Adobe's serious magic website was attacked by asprox botnet SQL Injection

Source: Internet
Author: User
Tags sql injection attack

According to sophoslabs, Adobe's seriousmagic.com website has just suffered an SQL injection attack from the asprox botnet and has become the most famous site recently attacked.

The infected webpage is in hxxp ://Www.seriousmagic.com/help/tuts/tutorials.cfm? P = 1The user accessing this page will be secretly installed with a maliciousProgram. Adobe announced the acquisition of serious magic two years ago. The whois information of serious magic shows that Adobe is its new master.

According to an article by the anti-virus vendor SophosArticleAdobe has noticed that its webpage is infected,The RegisterWhen I tried to access this infected page with a virtual machine on Thursday, I found that it was still directed to some malicious sites, including hxxp ://Abc.verynx.cn/W. jsAnd hxxp ://1.verynx.cn/javasjs.Currently, these two addresses have expired, but the other addresses used in the attack include hxxp ://Jjmaobuduo.3322.org/csrss/ W. jsAnd hxxp ://Www2.s800qn.cn/csrss/ new.htmStill valid.

The asprox botnet successfully attacked Redmond magazine, Sony PlayStation, and other famous sites in the 5 or 6 months. It didn't take long before serious magic became a victim.

Every infected webpage is endlessly executing a javascriptCodeAnd direct the user to a malicious site or advertising site. At the same time, W. js will try various system vulnerabilities and use the following structure to kill a virus with a low rate.Worm. win32.autorun. qtgInstall it on your system. (The virus detection rate is only 80.56%)

Www2.s800qn.cn/CSRSS/new.htm
Www2.s800qn.cn/CSRSS/flash.htm
Www2.s800qn.cn/CSRSS/i1.htm
Www2.s800qn.cn/CSRSS/f2.htm
Www2.s800qn.cn/CSRSS/i1.html
Www2.s800qn.cn/CSRSS/flash112.htm
Www2.s800qn.cn/CSRSS/ff.htm
Www2.s800qn.cn/CSRSS/xl.htm
Www2.s800qn.cn/CSRSS/mi.htm
Www2.s800qn.cn/CSRSS/real10.htm
Www2.s800qn.cn/CSRSS/real11.htm
Bbexe.com/CSRSS/rondll32.exe

Adobe seems to have cleared the virus.

Http://blogs.zdnet.com/security? P = 2039
Source: comsharp CMS (ruishang enterprise CMS) Official Website

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.