Log generated by 是昔流芳 use mdecoder 0.67
[root]http://bbs.wushu2008.cn/( 中华国术论坛  - Powered by Discuz!)
    [script]http://bbs.wushu2008.cn/forumdata/cache/common.js?rm1
    [script]http://60.190.236.11:8000/stat.js?ad_中华国术论坛_670X80
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
            [script]http://36007.8866.org:6677/a/pps.js
            [virus]http://232yaf.3322.org:6677/a/mc.exe
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)
        [exp]http://36007.8866.org:6677/a/ads.html(Exploit.Ie0dayCVE0806.a)


用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6

我纠结了 最近这个家伙入侵了很多网站，而且挂马方式都一样，确切说是一个人，因为3322域名都是一样的，
俩域名都是指向一台服务器




Log is generated by FreShow.
[wide]http://bbs.wushu2008.cn/
    [script]http://bbs.wushu2008.cn/forumdata/cache/common.js?rm1
    [script]http://60.190.236.11:8000/stat.js?ad_中华国术论坛_670X80
        [frame]http://36007.8866.org:6677/a/ads.html
            [object]http://232yaf.3322.org:6677/a/mc.exe
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html
        [frame]http://36007.8866.org:6677/a/ads.html

在看看这个也是一样的  确切说是一个人

Log is generated by FreShow.
[wide]http://bbs.522shop.com
[script]http://bbs.522shop.com/forumdata/cache/common.js?eeM
[script]http://60.190.236.11:8000/stat.js?ad_sjwjw_670X80
[frame]http://36007.8866.org:6677/a/ads.html
[object]http://232yaf.3322.org:6677/a/mc.exe
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[frame]http://36007.8866.org:6677/a/ads.html
[script]http://bbs.522shop.com/pic.php
[script]http://count34.51yes.com/click.aspx?id=340800901&logo=9

Log is generated by FreShow.
[wide]http://bbs.wushu2008.cn
    [script]http://bbs.wushu2008.cn/forumdata/cache/common.js?rm1
    [script]http://60.190.236.11:8000/stat.js?ad_中华国术论坛_670X80
        [frame]http://36007.2288.org:6677/a/ads.html
            [script]http://js.tongji.linezing.com/1676183/tongji.js
                [object]http://232ajf.3322.org:6677/a/alg.exe
            [script]http://36007.2288.org:6677/a/pps.js
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html
        [frame]http://36007.2288.org:6677/a/ads.html