Threat Level: green Handler on Duty: Brad Duncan

SANS ISC InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

IE 0day exploit domains (constantly updated)

Published: 2009-07-06
Last Updated: 2009-07-17 20:36:33 UTC
by Andre Ludwig (Version: 19)
6 comment(s)

This diary entry contains a list of domains that are exploiting the new IE-0day as well as secondary domains that are hosting potentially malicious binaries utilized in these attacks.  This list  has been produced as a combined effort of researchers, vendors, and volunteers. You can thank the groups below for their efforts and their willingness to share this information with the public.  This list is intended to serve as a quick way to provide protection against these attacks by identifying domains that are hosting these (and potentially other) exploits. This list is not formatted for any specific file format, it is up to you the reader to translate this date into the proper formatting that your environment requires.   

** In regards to IDS/IPS signatures, I would highly suggest looking for the malformed file vs trying to catch every permutation of the JS/Html seen.  Emerging threats has a signature that looks for the malformed file, it can be found in their main rules file.   2009493 - ET CURRENT_EVENTS Likely MSVIDCTL.dll exploit in transit (emerging.rules)

This diary entry will be updated frequently. The information provided has had varying degrees of verification performed on it. As such this information is provided as is.  There may very well be mistakes, mistakes that may result in legitimate sites being blocked if you choose to use this list as a block list.


Update: Removed some false positives (,, as well as a few IP addresses)

Update:    Removed, which reported back that they cleaned up the malicious files.

Link on how to leverage DNS to blackhole/redirect queries.

Google Cache version of the above link


Massive thanks go to the following contributors:

IBM X-Force
Sunbelt Software
Telenor SOC


List of exploit domains:



Second stage domains (binaries downloaded from these domains):

Ip's (no domain used in exploit page):

6 comment(s)

0-day in Microsoft DirectShow (msvidctl.dll) used in drive-by attacks

Published: 2009-07-06
Last Updated: 2009-07-07 14:08:53 UTC
by Stephen Hall (Version: 2)
8 comment(s)

A 0-day exploit within the msVidCtl component of Microsoft DirectShow is actively being exploited through drive-by attacks using thousands of newly compromised web sites, according to CSIS. The code has been published in the public domain via a number of Chinese web sites.

Please keep a watchful eye on your AV and IDS/IPS vendors updates to ensure coverage as early as possible on this exploit as it is likely to be widely deployed with the code being available.

A valid work around for the attack vector is available which set's the kill bit on the vulnerable DLL.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}]
"Compatibility Flags"=dword:00000400 

Details of the exploit are available on the CSIS web site, but are included below:

var appllaa='0';

var nndx='%'+'u9'+'0'+'9'+'0'+'%u'+'9'+'0'+'9'+appllaa;


var headersize=20;

var omybro=unescape(nndx);

var slackspace=headersize+dashell.length;







memory=new Array();



var myObject=document.createElement('object');







UPDATE July 6, 2009 19:00 UTC

Microsoft have released an advisory for the exploit, it can be found here :

In addition, they have published a number of blog entries to cover their user base:



Keywords: msVidCtl zero day
8 comment(s)
Diary Archives