Log is generated by FreShow.
[wide]http://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset
    [script]http://nokia.mobile.it168.com/forumdata/cache/common.js?Xox
    [frame]http://168.it168.com/newimage/20090814/nokia.html
    [script]http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?Xox
    [script]http://google.08.cn/js/google.js?ad_it168.com_420x760
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
            [script]http://ferrari14.3322.org:9999/wm/c039644/pack.js
            [script]http://ferrari14.3322.org:9999/wm/c039644/pack.css
                [object]http://a.brsqb.cn:9999/y/c03.exe
            [script]http://count42.51yes.com/click.aspx?id=425571802&logo=12
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari14.3322.org:9999/wm/c039644/c03.htm
        [frame]http://google.08.cn/css/css.html
        [frame]http://google.08.cn/css/css.html
    [script]http://stat.it168.com/pv.js
    [script]http://it168.wrating.com/a1.js
    [script]http://168.it168.com/js/175.js
    [script]http://168.it168.com/js/177.js
    [script]http://stat.it168.com/google/pv.js

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

关于:hxxp://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset解密的日志(全体输出 -  22):

Level  0>http://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset
Level  1>http://stat.it168.com/google/pv.js
Level  1>http://168.it168.com/js/177.js
Level  1>http://168.it168.com/js/175.js
Level  2>http://168.it168.com/adjs/175.js?rnd=20100315123440175
Level  3>http://adshow.it168.com/newimage/20091130/sebbs.html
Level  4>http://view.atdmt.com/mch/view/183987734/direct/01
Level  2>http://168.it168.com/show/175.js
Level  1>http://it168.wrating.com/a.gif?a=&
Level  1>http://it168.wrating.com/a1.js
Level  1>http://stat.it168.com/pv.js
Level  1>http://google.08.cn/js/google.js?ad_it168.com_420x760
Level  2>http://google.08.cn/css/css.html
Level  2>http://ferrari15.9966.org:9999/wm/c039644/c03.htm
Level  3>http://count42.51yes.com/click.aspx?id=425571802&logo=12
Level  4>http://count42.51yes.com/sa.aspx?id=425571802+yesdata+
Level  3>http://ferrari15.9966.org:9999/wm/c039644/pack.css
Level  4>http://a.brsqb.cn:9999/y/c03.exe
Level  3>http://ferrari15.9966.org:9999/wm/c039644/pack.js
Level  1>http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?xox
Level  1>http://168.it168.com/newimage/20090814/nokia.html
Level  1>http://nokia.mobile.it168.com/forumdata/cache/common.js?xox

日志由 Redoce2.0第15次修正版于 2010-3-15 16:47:11 生成。

Log is generated by FreShow.
[wide]http://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset
    [script]http://nokia.mobile.it168.com/forumdata/cache/common.js?Xox
    [frame]http://168.it168.com/newimage/20090814/nokia.html
    [script]http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?Xox
    [script]http://google.08.cn/js/google.js?ad_it168.com_420x760
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
            [script]http://ferrari15.8866.org:9999/wm/c039644/pack.js
            [script]http://ferrari15.8866.org:9999/wm/c039644/pack.css
                [object]http://a.brsqb.cn:9999/y/c03.exe
            [script]http://count42.51yes.com/click.aspx?id=425571802&logo=12
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://ferrari15.8866.org:9999/wm/c039644/c03.htm
        [frame]http://www.hmgc.com.cn/css/main.html
        [frame]http://www.hmgc.com.cn/css/main.html
    [script]http://stat.it168.com/pv.js
    [script]http://it168.wrating.com/a1.js
    [script]http://168.it168.com/js/175.js
    [script]http://168.it168.com/js/177.js
    [script]http://stat.it168.com/google/pv.js

这个俗套了,BD,不过这次代替%u的用的是CUTEQQ,变成6个的了`嘿嘿

关于:hxxp://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset解密的日志(全体输出 -  21):

Level  0>http://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset
Level  1>http://stat.it168.com/google/pv.js
Level  1>http://168.it168.com/js/177.js
Level  2>http://168.it168.com/adjs/177.js?rnd=20100315123303177
Level  2>http://168.it168.com/show/177.js
Level  1>http://168.it168.com/js/175.js
Level  1>http://it168.wrating.com/a1.js
Level  1>http://stat.it168.com/pv.js
Level  1>http://nokia.mobile.it168.com/images/common/online_member.gif
Level  1>http://nokia.mobile.it168.com/=13
Level  1>http://google.08.cn/js/google.js?ads_it168.com_42Ox76O
Level  2>http://www.hmgc.com.cn/css/main.html
Level  2>http://ferrari15.8866.org:9999/wm/c039644/c03.htm
Level  3>http://count42.51yes.com/click.aspx?id=425571802&logo=12
Level  3>http://ferrari15.8866.org:9999/wm/c039644/pack.css ●
Level  4>http://b.164t.com:9999/y/c03.exe ●
Level  3>http://ferrari15.8866.org:9999/wm/c039644/pack.js
Level  1>http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?uO9
Level  1>http://168.it168.com/newimage/20090814/nokia.html
Level  1>http://nokia.mobile.it168.com/=27
Level  1>http://nokia.mobile.it168.com/forumdata/cache/common.js?uO9

日志由 Redoce2.0第88次修正版于 2010-3-15 19:43:21 生成。


这个网马的地址怎么还总变呢？？

关于:hxxp://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset解密的日志(全体输出 -  15):

Level  1>http://nokia.mobile.it168.com/forumdata/cache/common.js?hfM
Level  2>http://stat.it168.com/google/pv.js
Level  2>http://168.it168.com/js/177.js
Level  2>http://168.it168.com/js/175.js
Level  2>http://it168.wrating.com/a1.js
Level  2>http://stat.it168.com/pv.js
Level  2>http://60.190.236.11:8000/stat.js?ad_nokia.mobile.it168.com_420x760同时更新网通电信的数据及模板缓存
Level  3>http://www.hmgc.com.cn/css/main.html
Level  3>http://ferrari15.3322.org:9999/wm/c039644/c03.htm
Level  4>http://count42.51yes.com/click.aspx?id=425571802&logo=12
Level  4>http://ferrari15.3322.org:9999/wm/c039644/pack.css
Level  5>http://b.164t.com:9999/y/c03.exe
Level  4>http://ferrari15.3322.org:9999/wm/c039644/pack.js
Level  2>http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?hfM
Level  2>http://168.it168.com/newimage/20090814/nokia.html

日志由 Redoce2.0第88次修正版于 2010-3-16 19:54:23 生成。

Log is generated by FreShow.
[wide]http://nokia.mobile.it168.com/redirect.php?fid=187&tid=787969&goto=nextnewset
    [script]http://nokia.mobile.it168.com/forumdata/cache/common.js?IAM
    [frame]http://168.it168.com/newimage/20090814/nokia.html
    [script]http://nokia.mobile.it168.com/forumdata/cache/viewthread.js?IAM
    [script]http://60.190.236.11:8000/stat.js?1TI68_κiξsΦψㄖゐ｜①⊙￡★й▓
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
            [frame]http://aa.qvodeddw.com:811/17/index.htm
                [object]http://wm6.dwefsd.com:81/aa/s1/s17.exe
            [script]http://ferrari16.6600.org:811/new/\"http://js.tongji.linezing.com/1247403/tongji.js\"
            [script]http://ferrari16.6600.org:811/new/\"http://js.tongji.linezing.com/1530019/tongji.js\"
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://ferrari16.6600.org:811/new/17.html?a3
        [frame]http://www.hmgc.com.cn/css/css.html
        [frame]http://www.hmgc.com.cn/css/css.html
    [script]http://stat.it168.com/pv.js
    [script]http://it168.wrating.com/a1.js
    [script]http://168.it168.com/js/175.js
    [script]http://168.it168.com/js/177.js
    [script]http://stat.it168.com/google/pv.js