瑞星网站每日安全播报(2012年1月11日) bbs.ikaka.com

networkedition - 2012-1-11 14:41:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://7xuxing.com/(锦捷网上商城)
2. http://www.999ttt.com/(轻音乐网)
3. http://bbs.178.com/(178游戏论坛)
4. http://www.gdcp.cn/(广东交通职业技术学院)
5. http://www.jm1ph.com/(荆门市第一人民医院)

用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; QQDownload 691; .NET CLR 2.0.50727)

networkedition - 2012-1-11 14:41:00

Log generated by networkedition use mdecoder 0.67
[root]http://7xuxing.com/edit/h.html
[exp]http://7xuxing.com/edit/jf.htm(Exploit.Ie0dayCVE0806.a)
[script]http://7xuxing.com/edit/jf.gif
[virus]http://7xuxing.com/edit/schost.exe
[iframe]http://7xuxing.com/edit/flash.html.htm
[exp]http://7xuxing.com/edit/of.htm(Exploit.OfficeSpreadsheet.a)
[script]http://7xuxing.com/edit/ubbi.jpg
[script]http://7xuxing.com/edit/qcc.jpg
[virus]http://7xuxing.com/edit/schost.exe

networkedition - 2012-1-11 14:41:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.999ttt.com/
[script]http://static.130v.com:81/skin/skin_01/function.js
[script]http://static.130v.com:81/skin/skin_01/ajax.js
[script]http://code.woiring.com/mmscode/bigbanner/06181723524292831289.js?id=06181723524292831289
[script]http://static.130v.com:81/js/gb_big5.js
[script]http://js.a3p4.com/i.js
[script]http://js.a3p4.com/+s(sr)+
[iframe]http://js.a3p4.com/+s(sr)+
[script]http://js.a3p4.com/i.js
[iframe]http://7xuxing.com/edit/h.html
[exp]http://7xuxing.com/edit/jf.htm(Exploit.Ie0dayCVE0806.a)
[script]http://7xuxing.com/edit/jf.gif
[iframe]http://7xuxing.com/edit/flash.html.htm
[exp]http://7xuxing.com/edit/of.htm(Exploit.OfficeSpreadsheet.a)
[script]http://7xuxing.com/edit/ubbi.jpg
[virus]http://7xuxing.com/edit/schost.exe
[script]http://7xuxing.com/edit/qcc.jpg

networkedition - 2012-1-11 14:42:00

Log generated by networkedition use mdecoder 0.67
[root]http://bbs.178.com/viewthread.php?tid=3186570&extra=page=1&filter=type&typeid=74
[script]http://www.178.com/s/js/nav.js
[script]http://bbs.178.com/include/javascript/common.js?ver=20110817
[script]http://bbs.178.com/include/javascript/viewthread.js
[iframe]http://zt.ipark.cn/new70/images/2/logo.html
[script]http://js.users.51.la/5518806.js
[iframe]http://zt.ipark.cn/new70/images/2/1.htm
[script]http://zt.ipark.cn/new70/images/2/1.js
[iframe]http://zt.ipark.cn/new70/images/2/3.htm
[iframe]http://zt.ipark.cn/new70/images/2/2.htm
[flash]http://zt.ipark.cn/new70/images/2/nbwm.swf
[exp]http://zt.ipark.cn/new70/images/2/i6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://zt.ipark.cn/new70/images/2/i1.js
[script]http://zt.ipark.cn/new70/images/2/i2.js
[script]http://zt.ipark.cn/new70/images/2/i3.js
[script]http://zt.ipark.cn/new70/images/2/i4.js
[script]http://zt.ipark.cn/new70/images/2/i5.js
[virus]http://zt.ipark.cn/new70/images/2/woe.exe
[script]http://bbs.178.com/include/javascript/checkurl.js?VERHASH
[script]http://bbs.178.com/include/javascript/recommend.js
[script]http://market.178.com/A/33262824097.js
[script]http://interface.i.178.com/?_app=sms&_controller=index&_action=check_new&rtype=4
[script]http://www.178.com/s/js/footer.js
[script]http://www.178.com/glr.js
[script]http://interface.i.178.com/?_app=sms&_controller=index&_action=check_new&rtype=4

networkedition - 2012-1-11 14:42:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.gdcp.cn/cgsb/file/zt/i6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://www.gdcp.cn/cgsb/file/zt/i1.js
[script]http://www.gdcp.cn/cgsb/file/zt/i2.js
[script]http://www.gdcp.cn/cgsb/file/zt/i3.js
[script]http://www.gdcp.cn/cgsb/file/zt/i4.js
[script]http://www.gdcp.cn/cgsb/file/zt/i5.js
[virus]http://www.gdcp.cn/cgsb/file/zt/zt.exe

networkedition - 2012-1-11 14:42:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.jm1ph.com/
[script]http://duh.UglyAs.com/b.js?google=1x033
[script]http://gcy.ns02.us/11/nyay.htm
[exp]http://gcy.ns02.us/11/6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://gcy.ns02.us/11/ie.jpg
[script]http://gcy.ns02.us/11/iee.jpg
[virus]http://gcy.ns02.us/o/um.exe
[iframe]http://gcy.ns02.us/11/7.htm
[script]http://gcy.ns02.us/11/ie.jpg
[script]http://gcy.ns02.us/11/iee.jpg
[script]http://gcy.ns02.us/11/ieee.jpg
[script]http://dvd.UglyAs.com/b.js?google=1x111
[iframe]http://www.jm1ph.com/top.htm
[script]http://www.jm1ph.com/flash_view.js
[script]http://www.jm1ph.com/flash_view.js
[iframe]http://www.jm1ph.com/left.asp
[script]http://duh.UglyAs.com/b.js?google=1x033
[script]http://dvd.UglyAs.com/b.js?google=1x111
[iframe]http://www.jm1ph.com/mail.htm
[script]http://www.jm1ph.com/xjlmail.js
[script]http://www.jm1ph.com/loginmail.js
[iframe]http://www.jm1ph.com/vote/vote_index.asp
[script]http://duh.UglyAs.com/b.js?google=1x033
[script]http://dvd.UglyAs.com/b.js?google=1x111
[iframe]http://www.jm1ph.com/makego0.asp
[script]http://duh.UglyAs.com/b.js?google=1x033
[script]http://dvd.UglyAs.com/b.js?google=1x111
[flash]http://www.jm1ph.com/ad/bst/top.swf
[script]http://duh.UglyAs.com/b.js?google=1x033
[script]http://dvd.UglyAs.com/b.js?google=1x111

瑞星卡卡安全论坛