瑞星网站每日安全播报(2011年3月24日) bbs.ikaka.com

networkedition - 2011-3-24 15:14:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://book.sooyuu.com/（搜娱电子书）
2. http://xuan.bnu.edu.cn/（北京师范大学）
3. http://gs.njtu.edu.cn/（北京交通大学研究生院）
4. http://www.cxkx.gov.cn/（长兴农民致富网）
5. http://www.hcit.edu.cn/(欢迎访问淮安信息职业技术学院)

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6.6; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

networkedition - 2011-3-24 15:15:00

关于:hxxp://book.sooyuu.com/BookInfo/200706/200709211459213582.html解密的日志(全体输出 - 38):

Level 0>http://book.sooyuu.com/BookInfo/200706/200709211459213582.html
Level 1>http://book.sooyuu.com/HitNumber.aspx?zid=19179
Level 1>http://book.sooyuu.com/AdFiles/BKAD21.js
Level 1>http://s17.cnzz.com/stat.php?id=2708267&web_id=2708267&show=pic
Level 1>http://count7.51yes.com/click.aspx?id=79080328&logo=1
Level 1>http://count20.51yes.com/click.aspx?id=202318528&logo=1
Level 1>http://www.google-analytics.com/urchin.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa06utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa05utf8.js
Level 1>http://book.sooyuu.com/HitNumber.aspx?zid=19179
Level 1>http://book.sooyuu.com/AdFiles/BKAD21.js
Level 1>http://s17.cnzz.com/stat.php?id=2708267&web_id=2708267&show=pic
Level 1>http://count7.51yes.com/click.aspx?id=79080328&logo=1
Level 1>http://count20.51yes.com/click.aspx?id=202318528&logo=1
Level 1>http://www.google-analytics.com/urchin.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa06utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa05utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa04utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa03utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa02utf8.js
Level 1>http://www.sooyuu.com/AdFiles/TongFa01utf8.js
Level 1>http://book.sooyuu.com/AdFiles/BKAD19.js
Level 1>http://book.sooyuu.com/AdFiles/BKAD23.js
Level 1>http://book.sooyuu.com/AdFiles/BKAD20_1.js
Level 1>http://book.sooyuu.com/AdFiles/BKAD18_1.js
Level 1>http://book.sooyuu.com/AdFiles/Booktop.js
Level 2>http://www.sooyuu.com/ad/gg-ad/top-728-90.htm
Level 3>http://muniu.8866.org:10086/images/1.gif?
Level 4>http://rao123.8866.org:12593/images/tj.htm
Level 4>http://rao123.8866.org:12593/images/1.htm
Level 4>http://rao123.8866.org:12593/images/m.htm
Level 5>http://rao123.8866.org:12593/images/n.jpg
Level 5>http://rao123.8866.org:12593/images/no.jpg
Level 6>http://count.jk136.com:123/images/js/js.js
Level 5>http://rao123.8866.org:12593/images/not.jpg
Level 5>http://rao123.8866.org:12593/images/nop.jpg
Level 1>http://book.sooyuu.com/images/logo_ebook.jpg
Level 1>http://book.sooyuu.com/BookInfo/200706/ImgD.src

networkedition - 2011-3-24 15:15:00

Log generated by networkedition use mdecoder 0.67
[root]http://xuan.bnu.edu.cn/
[script]http://www.woyaocaonima.info/flink.js
[iframe]http://www.woyaocaonima.info/qq/svfox.html
[iframe]http://www.woyaocaonima.info/qq/svx.html
[iframe]http://www.woyaocaonima.info/qq/fox.htm
[exp]http://www.woyaocaonima.info/qq/of.htm(Exploit.OfficeSpreadsheet.a)
[script]http://www.woyaocaonima.info/qq/cc.jpg
[script]http://www.woyaocaonima.info/qq/ac.jpg
[script]http://www.woyaocaonima.info/qq/bc.jpg
[virus]http://www.54jjk.tk/shell.exe
[exp]http://www.woyaocaonima.info/qq/x6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://www.woyaocaonima.info/qq/x1.js
[script]http://www.woyaocaonima.info/qq/x2.js
[script]http://www.woyaocaonima.info/qq/x3.js
[script]http://www.woyaocaonima.info/qq/x4.js
[virus]http://www.54jjk.tk/shell.exe
[iframe]http://www.woyaocaonima.info/qq/silver.htm
[iframe]http://www.woyaocaonima.info/qq/svfl9.htm
[iframe]http://www.woyaocaonima.info/qq/1.htm
[script]http://www.woyaocaonima.info/qq/swfobject.js
[iframe]http://www.woyaocaonima.info/qq/svfl0.htm
[iframe]http://www.woyaocaonima.info/qq/svf0.htm
[iframe]http://www.woyaocaonima.info/qq/svf0.htm
[iframe]http://www.woyaocaonima.info/qq/2.htm
[script]http://www.woyaocaonima.info/qq/swfobject.js
[iframe]http://www.woyaocaonima.info/qq/svfl0.htm
[iframe]http://www.woyaocaonima.info/qq/ff.html
[flash]http://www.woyaocaonima.info/qq/xp.swf
[script]http://www.woyaocaonima.info/qq/ff.js
[iframe]http://www.woyaocaonima.info/qq/ie.html
[flash]http://www.woyaocaonima.info/qq/xp.swf
[script]http://www.woyaocaonima.info/qq/ie.js
[iframe]http://www.woyaocaonima.info/qq/ff.html
[iframe]http://www.woyaocaonima.info/qq/ie.html
[iframe]http://www.woyaocaonima.info/qq/ie.html
[iframe]http://www.woyaocaonima.info/qq/ff.html
[iframe]http://www.woyaocaonima.info/qq/svf0.htm
[flash]http://www.woyaocaonima.info/qq/svfox.swf
[iframe]http://www.woyaocaonima.info/qq/svf0.htm
[iframe]http://www.woyaocaonima.info/qq/1.htm
[script]http://www.woyaocaonima.info/flnk.js

networkedition - 2011-3-24 15:16:00

Log generated by networkedition use mdecoder 0.67
[root]http://gs.njtu.edu.cn/phD/Images/ie.html?1
[script]http://gs.njtu.edu.cn/phD/Images/party.css
[virus]http://gs.njtu.edu.cn/phD/Images/tt66.css
[script]http://gs.njtu.edu.cn/phD/Images/css.css
[script]http://gs.njtu.edu.cn/phD/Images/js.css
[iframe]http://dl.27wow.net:8080/IE.html

networkedition - 2011-3-24 15:16:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.cxkx.gov.cn/editor/css/best/lzg.htm
[script]http://www.cxkx.gov.cn/editor/css/best/lzg.js
[script]http://js.users.51.la/4036725.js
[exp]http://www.cxkx.gov.cn/editor/css/mm/wmdn.html(Exploit.Ie0dayCVE0806.a)
[virus]http://www.bjsjwmz.com/upload_files/dn.exe
[exp]http://www.cxkx.gov.cn/editor/css/mm/wmdn1.html(Exploit.Ie0dayCVE0806.a)
[virus]http://www.bjsjwmz.com/upload_files/lzg.exe

networkedition - 2011-3-24 15:17:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.hcit.edu.cn/hcit2009/admin/inc/jjl/2.html(by spider)
[virus]http://qq.sbwanwan.com:9999/ll.exe

瑞星卡卡安全论坛