江西财大成教学院

显示全部楼层 · 发表于 2008-12-13 15:29:12

KIS8无视 maxthon内存疯涨200余M

显示全部楼层 · 发表于 2008-12-13 15:30:41

linkscanner扫了一下啥都没扫出来，看来，智能的工具有时就是不行

显示全部楼层 · 发表于 2008-12-13 15:45:38

Log is generated by FreShow. [wide]http://cjxy.jxufe.cn/ [script]http://cjxy.jxufe.cn/js_daohang1.js [script]http://conn.lachezvos.com/click.js?bgcr=ffffff&urlcr=0000ff&tbsz=260&sropls=1 [frame]http://wm.sllwrnm8.cn/a10/fxx.htm [script]http://js.tongji.cn.yahoo.com/857114/ystat.js [frame]http://www.rxgsslll.cn/yhyw/2.htm [frame]http://wm.sllwrnm8.cn/a10/fxx.htm [script]http://js.tongji.cn.yahoo.com/857114/ystat.js [frame]http://count27.51yes.com/sa.aspx?id=275666147&refe='+window.parent.location+'&location=http%3A//click.js/&color=32x&resolution=1024x768&returning=0&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29 [frame]http://wm.sllwrnm8.cn/a10/fxx.htm [script]http://js.tongji.cn.yahoo.com/857114/ystet.js [script]http://www.css.vu.cx/css.js?width=700&height=600&keyword=ua556

显示全部楼层 · 发表于 2008-12-13 17:06:02

Hello,

css[1].js_ - Trojan-Downloader.JS.Iframe.abo,
fxx[1].htm_ - Trojan-Downloader.JS.Iframe.abm,
fx[1].htm_ - Trojan-Downloader.JS.Iframe.abn,
ss[1].htm_ - Exploit.JS.XMLPars.f

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

>From: syf0110@qq.com
>Sent: Dec 13 2008 10:12AM
>To: "New Virus" <newvirus@kaspersky.com>
>Subject: 4x
>
>password:virus
>
> ------------------
> The Russia Kaspersky Lab Board Of the Honor Members
>
> Users ID:syfwxmh
>
--
Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

显示全部楼层 · 发表于 2008-12-13 17:15:58

传说中的IE 7 Oday漏洞?
Norton Internet Security 2009 KILL..

显示全部楼层 · 发表于 2008-12-13 17:42:53

网页分析结果如下(250662772).
[wide]http://cjxy.jxufe.cn/
[script]http://cjxy.jxufe.cn/js_daohang1.js
[script]http://conn.lachezvos.com/click.js?bgcr=ffffff&urlcr=0000ff&tbsz=260&sropls=1
      [frame]http://www.rxgsslll.cn/yhyw/2.htm
         [frame]http://wm.sllwrnm8.cn/a10/fxx.htm
            [frame]http://wm.sllwrnm8.cn/a10/fx.htm
                  [frame]http://wm.sllwrnm8.cn/a10/Ilink.html
                  [frame]http://wm.sllwrnm8.cn/a10/flink.html
            [frame]http://wm.sllwrnm8.cn/a10/../a1/ss.htm
                  [object]http://down.erhaha2.cn/down/ko.exe
            [frame]http://wm.sllwrnm8.cn/a10/../a1/MS06014.htm
                  [object]http://down.erhaha2.cn/new/a1.css
            [frame]http://wm.sllwrnm8.cn/a10/../a1/sina.htm
            [frame]http://wm.sllwrnm8.cn/a10/../a1/UU.htm
            [frame]http://wm.sllwrnm8.cn/a10/../a1/Thunder.html
                  [object]http://www.oiuytr.net/new/a1.css
                  [object]http://down.hs7yue.cn/down/ko.css
            [frame]http://wm.sllwrnm8.cn/a10/../a1/GLWORLD.html
                  [object]http://down.erhaha2.cn/new/a1.css
            [frame]http://wm.sllwrnm8.cn/a10/../a1/real.htm
                  [object]http://down.erhaha2.cn/new/a1.css
            [frame]http://wm.sllwrnm8.cn/a10/../a1/Real.html
                  [object]http://down.erhaha2.cn/new/a1.css
         [script]http://js.tongji.cn.yahoo.com/857114/ystat.js
      [frame]http://count27.51yes.com/sa.aspx?id=275666147&refe='+window.parent.location+'&location=http%3A//click.js/&color=32x&resolution=1024x768&returning=0&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29
[script]http://www.css.vu.cx/css.js?width=700&height=600&keyword=ua556

显示全部楼层 · 发表于 2008-12-13 20:11:46

火狐报了攻击站点。。

显示全部楼层 · 发表于 2008-12-13 21:45:18

同类的东西：http://down.erhaha2.cn/new/ko.exe

感觉现在挂的很恶心。

[已鉴定] 江西财大成教学院

回复 8楼 08红伞威点的帖子

[已鉴定] 江西财大成教学院

回复 8楼 08红伞威点 的帖子

回复 8楼 08红伞威点的帖子