Do you think difficult to make a
computer virus?, I guess not. But if we change the question, is it easy to
eradicate computer viruses?, the answer could be "Yes" and could also "No"
(depending on our skill).
The sentence above just intermezzo, this article is not to discuss how to make a virus. But you should to know, the sample of VBScript that I want to share to you can also be used for bad purposes.
You may still remember, how ferociously attack of the virus made using VBS (Visual Basic Script), and until recently, the virus created from VBScript is still popular.
The moral for all of us, USE SCIENCE FOR GOOD PURPOSES ONLY!
Below are some examples of VBScript
that you can apply on your PC.
A. How to copy itself to a place.
Like file bat, vbs file is also able
to duplicate itself to a place.
| 1 | On error resume next |
| 2 | Dim fso, source1 |
| 3 | Set fso = CreateObject("Scripting.FileSystemObject") |
| 4 | Set source1 = fso.GetFile(Wscript.ScriptFullName) |
| 5 | source1.Copy ("d:\Ghost.vbs") |
B. Setting file attributes.
One of the VBS greatness is able to set the attributes of the file directly.
| 1 | On error resume next |
| 2 | Dim fso, f1, f2 |
| 3 | Set fso = CreateObject("Scripting.FileSystemObject") |
| 4 | Set f1 = fso.CreateTextFile("d:\Ghost.txt", True) |
| 5 | |
| 6 | Set f2 = fso.GetFile("d:\Ghost.txt") |
| 7 | f2.Attributes = 3 |
0 = Normal 2 = Hidden 4 = System
1 = ReadOnly 3 = ReadOnly + Hidden
C. Accessing and writing values to the registry.
Other VBS capability is able to take the value of the registry and add some into the registry database.
| 1 | Dim reg |
| 2 | Set reg = CreateObject("Wscript.Shell") |
| 3 | msgbox "AppData folder location is" & vbnewline & reg.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData") |
The following script will insert a value into the registry (favorite of the virus makers).
| 1 | On error resume next |
| 2 | Dim fso, source1, regedit |
| 3 | Set fso = CreateObject("Scripting.FileSystemObject") |
| 4 | Set source1 = fso.GetFile(Wscript.ScriptFullName) |
| 5 | source1.Copy ("d:\Ghost.vbs") |
| 6 | Set regedit = CreateObject("Wscript.Shell") |
| 7 |
regedit.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Test",
"d:\Ghost.vbs" |
When you run the script, it will likely be detected as a virus by antivirus.
Keyword: VBScript | Example of VBScript
|
You may also like: