http://99j4.org/0.js

haol

請幫忙分析，謝謝
hxxp://99j4.org/0.js

gtyre1

Log is generated by FreShow.
[wide]http://99j4.org/0.js
    [frame]http://ee99zz.8866.org/aa/a3a.htm
        [frame]http://ee99zz.8866.org/aa/360.htm
            [script]http://ee99zz.8866.org/aa/go.jpg
                [object]http://msms5200.com/svchost.exe
            [script]http://ee99zz.8866.org/aa/go1.jpg
        [script]http://js.tongji.linezing.com/1137761/tongji.js
        [script]http://s6.cnzz.com/stat.php?id=1408285&web_id=1408285
    [script]http://99j4.org/\"http:\/\/count29.51yes.com\/click.aspx?id=298952206&logo=12\"

llzy3575

关于:hxxp://99j4.org/0.js解密的日志(全体输出 -  8):

Level  1>http://ee99zz.8866.org/aa/a3a.htm
Level  2>http://ee99zz.8866.org/aa/360.htm
Level  3>http://ee99zz.8866.org/aa/go1.jpg
Level  3>http://ee99zz.8866.org/aa/go.jpg
Level  4>http://msms5200.com/svchost.exe
Level  2>http://s6.cnzz.com/stat.php?id=1408285&web_id=1408285
Level  2>http://img.tongji.linezing.com/1137761/tongji.gif
Level  2>http://js.tongji.linezing.com/1137761/tongji.js

日志由 Redoce2.0第2次修正版于 2009/7/13 22:37:02 生成。

尤金卡巴斯基

2009/7/14 0:15:06 已隔离 病毒 HEUR:Trojan.Win32.Generic G:\Temp\Virus\svchost.rar/svchost.exe//NSPack  

url and sample to KL

[ 本帖最后由 尤金卡巴斯基 于 2009-7-14 00:18 编辑 ]

尤金卡巴斯基

Hello,

svchost.exe_ - Trojan-Dropper.Win32.Mudrop.bnj       

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

Best regards, Sergey Prokudin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.


10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com