12
返回列表 发新帖
楼主: kingmuro
收起左侧

[病毒样本] 中华网被挂马!

[复制链接]
fzz8848
头像被屏蔽
发表于 2008-10-26 16:30:10 | 显示全部楼层
原帖由 tanlimo 于 2008-10-26 15:30 发表
新闻中心某个页面被挂

385238

http://www.oopo1.cn/1.exe

。。。。。。。。

http://www.oopo1.cn/11.exe

打包了,11个

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
kingmuro
头像被屏蔽
 楼主| 发表于 2008-10-26 16:30:57 | 显示全部楼层
原帖由 wajika 于 2008-10-26 15:47 发表



需要打开浏览器的javascript设置才能正常浏览页面,或者直接
点击进入中华网中文版



你这个链接无非就是定向到了中华网的一个虚拟目录,但我并不是打不开中华网,我能打开。只是由于脚本加密,无法定位疑似病毒的这个脚本引用的链接在哪里。我的DNS解析是没有问题的。
我不想用Sniffer,因为一个中华网调用了太多的页面和图片、动画,杂乱的信息简直干扰我的判断。我不想为了一个链接,去分析几百个链接。
mofunzone
发表于 2008-10-26 16:40:23 | 显示全部楼层

回复 11楼 fzz8848 的帖子

miss 1
to vlab

Starting the file scan:

Begin scan in 'C:\Users\morgan\Desktop\11ge'
C:\Users\morgan\Desktop\11ge\
  1.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  10.exe
  11.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  2.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  3.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  4.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  5.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  6.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  7.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  8.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!
  9.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      The file was deleted!


End of the scan: 2008年10月26日  01:39
Used time: 00:06 Minute(s)

The scan has been done completely.

      1 Scanning directories
     11 Files were scanned
     10 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     10 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      1 Files not concerned
      0 Archives were scanned
      0 Warnings
     10 Notes
mofunzone
发表于 2008-10-26 16:41:24 | 显示全部楼层
File ID          Filename          Size (Byte)         Result
2224359          10.exe          112 KB          CLEAN
卩灬枫林晚
发表于 2008-10-26 16:46:37 | 显示全部楼层
-.-  这加密方式也太简单了吧
qigang
发表于 2008-10-26 19:18:09 | 显示全部楼层
Log is generated by FreShow.
[wide]http://www.china.com/zh_cn/
    [script]http://www.china.com/zh_cn/js0801/function.js
        [script]http://ipq.news.china.com/cgi-bin/adpi
        [script]http://ipq.news.china.com/cgi-bin/adpi
    [script]http://dvsend.china.com/js/chinaadclient.js
        [script]http://dvsend.china.com/js/
    [script]http://news.china.com/zh_cn/googlerebang3.js
    [script]http://news.china.com/zh_cn/googlerebang4.js
    [script]http://news.china.com/zh_cn/googlerebang5.js
    [script]http://news.china.com/zh_cn/googlerebang6.js
    [script]http://news.china.com/zh_cn/googlerebang7.js
    [frame]http://www.jiatx.com/html/chinajiatx/7.htm
    [frame]http://www.jiatx.com/html/chinajiatx/3.htm
    [frame]http://www.jiatx.com/html/chinajiatx/8.htm
    [frame]http://china.caixun.com/static/cooperation/china_indexnews.htm
        [script]http://china.caixun.com/js/wzlink.js
        [script]http://china.caixun.com/js/ywlink.js
    [frame]http://china.caixun.com/cooperation/china_index.htm
        [script]http://china.caixun.com/cooperation/" + gaJsHost + "google-analytics.com/ga.js
    [frame]http://www.soufun.com/Album/other/sfgundong_hz_china.aspx?url=/txt/album/html/hz_080619.html
    [script]http://www.china.com/zh_cn/js0801/fortune/cyjs.js
    [script]http://www.china.com/zh_cn/js0801/fortune/ccc.js
    [script]http://c.wrating.com/a1.js
    [script]http://dvs.china.com/channel/homepage/homepage.js
        [script]http://c.china.com/page/page.js?CH_SY_SY
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-7-18 11:05 , Processed in 0.094268 second(s), 14 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表