Ie suddenly found that it could not move back, busy looking for me to see. The following is my analysis, which proves that my words and deeds are very effective.
This is usually caused by JS on the page. Pay attention to anti-virus.
Access http://bbs.55bbs.com, ViewSource code:
When you look at the domain name, you will find it strange. Get http://test.whatthisdown.com/ad.js, as shown below:
Http://test.whatthisdown.com/prompt page not found, no problem, continue to follow up http://www.zhaowoooool.com
So cool, three at a moment, the first http://www.zhaowoooool.com/ajax.htm
BD96C556-65A3-11D0-983A-00C04FC29E36, nsfocus on a search, actually is a MS06-014, speechless...
Next the second http://www.zhaowoooool.com/Ms07004.html, the content is encrypted very BT, I built a textarea and then directly document. getelementbyid ("mytext"). innertext in, see the decoded:
Sure enough, look at the name will know will be disappointed, the last http://www.zhaowoooool.com/dns.htm, the same as directly look at the decoded:
It is MS06-014, I thought that the 0 day, GF is very angry, said "too no technical content": ppppp