Re: [ mallware doklejajacy zdalnie kod do stron ] - Grupy dyskusyjne w eGospodarka.pl

eGospodarka.pl › Grupy › pl.internet.polip › [ mallware doklejajacy zdalnie kod do stron ] › Re: [ mallware doklejajacy zdalnie kod do stron ]

Path: news-archive.icm.edu.pl!newsfeed.gazeta.pl!wsisiz.edu.pl!plix.pl!newsfeed1.plix
.pl!newsfeed00.sul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!nntp.g
iganews.com!postnews.google.com!u13g2000yqg.googlegroups.com!not-for-mail
From: Matt Rutkowski <m...@g...com>
Newsgroups: pl.internet.polip
Subject: Re: [ mallware doklejajacy zdalnie kod do stron ]
Date: Thu, 19 Feb 2009 05:15:00 -0800 (PST)
Organization: http://groups.google.com
Lines: 19
Message-ID: <b...@u...googlegroups.com>
References: <8...@4...googlegroups.com>
<gn4li1$1ak$1@inews.gazeta.pl>
<1...@c...googlegroups.com>
<gn65e8$9t5$1@inews.gazeta.pl>
<1...@w...googlegroups.com>
<gn6dqe$ug6$1@cougar.axelspringer.pl> <gn6eab$k8q$1@inews.gazeta.pl>
<f...@w...googlegroups.com>
<gn6lcq$oer$1@inews.gazeta.pl>
<f...@r...googlegroups.com>
<3...@v...googlegroups.com>
<gn97oq$joo$1@news.onet.pl>
<e...@p...googlegroups.com>
<f...@v...googlegroups.com>
<gnj6g4$9ij$1@node1.news.atman.pl>
<c...@t...googlegroups.com>
NNTP-Posting-Host: 83.13.1.110
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Trace: posting.google.com 1235049300 29663 127.0.0.1 (19 Feb 2009 13:15:00 GMT)
X-Complaints-To: g...@g...com
NNTP-Posting-Date: Thu, 19 Feb 2009 13:15:00 +0000 (UTC)
Complaints-To: g...@g...com
Injection-Info: u13g2000yqg.googlegroups.com; posting-host=83.13.1.110;
posting-account=hgNPwAoAAAARaMKubSnKNMN5kujuIbN-
User-Agent: G2/1.0
X-HTTP-UserAgent: Opera/9.63 (Windows NT 5.1; U; pl) Presto/2.1.1,gzip(gfe),gzip(gfe)
Xref: news-archive.icm.edu.pl pl.internet.polip:89083
[ ukryj nagłówki ]

eset dopiero dzis wypuscil odtrutki na tego vir'a choc nowych wersji
przybywa....

grzebalem w kodzie js tego czegos i finalnie malware laczy sie z
nastepujacymi url'ami:

http://85.17.189.183/opis/?h=2e - punkt przerzutowy

---[ wlasciwe trojany] --
http://banksguard.com/picxxx/gate.php?id=7534504a
http://banksguard.com/pics/ncr.exe
http://banksguard.com/picxxx/file.php?del
http://banksguard.com/picxxx/file.php?del
http://banksguard.com/pics/ncr.exe
http://www.trart.net/vildanezik.net/album/default.ex
e

--
Matt Rutkowski