我要玩手机论坛[挂马]

显示全部楼层 · 发表于 2010-5-9 22:31:51

本帖最后由小难民于 2010-5-9 22:34 编辑

论坛地址：hxxp://bbs.512530.com/512530.php

并不是每次登录都会报，用chrome/firefox+AdThwart就没提示～

附卡巴拦截提示截图：
未命名.jpg

卡巴日志：

2010/5/9 21:55:53 检测到威胁: Exploit.JS.CVE-2010-0806.n Internet Explorer hxxp://stb.cnool.net/cdmabs2/webmaster/images/i1.html
2010/5/9 21:55:53 被拒绝: Exploit.JS.CVE-2010-0806.n Internet Explorer hxxp://stb.cnool.net/cdmabs2/webmaster/images/i1.html

显示全部楼层 · 发表于 2010-5-9 22:37:52

关于:hxxp://bbs.512530.com/512530.php解密的日志(全体输出 - 7):

Level 0>http://bbs.512530.com/512530.php
Level 1>http://bbs.512530.com/attachments/google.js
Level 2>http://stb.cnool.net/cdmabs2/webmaster/images/404.html
Level 3>http://stb.cnool.net/cdmabs2/webmaster/images/i2.html
Level 4>http://stb.cnool.net/cdmabs2/webmaster/images/ypde.exe
Level 3>http://stb.cnool.net/cdmabs2/webmaster/images/i1.html
Level 4>http://stb.cnool.net/cdmabs2/webmaster/images/ypde.exe

日志由 Redoce2.0第93次修正版于 2010-5-9 22:36:10 生成。

显示全部楼层 · 发表于 2010-5-10 00:01:06

Log generated by anonymous use mdecoder 0.55
[root]http://bbs.512530.com/512530.php
[script]http://bbs.512530.com/include/js/common.js?WGI
[script]http://cpro.baidu.com/cpro/ui/cp.js
      [script]http://wm.baidu.com/preview/preview.js
[script]http://cpro.baidu.com/cpro/ui/cp.js
[script]http://bbs.512530.com/attachments/google.js
      [iframe]http://stb.cnool.net/cdmabs2/webmaster/images/404.html
         [exp]http://stb.cnool.net/cdmabs2/webmaster/images/i1.html(Exploit.Ie0dayCVE0806.a)
            [virus]http://stb.cnool.net/cdmabs2/webmaster/images/ypde.exe
         [exp]http://stb.cnool.net/cdmabs2/webmaster/images/i2.html(Exploit.Ie0dayCVE0806.a)
            [virus]http://stb.cnool.net/cdmabs2/webmaster/images/ypde.exe

[其它] 我要玩手机论坛[挂马]