hxxp://qvod.thesswws.com/u.html求鉴定【挂马】【已检测 by jack】

显示全部楼层 · 发表于 2011-5-14 10:40:09

本帖最后由 Sherry.ai 于 2011-5-14 12:24 编辑

Log generated by HanTao use mdecoder 0.67
[root]http://qvod.thesswws.com/u.html(无标题文档)
[exp]http://qvod.thesswws.com/1.html(Exploit.Ie0dayCVE0806.a)
[script]http://qvod.thesswws.com/yt.jpg
[virus]http://uk.thesswws.com/pk1.css
[iframe]http://qvod.thesswws.com/ux.html

显示全部楼层 · 发表于 2011-5-14 12:04:55

趋势拦截了……

显示全部楼层 · 发表于 2011-5-14 12:06:13

本帖最后由 a256886572008 于 2011-5-14 12:18 编辑

这只是 downloader

http://kkxx.wowdnfs.com:88/pp1.exe
http://kkxx.wowdnfs.com:88/pp2.exe
http://kkxx.wowdnfs.com:88/pp3.exe
http://kkxx.wowdnfs.com:88/pp4.exe
http://kkxx.wowdnfs.com:88/pp5.exe
http://kkxx.wowdnfs.com:88/pp6.exe
http://kkxx.wowdnfs.com:88/pp7.exe
http://kkxx.wowdnfs.com:88/pp8.exe
http://kkxx.wowdnfs.com:88/pp9.exe
http://kkxx.wowdnfs.com:88/pp10.exe
http://kkxx.wowdnfs.com:88/pp11.exe
http://kkxx.wowdnfs.com:88/pp12.exe
http://kkxx.wowdnfs.com:88/pp13.exe
http://kkxx.wowdnfs.com:88/pp14.exe
http://kkxx.wowdnfs.com:88/pp15.exe
http://kkxx.wowdnfs.com:88/pp16.exe
http://kkxx.wowdnfs.com:88/pp17.exe
http://kkxx.wowdnfs.com:88/pp18.exe
http://kkxx.wowdnfs.com:88/pp19.exe
http://kkxx.wowdnfs.com:88/pp20.exe
http://kkxx.wowdnfs.com:88/pp21.exe
http://kkxx.wowdnfs.com:88/pp22.exe
http://kkxx.wowdnfs.com:88/pp25.exe
http://kkxx.wowdnfs.com:88/gr.exe

显示全部楼层 · 发表于 2011-5-14 12:33:34

关于:hxxp://qvod.thesswws.com/u.html解密的日志(全体输出 -  6):

Level  0>http://qvod.thesswws.com/u.html
Level  1>http://qvod.thesswws.com/1.html
Level  2>http://uk.thesswws.com/pk1.css
Level  1>http://qvod.thesswws.com/ux.html
Level  2>http://qvod.thesswws.com/x5.swf
Level  2>http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

日志由 Redoce2.1第20次修正版于 2011-5-14 12:30:36 生成。

显示全部楼层 · 发表于 2011-5-14 12:49:01

a256886572008 发表于 2011-5-14 12:06
这只是 downloader

http://kkxx.wowdnfs.com:88/pp1.exe

哇。。链接全有效的说

显示全部楼层 · 发表于 2011-5-14 14:23:41

瑞星拦截

显示全部楼层 · 发表于 2011-5-14 16:18:19

eset nod32拦截。

显示全部楼层 · 发表于 2011-5-14 16:22:39

本帖最后由 coralsea 于 2011-5-14 16:23 编辑

其他丟上twister 剩下19 25

FS all kill

显示全部楼层 · 发表于 2011-5-17 00:45:54

avast!拦截

显示全部楼层 · 发表于 2011-5-17 03:28:02

金山毒霸拦截！

[已鉴定] hxxp://qvod.thesswws.com/u.html求鉴定【挂马】【已检测 by jack】