瑞星网站每日安全播报(2010年8月2日) bbs.ikaka.com

networkedition - 2010-8-2 13:14:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://hy.tsinghua.edu.cn/(清华大学航天航空学院)
2. http://mpa.hit.edu.cn/(哈尔滨工业大学MPA教育中心 )
3. http://www.dragontv.cn/(东方卫视)
4. http://www.yangtse.com/(扬子晚报网-生活经验分享媒体)

用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

networkedition - 2010-8-2 13:14:00

Log generated by networkedition use mdecoder 0.54
[root]http://hy.tsinghua.edu.cn/(==清华大学航天航空学院==)
[flash]http://hy.tsinghua.edu.cn/images/Movie1.swf
[iframe]http://www.lblp.com.cn/admin/webedit/SysImage/bg/18.htm
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/cf.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ok.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/cfox.htm
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/snow.htm
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/xi.htm
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/swfobject.js
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/cfl.htm
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/xf.htm
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/swfobject.js
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/cfl.htm
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ff.html
[flash]http://www.lblp.com.cn/admin/webedit/dialog/about/music.swf
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/ff.js
[exe]http://laso.3322.org/y.exe
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ie.html
[flash]http://www.lblp.com.cn/admin/webedit/dialog/about/music.swf
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/ie.js
[exe]http://laso.3322.org/y.exe
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ff.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ie.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ie.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/ff.html
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/xi.htm
[exp]http://www.lblp.com.cn/admin/webedit/dialog/about/n6.htm(Exploit.Ie0dayCVE0806.c)
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/x.jpg
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/a.jpg
[virus]http://laso.3322.org/y.exe
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/b.jpg
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/c.jpg
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/d.jpg
[exp]http://www.lblp.com.cn/admin/webedit/dialog/about/n7.htm(Exploit.Ie0dayCVE0806.a)
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/AHHS.js
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/AHHS2.js
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/AHHS3.js
[virus]http://laso.3322.org/y.exe
[iframe]http://www.lblp.com.cn/admin/webedit/dialog/about/cfox2.htm
[exp]http://www.lblp.com.cn/admin/webedit/dialog/about/of.htm(Exploit.OfficeSpreadsheet.a)
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/n90.jpg
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/n93.jpg
[virus]http://laso.3322.org/y.exe
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/n95.jpg
[script]http://www.lblp.com.cn/admin/webedit/dialog/about/n97.jpg

networkedition - 2010-8-2 13:15:00

Log is generated by FreShow.
[wide]http://mpa.hit.edu.cn/aux.show.asp?dy=210061598
[script]http://cache.soso.com/wenwen/js/w_base_201007201119.js
[script]http://cache.soso.com/wenwen/js/question_201007130947.js
[script]http://wenwen.soso.com/js/form/Form.js
[script]http://wenwen.soso.com/js/form/RegExValidator.js
[script]http://cache.soso.com/wenwen/js/editor_201007261612.js
[script]http://cache.soso.com/wenwen/js/formnew_200910131204.js
[script]http://cache.soso.com/js/s_base.js
[script]http://cache.soso.com/js/an.js
[script]http://cache.soso.com/wenwen/js/wa_16.js
[object]http://p1.UJDE90ONLINE.INFO/2.htm
[object]http://p1.ujde90s.info/xx1.exe
[script]http://cache.soso.com/wenwen/js/tcss.js
[script]http://mpa.hit.edu.cn/
[script]http://cache.soso.com/wenwen/js/w_base_201007201119.js
[script]http://cache.soso.com/wenwen/js/question_201007130947.js
[script]http://wenwen.soso.com/js/form/Form.js
[script]http://wenwen.soso.com/js/form/RegExValidator.js
[script]http://cache.soso.com/wenwen/js/editor_201007261612.js
[script]http://cache.soso.com/wenwen/js/formnew_200910131204.js
[script]http://cache.soso.com/js/s_base.js
[script]http://cache.soso.com/js/an.js
[script]http://cache.soso.com/wenwen/js/wa_16.js
[script]http://cache.soso.com/wenwen/js/tcss.js
[script]http://mpa.hit.edu.cn/
[script]http://cache.soso.com/wenwen/js/w_base_201007201119.js
[script]http://cache.soso.com/wenwen/js/question_201007130947.js
[script]http://wenwen.soso.com/js/form/Form.js
[script]http://wenwen.soso.com/js/form/RegExValidator.js
[script]http://cache.soso.com/wenwen/js/editor_201007261612.js
[script]http://cache.soso.com/wenwen/js/formnew_200910131204.js
[script]http://cache.soso.com/js/s_base.js
[script]http://cache.soso.com/js/an.js
[script]http://cache.soso.com/wenwen/js/wa_16.js
[script]http://cache.soso.com/wenwen/js/tcss.js
[script]http://mpa.hit.edu.cn/
[script]http://mpa.hit.edu.cn/
[script]http://mpa.hit.edu.cn/
[script]http://js.users.51.la/3902985.js
[script]http://js.users.51.la/3902985.js
[frame]http://www.jjeffyfc19.info/wm/xyq/index.htm
[frame]http://mpa.hit.edu.cn/

networkedition - 2010-8-2 13:15:00

Log generated by networkedition use mdecoder 0.54
[root]http://www.dragontv.cn/data/tlbb/tl201019174707.html
[flash]http://player.youku.com/player.php/sid/XMTQ5MDI4NDY4=/v.swf

[script]http://js.users.51.la/3794335.js
[script]http://a5.lvguihua.com:8081/user/inc/tl/css.png
[exp]http://a2.lvguihua.com:8081/user/inc/tl/ie.html?轻(Exploit.Ie0dayCVE0806.a)
[virus]http://121.12.170.183:8081/user/inc/tl.exe

networkedition - 2010-8-2 13:15:00

Log generated by networkedition use mdecoder 0.54
[root]http://www.yangtse.com/baby/vote/css/dt1007142363.html
[flash]http://player.youku.com/player.php/sid/XMTcxODA2Mzk2=/v.swf

[script]http://js.users.51.la/3785318.js
[script]http://a4.lvguihua.com:8081/user/inc/dt/css.png
[exp]http://a6.lvguihua.com:8081/user/inc/dt/ie.html?哈韩(Exploit.Ie0dayCVE0806.a)
[virus]http://a5.lvguihua.com:8081/user/inc/dt.exe

jks_风 - 2010-8-2 19:56:00

老师，这个貌似和前两天的那个。。手动替换了域名信息，不知道为啥FreShow为啥解释不出来他的域名
Log is generated by FreShow.
[wide]http://hy.tsinghua.edu.cn/
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/SysImage/bg/18.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/SysImage/bg/18.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/cf.html
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/ok.html
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/cfox.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/snow.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/xi.htm
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/swfobject.js
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/cfl.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/\"
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/xf.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/xi.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n6.htm
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/x.jpg
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/a.jpg
[object]http://laso.3322.org/y.exe
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/b.jpg
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/c.jpg
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/d.jpg
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n7.htm
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/AHHS.js
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/AHHS2.js
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/AHHS3.js
[object]http://laso.3322.org/y.exe
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/cfox2.htm
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/of.htm
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n90.jpg
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n93.jpg
[object]http://laso.3322.org/y.exe
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n95.jpg
[script]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/n97.jpg
[frame]http://http://hy.tsinghua.edu.cn//admin/webedit/dialog/about/cf.html

小傻大呆 - 2010-8-2 20:44:00

http://www.yangtse.com/baby/vote/css/dt1007142363.html
老师，这个是只能用神奇来进行解码吗？
我用FRESHOW出来时Log is generated by FreShow.
[wide]http://www.yangtse.com/baby/vote/css/dt1007142363.html
[ani]http://www.800n.cn/images/dt2img/jj2.jpg
[script]http://js.users.51.la/3785318.js
[script]http://a4.lvguihua.com:8081/user/inc/dt/css.png

ANI这个类型不明白是什么..看您解密出来的写的是FLASH，意思是这个是一个在动画里面的木马吗？

jks_风 - 2010-8-3 17:15:00

第二个暂时不会解密，晚上再解密

jks_风 - 2010-8-3 17:17:00

Log is generated by FreShow.
[wide]http://www.dragontv.cn/data/tlbb/tl201019174707.html
[script]http://www.dragontv.cn/data/tlbb/
[ani]http://www.13vv.com/game/images/tlbb_01.gif
[script]http://js.users.51.la/3794335.js
[script]http://a5.lvguihua.com:8081/user/inc/tl/css.png
[frame]http://a2.lvguihua.com:8081/user/inc/tl/ie.html?轻
[object]http://121.12.170.183:8081/user/inc/tl.exe

jks_风 - 2010-8-3 17:17:00

最后一个同上但是已经失效。

瑞星卡卡安全论坛