Beware of streaming media files in Web pages

Yesterday, an Cert group found a typical invasion of horse incident, malicious users use the government website to disseminate the link containing the Trojan, hereby remind the vast number of users: unknown source address do not visit!

Hacked sites:

http://ecc****gov.cn/

The detailed address of the virus is:

Http://ecc****gov.cn/i****s/music.htm

Http://221.***.***.99/****/music.htm

When the malicious user mounts the virus, it posts the address in some forums, such as:

http://post.baidu.com/f?kz=*******

When the user browses to the two music pages, The page embedded in the use of RealPlayer playback of the Music.smi file, so that the user started the RealPlayer to play, Music.smi file built-in a shellcode code, overflow user's machine in the RealPlayer version of the vulnerability, the implementation of the Shellco De code, and from the Http://221.***.***.99/***/setup.exe download a gray pigeon variant to the target host, which, when run, will inject into the IExploer.exe process and then attempt to connect http://cimg2.163.com /catchpic/0/07/075cdc5feef3b081018de20d1d01bee7.jpg to obtain the IP address.