Jul 7 08:02:08 192.x.x.x 139.175.236.72 1434 => 80 (WAN1) 48 B
Jul 7 08:02:08 172.x.x.x 139.175.236.72 2924 => 80 (WAN1) 48 B
Jul 7 08:02:07 192.x.x.x 139.175.236.82 1778 => 80 (WAN1) 52 B
Jul 7 08:02:07 192.x.x.x 139.175.236.82 1777 => 80 (WAN1) 52 B
Jul 7 08:02:07 192.x.x.x 139.175.236.82 1776 => 80 (WAN1) 52 B
Jul 7 08:02:06 192.x.x.x 139.175.236.82 1038 => 80 (WAN1) 48 B
Jul 7 08:02:06 192.x.x.x 139.175.236.73 1950 => 80 (WAN1) 48 B

從防火牆可以看出這些電腦有部份連線連接139.175.236的網段...
又從NetLimit觀察出連到這個網段的程式有Firefox與Thundbird..
請問示中木馬還是FireFox or thundbird的正常連線 ..
因為tracert回去為seednet的ip..

beaver

查出來了...
原來msn or shutterstock
的網頁都會連結到這個網段