瑞星卡卡安全论坛

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

Log is generated by FreShow.
[wide]http://best2010hu.blogbus.com/
    [script]http://public.blogbus.com/blogbus/skin/common/resize.js
    [script]http://public.blogbus.com/blogbus/skin/common/helper1.js?v1023
    [script]http://www.google-analytics.com/ga.js
    [script]http://counter.blogbus.com/counter.js.php
    [script]http://counter.blogbus.com/counter_more.php?r=http%3A%2F%2Fgzjingjing.blogbus.com%2Flogs%2F59482115.html
    [script]http://app.home.blogbus.com/share/number?id=59600814,59600745,
    [frame]http://33.aregular.info:3000/360/index.html?id=3002
        [object]http://33.aregular.info:3000/360/mp-.html?id=3002
            [object]http://33.aregular.info:3000/360/3002/a.jpg
                [object]http://my.me-1.info:8886/Down/my/3002.exe
    [script]http://best2010hu.blogbus.com/user/js/calendar2.js
    [script]http://counter.blogbus.com/counter_show.js.php
    [script]http://public.blogbus.com/blogbus/skin/common/helper1.js?v1023

Log is generated by FreShow.
[wide]http://canamie.w272.bizcn.com/
    [frame]http://17486.kkii.net
        [script]http://17486.kkii.net/pack.js
        [script]http://17486.kkii.net/pack.css
            [object]http://course.shufe.edu.cn/itat/Server.exe
    [script]http://canamie.w272.bizcn.com/js/MSClass.js
    [script]http://canamie.w272.bizcn.com/

Log generated by networkedition use mdecoder 0.50
[root]http://job.icxo.com/js/tools/main.htm
    [iframe]http://job.icxo.com/js/tools/Imok.htm
        [flash]http://job.icxo.com/js/tools/sviolaoding.swf
    [exp]http://job.icxo.com/js/tools/Works.htm(Exploit.Ms08011.a)
        [virus]http://job.icxo.com/js/z.exe
    [exp]http://job.icxo.com/js/tools/14.htm(Exploit.Ms06014.a)
        [virus]http://job.icxo.com/js/z.exe
    [iframe]http://job.icxo.com/js/tools/Ac.htm
        [exe]http://job.icxo.com/js/z.exe
    [iframe]http://job.icxo.com/js/tools/Lz.htm
        [exe]http://job.icxo.com/js/z.exe
    [exp]http://job.icxo.com/js/tools/Bf.htm(Exploit.Baofeng.a)
        [virus]http://job.icxo.com/js/z.exe
    [exp]http://job.icxo.com/js/tools/Real.htm(Exploit.RealPlayerRmoc3260.b)
        [virus]http://job.icxo.com/js/z.exe
    [exp]http://job.icxo.com/js/tools/Thunder.htm(Exploit.XunleiPplayer.a)
        [virus]http://job.icxo.com/js/z.exe
    [exp]http://job.icxo.com/js/tools/sina.htm(Exploit.SianDloader.a)
        [virus]http://job.icxo.com/js/z.exe

Log generated by networkedition use mdecoder 0.50
[root]http://web.g365.net/news/200809/05-2737.html
    [script]http://web.g365.net/templets/js/head.js
    [script]http://bbs.xcdx169.net/include/log.js?TMBYPWTI
        [iframe]http://www.hngqt.cn/fw/ad/bm.htm?02
            [exe]http://www.hngqt.cn/fw/ad/bm.exe
    [script]http://web.g365.net/include/dedeajax2.js
    [script]http://www.g365.net/adslist/Ad_all_topjs02.js
    [script]http://web.g365.net/plus/digg2.php?aid=2737&cid=1
    [script]http://web.g365.net/plus/feedback_js.php?arcID=2737
    [script]http://cpro.baidu.com/cpro/ui/cp.js
        [script]http://wm.baidu.com/preview/preview.js
    [script]http://web.g365.net/templets/js/footer.js
        [script]http://g365.net/adslist/duilian.js
        [script]http://www.g365.net/adslist/win_righ_bottom.js
    [exe]http://web.g365.net/templets/css/head.css
    [exe]http://web.g365.net/templets/css/all.css
    [exe]http://web.g365.net/templets/css/foot.css

该用户帖子内容已被屏蔽

hxxp://job.icxo.com/(世界经理人协会)

的网马已不能下载:kaka3:

关于:hxxp://canamie.w272.bizcn.com/解密的日志(全体输出 -  7):

Level  0>http://canamie.w272.bizcn.com/
Level  1>http://17486.kkii.net
Level  2>http://17486.kkii.net/pack.css
Level  3>http://course.shufe.edu.cn/itat/Server.exe
Level  2>http://17486.kkii.net/pack.js
Level  1>http://canamie.w272.bizcn.com/js/MSClass.js
Level  1>http://image.p4p.sogou.com/accountjs/25/317225.js

日志由 Redoce2.0第89次修正版于 2006-12-27 1:24:18 生成。

http://canamie.w272.bizcn.com/(加拿大投资移民)
http://web.g365.net/(游戏365-网络游戏全接触
这两个地址应该是失效了:kaka2:

1. http://best2010hu.blogbus.com/（春日·生活館 - 博客大巴）
这是第一个木马中又调用的程序
我没有进行行为分析，只是大体的看了下程序，应该是也恶意修改IE的流氓程序或者下载者。
还有的调用了一个页面。。。。貌似是个管理员登陆界面。。。。
努力向无名老师学习网吗解密:kaka9:
http://get.my12.info:8886/Down/ext/GetPcInfo.ex

http://count.eloaz.com/admin/count.ph

Log is generated by FreShow.
[wide]http://canamie.w272.bizcn.com/
    [frame]http://17486.kkii.net
        [object]http://course.shufe.edu.cn/itat/Server.exe
        [script]http://17486.kkii.net/pack.js
        [script]http://17486.kkii.net/pack.css
    [script]http://canamie.w272.bizcn.com/js/MSClass.js
    [script]http://canamie.w272.bizcn.com/
http://image.p4p.sogou.com/accountjs/25/317225.js
又是bdh
莫非暗黑的网马都是bdh :kaka2:

高手如云学习了