http://astrovastuworld.com/pyra-18.html

firefox3

****************** Sophos Anti-Virus 日志记录 - 2012/9/23 17:02:35 **************

    ...
20120923 170145        文件"C:\Users\S\AppData\Roaming\SogouExplorer\Webkit\Default\Cache\f_00003b"属于病毒/间谍软件 'Troj/ObfJS-O'。
20120923 170145        文件"C:\Users\S\AppData\Roaming\SogouExplorer\Temp\__SEHttpCache__\6280\2888\pyra-18.html"属于病毒/间谍软件 'Troj/ObfJS-O'。
      (2 个项目)

炎之使者

Category: Intrusion Prevention
Date & Time,Risk,Activity,Status,Recommended Action,IPS Alert Name,Default Action,Action Taken,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description
2012/9/24 10:57:09,High,An intrusion attempt by astrovastuworld.com was blocked.,Blocked,No Action Required,Web Attack: Malicious Toolkit Website,No Action Required,No Action Required,"astrovastuworld.com (129.121.186.229, 80)",astrovastuworld.com/pyra-18.html,"TOM (192.168.129.133, 49564)",129.121.186.229 (129.121.186.229),"TCP, www-http"
Network traffic from <b>astrovastuworld.com/pyra-18.html</b> matches the signature of a known attack.  The attack was resulted from \DEVICE\HARDDISKVOLUME1\USERS\JOHN\APPDATA\LOCAL\GOOGLE\CHROME\APPLICATION\CHROME.EXE.  To stop being notified for this type of traffic, in the <b>Actions</b> panel, click <b>Stop Notifying Me</b>.

said411f