挂马 bbs.ikaka.com

qihuakai - 2009-5-25 1:20:00

www.prcqq.cn/qqshandong/13-3.html（中國QQ站）
www.020ups.com/(UPS快递公司)
www.hdjwx.com（红杜鹃文学网）
www.hz-redshield.com.cn（菏泽红盾信息网）
www.singee-pearl.com（心艺珍珠饰品网）
www.kd56.com（广州市红白蓝市内快递有限公司）
www.orafi.com.cn（北京握拉菲首饰有限公司）
www.go8abc.com(咕吧天下八卦网)
www.srebook.com( 北京春雨教育书店)
www.gthu.cn/news_list.asp?classid=21&da=0
ask.bioon.com/qlist.asp?sortid=&classid=10
www.jxzx.net/lm
www.iac55.cn/wm/GVxxz.htm

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

networkedition - 2009-5-25 9:40:00

Log is generated by FreShow.
[wide]http://www.prcqq.cn/qqshandong/13-3.html
[script]http://www.prcqq.cn/js/top.js
[script]http://www.prcqq.cn/qqshandong/js/1.js
[script]http://www.prcqq.cn/js/listad1.js
[script]http://www.prcqq.cn/js/youxia.js
[script]http://www.prcqq.cn/js/tongji.js
[script]http://www.prcqq.cn/js/\"http:\/\/count.pee.cn\/giveout.aspx?tid=2&webid=10334\"
[script]http://c2.pee.cn/show.aspx?pk=6970956353954A1CC7A5241FA03500F3&tt=633788413490781250&tid=2&webid=10334&fromip=218.247.215.232&fromurl=http%3a%2f%2flocalhost%2f&server=c2.pee.cn
[script]http://c2.pee.cn/js/rlx.js
[script]http://www.prcqq.cn/js/\"http:\/\/js.tongji.cn.yahoo.com\/1006611\/ystat.js\"
[script]http://www.prcqq.cn/js/http:\/\/www.kun-520.cn\/%31.gif
[frame]http://www.kun-520.cn/\"http://xcbnr.c%6E:338/b148610/b14.htm\"(ms失效)
[script]http://www.prcqq.cn/js/listadqq.js

networkedition - 2009-5-25 9:42:00

Log is generated by FreShow.
[wide]http://www.iac55.cn/wm/GVxxz.htm
[object]http://www.7gan.org/1.exe

networkedition - 2009-5-25 9:44:00

Log is generated by FreShow.
[wide]http://www.020ups.com/（UPS快递公司)
[script]http://%77%76%67%32%2E%63%6E
[frame]http://26c26.3322.org/a/a4.htm?5
[frame]http://26c26.3322.org/a/163.htm
[frame]http://26c26.3322.org/a/ggqm.htm
[object]http://li3bn.3322.org/web/activex.exe
[script]http://26c26.3322.org/a/js.js
[frame]http://26c26.3322.org/a/gg14.htm
[script]http://26c26.3322.org/a/14.js
[object]http://exe316.com/web/xp.exe
[script]http://26c26.3322.org/a/15.js
[script]http://26c26.3322.org/a/16.js
[frame]http://26c26.3322.org/a/ggfl.htm
[frame]http://26c26.3322.org/a/ggff.htm
[frame]http://26c26.3322.org/a/ggvod.htm
[frame]http://26c26.3322.org/a/z.htm
[frame]http://26c26.3322.org/a/e.htm
[frame]http://26c26.3322.org/a/ggbb.htm
[frame]http://26c26.3322.org/a/ggr.htm
[script]http://26c26.3322.org/a/\"http:\/\/js.tongji.cn.yahoo.com\/1081637\/ystat.js\"
[script]http://s6.cnzz.com/stat.php?id=1408285&web_id=1408285
[script]http://%77%76%67%34%2E%63%6E
[script]http://s90.cnzz.com/stat.php?id=1035628&web_id=1035628&show=pic
[script]http://%77%76%67%32%2E%63%6E
[script]http://%77%76%67%34%2E%63%6E

networkedition - 2009-5-25 9:46:00

Log is generated by FreShow.
[wide]http://www.hdjwx.com（红杜鹃文学网）
[script]http://www.hdjwx.com/js/0006.js
[script]http://www.hdjwx.com/js/0000.js
[script]http://www.hdjwx.com/js/0006.js
[script]http://www.hdjwx.com/js/0000.js
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=15
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=9
[script]http://www.hdjwx.com/tjnews.asp?n=9
[script]http://www.hdjwx.com/month3.js
[script]http://www.hdjwx.com/month_dp.js
[script]http://www.hdjwx.com/tj.js
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=8
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=5
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=3
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=6
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=4
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=2
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=7
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=1
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=10
[script]http://www.hdjwx.com/allnews.asp?n=8&typeid=11
[script]http://www.hdjwx.com/seephoto/001.js
[script]http://office2.viens.la/office.js?do=list&uid=193&type=blog
[script]http://www.hdjwx.com/tj_mb/count.asp?style=2
[script]http://www.hdjwx.com/tj/online.asp
[script]http://%76%76%6B%31%2E%63%6E（所挂链接地址）
[script]http://%76%76%6B%31%2E%63%6E

networkedition - 2009-5-25 9:47:00

Log is generated by FreShow.
[wide]http://www.hz-redshield.com.cn（菏泽红盾信息网）
[script]http://www.hz-redshield.com.cn/pic.js
[script]http://www.hz-redshield.com.cn/voto/vote.asp?top=1
[script]http://www.hz-redshield.com.cn/news/list_gundong.asp
[script]http://%6D%62%72%33%2E%63%6E
[script]http://%77%76%67%32%2E%63%6E
[script]http://www.hz-redshield.com.cn/news/lyjs.asp?classid=17&Nclassid=45
[frame]http://www.hz-redshield.com.cn/backup/040113/xinxi/new10.asp
[script]http://www.hz-redshield.com.cn/file:///I|/红盾20050728备份/count/mystat.asp?style=text
[script]http://%31%31%37%6C%61%2E%63%6E
[script]http://%77%76%67%32%2E%63%6E（所挂链接地址）

networkedition - 2009-5-25 9:49:00

Log is generated by FreShow.
[wide]http://www.singee-pearl.com（（心艺珍珠饰品网）
）
[script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556
[frame]http://zwwderff.cn/09/0009.htm（所挂链接地址）
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://csson.ch.ma/about:blank
[frame]http://ddv.sarl.tk/cnzz1.html
[frame]http://count41.51yes.com/sa.aspx?id=419175949&refe='+window.parent.location+'&location=http%3A//'+paramsArr[0]+'&color=32x&resolution=1280x1024&returning=0&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29
[script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556
[script]http://www.singee-pearl.com/move_ad.js
[frame]http://www.singee-pearl.com/singee_link/link.asp
[script]http://count8.51yes.com/click.aspx?id=88815797&logo=1
[script]http://www.singee-pearl.com/esky_counter/mystat.asp?style=no
[script]http://csson.ch.ma/css.js?width=700&height=600&keyword=uf556

networkedition - 2009-5-25 9:50:00

Log is generated by FreShow.
[wide]http://www.kd56.com（（广州市红白蓝市内快递有限公司））
[script]http://playe.gaming.cx/asd.js?s=201&col=ffdd00
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://zwwderff.cn/09/0009.htm
[frame]http://playe.gaming.cx/about:blank
[frame]http://ddv.sarl.tk/cnzz1.html
[frame]http://count41.51yes.com/sa.aspx?id=419175949&refe='+window.parent.location+'&location=http%3A//'+paramsArr[0]+'&color=32x&resolution=1280x1024&returning=0&language=zh-cn&ua=Mozilla/4.0%20%28compatible%3B%20MSIE%206.0%3B%20Windows%20NT%205.1%3B%20SV1%3B%20.NET%20CLR%202.0.50727%3B%20.NET%20CLR%203.0.04506.30%29

networkedition - 2009-5-25 9:52:00

Log is generated by FreShow.
[wide]http://www.srebook.com（( 北京春雨教育书店)）
[script]http://%77%76%67%32%2E%63%6E
[script]http://%77%76%67%33%2E%63%6E
[script]http://%77%76%67%34%2E%63%6E
[script]http://www.srebook.com/script/func.js
[frame]http://www.srebook.com/*.html
[script]http://count25.51yes.com/click.aspx?id=250253504&logo=12
[script]http://s60.cnzz.com/stat.php?id=232208&web_id=232208&show=pic
[script]http://%77%76%67%32%2E%63%6E
[script]http://%77%76%67%33%2E%63%6E
[script]http://%77%76%67%34%2E%63%6E

networkedition - 2009-5-25 9:53:00

Log is generated by FreShow.
[wide]http://www.gthu.cn/news_list.asp?classid=21&da=0（中国钢铁物流网）
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://r01.3322.org/c.js
[script]http://r01.3322.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://r01.3322.org/c.js
[script]http://r01.3322.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://3b3.org/c.js
[script]http://www.gthu.cn/count1/index.asp

networkedition - 2009-5-25 9:55:00

Log is generated by FreShow.
[wide]http://ask.bioon.com/qlist.asp?sortid=&classid=10（生物知道 - 生物谷旗下网站）
[script]http://c.%6Euclear3.com/css/c.js（失效）
[script]http://c.%6Euclear3.com/css/c.js
[script]http://ask.bioon.com/js/ask_category_list.js
[script]http://ask.bioon.com/js/ask_general.js
[script]http://ask.bioon.com/js/ajax_WhoAmI.js
[script]http://js.tongji.cn.yahoo.com/683737/ystat.js

networkedition - 2009-5-25 9:56:00

Log is generated by FreShow.
[wide]http://www.jxzx.net/lm（靖西在线）
[script]http://r01.3322.org/c.js
[frame]http://95fere5.8866.org/a/a100.htm
[frame]http://95fere5.8866.org/a/163.htm
[frame]http://95fere5.8866.org/a/ggqm.htm
[object]http://li3bn.3322.org/web/activex.exe
[script]http://95fere5.8866.org/a/js.js
[frame]http://95fere5.8866.org/a/gg14.htm
[script]http://95fere5.8866.org/a/14.js
[object]http://exe316.com/web/xp.exe
[script]http://95fere5.8866.org/a/15.js
[script]http://95fere5.8866.org/a/16.js
[frame]http://95fere5.8866.org/a/ggfl.htm
[frame]http://95fere5.8866.org/a/ggff.htm
[frame]http://95fere5.8866.org/a/ggvod.htm
[frame]http://95fere5.8866.org/a/z.htm
[frame]http://95fere5.8866.org/a/e.htm
[frame]http://95fere5.8866.org/a/ggbb.htm
[frame]http://95fere5.8866.org/a/ggr.htm
[script]http://95fere5.8866.org/a/\"http:\/\/js.tongji.cn.yahoo.com\/1083501\/ystat.js\"
[script]http://s31.cnzz.com/stat.php?id=1408284&web_id=1408284
[frame]http://95fere5.8866.org/a/a100.htm
[script]http://r01.3322.org/\"http:\/\/js.tongji.cn.yahoo.com\/908507\/ystat.js\"
[script]http://www.jxzx.net/images/topm1.gif
[frame]http://www.jxzx.net/new.asp?id=0
[script]http://r01.3322.org/c.js

清水_无忧 - 2009-5-25 17:16:00

www.hz-re**hield.com.cn被嵌入了3个不同的恶意地址，但存在指向http://26c26.3**2.org/**/*.htm?5页面的共性，然后经过多次跳转:kaka6: 后下载了:kaka7: 2个病毒文件。

清水_无忧 - 2009-5-25 17:17:00

www.prcqq.cn/qqshandong/13-3.html（中國QQ站）打不开了
www.020ups.com/(UPS快递公司)没有被挂
www.hdjwx.com（红杜鹃文学网）恶意连接已经:kaka9: 实效
www.singee-pearl.com也没有了挂马

清水_无忧 - 2009-5-25 17:40:00

www.go8abc.com
www.srebook.com
http://www.gthu.cn/news_list.asp?classid=21&da=0
www.jxzx.net/lm均被挂马，手段极其相似，但瑞星同样可以拦截
www.iac55.cn/wm/GVxxz.htm被挂马，瑞星查到http://www.7gan.org/1.exe文件是病毒

:kaka11: 其他没有发现恶意代码:kaka12:

瑞星卡卡安全论坛