本帖最后由 schweik60 于 2016-3-5 20:02 编辑
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="x-dns-prefetch-control" content="on" />
<link rel="dns-prefetch" href="http://intercept.onedns.net" />
<link rel="dns-prefetch" href="http://fast.onedns.net" />
<link rel="dns-prefetch" href="http://jf.revolvermaps.com" />
<link rel="dns-prefetch" href="http://rf.revolvermaps.com" />
<link rel="dns-prefetch" href="http://pagead2.googlesyndication.com/" />
<link rel="dns-prefetch" href="http://googleads.g.doubleclick.net/" />
<link rel="dns-prefetch" href="http://big.g.doubleclick.net/" />
<link rel="dns-prefetch" href="http://www.onedns.net" />
<link rel="dns-prefetch" href="http://www.mwsl.pw" />
<link rel="dns-prefetch" href="http://www.mwsl.org.cn" />
<title>oneDNS block system</title>
</head>
<body>
<script type="text/javascript">
var mobileAgent = new Array("iphone", "ipod", "ipad", "android", "mobile", "blackberry", "webos", "incognito", "webmate", "bada", "nokia", "lg", "ucweb", "skyfire");
var browser = navigator.userAgent.toLowerCase();
var isMobile = false;
for (var i=0; i<mobileAgent.length; i++){ if (browser.indexOf(mobileAgent)!=-1){ isMobile = true;
//alert(mobileAgent);
location.href = 'http://intercept.onedns.net/mobile';
break; } }
</script>
<a href="javascript:countDown"></a>
<script language="javascript" type="">
document.write('<script type="text/javascript" src="/test.php?ref='+location.href+'"><\/script>');
if (/MSIE (\d+\.\d+);/.test(navigator.userAgent) || /MSIE(\d+\.\d+);/.test(navigator.userAgent)){
var referLink = document.createElement('a');
referLink.href = "http://intercept.onedns.net/index.php";
document.body.appendChild(referLink);
referLink.click();
} else {
location.href = "http://intercept.onedns.net/index.php";
}
</script>
</body>
</html>
txt打开内容如上，看其中的网址，似乎和onedns有关，下午切了onedns后，开始出现在临时文件夹中。上传virusscan后，发现十余个杀软报毒，但几乎都是bd系的，比如bd，emsisoft、360、FS、escan、G-data等。 |
发表于 2016-3-5 19:59:37
楼主
