万客印象电子杂志[挂马][by 帅就是帅]

显示全部楼层 · 发表于 2012-4-9 11:39:33

本帖最后由疯狂的小鬼于 2012-4-9 13:40 编辑

http://www.ivook.com

Virus: JS:MalHead-ES [Trj] (Engine B)

An attempt was made to open an infected file.

File: b[1].js
Directory: C:\Users\x\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W59LAM0W

显示全部楼层 · 发表于 2012-4-9 13:38:05

关于:hxxp://www.ivook.com/解密的日志(全体输出 -  8):

Level  0>hxxp://www.ivook.com/
  Level  1>hxxp://f%65q.U%67ly%41s.c%6Fm/b.js?google=4x091
Level  2>hxxp://jjd.ns02.us/a/jday.htm
   Level  3>hxxp://jjd.ns02.us/a/7.htm
   Level  3>hxxp://jjd.ns02.us/a/medi.htm
      Level  4>hxxp://jjd.ns02.us/o/yd.exe
   Level  3>hxxp://jjd.ns02.us/a/6.htm
  Level  1>hxxp://f%64q.U%67ly%41s.c%6Fm/b.js?google=3x312

Analyzed by 叉就是叉

[已鉴定] 万客印象电子杂志[挂马][by 帅就是帅]