Author Topic: Trojan-Spy.Win32.FtpSend.b  (Read 2511 times)

0 Members and 1 Guest are viewing this topic.

July 30, 2008, 04:59:15 pm
Read 2511 times

Serg

  • Special Members
  • Sr. Member

  • Offline
  • *

  • 132
Code: [Select]
http://cs.rm510.com/ads.txt and http://cs.rm510.com/ftpdata.asp already in a base.
ads.txt includes some crypto
Code: [Select]
===
> ads.txt.1
> 0x000029 -> LinearXor(0x65,0x00) -> http://v.freefl.info/day.js
> http://v.freefl.info/day.js   
===
js writes iframes with exploits on
Code: [Select]
http://v.freefl.info/lz.htm
http://v.freefl.info/bf.htm
http://v.freefl.info/kong.htm




August 02, 2008, 02:12:24 pm
Reply #1

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964