http://orafaq.com/wiki/index.php?title=Special:Search

firefox3

****************** Sophos Anti-Virus 日志记录 - 2012/9/24 5:24:05 **************

    ...
20120924 052324        文件"C:\Users\S\AppData\Roaming\SogouExplorer\Webkit\Default\Cache\f_0000e4"属于病毒/间谍软件 'Mal/Iframe-W'。
20120924 052341        文件"C:\Users\S\AppData\Roaming\SogouExplorer\Webkit\Default\Cache\f_0000e4"已清除。
20120924 052341        病毒/间谍软件 'Mal/Iframe-W' 已删除。
      (3 个项目)

炎之使者

Category: Intrusion Prevention
Date & Time,Risk,Activity,Status,Recommended Action,IPS Alert Name,Default Action,Action Taken,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description
2012/9/24 13:33:59,High,An intrusion attempt by orafaq.com was blocked.,Blocked,No Action Required,Web Attack: Mass Injection Website,No Action Required,No Action Required,"orafaq.com (85.25.126.90, 80)",orafaq.com/wiki/index.php?title=Special:Search,"TOM (192.168.129.133, 54071)",85.25.126.90 (85.25.126.90),"TCP, www-http"
Network traffic from <b>orafaq.com/wiki/index.php?title=Special:Search</b> matches the signature of a known attack.  The attack was resulted from \DEVICE\HARDDISKVOLUME2\WIN8\AD MUNCHER4.91\ADMUNCH.EXE.  To stop being notified for this type of traffic, in the <b>Actions</b> panel, click <b>Stop Notifying Me</b>.

said411f

又是*[1].htm......