http://www.hxwangda.com bbs.ikaka.com

networkedition - 2009-7-29 13:04:00

源代码内容如下：

CODE:

<html>
<head>
<META HTTP-EQUIV="pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Content-Type" content="text/html; charset=UTF-8">
<META HTTP-EQUIV="Cache-Control" CONTENT="no-cache, must-revalidate">
<META HTTP-EQUIV="expires" CONTENT="Wed, 26 Feb 1997 08:21:57 GMT">
<META HTTP-EQUIV="expires" CONTENT="0">
</head>

<script>
s=String(window.location.href);
mylocal=s.substring(7,s.indexOf('/',7));
t = "http://202.106.195.28:8080/index.html?Url=" + mylocal;
document.location.href = t;
</script>

<body></body>
</html>

浏览器直接访问无法打开，地址：http://202.106.195.28:8080/index.html?Url=www.hxwangda.com
今天发现解密有好几个网站都是这类源代码。

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

shadowmin - 2009-7-29 13:42:00

<html>
<head>
<META HTTP-EQUIV="pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Content-Type" content="text/html; charset=UTF-8">
<META HTTP-EQUIV="Cache-Control" CONTENT="no-cache, must-revalidate">
<META HTTP-EQUIV="expires" CONTENT="Wed, 26 Feb 1997 08:21:57 GMT">
<META HTTP-EQUIV="expires" CONTENT="0">

<link rel="stylesheet" type="text/css" href="http://202.106.195.21/aicss_bbn_21_8080.css" />
</head>

<script>
s=String(window.location.href);
var strArray=new Array();
strArray=s.split("Url=");
mylocal=strArray[1].replace(/\./g,' ');
t = "http://www.wa7.cn/getpara.asp?cid=zwwmdz&cl=" + mylocal;
document.location.href = t;
</script>

<body></body>
</html>

networkedition - 2009-7-29 14:11:00

ls上的确定一下是否有马，最好给个详细的解密思路。:kaka12:

Enao2005 - 2009-7-29 14:20:00

09kaka - 2009-7-29 15:57:00

我也看见一个这样内容的
http://vvk7.cn

shadowmin - 2009-7-29 16:07:00

在htmlview里面测试一下就知道了
应该是无毒，广告。

shadowmin - 2009-7-29 16:10:00

s=String("http://202.106.195.28:8080/index.html?Url=www.hxwangda.com");
var strArray=new Array();
strArray=s.split("Url=");
mylocal=strArray[1].replace(/\./g,' ');
t = "http://www.wa7.cn/getpara.asp?cid=zwwmdz&cl=" + mylocal;
eval(t);

瑞星卡卡安全论坛