中国DOS联盟

TaskKill("logo1_.exe");
TaskKill("rundl132.exe");
var form1 = new Form;
form1.Run();
function Form()
{
	var IE = WSH.GetObject("", "InternetExplorer.Application");
	IE.ToolBar = 0;
	IE.StatusBar = 0;
	IE.Width = 350;
	IE.Height = 90;
	IE.Navigate("about:blank");
	var document = IE.document;
	document.body.scroll = "no";
	var window = document.parentWindow;
	document.body.charset = "gb2312";
	document.bgColor = "menu";
	document.body.style.border = 0;
	document.title = "Logo1_.exe 病毒清除工具";
	function AddControl(obj)
	{
		document.body.appendChild(obj);
	}
	function FileBox()
	{
		var obj = document.createElement("input");
		obj.type = "file";
		return obj;
	}
	function Button(text)
	{
		var obj = document.createElement("input");
		obj.type = "button";
		obj.value = text;
		return obj;
	}
	this.Run = function()
	{
		var btnKill = new Button("清除病毒");
		var filebox = new FileBox;
		AddControl(filebox);
		AddControl(btnKill);
		btnKill.onclick = btnKill_Clicked;
		IE.Visible = true;
		try
		{
			while(!window.closed) WSH.Sleep(1000);
		}
		catch(err)
		{}
		function btnKill_Clicked()
		{
			if(filebox.value && Check(filebox.value))
			{
				if(window.confirm("发现病毒，是否清除？"))
				{
					try
					{
						Backup(filebox.value);
					}
					catch(Err){}
					Clear(filebox.value);
					window.alert("清除了一个病毒。");
				}
			}
			else
			{
				window.alert("未发现病毒。");
			}
		}
	}
}
function TaskKill(Process)
{
	var WinMgmts = GetObject("WinMgmts://127.0.0.1");
	var ProcList = WinMgmts.ExecQuery("select * from win32_process");
	var ProcList = new Enumerator(ProcList);
	while(!ProcList.atEnd())
	{
		if(ProcList.item().Name.toLowerCase() == Process.toLowerCase())
			ProcList.item().terminate();
		ProcList.moveNext();
	}
}
function Check(SourcePath)
{
	var Code = "MZKERNEL32.DLL\x00\x00LoadLibraryA\x00\x00\x00\x00GetProcAddress";
	var Stream = new ActiveXObject("Adodb.Stream");
	Stream.Open();
	Stream.Charset = "gb2312";
	Stream.LoadFromFile(SourcePath);
	var Body = Stream.ReadText(46);
	Stream.Close();
	return Body==Code;
}
function Clear(SourcePath)
{
	var Stream = new ActiveXObject("Adodb.Stream");
	Stream.Open();
	Stream.LoadFromFile(SourcePath);
	var Body = Stream.ReadText(500 * 1024);
	Stream.Close();
	var Match = "";
	while(Match.length < 21) Match += "\x00";
	Match += "MZ";
	var C = 0, Temp = "";
	while(C< Body.length && Temp.indexOf(Match) <0)
	{
		var Uni = Body.substr(C, 1000);
		C += 1000;
		Temp += Decode(Uni);
	}
	var Position = Temp.indexOf(Match) + 21;
	Stream.Type = 1;
	Stream.Open();
	Stream.LoadFromFile(SourcePath);
	Stream.Position = Position;
	Body = Stream.Read();
	Stream.Position = 0;
	Stream.SetEOS();
	Stream.Write(Body);
	Stream.SaveToFile(SourcePath, 2);
	Stream.Close();
	while(Check(SourcePath)) Clear(SourcePath);
}
function Backup(SourcePath)
{
	var FSO = new ActiveXObject("Scripting.FileSystemObject");
	var File = FSO.GetFile(SourcePath);
	File.Copy(SourcePath + ".logo1_vir", false);
}
function Decode(text)
{
	return text.replace(/([\u0000-\uffff])/g, function($1)
	{
		var uni = $1.charCodeAt(0).toString(16);
		while(uni.length < 4) uni = "0" + uni;
		uni = uni.replace(/(\w{2})(\w{2})/g, "%$2%$1");
		return unescape(uni);
	});
}