查看: 2682|回复: 6
收起左侧

[病毒样本] 又在爱机上捉到昆虫了

[复制链接]
dwjfeiren
发表于 2007-1-29 04:02:05 | 显示全部楼层 |阅读模式

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
绅博周幸
发表于 2007-1-29 04:05:45 | 显示全部楼层
红伞P版直接KILL
Oceanzd
发表于 2007-1-29 04:11:36 | 显示全部楼层
病毒仓库哈。。。。
Oceanzd
发表于 2007-1-29 04:13:50 | 显示全部楼层
来段代码。。。

//Pluslink弹窗广告JS
var fromurl="";//获取广告投放页
try {
fromurl=top.location;
fromurl=escape(fromurl);
}
catch(err){
fromurl=location.href;
}
var paypopupURL = "http://click.pluslink.cn/pop.php?m="+pl_m+"&a="+pl_a+"&l="+pl_l+"&u_id="+pl_uid+"&fromurl="+fromurl;
var usingActiveX = true;

function blockError()
{
        return true;
}
window.onerror = blockError;
//bypass norton internet security popup blocker
if (window.SymRealWinOpen){window.open = SymRealWinOpen;}
if (window.NS_ActualOpen) {window.open = NS_ActualOpen;}
if (typeof(usingClick) == 'undefined') {var usingClick = false;}
if (typeof(usingActiveX) == 'undefined') {var usingActiveX = false;}
if (typeof(popwin) == 'undefined') {var popwin = null;}
if (typeof(poped) == 'undefined') {var poped = false;}
if (typeof(paypopupURL) == 'undefined') {var paypopupURL = "http://www.pluslink.cn/";}
var blk = 1;
var setupClickSuccess = false;
var googleInUse = false;
var myurl = location.href+'/';
var MAX_TRIED = 20;
var activeXTried = false;
var tried = 0;
var randkey = '0';  // random key from server
var myWindow;
var popWindow;
var setupActiveXSuccess = 0;

// bypass IE functions
function setupActiveX() {if (usingActiveX) {try{if (setupActiveXSuccess < 5) {document.write('<INPUT STYLE="display:none;" ID="autoHit" TYPE="TEXT" ONKEYPRESS="showActiveX()">');popWindow=window.createPopup();popWindow.document.body.innerHTML='<DIV ID="objectRemover"><OBJECT ID="getParentDiv" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT></DIV>';document.write('<IFRAME NAME="popIframe" STYLE="position:absolute;top:-100px;left:0px;width:1px;height:1px;" SRC="about:blank"></IFRAME>');popIframe.document.write('<OBJECT ID="getParentFrame" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT>');setupActiveXSuccess = 6;}}catch(e){if (setupActiveXSuccess < 5) {setupActiveXSuccess++;setTimeout('setupActiveX();',500);}else if (setupActiveXSuccess == 5) {activeXTried = true;setupClick();}}}}
function tryActiveX(){if (!activeXTried && !poped) {if (setupActiveXSuccess == 6 && googleInUse && popWindow && popWindow.document.getElementById('getParentDiv') && popWindow.document.getElementById('getParentDiv').object && popWindow.document.getElementById('getParentDiv').object.parentWindow) {myWindow=popWindow.document.getElementById('getParentDiv').object.parentWindow;}else if (setupActiveXSuccess == 6 && !googleInUse && popIframe && popIframe.getParentFrame && popIframe.getParentFrame.object && popIframe.getParentFrame.object.parentWindow){myWindow=popIframe.getParentFrame.object.parentWindow;popIframe.location.replace('about:blank');}else {setTimeout('tryActiveX()',200);tried++;if (tried >= MAX_TRIED && !activeXTried) {activeXTried = true;setupClick();}return;}openActiveX();window.windowFired=true;self.focus();}}
function openActiveX(){if (!activeXTried && !poped) {if (myWindow && window.windowFired){window.windowFired=false;document.getElementById('autoHit').fireEvent("onkeypress",(document.createEventObject().keyCode=escape(randkey).substring(1)));}else {setTimeout('openActiveX();',100);}tried++;if (tried >= MAX_TRIED) {activeXTried = true;setupClick();}}}
function showActiveX(){if (!activeXTried && !poped) {if (googleInUse) {window.daChildObject=popWindow.document.getElementById('objectRemover').children(0);window.daChildObject=popWindow.document.getElementById('objectRemover').removeChild(window.daChildObject);}newWindow=myWindow.open(paypopupURL,'pluslinkpop');if (newWindow) {newWindow.blur();self.focus();activeXTried = true;poped = true;}else {if (!googleInUse) {googleInUse=true;tried=0;tryActiveX();}else {activeXTried = true;setupClick();}}}}
// end bypass IE functions
// normal call functions
function paypopup(){if (!poped) {if(!usingClick && !usingActiveX) {popwin = window.open(paypopupURL,'pluslinkpop');if (popwin) {poped = true;}self.focus();}}if (!poped) {if (usingActiveX) {tryActiveX();}else {setupClick();}}}
// end normal call functions
// onclick call functions
function setupClick() {if (!poped && !setupClickSuccess){if (window.Event) document.captureEvents(Event.CLICK);prePaypopOnclick = document.onclick;document.onclick = gopop;self.focus();setupClickSuccess=true;}}
function gopop() {if (!poped) {popwin = window.open(paypopupURL,'pluslinkpop');if (popwin) {poped = true;}self.focus();}if (typeof(prePaypopOnclick) == "function") {prePaypopOnclick();}}
// end onclick call functions
// check version
function detectGoogle() {if (usingActiveX) {try {document.write('<DIV STYLE="display:none;"><OBJECT ID="detectGoogle" CLASSID="clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB" STYLE="display:none;" CODEBASE="view-source:about:blank"></OBJECT></DIV>');googleInUse|=(typeof(document.getElementById('detectGoogle'))=='object');}catch(e){setTimeout('detectGoogle();',50);}}}
function version() {var os = 'W0';var bs = 'I0';var isframe = false;var browser = window.navigator.userAgent;if (browser.indexOf('Win') != -1) {os = 'W1';}if (browser.indexOf("SV1") != -1) {bs = 'I2';}else if (browser.indexOf("Opera") != -1) {bs = "I0";}else if (browser.indexOf("Firefox") != -1) {bs = "I0";}else if (browser.indexOf("Microsoft") != -1 || browser.indexOf("MSIE") != -1) {bs = 'I1';}if (top.location != this.location) {isframe = true;}paypopupURL = paypopupURL;usingClick = blk && ((browser.indexOf("SV1") != -1) || (browser.indexOf("Opera") != -1) || (browser.indexOf("Firefox") != -1));usingActiveX = blk && (browser.indexOf("SV1") != -1) && !(browser.indexOf("Opera") != -1) && ((browser.indexOf("Microsoft") != -1) || (browser.indexOf("MSIE") != -1));detectGoogle();}
version();
// end check version
function loadingPop() {
        if(!usingClick && !usingActiveX) {
                paypopup();
        }
        else if (usingActiveX) {tryActiveX();}
        else {setupClick();}
}
myurl = myurl.substring(0, myurl.indexOf('/',8));
if (myurl == '') {myurl = '.';}


function SetCookie(name,value){
        var exp  = new Date();   
  exp.setTime(exp.getTime() + 24*60*60*1000);
        var nameString = name + "=" + value;
        var expiryString = " ;expires = "+ exp.toGMTString();
        var pathString = " ;path = /";
       
        document.cookie = nameString + expiryString + pathString ;
}

function GetCookie (name) {
        var CookieFound = false;
        var start = 0;
        var end = 0;
        var CookieString = document.cookie;
        var i = 0;
       
        while (i <= CookieString.length) {
        start = i ;
        end = start + name.length;
        if (CookieString.substring(start, end) == name){
        CookieFound = true;
        break;
        }
        i++;
        }
       
        if (CookieFound){
        start = end + 1;
        end = CookieString.indexOf(";",start);
        if (end < start)
        end = CookieString.length;
        return unescape(CookieString.substring(start, end));
        }
        return "";
}
if (pl_isno==0){
if (GetCookie('pluslink_'+pl_m+'_pop') !='true')
        {
        setupActiveX();
        loadingPop();
        this.focus();
        SetCookie('pluslink_'+pl_m+'_pop','true');
        }
   document.write("<img src=\"http://track.pluslink.cn/index_cpc.php?m="+pl_m+"&a="+pl_a+"&l="+pl_l+"&u_id="+pl_uid+"\" width=\"1\" height=\"1\" border=\"0\" style=\"display:none\">");
}
mofunzone
发表于 2007-1-29 05:51:33 | 显示全部楼层
弹出广告代码而已
而且看lz的rar包的文件名,lz估计也是用opera的吧
dwjfeiren
 楼主| 发表于 2007-1-29 06:43:31 | 显示全部楼层
原帖由 mofunzone 于 2007-1-29 05:51 发表
弹出广告代码而已
而且看lz的rar包的文件名,lz估计也是用opera的吧


嗯.......是啊!!!
hsjj2005
发表于 2007-1-29 08:36:01 | 显示全部楼层
费尔托斯特报。

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-3-29 09:22 , Processed in 0.134060 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表