http://bbs.pcbeta.com/（远景论坛）

显示全部楼层 · 发表于 2009-8-30 07:13:26

Level  0>http://bbs.pcbeta.com/
Level  1>http://bbs.pcbeta.com/include/js/common.js?f88
Level  1>http://bbs.pcbeta.com/=27
Level  1>http://cpro.baidu.com/cpro/ui/cp.js
Level  1>http://pbcdn.com/links/community_logo.png
Level  1>http://s61.cnzz.com/stat.php?id=1399734&web_id=1399734
Level  1>http://imagesb.9966.org/images/view_sysmenub.png
Level  2>http://statviewa.9966.org/oday/2.htm
Level  3>http://count27.51yes.com/click.aspx?id=274386209&logo=12
Level  3>http://statviewa.9966.org/web1/web.html
Level  4>http://statviewa.9966.org/web1/yut.htm
Level  5>http://statviewa.9966.org/web1/of.htm
Level  6>http://statviewa.9966.org/web1/of.css  ●
Level  6>http://statviewa.9966.org/web1/of1.css  ●
Level  6>http://statviewa.9966.org/web1/of.js
Level  7>http://goodhao1.3322.org/cmd.css  ●
Level  5>http://statviewa.9966.org/web1/ytfl.htm
Level  6>http://statviewa.9966.org/web1/ff.html
Level  7>http://statviewa.9966.org/web1/xp.swf  ●
Level  7>http://statviewa.9966.org/web1/done.swf  ●
Level  7>http://goodhao1.3322.org/cmd.css  ●
Level  6>http://statviewa.9966.org/web1/ie.html
Level  7>http://statviewa.9966.org/web1/xp.swf  ●
Level  7>http://statviewa.9966.org/web1/done.swf  ●
Level  7>http://goodhao1.3322.org/cmd.css  ●
Level  4>http://statviewa.9966.org/web1/nyntdxxz.htm
Level  5>http://statviewa.9966.org/web1/092.js
Level  5>http://statviewa.9966.org/web1/091.js
Level  6>http://goodhao1.3322.org/cmd.css  ●
Level  4>http://statviewa.9966.org/web1/yt.htm
Level  5>http://statviewa.9966.org/web1/f.jpg
Level  5>http://statviewa.9966.org/web1/e.jpg
Level  5>http://statviewa.9966.org/web1/d.jpg
Level  5>http://statviewa.9966.org/web1/c.jpg
Level  5>http://statviewa.9966.org/web1/url.jpg
Level  6>http://goodhao1.3322.org/cmd.css  ●
Level  5>http://statviewa.9966.org/web1/b.jpg
Level  5>http://statviewa.9966.org/web1/a.jpg
Level  4>http://statviewa.9966.org/web1/nyntd14.htm

日志由 Redoce2.0第36次修正版于 2009-8-30 7:07:30 生成。

显示全部楼层 · 发表于 2009-8-30 07:43:11

病毒样本上报卡巴斯基（病毒下载地址上报卡巴斯基，加入黑名单）

样本md5：ad78a6cfeaaeb0dea576ab68c776b20e

Hello,

ad78a6cfeaaeb0dea576ab68c776b20e - Trojan-Downloader.Win32.Geral.cqh

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由幸福的猪猪于 2009-8-30 07:50 编辑 ]

显示全部楼层 · 发表于 2009-8-30 08:51:40

原始 - http://bbs.pcbeta.com/
开始自动解析 - http://bbs.pcbeta.com/
L1 - http://bbs.pcbeta.com/include/js/common.js?F88
L1 - http://imagesb.9966.org/images/view_sysmenub.png
L1 - http://bbs.pcbeta.com/rss.php?auth=0
L2 - http://pbcdn.com/img/smilies/
L2 - http://statviewa.9966.org/oday/2.htm
L2 - http://bbs.pcbeta.com/http://bbs.pcbeta.com</link
L2 - http://bbs.pcbeta.com/images/logo.gif</url
L2 - http://bbs.pcbeta.com/</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570023</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570022</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570021</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570020</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570019</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570018</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570017</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570016</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570015</link
L2 - http://bbs.pcbeta.com/viewthread.php?tid=570014</link
L3 - http://statviewa.9966.org/web1/web.html
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570023</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570022</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570021</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570020</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570019</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570018</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570017</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570016</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570015</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L3 - http://bbs.pcbeta.com/viewthread.php?tid=570014</include/js/common.js?F88
L3 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://statviewa.9966.org/web1/nYnTd14.htm
L4 - http://statviewa.9966.org/web1/yt.htm
L4 - http://statviewa.9966.org/web1/nYnTdxxz.htm
L4 - http://statviewa.9966.org/web1/yut.htm
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570023</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570022</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570021</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570020</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570019</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570018</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570017</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570016</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570015</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L4 - http://bbs.pcbeta.com/viewthread.php?tid=570014</include/js/include/js/common.js?F88
L4 - http://imagesb.9966.org/images/view_sysmenub.png - 跳过 - 重复检测
L5 - http://statviewa.9966.org/web1/a.jpg
L5 - http://statviewa.9966.org/web1/b.jpg
L5 - http://statviewa.9966.org/web1/url.jpg
自动解析 - Auto XOR - 高度可疑 - http://goodhao1.3322.org/cmd.css

输出的对象 - http://goodhao1.3322.org/cmd.css

此分析日志由猫猫使用 Astox v1 Build 1100 在 2009年8月30日8时50分8秒生成。

显示全部楼层 · 发表于 2009-8-30 08:51:59

第n次被挂了吧~

显示全部楼层 · 发表于 2009-8-30 08:59:04

我今天上远景，小伞报被挂马。html/infected.webpage.gen
http://bbs.pcbeta.com/forum-214-1.html

显示全部楼层 · 发表于 2009-8-30 09:19:18

关于:hxxp://bbs.pcbeta.com/解密的日志(全体输出 -  47):

Level  1>http://bbs.pcbeta.com/include/js/common.js?f88
Level  1>http://pbcdn.com/gg/oaoidc.gif
Level  1>http://spcode.baidu.com/spcode/spstyle/style1634.jsp?tn=pcbeta_sp&amp
Level  1>http://spcode.baidu.com/spcode/spstyle/style2935.jsp?tn=pcbeta_sp&amp
Level  1>http://cpro.baidu.com/cpro/ui/cp.js
Level  1>http://unstat.baidu.com/bdun.bsc?tn=pcbeta_pg&amp
Level  1>http://bbs.pcbeta.com/images/default/collapsed_no.gif
Level  1>http://pbcdn.com/mac/ad980.jpg
Level  1>http://s61.cnzz.com/stat.php?id=1399734&web_id=1399734
Level  1>http://js.tongji.linezing.com/903171/tongji.js
Level  1>http://imagesb.9966.org/images/view_sysmenub.png
Level  2>http://statviewa.9966.org/oday/2.htm
Level  3>http://statviewa.9966.org/web1/web.html
Level  4>http://statviewa.9966.org/web1/yut.htm
Level  5>http://statviewa.9966.org/web1/of.htm
Level  6>http://statviewa.9966.org/web1/of.css  ●
Level  6>http://statviewa.9966.org/web1/of1.css  ●
Level  6>http://statviewa.9966.org/web1/of.js
Level  7>http://goodhao1.3322.org/cmd.css  ●
Level  5>http://statviewa.9966.org/web1/ytfl.htm
Level  6>http://statviewa.9966.org/web1/ff.html
Level  7>http://statviewa.9966.org/web1/xp.swf  ●
Level  7>http://statviewa.9966.org/web1/done.swf  ●
Level  7>http://goodhao1.3322.org/cmd.css-
Level  6>http://statviewa.9966.org/web1/ff.html
Level  6>http://statviewa.9966.org/web1/ie.html
Level  7>http://statviewa.9966.org/web1/xp.swf  ●
Level  7>http://statviewa.9966.org/web1/done.swf  ●
Level  7>http://goodhao1.3322.org/cmd.css  ●
Level  6>http://statviewa.9966.org/web1/ff.html
Level  6>http://statviewa.9966.org/web1/ie.html
Level  6>http://statviewa.9966.org/web1/ff.html
Level  4>http://statviewa.9966.org/web1/nyntdxxz.htm
Level  5>http://statviewa.9966.org/web1/092.js
Level  5>http://statviewa.9966.org/web1/091.js
Level  6>http://goodhao1.3322.org/cmd.css  ●
Level  4>http://statviewa.9966.org/web1/yt.htm
Level  5>http://statviewa.9966.org/web1/f.jpg
Level  5>http://statviewa.9966.org/web1/e.jpg
Level  5>http://statviewa.9966.org/web1/d.jpg
Level  5>http://statviewa.9966.org/web1/c.jpg
Level  5>http://statviewa.9966.org/web1/url.jpg
Level  6>http://goodhao1.3322.org/cmd.css  ●
Level  5>http://statviewa.9966.org/web1/b.jpg
Level  5>http://statviewa.9966.org/web1/a.jpg
Level  4>http://statviewa.9966.org/web1/nyntd14.htm
Level  1>http://bbs.pcbeta.com/

日志由 Redoce2.0第16次修正版于 2009-8-30 9:19:04 生成。

显示全部楼层 · 发表于 2009-8-30 11:06:01

怪不得啊，利用的IE7的漏洞，AVG MSE 全都报了

显示全部楼层 · 发表于 2009-8-30 11:41:37

呵呵，偶也是看到就想到卡饭了

显示全部楼层 · 发表于 2009-8-30 12:52:44

远景为啥老被挂

显示全部楼层 · 发表于 2009-8-30 15:11:40

今早起的晚了点，没赶上！

[已鉴定] http://bbs.pcbeta.com/（远景论坛）

评分

回复 1楼 Micropoint 的帖子