http://210.38.57.36/ 挂马

显示全部楼层 · 发表于 2009-7-24 14:10:22

昨天上的，回来后发现沙盘捞到了很多。

h ttp://210.38.57.36/

解出两个css，应该还有很多。

[ 本帖最后由 hj5abc 于 2009-7-24 14:11 编辑 ]

显示全部楼层 · 发表于 2009-7-24 14:25:20

貌似是这个，迅雷下载看看

关于:hxxp://210.38.57.36/解密的日志(全体输出 -  27):

Level  1>http://ghbrty.3322.org/a0036159/a03.htm
Level  2>http://ghbrty.3322.org/a0036159/new.html
Level  3>http://ghbrty.3322.org/wewew.js
Level  4>http://liz.8866.org:8808/baidu.cab  ●
Level  3>http://ghbrty.3322.org/real11.htm
Level  3>http://ghbrty.3322.org/real10.htm
Level  3>http://ghbrty.3322.org/cx.htm
Level  3>http://ghbrty.3322.org/active.htm
Level  3>http://ghbrty.3322.org/a0036159/fx.htm
Level  3>http://ghbrty.3322.org/apple4.htm
Level  3>http://ghbrty.3322.org/dir.htm
Level  3>http://ghbrty.3322.org/zhin.js
Level  3>http://ghbrty.3322.org/xnnn.js
Level  2>http://www.linezing.com
Level  2>http://js.tongji.linezing.com/1170422/tongji.js
Level  1>http://210.38.57.36/
Level  1>http://210.38.57.36/x.src
Level  1>http://210.38.57.36/a
Level  1>http://210.38.57.36/news.asp?typeid=7&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=4&shu=5
Level  1>http://210.38.57.36/news.asp?typeid=15&shu=3
Level  1>http://210.38.57.36/news.asp?typeid=11&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=12&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=5&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=14&shu=7
Level  1>http://www.wdedu.net/1.js
Level  1>http://lipumz.cn/n.js

日志由 Redoce2.0第15次修正版于 2009-07-24 下午 02:24:59 生成。

显示全部楼层 · 发表于 2009-7-24 14:30:43

不只吧，好像有很多。

显示全部楼层 · 发表于 2009-7-24 14:32:50

那我再看看

显示全部楼层 · 发表于 2009-7-24 14:41:49

真多

还有些没解出来

关于:hxxp://210.38.57.36/解密的日志(全体输出 -  38):

Level  4>http://ghbrty.3322.org/a0036159/a03.htm
Level  5>http://ghbrty.3322.org/a0036159/new.html
Level  6>http://ghbrty.3322.org/wewew.js
Level  7>http://liz.8866.org:8808/baidu.cab  ●
Level  6>http://ghbrty.3322.org/real11.htm
Level  7>http://ghbrty.3322.org/realplay.js
Level  6>http://ghbrty.3322.org/real10.htm
Level  7>http://ghbrty.3322.org/real.js
Level  8>http://liz.8866.org:8808/a/re.css  ●
Level  6>http://ghbrty.3322.org/cx.htm
Level  6>http://ghbrty.3322.org/active.htm
Level  6>http://ghbrty.3322.org/a0036159/fx.htm
Level  6>http://ghbrty.3322.org/apple4.htm
Level  6>http://ghbrty.3322.org/dir.htm
Level  6>http://ghbrty.3322.org/zhin.js
Level  7>http://ghbrty.3322.org/bfyy.htm
Level  8>http://ghbrty.3322.org/bf.js
Level  8>http://ghbrty.3322.org/bff.js
Level  7>http://ghbrty.3322.org/as.htm
Level  8>http://ghbrty.3322.org/as.js
Level  8>http://liz.8866.org:8808/a/as.css  ●
Level  7>http://ghbrty.3322.org/lzz.htm
Level  8>http://ghbrty.3322.org/lzz.js
Level  6>http://ghbrty.3322.org/xnnn.js
Level  5>http://www.linezing.com
Level  5>http://js.tongji.linezing.com/1170422/tongji.js
Level  2>http://210.38.57.36/news.asp?typeid=11&shu=7
Level  2>http://210.38.57.36/news.asp?typeid=15&shu=3
Level  2>http://210.38.57.36/news.asp?typeid=4&shu=5
Level  2>http://210.38.57.36/news.asp?typeid=7&shu=7
Level  2>http://210.38.57.36/a
Level  1>http://210.38.57.36/
Level  1>http://210.38.57.36/x.src
Level  1>http://www.wdedu.net/1.js
Level  1>http://210.38.57.36/news.asp?typeid=14&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=5&shu=7
Level  1>http://210.38.57.36/news.asp?typeid=12&shu=7
Level  1>http://lipumz.cn/n.js

日志由 Redoce2.0第15次修正版于 2009-07-24 下午 02:41:10 生成。

显示全部楼层 · 发表于 2009-7-24 14:46:58

显示全部楼层 · 发表于 2009-7-24 14:53:03

http://lipumz.cn/n.js这个不会解

显示全部楼层 · 发表于 2009-7-24 14:54:06

很多不会。

Log is generated by FreShow.

[wide]http://210.38.57.36/
[script]http://210.38.57.36/news.asp?typeid=12&shu=7
      [script]http://lipumz.cn/n.js
         [frame]http://ghbrty.3322.org/a0036159/a03.htm
            [frame]http://ghbrty.3322.org/a0036159/new.html
                  [script]http://ghbrty.3322.org/a0036159/../zhin.js
                     [frame]http://ghbrty.3322.org/a0036159/../../lzz.htm
                        [script]http://ghbrty.3322.org/a0036159/../../lzz.js
                              [object]http://liz.8866.org:8808/a/lzz.css
                     [frame]http://ghbrty.3322.org/a0036159/../../as.htm
                        [object]http://liz.8866.org:8808/a/as.css
                        [script]http://ghbrty.3322.org/a0036159/../../as.js
                     [frame]http://ghbrty.3322.org/a0036159/../../bfyy.htm
                        [script]http://ghbrty.3322.org/a0036159/../../bff.js
                        [script]http://ghbrty.3322.org/a0036159/../../bf.js
                  [frame]http://ghbrty.3322.org/a0036159/../dir.htm
                     [script]http://ghbrty.3322.org/a0036159/../og.jpg
                     [script]http://ghbrty.3322.org/a0036159/../go.jpg
                  [frame]http://ghbrty.3322.org/a0036159/fx.htm
                     [frame]http://ghbrty.3322.org/a0036159/mlink.html
                        [script]http://ghbrty.3322.org/a0036159/swfobject.js
                        [script]http://ghbrty.3322.org/a0036159/flash.js
                  [frame]http://ghbrty.3322.org/a0036159/../real10.htm
                     [script]http://ghbrty.3322.org/a0036159/../real.js
                  [frame]http://ghbrty.3322.org/a0036159/../real11.htm
                     [script]http://ghbrty.3322.org/a0036159/../realplay.js
                  [script]http://ghbrty.3322.org/a0036159/../wewew.js

显示全部楼层 · 发表于 2009-7-24 15:05:42

关于:hxxp://lipumz.cn/n.js解密的日志(全体输出 -  46):

Level  0>http://lipumz.cn/n.js
Level  1>http://ghbrty.3322.org/a0036159/a03.htm
Level  2>http://js.tongji.linezing.com/1170422/tongji.js
Level  2>http://ghbrty.3322.org/a0036159/new.html
Level  3>http://ghbrty.3322.org/wewew.js
Level  4>http://liz.8866.org:8808/baidu.cab
Level  5>http://liz.8866.org:8808/baidu.exe
Level  3>http://ghbrty.3322.org/real11.htm
Level  4>http://ghbrty.3322.org/realplay.js
Level  5>http://liz.8866.org:8808/a/real11.css
Level  3>http://ghbrty.3322.org/real10.htm
Level  4>http://ghbrty.3322.org/real.js
Level  5>http://liz.8866.org:8808/a/re.css
Level  3>http://ghbrty.3322.org/cx.htm
Level  3>http://ghbrty.3322.org/active.htm
Level  3>http://ghbrty.3322.org/a0036159/fx.htm
Level  4>http://ghbrty.3322.org/a0036159/xlink.html
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,16,0f.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,28,0f.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,45,0f.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,47,0f.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,64,0f.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,115,0f.swf
Level  4>http://ghbrty.3322.org/a0036159/mlink.html
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,47,0i.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,28,0i.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,64,0i.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,16,0i.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,45,0i.swf
Level  5>http://ghbrty.3322.org/a0036159/win 9,0,115,0i.swf
Level  3>http://ghbrty.3322.org/apple4.htm
Level  3>http://ghbrty.3322.org/dir.htm
Level  4>http://ghbrty.3322.org/go.jpg
Level  4>http://ghbrty.3322.org/og.jpg
Level  5>http://liz.8866.org:8808/a/dir.css
Level  3>http://ghbrty.3322.org/zhin.js
Level  4>http://ghbrty.3322.org/bfyy.htm
Level  5>http://ghbrty.3322.org/bf.js
Level  6>http://liz.8866.org:8808/a/bf.css
Level  5>http://ghbrty.3322.org/bff.js
Level  4>http://ghbrty.3322.org/as.htm
Level  5>http://liz.8866.org:8808/a/as.css
Level  4>http://ghbrty.3322.org/lzz.htm
Level  5>http://ghbrty.3322.org/lzz.js
Level  6>http://liz.8866.org:8808/a/lzz.css
Level  3>http://ghbrty.3322.org/xnnn.js

日志由 Redoce2.0第13次修正版于 2009/7/24 15:05:25 生成。

显示全部楼层 · 发表于 2009-7-24 15:16:40

请问 hxxp://ghbrty.3322.org/wewew.js这个要怎么解？

[ 本帖最后由 hj5abc 于 2009-7-24 15:20 编辑 ]

[已鉴定] http://210.38.57.36/ 挂马

回复 2楼 llzy3575 的帖子

回复 3楼 hj5abc 的帖子

回复 9楼 taoyuan237 的帖子