PCINLIFE被挂马？[挂马][by knifed]

显示全部楼层 · 发表于 2010-4-3 14:52:44

本帖最后由 knifed 于 2010-4-3 18:12 编辑

hxxp://we.pcinlife.com/index.php

已经不是第一天报毒了，一开始以为是误报，今天发现好像真的有问题饿……

Log generated by dz007 use mdecoder 0.26
[root]http://we.pcinlife.com/index.php
[script]http://www.crcf.org.cn/logo.gif?▓★
      [iframe]http://ferrari23.8800.org:8800/ak47/18.html
         [iframe]http://ferrari23.8800.org:8800/ak47/../b46/18/index.html
            [iframe]http://ferrari23.8800.org:8800/ak47/../b46/18/qc.html
                  [script]http://ferrari23.8800.org:8800/ak47/../b46/18/rl.jpg
                     [exe]http://yurenjieok.9966.org:8800/aaaa/s6/s18.exe
                  [script]http://ferrari23.8800.org:8800/ak47/../b46/18/y1.jpg
                  [script]http://ferrari23.8800.org:8800/ak47/../b46/18/tl.jpg
[script]http://we.pcinlife.com/forumdata/cache/common.js?woc
[script]http://we.pcinlife.com/+
[script]http://www.crcf.org.cn/logo.gif?▓★

显示全部楼层 · 发表于 2010-4-3 14:55:15

VirTool:WinNT/Dogrobot.gen!K

显示全部楼层 · 发表于 2010-4-3 15:15:14

关于:hxxp://we.pcinlife.com/index.php解密的日志(全体输出 -  9):

Level  0>http://we.pcinlife.com/index.php
Level  1>http://www.crcf.org.cn/logo.gif?▓★
Level  2>http://ferrari23.8800.org:8800/ak47/18.html
Level  3>http://js.tongji.linezing.com/1530019/tongji.js
Level  3>http://js.tongji.linezing.com/1562645/tongji.js
Level  3>http://ferrari23.8800.org:8800/b46/18/index.html——无法读取
Level  1>http://we.pcinlife.com/forumdata/cache/common.js?wOC
Level  1>http://www.crcf.org.cn/logo.gif?▓★
Level  1>http://pagead2.googlesyndication.com/pagead/show_ads.js

analyzed by 是昔流芳

显示全部楼层 · 发表于 2010-4-3 18:12:06

Log is generated by FreShow.
[wide]http://we.pcinlife.com/index.php
[script]http://www.crcf.org.cn/logo.gif?▓★
      [frame]http://ferrari23.6600.org:8800/ak47/18.html
         [frame]http://ferrari23.6600.org:8800/ak47/../b46/18/index.html
            [frame]http://ferrari23.6600.org:8800/ak47/../b46/18/qc.html
                  [script]http://ferrari23.6600.org:8800/ak47/../b46/18/rl.jpg
                     [object]http://yurenjieok.9966.org:8800/aaaa/s6/s18.exe
                  [script]http://ferrari23.6600.org:8800/ak47/../b46/18/y1.jpg
                  [script]http://ferrari23.6600.org:8800/ak47/../b46/18/tl.jpg
[script]http://we.pcinlife.com/forumdata/cache/common.js?h2Z
[script]http://www.crcf.org.cn/logo.gif?▓★
[script]http://pagead2.googlesyndication.com/pagead/show_ads.js

显示全部楼层 · 发表于 2010-4-21 13:36:17

晕，小a 金山网盾 360浏览器都无反应

显示全部楼层 · 发表于 2010-4-21 22:21:43

瑞星恶意网址拦截报

[其它] PCINLIFE被挂马？[挂马][by knifed]