我是菜鸟
最近出了个XP2全打补丁都防不住的IE漏洞
通过嗅探 得出了一些病毒文件的下载路径
http://www.qqcong.cn/
http://www.qqcong.cn/Index.html
http://www.qqcong.cn/skin/css.css
http://www.qqcong.cn/fire.js
http://getunder50.com/ping.php?host=
http://www.qqcong.cn/images/logo.gif
http://www.qqcong.cn/Images/arrow3.gif
http://www.hao1860.cn/close1.gif
http://www.hao1860.cn/warning.gif
http://www.qqcong.cn/Article/images/article_common2.gif
http://www.hao1860.cn/close1.gif
http://www.hao1860.cn/warning.gif
http://ppntv.033.com/clientPage/js.jsp?width=359&height=249&user_id=2275&web_id=2565&union_id=1&code_id=346&serverIp=ppntv.033.com&ad_id=368&codeType=4&serverIp=ppntv.033.com
http://www.qqcong.cn/js/gg1.js
http://js.users.51.la/950598
http://s113.cnzz.com/stat.php?id=438428&web_id=438428&show=pic
http://www.qqcong.cn/js/gg7.js
http://www.dhc-2009.cn/wp/sp/qqcong.htm
http://www.dhc-2009.cn/wp/sp/2007-200
http://oo.vg/page/add_10515.htm
http://gm/ping.php?host=
http://count24.51yes.com/click.aspx?id=246991311&logo=12
http://oo.vg/page/No.js
http://ppntv.033.com/clientPage/js.jsp?width=359&height=249&user_id=2275&web_id=2565&union_id=1&code_id=346&serverIp=ppntv.033.com&ad_id=368&codeType=4&serverIp=ppntv.033.com
http://vip-qq-city.jskdfjsldkjflsdkjfksdjfklsdja.cn:8088/show.aspx?width=359&height=249&uid=2275&w=2565&union_id=1&cid=346&serverip=ppntv.033.com&p=368&codetype=4&serverip=ppntv.033.com&pk=089cd3e60e2f34c87918f522c3796480
http://count.16.vg/S168/NewJs1.js
http://count.16.vg/s168/Link168.gif
http://vip-qq-city.jskdfjsldkjflsdkjfksdjfklsdja.cn:8088/show.aspx?width=359&height=249&uid=2275&w=2565&union_id=1&cid=346&serverip=ppntv.033.com&p=368&codetype=4&serverip=ppntv.033.com&pk=089cd3e60e2f34c87918f522c3796480
http://count24.51yes.com/click.aspx?id=246991311&logo=12
http://count.51yes.com/index.aspx?id=
http://count24.51yes.com/count
http://count.51yes.com/index.aspx?id=
http://count24.51yes.com/sa.aspx?id=
http://count24.51yes.com/sa.aspx?id=246991311&refe=http%3A//www.dhc-2009.cn/wp/sp/qqcong.htm&location=http%3A//oo.vg/page/add_10515.htm&color=32x&resolution=1024x768&returning=0&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%29
http://www.qqcong.cn/Index.html,pk=089cd3e
http://vip-qq-city.jskdfjsldkjflsdkjfksdjfklsdja.cn/Code/ppntv/cpc_ppntv23.html?w=2565&p=368&uid=2275&cid=346&md=b2112f540739f704c173d30fd9f62129&ts=633301277559531250&ul=http:
http://www.qqcong.cn/Index.html
http://vip-qq-city.jskdfjsldkjflsdkjfksdjfklsdja.cn/Code/ppntv/cpc_ppntv23.html.js
/Code/ppntv/cpc_ppntv23.html?w=2565&p=368&uid=2275&cid=346&md=b2112f540739f704c173d30fd9f62129&ts=633301277559531250&ul=http://www.qqcong.cn/Index.html
http://www.w3.org/TR/html4/loose.dtd
http://img.033.com/cpc_20.gif);
http://img.033.com/cpc_20.gif
http://vip-qq-city.jskdfjsldkjflsdkjfksdjfklsdja.cn/Code/ppntv/cpc_ppntv23.html.js
http://www.rav9.com/gm/3666.htm
http://img.033.com/cpc_20.gif
http://www.w3.org/TR/html4/strict.dtd
http://go.microsoft.com/fwlink/?linkid=8180
http://img.033.com/cpc_20.gif
http://js.users.51.la/950598.js
http://www.51.la/?950598
http://icon.ajiang.net/icon_5.gif
http://vip.51.la/go.asp?svid=17&id=950598&tpages=
http://s113.cnzz.com/stat.php?id=438428&web_id=438428&show=pic
http://www.cnzz.com/stat/website.php?web_id=438428
http://icon.cnzz.com/icon.gif
http://s113.cnzz.com/stat.htm?id=438428
http://icon.ajiang.net/icon_5.gif
http://www.qqcong.cn/index.js
http://s113.cnzz.com/stat.htm?id=438428&agt=mozilla/4.0%20%28compatible%3B%20msie%206.0%3B%20windows%20nt%205.1%3B%20sv1%3B%20.net%20clr%202.0.50727%29&r=http%3A//www.baidu.com/s%3Fkw%3D%26sc%3Dweb%26cl%3D3%26tn%3Dsitehao123%26ct%3D0%26pn%3D%26rn%3D%26lm%3D%26ie%3Dgb2312%26rs2%3D%26myselectvalue%3D%26f%3D%26pv%3D%26z%3D%26from%3D%26word%3Dqq4.0&aN=Microsoft%20Internet%20Explorer&lg=zh-cn&OS=Win32&aV=4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%29&ntime=0.88317000%201194502151&repeatip=0&rtime=0&cnzz_eid=57219138-http%3A//www.baidu.com/s%3Fkw%3D%26sc%3Dweb%26cl%3D3%26tn%3Dsitehao123%26ct%3D0%26pn%3D%26rn%3D%26lm%3D%26ie%3Dgb2312%26rs2%3D%26myselectvalue%3D%26f%3D%26pv%3D%26z%3D%26from%3D%26word%3Dqq4.0&showp=1024x768
http://vip.51.la/go.asp?svid=17&id=950598&tpages=1&ttimes=1&tzone=8&tcolor=32&sSize=1024,768&referrer=http%3A//www.baidu.com/s%3Fkw%3D%26sc%3Dweb%26cl%3D3%26tn%3Dsitehao123%26ct%3D0%26pn%3D%26rn%3D%26lm%3D%26ie%3Dgb2312%26rs2%3D%26myselectvalue%3D%26f%3D%26pv%3D%26z%3D%26from%3D%26word%3Dqq4.0&vpage=http%3A//www.qqcong.cn/Index.html
http://img.16.vg/S168/S1682.exe
http://icon.cnzz.com/icon.gif
http://img.16.vg/S168/S168.exe
本来想把网马嗅探出来的 无奈 水平实在太烂~
然后把目光转向EXE
奇怪的是EXE好像的分成两个部分
S1682.exe 只有2K不到 无法用OD载入
S168.exe 用ESP定律 脱了一层后（没有修复 还没找到资料）提示的是 upolyx 的壳
再载如 入口点是一个循环 跳开后发现另一个入口 脱了后 同样....
继续不下去了
希望高手能解释一下
顺便把过程贴一下 让菜鸟学习一下
谢谢了
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
