其实叫any2vbs更准确，因为经这段代码转换后的文件本就是vbs，只不过出于某种需要(应用环境 渗透/入侵)才又将vbs转为bat。
'Any2Bat.vbs by zzzEVAzzz
Dim WshSHell,FSO
On Error Resume Next
Set WshSHell = WScript.CreateObject("WScript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WinVer = WshSHell.Environment("Process")
Set Args = WScript.Arguments
CloseTime = 5
FileName = WScript.ScriptName
FileFullName = WScript.ScriptFullName
FilePath = FSO.GetParentFolderName(FileFullName)
InsPath = FSO.GetSpecialFolder(1)
InsFullName = FSO.BuildPath(InsPath ,FileName)
LnkPathNT = WshSHell.SpecialFolders(2)
LnkPath9X = WshSHell.SpecialFolders(14)
LnkPathAll = WshSHell.SpecialFolders("SendTo")
OtherFileName="Manage_New.txt"
OtherFilePath=FSO.GetSpecialFolder(2)
TemFileName="无标题"
TemFilePath=FSO.GetSpecialFolder(2)
Copyright="玲珑科技"
QQ="QQ:25926183"
Email="Email：
fty1995@163.com"
InsTitle="Any2Bat by zzzEVAzzz"
InsAnswer="Any2Bat by zzzEVAzzz"
RegPath1="HKEY_CLASSES_ROOT\*\shell\AnyToBat\"
RegValue1="转换为批处理文件"
RegForm1="REG_SZ"
RegPath2="HKEY_CLASSES_ROOT\*\shell\AnyToBat\command\"
RegValue2="wscript.exe " & chr(34) & InsFullName & chr(34) & " " & chr(34) & "%L" & chr(34)
RegForm2="REG_SZ"
IF FileFullName <> InsFullName then
intAnswer = MsgBox("【是】将“"+ InsAnswer +"”加入到右键菜单，"&Chr(10)&Chr(10)&"【否】将“"+ InsAnswer +"”从右键菜单删除。 ", vbQuestion + vbYesNoCancel, "安装 - "+ InsTitle +" - "+ Copyright)
If intAnswer = vbYes Then
WshSHell.RegWrite RegPath1,RegValue1,RegForm1
WshSHell.RegWrite RegPath2,RegValue2,RegForm2
FSO.GetFile(FileFullName).Copy(InsFullName)
WshSHell.popup _
"添加脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _
"添加注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10)+ _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "安装成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
If intAnswer = vbNo Then
WshSHell.RegDelete RegPath2
WshSHell.RegDelete RegPath1
FSO.DeleteFile InsFullName
WshSHell.popup _
"删除脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _
"删除注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10)+ _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "卸载成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
If intAnswer = vbCancel Then
end if
ELSE
if Args.count=0 then wscript.quit
with CreateObject("ADODB.Stream")
.type=1:.open:.loadfromfile Args(0):bs=.read:l=.size:.close
end with
if err.number<>0 then wscript.quit
with fso.opentextfile(Args(0)&".bat",2,true)
if err.number<>0 then wscript.quit
.writeline "@echo bs=_>xx.vbs"
for k=1 to l step 129
.write "@echo """
.write b64b(midb(bs,k,129))
.writeline """+_>>xx.vbs"
next
.writeline "@echo """":set rs=CreateObject(""ADODB.Recordset"")>>xx.vbs"
.writeline "@echo set ado=CreateObject(""ADODB.Stream"")>>xx.vbs"
.writeline "@echo l=len(bs):ss="""":for k=1 to l step 4096:ss=ss+ub64(mid(bs,k,4096)):next:l=len(ss)>>xx.vbs"
.writeline "@echo rs.fields.append ""b"",205,l/2:rs.open:rs.addnew:rs(""b"")=ss+chrb(0):rs.update>>xx.vbs"
.writeline "@echo ado.mode=3:ado.type=1:ado.open:ado.write rs(""b"").getchunk(l/2)>>xx.vbs"
.writeline "@echo ado.savetofile """+fso.getfilename(Args(0))+""",2:ado.close>>xx.vbs"
.writeline "@echo function ub64(s):dim t(4),b(3):ub64="""":n=len(s):r=2 >>xx.vbs"
.writeline "@echo if n mod 4^<^>0 then exit function:end if:for i=1 to n step 4:for j=0 to 3 >>xx.vbs"
.writeline "@echo a=asc(mid(s,i+j,1)):if a=43 then:a=62:else if a=47 then:a=63:else if a^>47 and a^<58 then:_>>xx.vbs"
.writeline "@echo a=a+4:else if a=61 then:a=0:if r=2 then r=j-2:end if:else if a^>64 and a^<91 then:_>>xx.vbs"
.writeline "@echo a=a-65:else if a^>96 and a^<123 then:a=a-71:else:exit function:_>>xx.vbs"
.writeline "@echo end if:end if:end if:end if:end if:end if:t(j)=a:next>>xx.vbs"
.writeline "@echo b(0)=t(0)+t(1)*64 mod 256:b(1)=t(1)\4+t(2)*16 mod 256:b(2)=t(2)\16+t(3)*4 >>xx.vbs"
.writeline "@echo for j=0 to r:if b(j)^<16 then ub64=ub64+""0"":end if:ub64=ub64+hex(b(j))>>xx.vbs"
.writeline "@echo next:next:end function>>xx.vbs&&cscript.exe //nologo xx.vbs&del xx.vbs"
end with
const b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
function b64b(bin)
b64b=""
n=lenb(bin)
for i=1 to n step 3
a=ascb(midb(bin,i,1))
b64b=b64b+mid(b64,a mod 64+1,1)
if i<n then
b=ascb(midb(bin,i+1,1))
b64b=b64b+mid(b64,(a\64+b*4)mod 64+1,1)
if i+1<n then
c=ascb(midb(bin,i+2,1))
b64b=b64b+mid(b64,(b\16+c*16)mod 64+1,1)
b64b=b64b+mid(b64,c\4+1,1)
else
b64b=b64b+mid(b64,b\16+1,1)
b64b=b64b+"="
end if
else
b64b=b64b+mid(b64,a\64+1,1)
b64b=b64b+"=="
end if
next
end function
end if
Set WshSHell = Nothing
Set FSO = Nothing
Set Args = Nothing
WScript.Quit(0)
Last edited by baomaboy on 2007-12-15 at 07:33 PM ]
