瑞星网站每日安全播报(2010年4月13日) bbs.ikaka.com

networkedition - 2010-4-13 14:28:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://cool.woku.com/（专题首页 - 专题-我酷网Woku.com）
2. http://cx.yn.vnet.cn/(楚雄信息港楚雄电信)
3. http://group.lovetown.com/(居家过日子 - 恋爱小镇)
4. http://image.i18.cn/(中华零售网商业图库频道)
5. http://news.jinti.com/(资讯首页_今题网)

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

networkedition - 2010-4-13 14:29:00

Log is generated by FreShow.
[wide]http://cool.woku.com/temp/images/?wow/=/2t/59071.html
[object]http://www.aliqq.com.cn/Stuff/style/404_page_style.css
[object]http://www.baishiketong.com/job/image/wm/aliqq.html
[object]http://www.xin21.com/xuyuan/images/main/wow.jpg?垰
[frame]http://www.baishiketong.com/job/image/wm/mm.html
[object]http://www.baishiketong.com/job/image/wm/mm.exe
[script]http://s40.cnzz.com/stat.php?id=559618&web_id=559618&show=pic1
[script]http://count37.51yes.com/click.aspx?id=373042133&logo=6

networkedition - 2010-4-13 14:29:00

Log is generated by FreShow.
[wide]http://cx.yn.vnet.cn/
[script]http://cx.yn.vnet.cn/../NetPolice-Left.js
[script]http://cx.yn.vnet.cn/../NetPolice-Right.js
[script]http://2shou.cxinfo.cn/one/JS/yzsxl.js
[frame]http://news.yninfo.com/dzty/dzdy1/index.htm
[frame]http://61.166.43.5:88/pre/xsl/281/0/72057594037927936/index.html
[script]http://114.vnet.cn/show.html?UID=401&bt=s
[frame]http://www.cxinfo.cn/gb/hdtp1.htm
[frame]http://%77%77%77%2E%73%65%64%69%61%6E%79%69%6E%67%2E%63%6F%6D%2E%63%6E/%63%6F%75%6E%74%2E%68%74%6D%6C
[frame]http://life.cxinfo.cn/life_dy1.asp
[script]http://2shou.cxinfo.cn/one/JS/20080706.js
[frame]http://www.cxinfo.cn/jiaotong/chaxun_dy1.htm
[frame]http://cx.yn.vnet.cn/diaoyong/Option1.htm
[frame]http://cx.yn.vnet.cn/diaoyong/Option2.htm
[frame]http://soft.cxinfo.cn/ftdms/new_dy.htm
[script]http://10000.cxinfo.cn/js/new_dy.js
[script]http://2shou.cxinfo.cn/one/JS/hmbst2.js
[frame]http://www.cxinfo.cn/jccx1.asp
[frame]http://life.cxinfo.cn/classad_l.asp
[script]http://www.cxinfo.cn/cxcount/count.asp
[script]http://%71.%74%67%32%350.com%2E%63%6E
[frame]http://asd1233.3322.org:97/xo/dk.html
[script]http://js.tongji.linezing.com/1566155/tongji.js
[frame]http://asd1233.3322.org:97/xo/0.htm
[frame]http://asd1233.3322.org:97/xo/../0.htm
[object]http://kjy6fj.3322.org:28/www.baidu.com
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://q.%74%67%325%30.%63o%6D.%63%6E
[script]http://%76.j%73%67%75ang%6Ai%2Ec%6E
[script]http://v.ta%6F%67%75.or%67%2E%63n
[script]http://v%2Et%6725%30.c%6F%6D%2Ecn

networkedition - 2010-4-13 14:30:00

Log is generated by FreShow.
[wide]http://group.lovetown.com/
[script]http://%71%2Eu%73t%6F%63n.%63o%6D.cn:%395
[script]http://%76%2E%6A%73%67ua%6E%67%6Ai.cn
[frame]http://asd1233.3322.org:97/xo/dk.html
[script]http://js.tongji.linezing.com/1566155/tongji.js
[frame]http://asd1233.3322.org:97/xo/0.htm
[frame]http://asd1233.3322.org:97/xo/../0.htm
[object]http://kjy6fj.3322.org:28/www.baidu.com
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://v.tg%32%35%30%2E%63%6F%6D%2E%63n
[script]http://marry.lovetown.com/templates/main/default/js/flashobj.js
[script]http://marry.lovetown.com/templates/main/default/newimg/s.js
[script]http://group.lovetown.com/source/script_ajax.js
[script]http://group.lovetown.com/source/script_menu.js
[script]http://group.lovetown.com/source/script_common.js
[script]http://group.lovetown.com/source/script_face.js
[script]http://group.lovetown.com/source/script_cookie.js
[script]http://group.lovetown.com/template/default/js/s.js
[script]http://count21.51yes.com/click.aspx?id=212902936&logo=6
[script]http://group.lovetown.com/source/script_manage.js
[script]http://group.lovetown.com/do.php?ac=sendmail&rand=1271139519

networkedition - 2010-4-13 14:31:00

Log is generated by FreShow.
[wide]http://image.i18.cn/html/bianli/shpcl/index.htm
[script]http://%77%2E%6A%73%67%75%61%6E%67%6A%69%2E%63%6E
[frame]http://asd1233.3322.org:97/xo/dk.html
[script]http://js.tongji.linezing.com/1566155/tongji.js
[frame]http://asd1233.3322.org:97/xo/0.htm
[frame]http://asd1233.3322.org:97/xo/../0.htm
[object]http://kjy6fj.3322.org:28/www.baidu.com
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://asd1233.3322.org:97/xo/\"http://js.tongji.linezing.com/1549551/tongji.js\"

networkedition - 2010-4-13 14:31:00

Log is generated by FreShow.
[wide]http://news.jinti.com/news/html/20070616/html.aspx?1409.html
[script]http://ns.ipp.com.ru/down/downwow/ads01.js
[frame]http://ns.ipp.com.ru/ms/mm.htm
[object]http://ns.ipp.com.ru/ms/12345.exe
[script]http://js.users.51.la/2682008.js
[frame]http://news.jinti.com/news/Images/Navi.gif?typeid=15
[script]http://news.jinti.com/news/Js/share.js
[frame]http://news.jinti.com/news/Images/webr.gif
[script]http://js.users.51.la/2721820.js

辛达星郁 - 2010-4-14 17:42:00

关于:hxxp://cool.woku.com/temp/images/?wow/=/2t/59071.html解密的日志(全体输出 - 8):

Level 0>hxxp://cool.woku.com/temp/images/?wow/=/2t/59071.html
Level 1>hxxp://www.aliqq.com.cn/Stuff/style/404_page_style.css
Level 2>hxxp://www.baishiketong.com/job/image/wm/aliqq.html
Level 3>hxxp://www.xin21.com/xuyuan/images/main/wow.jpg
Level 4>hxxp://www.baishiketong.com/job/image/wm/mm.html
Level 5>hxxp://www.baishiketong.com/job/image/wm/mm.exe
Level 1>hxxp://www.aliqq.cn/skin/img/logo.gif
Level 1>hxxp://www.aliqq.cn/sitemap.html

日志由 Redoce2.0第91次修正版于 2010-4-14 17:39:50 生成。

瑞星卡卡安全论坛