Log is generated by FreShow.
[wide]http://read.southcn.com/good/sz/200811170004.htm
[frame]http://ZieF.pl/iraq.jpg
[object]http://jl.chura.pl/rc/load.php?id=508
[frame]http://ZieF.pl/iraq.jpg

豪斯登堡新郎 - 2009-7-7 0:05:00

变的还真快

http://kikimm.com/wm/svchost.exe

CPU_ringO - 2009-7-7 1:17:00

这个毒竟然不搞IFEO

:kaka6:

瑞星卡卡安全论坛