江西财大成教学院

mr_zhj

http://cjxy.jxufe.cn/

费尔报木马

残缺的唯美

Malicious Web Site Blocked

You attempted to access:

​http:​//cjx​y.jxu​fe.cn​/

This is a known mailicious web site. It is recommended that you do NOT visit this site. The detailed report explains the security risks on this site.

For your protection, this web site has been blocked. Visit Symantec to learn more about phishing and internet security.

tanlimo

Log is generated by FreShow.
[wide]http://cjxy.jxufe.cn/
    [script]http://conn.lachezvos.com/click.js?bgcr=ffffff&urlcr=0000ff&tbsz=260&sropls=1
        [frame]http://www.rxgsslll.cn/yhyw/2.htm
            [frame]http://wm.sllwrnm8.cn/a10/fxx.htm
                [frame]http://wm.sllwrnm8.cn/a10/fx.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/ss.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/MS06014.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/sina.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/UU.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/Thunder.html
                [frame]http://wm.sllwrnm8.cn/a10/../a1/GLWORLD.html
                [frame]http://wm.sllwrnm8.cn/a10/../a1/real.htm
                [frame]http://wm.sllwrnm8.cn/a10/../a1/Real.html


http://down.erhaha2.cn/new/a1.css
http://down.hs7yue.cn/down/ko.css

[ 本帖最后由 tanlimo 于 2008-12-13 14:43 编辑 ]

电影结束了

http://down.erhaha2.cn/new/a1.css

残缺的唯美

Total threats found: 888

Small-whitebg-red         Drive-By Downloads (what's this?)

Threats found: 663
Here is a sample:
Threat Name:         Downloader
Signature (MD5):         8599a389d7cb7aae4ea7f9a6cd3aac09
Location:         http://stuaff.jxufe.cn/xgb/bigcl ... 6&bigclassid=71

       
Threat Name:         Downloader
Signature (MD5):         8599a389d7cb7aae4ea7f9a6cd3aac09
Location:         http://stuaff.jxufe.cn/xgb/type.asp?typeID=16

       
Threat Name:         Downloader
Signature (MD5):         8599a389d7cb7aae4ea7f9a6cd3aac09
Location:         http://stuaff.jxufe.cn/xgb/bigcl ... 4&bigclassid=20

       
Threat Name:         Processes Started
Location:         http://art.jxufe.cn/informations/selfupdata.asp

       
Threat Name:         Processes Started
Location:         http://art.jxufe.cn/news/more.as ... 0%C3%82%C3%8E%C3%85

       
Direct link to:
Location:         http://www.finance.jxufe.cn/student/Softdown.asp

       
Direct link to:
Location:         http://stuaff.jxufe.cn/

       
Direct link to:
Location:         http://art.jxufe.cn/

       
Direct link to:
Location:         http://stuaff.jxufe.cn/xgb/Index.Asp

       
Direct link to:
Location:         http://www.finance.jxufe.cn/class/03_4/index.htm

       
Small-whitebg-red         Viruses (what's this?)

Threats found: 225
Here is a sample:
Direct link to:
Location:         http://www.finance.jxufe.cn/student/index.asp

       
Direct link to:
Location:         http://www.finance.jxufe.cn/class/03_2/index.htm

       
Direct link to:
Location:         http://www.finance.jxufe.cn/class/05_2/index.htm

       
Direct link to:
Location:         http://www.finance.jxufe.cn/class/04_2/index.htm

       
Direct link to:
Location:         http://www.finance.jxufe.cn/stud ... .asp?ArticleID=1523

       
Direct link to:
Location:         http://www.finance.jxufe.cn/student/Photo_Class.asp?ClassID=2

       
Direct link to:
Location:         http://www.finance.jxufe.cn/class/bbs/

       
Direct link to:
Location:         http://www.finance.jxufe.cn/student/Index.asp

       
Direct link to:
Location:         http://finance.jxufe.cn/

       
Direct link to:
Location:         http://www.finance.jxufe.cn/english/index.html

syfwxmh

卡巴KSN阻止

该文件TO KL

syfwxmh

Hello.

This file is already detected. Please update your bases.
Trojan-Dropper.Win32.Agent.abku

>
>
> ------------------
> The Russia Kaspersky Lab Board Of the Honor Members
>
> Users ID:syfwxmh
>
Regards, Tatarinov Ivan
Virus Analyst

08红伞威点

红伞进去捉了4个出来。

打包上传 文件x4.rar (4.76 KB, 下载次数: 33)

2008-12-13 15:05 上传

点击文件名下载附件

08红伞威点

Start of the scan: 2008年12月13日  15:07

Starting the file scan:

Begin scan in 'C:\Documents and Settings\***\桌面\文件x4.rar'
C:\Documents and Settings\***\桌面\文件x4.rar
    [0] Archive type: RAR
发表帖    --> ￎￄﾼ?x4\css[1].js
      [DETECTION] Contains recognition pattern of the JS/Iframe.W.55 Java script virus
子[完成后可按    --> ￎￄﾼ?x4\fxx[1].htm
      [DETECTION] Contains recognition pattern of the JS/Dldr.Agent.HZ Java script virus
Ctrl+En    --> ￎￄﾼ?x4\fx[1].htm
      [DETECTION] Contains recognition pattern of the HTML/Agent.655 HTML script virus
ter 发布]     --> ￎￄﾼ?x4\ss[1].htm
      [DETECTION] Contains recognition pattern of the JS/Agent.bct Java script virus
    [NOTE]      A backup was created as '49bbae29.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

killloop

Bloodhound.EXPLOIT.219