Adware, malware, spyware, hijacker discussion and information

[Gain Knowledge]  [Install Prevention]  [Maintain Security]  [Spyware Removal Help]


It is currently Sat Jul 31, 2010 2:12 pm

All times are UTC - 7 hours




Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: myb88.com/t.js - A quick analysis
PostPosted: Thu Jul 09, 2009 1:30 pm 
Offline
Site Admin
Site Admin
User avatar

Joined: Sun May 15, 2005 12:42 pm
Posts: 3472
Location: Newcastle, UK
Code:
I thought I'd give you guys a quick analysis of what myb88.com/t.js (IP: 203.158.16.18), as mentioned by DNS-BH, actually does. The first thing we need to look at, is the contents of t.js;

From here, we can see that it is loading an iFrame to bybyybyb.com (59.34.197.154 - AS4134), based on whether tmpdomain is equal to zero (which is based on whether or not the URL matches any of the items in the arydomain array). This iFrame, then loads another iframe to index.htm which contains;


http://hphosts.blogspot.com/2009/07/myb ... lysis.html

_________________
Regards

Steven Burn
Ur I.T. Mate Group / hpHosts
it-mate.co.uk / hosts-file.net

Keeping it FREE!


Top
 Profile Send private message  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  

Who is online

Who is online In total there is 1 user online :: 0 registered, 0 hidden and 1 guest (based on users active over the past 5 minutes)
Most users ever online was 115 on Tue Jul 13, 2010 5:32 pm

Users browsing this forum: No registered users and 1 guest

New posts    No new posts    Forum locked
Powered by phpBB