vbs病毒_vbs病毒代码_u盘vbs病毒(4)

（由于这里与上面的病毒破坏恶意修改恰好相反，故不做注释了）

set fs=createobject("ing.filesystemobject"

set dir1=fs.getspecialfolder(0)

set dir2=fs.getspecialfolder(1)

set so=createobject("ing.filesystemobject"

dim r

set r=createobject("w.shell"

r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/win32system.vbs"

r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir2&"/win32system.vbs"

r.regwrite "hklm/software/microsoft/windows/currentversion/runonce/deltree.exe","start.exe /m deltree /y "&dir1&"/start menu/programs/启动/win32system.vbs"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/norun",0,"reg_dword"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/noclose",0,"reg_dword"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodrives",0,"reg_dword"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/system/disableregistrytools",0,"reg_dword"

r.regwrite "hklm/software/microsoft/windows/currentversion/run/scanregistry","scanregw.exe /autorun"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nologoff",0,"reg_dword"

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/winoldapp/norealmode",0,"reg_dword"

r.regwrite "hklm/software/microsoft/windows/currentversion/run/win32system",""

r.regwrite "hkcu/software/microsoft/windows/currentversion/policies/explorer/nodesktop",0,"reg_dword"

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-25220-4.html