九天电讯旗下专业手机论坛－－灵图天行者（挂马）

显示全部楼层 · 发表于 2010-7-14 15:26:56

关于:hxxp://bbs.522shop.com/thread-44882-1-1.html解密的日志(全体输出 - 15):

Level 0>hxxp://bbs.522shop.com/thread-44882-1-1.html
Level 1>hxxp://bbs.522shop.com/forumdata/cache/common.js?eeM
Level 1>hxxp://60.190.236.11:8000/stat.js?ad_sjwjw_670X80
Level 2>hxxp://microsoft72.7766.org:6677/a/ads.html
Level 3>hxxp://microsoft72.7766.org:6677/a/ap.js
Level 3>hxxp://232asdra.3322.org:6677/a/tv.exe
Level 3>hxxp://js.tongji.linezing.com/1676183/tongji.js
Level 4>hxxp://js.tongji.linezing.com/1676183/+url_id+/clickcollect.js
Level 4>hxxp://tongji.linezing.com/clickmap/load_clickmap.html?r=+Math.random
Level 4>hxxp://js.tongji.linezing.com/1676183/141e56c9;
Level 1>hxxp://bbs.522shop.com/=27
Level 1>hxxp://bbs.522shop.com/forumdata/cache/viewthread.js?eeM
Level 1>hxxp://bbs.522shop.com/=13
Level 1>hxxp://bbs.522shop.com/redirect.php?ptid=44882&ordertype=0&postno=+$
Level 1>hxxp://count34.51yes.com/click.aspx?id=340800901&logo=9

日志由 Redoce2.1第9次修正版于 2010-7-14 15:23:54 生成。

显示全部楼层 · 发表于 2010-7-15 01:01:33

显示全部楼层 · 发表于 2010-7-15 08:29:32

挂马地址到这里 http://microsoft72.7766.org:6677/a/ads.html ，好象失效了，我这打不开…

显示全部楼层 · 发表于 2010-7-15 08:45:03

挂马地址不断在变化，你要从头分析起才行。
关于:hxxp://bbs.522shop.com/thread-44882-1-1.html解密的日志(全体输出 -  18):

Level  0>hxxp://bbs.522shop.com/thread-44882-1-1.html
Level  1>hxxp://count34.51yes.com/click.aspx?id=340800901&logo=9
Level  1>hxxp://bbs.522shop.com/redirect.php?ptid=44882&ordertype=0&postno=+$
Level  1>hxxp://bbs.522shop.com/=13
Level  1>hxxp://bbs.522shop.com/forumdata/cache/viewthread.js?eeM
Level  1>hxxp://bbs.522shop.com/=27
Level  1>hxxp://60.190.236.11:8000/stat.js?ad_sjwjw_670X80
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  2>hxxp://microsoft73.9966.org:6677/a/ads.html
Level  1>hxxp://bbs.522shop.com/forumdata/cache/common.js?eeM

日志由 Redoce2.1第9次修正版于 2010-7-15 8:43:31 生成。

显示全部楼层 · 发表于 2010-7-16 17:44:53

ess无反应

显示全部楼层 · 发表于 2010-7-16 18:56:25

本帖最后由 250662772 于 2010.7.16 19:06 编辑

确实是不断变化

**网页分析:250662772 分析工具:mdecoder0.67**
[root]http://bbs.522shop.com/( 手机玩家网智能手机论坛|多普达论坛|HTC论坛|O2论坛,九天电讯旗下专业手机论坛 - Powered by Discuz!)
[script]http://bbs.522shop.com/forumdata/cache/common.js?eeM
[script]http://60.190.236.11:8000/stat.js?ad_sjwjw_670X80
      [exp]http://36001.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
         [script]http://36001.8866.org:6677/a/pps.js
         [virus]http://232asd.3322.org:6677/a/tv.exe
[script]http://bbs.522shop.com/pic.php
      [flash]http://bbs.522shop.com/images/focus.swf

[其它] 九天电讯旗下专业手机论坛－－灵图天行者（挂马）