networkedition - 2010-6-11 15:08:00
网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。
注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。
1. http://book.xhsd.net/(玄幻书殿)
2. http://dxal.gov.cn/(西西外挂网)
3. http://ncrc.gov.cn/(南充人才网)
4. http://wuhumsa.gov.cn/(wow英雄榜排名)
5. http://www.sxhs.gov.cn/(横山新闻网 )
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
networkedition - 2010-6-11 15:08:00
Log is generated by FreShow.
[wide]http://book.xhsd.net/new/html/0/3530/14.htm
[script]http://book.xhsd.net/new/html/0/3530/page.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/mono.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/base.js
[script]http://book.xhsd.net/new/html/0/3530/../../../ads/ad1.js
[frame]http://www.xhsd.net/js/gg300.html
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
[frame]http://www.xhsd.net/baidu/baidusou.htm
[script]http://a.alimama.cn/inf.js
[script]http://new.netgy.com/cpm/turn?s=10099
[script]http://new.netgy.com:80/cpm/turn?s=10099&cpmMode='+cpmMode+'&cookie='+getNetgyCookie('netgyCookieName_turn')+'
[script]http://www230.clickeye.cn/common/clickeye.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/top.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/../../../js/html/top1.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/../../../js/html/top2.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/../../../js/html/top3.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/../../../js/html/top4.js
[script]http://book.xhsd.net/new/html/0/3530/../../../ads/ad2.js
[script]http://u.9wee.com/adcode?id=100451
[frame]http://s.114.com.cn/us.php?userid=12638&width=760&height=60&ismargin=1&website_id=1188&ad_type=0&pay_mode=1&position=0&class=s76060&bg=&link=&border=&
[script]http://s.114.com.cn/./stat/114union_stat.php?class=s76060&userid=12638&website_id=1188&pay_mode=1&ad_type=1&ad_id=13840,13748,13164,13329,13361,13481,13536,13550,13566,13568,13577,13792,13822,13830,13844,13870,13875,13879,13932,13950
[script]http://book.xhsd.net/new/html/0/3530/../../../ads/ad3.js
[frame]http://www.xhsd.net/js/gogo.html
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js
[frame]http://soso1.9966.org:300/11index.htm
[frame]http://book.xaonline.com/js/gogo.html
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/bottom.js
[script]http://book.xhsd.net/new/html/0/3530/../../../ads/ad4.js
[script]http://book.xhsd.net/new/html/0/3530/../../../js/html/foot.js
networkedition - 2010-6-11 15:08:00
Log is generated by FreShow.
[wide]http://dxal.gov.cn/jsxs/news/css./New/2479.html
[script]http://ad.2112111.com/web/mhxy/mhxy.js
[frame]http://222.122.157.173/TelJobFiles/CompanyFiles/2007/game/mhxy/IE.htm
[object]http://222.122.157.173/Erwin/web/mhxy/mhxy.exe
[frame]http://222.122.157.173/TelJobFiles/CompanyFiles/2007/game/mhxy/IE2.htm
[frame]http://222.122.157.173/TelJobFiles/CompanyFiles/2007/game/mhxy/MM.htm
[frame]http://ad.2112111.com/web/mhxy/\"http:\/\/ad.2112111.com\/web\/mhxy\/index.htm\"
[script]http://ad.2112111.com/ad/tc.js
[script]http://count31.51yes.com/click.aspx?id=317732936&logo=12
networkedition - 2010-6-11 15:09:00
Log is generated by FreShow.
[wide]http://ncrc.gov.cn/plus/wow/12868.html
[script]http://bbs.lovewowlist.com/wow.js?test魔兽
[frame]http://3602.lovewowlist.com/anhei/web.html
[frame]http://3602.lovewowlist.com/anhei/love.html
[frame]http://3602.lovewowlist.com/anhei/ah14.htm
[frame]http://3602.lovewowlist.com/anhei/nop.htm
[frame]http://3602.lovewowlist.com/anhei/ah90.htm
[frame]http://3602.lovewowlist.com/anhei/webs.htm
[frame]http://3602.lovewowlist.com/anhei/ahf.htm
[frame]http://3602.lovewowlist.com/anhei/i1.htm
[frame]http://3602.lovewowlist.com/anhei/f2.htm
[frame]http://3602.lovewowlist.com/anhei/i1.htm
[frame]http://3602.lovewowlist.com/anhei/of.htm
[frame]http://3602.lovewowlist.com/cf/cf.html
[frame]http://3602.lovewowlist.com/cf/ok.html
[frame]http://3602.lovewowlist.com/cf/CFox.htm
[frame]http://3602.lovewowlist.com/cf/foxf
[frame]http://3602.lovewowlist.com/cf/18.htm
[frame]http://3602.lovewowlist.com/cf/19.htm
[frame]http://www.zglwfb.com/asd/1.html
[object]http://www.lovewowlist.com/qwer.exe
[frame]http://3602.lovewowlist.com/mm/mm.htm
[object]http://www.lovewowlist.com/qwer.exe
[frame]http://3602.lovewowlist.com/ie/test.html
[frame]http://www.zglwfb.com/asd/1.html
[object]http://www.lovewowlist.com/qwer.exe
[script]http://js.users.51.la/3873928.js
networkedition - 2010-6-11 15:09:00
Log is generated by FreShow.
[wide]http://wuhumsa.gov.cn/
[frame]http://www.jiandanq.com/data/index.html
[object]http://www.jiandanq.com/data/help.exe
[script]http://js.users.51.la/3785044.js
networkedition - 2010-6-11 15:09:00
Log is generated by FreShow.
[wide]http://www.sxhs.gov.cn/html/2010/y./939.html
[script]http://js.users.51.la/2671797.js
[frame]http://121.10.104.232:81/ss/index.html
[script]http://js.users.51.la/2671797.js
踏月而来 - 2010-6-18 10:05:00
gaga
南方俄大幅度 - 2010-6-19 9:27:00
http://ncrc.gov.cn/(南充人才网)
Log is generated by FreShow.
[wide]http://ncrc.gov.cn/plus/wow/12868.html
[script]http://bbs.lovewowlist.com/wow.js?test魔兽
[frame]http://3602.lovewowlist.com/anhei/web.html
[frame]http://3602.lovewowlist.com/anhei/love.html
[frame]http://3602.lovewowlist.com/anhei/ah14.htm
[frame]http://3602.lovewowlist.com/anhei/nop.htm
[frame]http://3602.lovewowlist.com/anhei/ah90.htm
[frame]http://3602.lovewowlist.com/anhei/webs.htm
[frame]http://3602.lovewowlist.com/anhei/ahf.htm
[frame]http://3602.lovewowlist.com/anhei/i1.htm
[frame]http://3602.lovewowlist.com/anhei/f2.htm
[frame]http://3602.lovewowlist.com/anhei/i1.htm
[frame]http://3602.lovewowlist.com/anhei/of.htm
[frame]http://3602.lovewowlist.com/cf/cf.html
[frame]http://3602.lovewowlist.com/cf/ok.html
[frame]http://3602.lovewowlist.com/cf/CFox.htm
[frame]http://3602.lovewowlist.com/cf/foxf
[frame]http://3602.lovewowlist.com/cf/18.htm
[frame]http://3602.lovewowlist.com/cf/19.htm
[frame]http://www.zglwfb.com/asd/1.html
[object]http://www.lovewowlist.com/qwer.exe
[frame]http://3602.lovewowlist.com/mm/mm.htm
[object]http://www.lovewowlist.com/qwer.exe
[frame]http://3602.lovewowlist.com/ie/test.html
[frame]http://www.zglwfb.com/asd/1.html
[object]http://www.lovewowlist.com/qwer.exe
[script]http://js.users.51.la/3873928.js
网马解密系列教程——2010年3月31号更新(9周年活动，第二关网马解密方法详解（一）)
网马解密系列视频——6.24号更新(网马解密工具SWFDecompiler视频之——swf篇)
|
|
| |
|
XX依然XX - 2010-6-19 9:44:00
总是不知不觉的被挂了马~·呵呵 按了瑞星 也不怎么样啊 ，，瑞星没有木马查杀的系统吗？？
yishuad - 2010-6-19 16:10:00
原帖由 networkedition 于 2010-6-11 15:09:00 发表
Log is generated by FreShow.
[wide]http://wuhumsa.gov.cn/
[frame]http://www.jiandanq.com/data/index.html
[object]http://www.jiandanq.com/data/help.exe
[script]......
Log generated by anonymous use mdecoder 0.53
[root]http://wuhumsa.gov.cn/(wow英雄榜排名 wow英雄榜匹配度)
[iframe]http://www.jiandanq.com/data/index.html
[iframe]http://baidutest.9966.org/1.html
[script]http://www.gakm.net/images/help.js
[exp]http://www.gakm.net/images/2.html(Exploit.Ie0dayCVE0806.a) [virus]http://www.gakm.net/imgg/w.exe [script]http://js.users.51.la/3885913.js
[script]http://js.users.51.la/3889268.js
[script]http://js.users.51.la/3885281.js
[script]http://js.users.51.la/3785044.js
游荡心坟 - 2010-6-20 16:11:00
木马原来是这个样啊……
© 2000 - 2024 Rising Corp. Ltd.