瑞星网站每日安全播报(2010年4月23日) bbs.ikaka.com

networkedition - 2010-4-23 12:45:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://www.du8.com/（电子书小说_读吧网 du8.com）
2. http://bbs.aweb.com.cn/(中国三农论坛 - Powered by Discuz!)
3. http://edu.hinews.cn/(南海网教育频道)
4. http://hzpk.39.net/(39健康美容化妆品库_最齐全的化妆品数据库_数据库)
5. http://i.lovetown.com/(恋爱小镇)

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

networkedition - 2010-4-23 12:46:00

Log is generated by FreShow.
[wide]http://www.du8.com/books/outepzw1028/25.shtml
[script]http://www.du8.com/books/out/epzw/10/28_data.js
[object]http://www.epzw.com/files/article/html/1/1028/215392.html
[script]http://www.epzw.com/configs/article/pagetop1.js
[script]http://www.epzw.com/configs/article/pagetopttt.js
[script]http://www.epzw.com/scripts/ajax.js
[script]http://www.epzw.com/configs/article/pagebottom.js
[object]http://club.9istyle.com/wap/include/main/ads.jpg?13543
[frame]http://www.risinima.com/wq/bb.html
[object]http://www.risinima.com/wq/bbbb.css
[script]http://www.epzw.com/configs/article/pagebottom4.js
[script]http://www.du8.com/books/out/read.js
[frame]http://www.du8.com/books/out/epzw/10/28_top.shtml?page='+pg.page+'
[frame]http://www.du8.com/books/outepzw1028/'+urlarr[pg.page-1]+'

networkedition - 2010-4-23 12:47:00

Log is generated by FreShow.
[wide]http://bbs.aweb.com.cn/viewthread.php?tid=1215
[script]http://bbs.aweb.com.cn/include/js/common.js?xW5
[script]http://bbs.aweb.com.cn/include/js/viewthread.js?xW5
[script]http://61.232.154.43:8888/ga.js?google_ad=255×182_ξㄖ
[frame]http://ferrari38.2288.org:97/pc2/dk.html
[frame]http://ferrari38.2288.org:97/pc2/0.htm
[frame]http://ferrari38.2288.org:97/pc2/../0.htm
[object]http://mngh54.6600.org:58/.h
[script]http://ferrari38.2288.org:97/pc2/

\"http://js.tongji.linezing.com/1567298/tongji.js\"
[script]http://ferrari38.2288.org:97/pc2/

\"http://js.tongji.linezing.com/1488067/tongji.js\"
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://ferrari38.6600.org:97/pc2/dk.html
[frame]http://www.hmgc.com.cn/css/ad.html
[frame]http://www.hmgc.com.cn/css/ad.html
[script]http://aweb.wrating.com/a1.js
[script]http://www.aweb.com.cn/getacc.js

networkedition - 2010-4-23 12:48:00

Log is generated by FreShow.
[wide]http://edu.hinews.cn/zt/hainsfdx/all/games/dnf/100.html
[script]http://js.tudou.us/js/dnf.js?7
[frame]http://www.hngqt.cn/fw/ad/ie.html
[object]http://www.hngqt.cn/fw/ad/ie.exe
[script]http://s11.cnzz.com/stat.php?id=2090443&web_id=2090443

networkedition - 2010-4-23 12:48:00

Log is generated by FreShow.
[wide]http://hzpk.39.net/list/hz/xs/
[script]http://img.39.net/js/hzp/show_test.js
[script]http://img.39.net/js/hzp/39fun.js
[frame]http://dpvc.39.net/ADPolestar/lgs/door/;ap=686f182a-a851-4eef-8b57-

afc7c843f6c4&ct=i&pw=970&ph=90&mv=710&er=&ir=f&pu=san9?
[script]http://hzpk.39.net/include2/hotkeyword-hzp.js
[script]http://img.39.net/js/hzp/tabs.js
[script]http://img.39.net/js/hzp/search_test.js
[script]http://img.39.net/js/hzp/jquery.js
[script]http://www.w.wwvv.us/images/css/swf.swf
[frame]http://www.hao123.com.wwvv.us/images/css/jg.htm
[object]http://www.baidu.cn.wwvv.us/images/css/css.exe

[frame]http://www.hao123.com.wwvv.us/images/css/jf.htm
[frame]http://www.hao123.com.wwvv.us/images/css/mepeg.htm
[frame]http://www.hao123.com.wwvv.us/images/css/of.htm
[frame]http://www.hao123.com.wwvv.us/images/css/bf.htm
[frame]http://www.hao123.com.wwvv.us/images/css/018.htm
[frame]http://www.hao123.com.wwvv.us/images/css/tj.htm
[script]http://hzpk.39.net/list/hz/xs/pager.js
[script]http://image.39.net/js/function.js
[script]http://image.39.net/tools/djan.js

networkedition - 2010-4-23 12:49:00

Log is generated by FreShow.
[wide]http://i.lovetown.com/
[script]http://%71%2Eu%73t%6F%63n.%63o%6D.cn:%395
[script]http://%76%2E%6A%73%67ua%6E%67%6Ai.cn
[frame]http://samt1.8800.org:97/xo/dk.html
[script]http://js.tongji.linezing.com/1566155/tongji.js
[frame]http://samt1.8800.org:97/xo/0.htm
[frame]http://samt1.8800.org:97/xo/../0.htm
[object]http://mngh54.6600.org:58/.h
[script]http://samt1.8800.org:97/xo/

\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://samt1.8800.org:97/xo/

\"http://js.tongji.linezing.com/1549551/tongji.js\"
[script]http://v.tg%32%35%30%2E%63%6F%6D%2E%63n
[script]http://c.tlinee.%63o%6D.c%6E
[script]http://c%2E%75%73t%6F%63%6E%2E%63om%2Ec%6E
[script]http://%63%2Evcmar%74%2Eco%6D%2Ec%6E
[script]http://i.lovetown.com/source/script_common.js
[script]http://i.lovetown.com/source/script_menu.js
[script]http://i.lovetown.com/source/script_ajax.js
[script]http://i.lovetown.com/source/script_face.js
[script]http://i.lovetown.com/source/script_cookie.js
[script]http://i.lovetown.com/template/default/js/head-9.js
[script]http://i.lovetown.com/template/default/js/s.js
[script]http://count21.51yes.com/click.aspx?id=212902936&logo=6
[script]http://i.lovetown.com/source/script_manage.js
[script]http://i.lovetown.com/do.php?ac=sendmail&rand=1271993379

辛达星郁 - 2010-4-23 19:17:00

关于:hxxp://edu.hinews.cn/zt/hainsfdx/all/games/dnf/100.html解密的日志(全体输出 - 6):

Level 0>http://edu.hinews.cn/zt/hainsfdx/all/games/dnf/100.html
Level 1>http://js.tudou.us/js/dnf.js?7
Level 2>http://web1.51.la:82/go.asp?svid=11&id=3665943&tpages=+a5943ops+&ttimes=+a5943ot+&tzone=+
Level 2>http://www.hngqt.cn/fw/ad/ie.html
Level 3>http://www.hngqt.cn/fw/ad/ie.exe
Level 1>http://s11.cnzz.com/stat.php?id=2090443&web_id=2090443

日志由 Redoce2.0第15次修正版于 2010-4-23 19:24:17 生成。

瑞星卡卡安全论坛