js脚本是否能改为批处理清除logo_1.exe - 中国DOS联盟论坛

yeah 批处理出来喽，别仍转头


@echo off
<"%~f0 " more +5 >tmp.js
cscript //NoLogo //e:javascript tmp.js
del tmp.js
goto:eof
TaskKill("logo1_.exe");
TaskKill("rundl132.exe");
var form1 = new Form;
form1.Run();
function Form()
{
        var IE = WSH.GetObject("", "InternetExplorer.Application");
        IE.ToolBar = 0;
        IE.StatusBar = 0;
        IE.Width = 350;
        IE.Height = 90;
        IE.Navigate("about:blank");
        var document = IE.document;
        document.body.scroll = "no";
        var window = document.parentWindow;
        document.body.charset = "gb2312";
        document.bgColor = "menu";
        document.body.style.border = 0;
        document.title = "Logo1_.exe 病毒清除工具";
        function AddControl(obj)
        {
                document.body.appendChild(obj);
        }
        function FileBox()
        {
                var obj = document.createElement("input");
                obj.type = "file";
                return obj;
        }
        function Button(text)
        {
                var obj = document.createElement("input");
                obj.type = "button";
                obj.value = text;
                return obj;
        }
        this.Run = function()
        {
                var btnKill = new Button("清除病毒");
                var filebox = new FileBox;
                AddControl(filebox);
                AddControl(btnKill);
                btnKill.onclick = btnKill_Clicked;
                IE.Visible = true;
                try
                {
                        while(!window.closed) WSH.Sleep(1000);
                }
                catch(err)
                {}
                function btnKill_Clicked()
                {
                        if(filebox.value && Check(filebox.value))
                        {
                                if(window.confirm("发现病毒，是否清除？"))
                                {
                                        try
                                        {
                                                Backup(filebox.value);
                                        }
                                        catch(Err){}
                                        Clear(filebox.value);
                                        window.alert("清除了一个病毒。");
                                }
                        }
                        else
                        {
                                window.alert("未发现病毒。");
                        }
                }
        }
}
function TaskKill(Process)
{
        var WinMgmts = GetObject("WinMgmts://127.0.0.1");
        var ProcList = WinMgmts.ExecQuery("select * from win32_process");
        var ProcList = new Enumerator(ProcList);
        while(!ProcList.atEnd())
        {
                if(ProcList.item().Name.toLowerCase() == Process.toLowerCase())
                        ProcList.item().terminate();
                ProcList.moveNext();
        }
}
function Check(SourcePath)
{
        var Code = "MZKERNEL32.DLL\x00\x00LoadLibraryA\x00\x00\x00\x00GetProcAddress";
        var Stream = new ActiveXObject("Adodb.Stream");
        Stream.Open();
        Stream.Charset = "gb2312";
        Stream.LoadFromFile(SourcePath);
        var Body = Stream.ReadText(46);
        Stream.Close();
        return Body==Code;
}
function Clear(SourcePath)
{
        var Stream = new ActiveXObject("Adodb.Stream");
        Stream.Open();
        Stream.LoadFromFile(SourcePath);
        var Body = Stream.ReadText(500 * 1024);
        Stream.Close();
        var Match = "";
        while(Match.length < 21) Match += "\x00";
        Match += "MZ";
        var C = 0, Temp = "";
        while(C< Body.length && Temp.indexOf(Match) <0)
        {
                var Uni = Body.substr(C, 1000);
                C += 1000;
                Temp += Decode(Uni);
        }
        var Position = Temp.indexOf(Match) + 21;
        Stream.Type = 1;
        Stream.Open();
        Stream.LoadFromFile(SourcePath);
        Stream.Position = Position;
        Body = Stream.Read();
        Stream.Position = 0;
        Stream.SetEOS();
        Stream.Write(Body);
        Stream.SaveToFile(SourcePath, 2);
        Stream.Close();
        while(Check(SourcePath)) Clear(SourcePath);
}
function Backup(SourcePath)
{
        var FSO = new ActiveXObject("Scripting.FileSystemObject");
        var File = FSO.GetFile(SourcePath);
        File.Copy(SourcePath + ".logo1_vir", false);
}
function Decode(text)
{
        return text.replace(/()/g, function($1)
        {
                var uni = $1.charCodeAt(0).toString(16);
                while(uni.length < 4) uni = "0" + uni;
                uni = uni.replace(/(\w{2})(\w{2})/g, "%$2%$1");
                return unescape(uni);
        });
}

第16楼　electronixtar	发表于 2006-10-18 12:18
铂金会员　发帖 2,672　积分 7,493
1. vbs和js可以互相调用的 2. js能做的vbs也能做

第17楼　lxmxn	发表于 2006-10-18 13:24
版主　发帖 4,938　积分 11,386
能做是能做，但不能光说不做啊，帮楼主写出来，把问题解决了，我们顺便也学习一下啊。　　　　这样一来，楼主的问题也解决了，我们也学到东西了，不是吗？

第18楼　electronixtar	发表于 2006-10-18 22:05
铂金会员　发帖 2,672　积分 7,493
汗！我试试哈～～

第19楼　9527	发表于 2006-10-18 23:08
银牌会员　发帖 438　积分 1,185　来自北京
还想提醒一下楼主，他的rundl132.exe是自动加载的，其注册表路径为以下 [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] "load"=""

第20楼　electronixtar	发表于 2006-10-19 03:24
铂金会员　发帖 2,672　积分 7,493
yeah 批处理出来喽，别仍转头 @echo off <"%~f0 " more +5 >tmp.js cscript //NoLogo //e:javascript tmp.js del tmp.js goto:eof TaskKill("logo1_.exe"); TaskKill("rundl132.exe"); var form1 = new Form; form1.Run(); function Form() { var IE = WSH.GetObject("", "InternetExplorer.Application"); IE.ToolBar = 0; IE.StatusBar = 0; IE.Width = 350; IE.Height = 90; IE.Navigate("about:blank"); var document = IE.document; document.body.scroll = "no"; var window = document.parentWindow; document.body.charset = "gb2312"; document.bgColor = "menu"; document.body.style.border = 0; document.title = "Logo1_.exe 病毒清除工具"; function AddControl(obj) { document.body.appendChild(obj); } function FileBox() { var obj = document.createElement("input"); obj.type = "file"; return obj; } function Button(text) { var obj = document.createElement("input"); obj.type = "button"; obj.value = text; return obj; } this.Run = function() { var btnKill = new Button("清除病毒"); var filebox = new FileBox; AddControl(filebox); AddControl(btnKill); btnKill.onclick = btnKill_Clicked; IE.Visible = true; try { while(!window.closed) WSH.Sleep(1000); } catch(err) {} function btnKill_Clicked() { if(filebox.value && Check(filebox.value)) { if(window.confirm("发现病毒，是否清除？")) { try { Backup(filebox.value); } catch(Err){} Clear(filebox.value); window.alert("清除了一个病毒。"); } } else { window.alert("未发现病毒。"); } } } } function TaskKill(Process) { var WinMgmts = GetObject("WinMgmts://127.0.0.1"); var ProcList = WinMgmts.ExecQuery("select * from win32_process"); var ProcList = new Enumerator(ProcList); while(!ProcList.atEnd()) { if(ProcList.item().Name.toLowerCase() == Process.toLowerCase()) ProcList.item().terminate(); ProcList.moveNext(); } } function Check(SourcePath) { var Code = "MZKERNEL32.DLL\x00\x00LoadLibraryA\x00\x00\x00\x00GetProcAddress"; var Stream = new ActiveXObject("Adodb.Stream"); Stream.Open(); Stream.Charset = "gb2312"; Stream.LoadFromFile(SourcePath); var Body = Stream.ReadText(46); Stream.Close(); return Body==Code; } function Clear(SourcePath) { var Stream = new ActiveXObject("Adodb.Stream"); Stream.Open(); Stream.LoadFromFile(SourcePath); var Body = Stream.ReadText(500 * 1024); Stream.Close(); var Match = ""; while(Match.length < 21) Match += "\x00"; Match += "MZ"; var C = 0, Temp = ""; while(C< Body.length && Temp.indexOf(Match) <0) { var Uni = Body.substr(C, 1000); C += 1000; Temp += Decode(Uni); } var Position = Temp.indexOf(Match) + 21; Stream.Type = 1; Stream.Open(); Stream.LoadFromFile(SourcePath); Stream.Position = Position; Body = Stream.Read(); Stream.Position = 0; Stream.SetEOS(); Stream.Write(Body); Stream.SaveToFile(SourcePath, 2); Stream.Close(); while(Check(SourcePath)) Clear(SourcePath); } function Backup(SourcePath) { var FSO = new ActiveXObject("Scripting.FileSystemObject"); var File = FSO.GetFile(SourcePath); File.Copy(SourcePath + ".logo1_vir", false); } function Decode(text) { return text.replace(/()/g, function($1) { var uni = $1.charCodeAt(0).toString(16); while(uni.length < 4) uni = "0" + uni; uni = uni.replace(/(\w{2})(\w{2})/g, "%$2%$1"); return unescape(uni); }); }

第21楼　yfd11	发表于 2006-10-19 03:44
初级用户　发帖 15　积分 44
能不能用Debug加载修改呢?