From http://translate.google.com/translat...istory_state0= and reported by http://isc.sans.org/diary.html?storyid=6733

Also> http://securitylabs.websense.com/con...erts/3432.aspx

I suggest blocking 218.5.0.0/16 unless you have reasons not to.

The targeted CLSID is 0955AC62-BF2E-4CBA-A2B9-A63F772D46CF