用户系统信息：Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.802.30 Safari/535.1 SE 2.X MetaSr 1.0

Log generated by networkedition use mdecoder 0.67
[root]http://www.kf98.com/
    [iframe]http://www.kf98.com/*.htm
    [iframe]http://www.kf98.com/search.html
        [exp]http://www.kcpoo.com/sf/CUTE-IE.html(Exploit.Ie0dayCVE0806.c)
            [virus]http://www.kcpoo.com/sf/qq.exe
        [iframe]http://unstat.baidu.com/bdun.bsc?tn=whyboylove_pg&cv=0&cid=1141398&csid=242&bgcr=ffffff&ftcr=000000&urlcr=0000ff&tbsz=335&sropls=1,2,4,5,6,9&kwgp=1
            [script]http://unstat.baidu.com/code/js/fyb_1.js
    [iframe]http://www.1998w.com/
        [exp]http://www.kcpoo.com/sf/CUTE-IE.html(Exploit.Ie0dayCVE0806.c)
            [script]http://www.kcpoo.com/sf/pack.js
            [script]http://www.kcpoo.com/sf/pack.css
            [iframe]http://www.kcpoo.com/sf/flash.html
        [script]http://www.1998w.com/static/js/common.js?sip
        [script]http://www.1998w.com/static/js/portal.js?sip
        [script]http://www.1998w.com/static/js/logging.js?sip
        [script]http://www.1998w.com/template/default/portal/index/js/qiehuan.js
        [script]http://v2.jiathis.com/code/jiathis_r.js?type=left&move=0&btn=l4.gif&uid=1532774
        [script]http://www.1998w.com/home.php?mod=misc&ac=sendmail&rand=1333086093
            [exp]http://www.kcpoo.com/sf/CUTE-IE.html(Exploit.Ie0dayCVE0806.c)
    [iframe]http://www.51fali.com/
        [script]http://www.51fali.com/include/Base1.js?v=20061117
        [script]http://www.51fali.com/include/swfobject.js
        [flash]http://www.51fali.com/img/process.swf
        [flash]http://www.51fali.com/img/process.swf
        [script]http://www.google-analytics.com/urchin.js
    [iframe]http://www.1998w.com/
    [script]http://www.kf98.com/images/shd.js
    [script]http://file.chanet.com.cn/html/js/wangjinlian/wangjinlian.js?v=.js
    [script]http://file.chanet.com.cn/html/js/wangjinlian/wangjinlian2.js?v=.js

Log generated by networkedition use mdecoder 0.67
[root]http://www.kcpoo.com/sf/CUTE-IE.html(Exploit.Ie0dayCVE0806.c)
    [script]http://www.kcpoo.com/sf/pack.js
    [script]http://www.kcpoo.com/sf/pack.css
[virus]http://www.kcpoo.com/sf/qq.exe
    [iframe]http://www.kcpoo.com/sf/flash.html

Log generated by networkedition use mdecoder 0.67
[root]http://kakagg.com/(qq飞车外挂-qq农场牧场偷匪-西西游戏网-炫舞挂-dnf外挂-cf外挂-洛克王国外i挂-西西外f挂网-卡卡游戏网)
    [iframe]http://buyudaren.2288.org:808/ms12-004.htm
        [iframe]http://buyudaren.2288.org:808/1.htm
            [script]http://buyudaren.2288.org:808/1.js
            [iframe]http://buyudaren.2288.org:808/3.htm
            [iframe]http://buyudaren.2288.org:808/2.htm
                [flash]http://buyudaren.2288.org:808/nb.swf
            [flash]http://buyudaren.2288.org:808/nbwm.swf
        [exp]http://buyudaren.2288.org:808/i6.htm(Exploit.Ie0dayCVE0806.a)
            [script]http://buyudaren.2288.org:808/i1.js
            [script]http://buyudaren.2288.org:808/i2.js
            [script]http://buyudaren.2288.org:808/i3.js
            [script]http://buyudaren.2288.org:808/i4.js
            [script]http://buyudaren.2288.org:808/i5.js
            [virus]http://yxm.eatuo.com:999/mm.exe
        [script]http://js.users.51.la/4924901.js
        [iframe]http://buyudaren.2288.org:808/888.htm
        [iframe]http://buyudaren.2288.org:808/ms12-005.htm
    [script]http://kakagg.com/count.asp?cid=0
    [script]http://www.csaicc.com/1/138.js
    [iframe]http://buyudaren.2288.org:808/ms12-004.htm
    [script]http://kakagg.com/js/main.js
    [script]http://kakagg.com/adfile/banner.js
    [script]http://v2.jiathis.com/code/jia.js
    [script]http://kakagg.com/adfile/top.js
    [script]http://kakagg.com/js/searchsug.js

Log generated by networkedition use mdecoder 0.67
[root]http://www.51xxx.net/
    [script]http://www.51xxx.net/js/20008.js
    [script]http://www.51xxx.net/js/all_770_60.js
    [script]http://www.51xxx.net/other/js/resource.js
    [script]http://www.51xxx.net/other/js/searchform.js
    [script]http://www.51xxx.net/other/js/label_2.js
    [script]http://www.51xxx.net/downplusflink.js
    [iframe]http://axmaxm.68480.net/index.html
        [iframe]http://axmaxm.68480.net/nbwm.html
            [iframe]http://axmaxm.68480.net/1.htm
                [iframe]http://axmaxm.68480.net/f.htm
            [exp]http://axmaxm.68480.net/x6.htm(Exploit.Ie0dayCVE0806.a)
                [virus]http://axmaxm.68480.net/server.exe
            [iframe]http://axmaxm.68480.net/2.htm
                [exp]http://axmaxm.68480.net/of.htm(Exploit.OfficeSpreadsheet.a)
                    [script]http://axmaxm.68480.net/a.jpg
                    [script]http://axmaxm.68480.net/b.jpg
                    [script]http://axmaxm.68480.net/c.jpg
                    [virus]http://axmaxm.68480.net/server.exe

http://hao.rising.cn/123/

IE被http://hao.rising.cn/123/劫持还删除不了。