Log is generated by FreShow.
[wide]http://www.desktx.com/
    [script]http://www.desktx.com/templates/pc/indexflash.js
    [script]http://drmcmm.baidu.com/js/m.js
    [script]http://pagead2.googlesyndication.com/pagead/show_sdo.js
    [script]http://pagead2.googlesyndication.com/pagead/show_ads.js
    [script]http://pagead2.googlesyndication.com/pagead/show_ads.js
    [script]http://pagead2.googlesyndication.com/pagead/show_ads.js
    [script]http://pagead2.googlesyndication.com/pagead/show_ads.js
    [script]http://a.alimama.cn/inf.js
    [script]http://www.desktx.com/d/js/acmsd/thea30.js
        [frame]http://1saefw.qvod-setvp.com:171/360/index.html?id=3002
            [object]http://1saefw.qvod-setvp.com:171/360/me-.html?id=3002
                [object]http://1saefw.qvod-setvp.com:171/360/3002/a.jpg
                        [object]http://my.me-1.info:8886/Down/my/3002.exe
    [script]http://a.alimama.cn/inf.js
    [script]http://s61.cnzz.com/stat.php?id=1819431&web_id=1819431

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)

XOR BD，密钥为bd

密钥可以通过猜，猜的话就是shellcode中有很多相同的内容的字符，还有就是enumxor的枚举，再就是使用od调试。使用enumxor枚举时需要将代码整理不能有多余的字符标点符号等。