VBS版MBR保护器

大家好，今天我们来聊聊mbr保护器。mbr俗称（master boot record)是启动时必不可少的引导文件，被改写之后会造成严重的后果。所以我给大家准备了一个mbr防护系统：

 

' Define global variables
Const LOG_FILE = "C:\AntiVirusLog.txt"
Const MONITOR_FOLDER = "C:\MonitoredFolder"
Const MBR_PROTECT_SCRIPT = "C:\ProtectMBR.vbs"

Set fso = CreateObject("Scripting.FileSystemObject")
Set shell = CreateObject("WScript.Shell")
Set network = CreateObject("WScript.Network")

' Initialize log file
Sub InitLogFile()
    If Not fso.FileExists(LOG_FILE) Then
        Set logFile = fso.CreateTextFile(LOG_FILE, True)
        logFile.WriteLine("Antivirus Log Initialized: " & Now)
        logFile.Close
    End If
End Sub

' Log events
Sub LogEvent(eventType, message)
    Set logFile = fso.OpenTextFile(LOG_FILE, 8, True)
    logFile.WriteLine("[" & Now & "] [" & eventType & "] " & message)
    logFile.Close
End Sub

' Monitor folder for changes
Sub MonitorFolder()
    Do
        Set folder = fso.GetFolder(MONITOR_FOLDER)
        For Each file In folder.Files
            If IsMalicious(file.Name) Then
                file.Delete True
                LogEvent "Malware Detected", "Deleted file: " & file.Name
            End If
        Next
        WScript.Sleep 5000
    Loop
End Sub

' Check if the file is malicious
Function IsMalicious(fileName)
    IsMalicious = False
    ' Example of simple check (this should be replaced with real logic)
    If InStr(fileName, "malware") > 0 Then
        IsMalicious = True
    End If
End Function

' Protect MBR
Sub ProtectMBR()
    ' Simplified example of MBR protection
    Set protectMBRFile = fso.CreateTextFile(MBR_PROTECT_SCRIPT, True)
    protectMBRFile.WriteLine("Set fso = CreateObject(""Scripting.FileSystemObject"")")
    protectMBRFile.WriteLine("Set shell = CreateObject(""WScript.Shell"")")
    protectMBRFile.WriteLine("Set network = CreateObject(""WScript.Network"")")
    protectMBRFile.WriteLine("shell.Run ""cmd.exe /c echo Your MBR is protected!""")
    protectMBRFile.Close
    shell.Run "wscript.exe " & MBR_PROTECT_SCRIPT, 0, False
End Sub

' Main program
InitLogFile()
LogEvent "Startup", "Antivirus script started"
ProtectMBR()
MonitorFolder()