『第
6 楼』:
Quote: | Originally posted by qasa at 2007-4-4 10:49:
美中不足之处就是不能一观楼主的源代码,可惜~~~~~~~~
|
|
修改过的锁不住的regedit.exe
Dim WshSHell,FSO
On Error Resume Next
Set WshSHell = WScript.CreateObject("WScript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WinVer = WshSHell.Environment("Process")
Set Args = WScript.Arguments
CloseTime = 5
FileName = WScript.ScriptName
FileFullName = WScript.ScriptFullName
FilePath = FSO.GetParentFolderName(FileFullName)
InsPath = FSO.GetSpecialFolder(1)
InsFullName = FSO.BuildPath(InsPath ,FileName)
LnkPathNT = WshSHell.SpecialFolders(2)
LnkPath9X = WshSHell.SpecialFolders(14)
LnkPathAll = WshSHell.SpecialFolders("StartMenu")
If WinVer("OS") = "Windows_NT" Then
OtherFileName="REGEDIT.XP"
else
OtherFileName="REGEDIT.9X"
end if
OtherFilePath=FSO.GetSpecialFolder(0)
TemFileName="regedit.com"
TemFilePath=FSO.GetSpecialFolder(2)
Copyright="玲珑科技"
QQ="QQ:25926183"
Email="Email:fty1995@163.com"
InsTitle="锁不住的注册表"
InsAnswer="解除/释放注册表"
RegPath1="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\"
RegForm1="REG_SZ"
RegPath2="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\command\"
RegValue2="wscript.exe "&InsFullName
RegForm2="REG_SZ"
RegPath3="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"
RegForm3="REG_DWORD"
RegPath4="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\HiddenReg-QQ25926183"
RegForm4="REG_DWORD"
if WshSHell.RegRead(RegPath3) = "1" then
RegValue1="释放注册表"
RegValue3 = 1
msgsrting="已锁定!"
else
RegValue1="锁定注册表"
RegValue3 = 0
msgsrting="未锁定!"
end if
IF FileFullName <> InsFullName then
intAnswer = MsgBox("【是】将“"+ InsAnswer +"”加入到我的电脑右键菜单,"&Chr(10)&Chr(10)&"【否】将“"+ InsAnswer +"”从我的电脑右键菜单删除。 ", vbQuestion + vbYesNoCancel, "安装 - "+ InsTitle +" - "+ Copyright)
If intAnswer = vbYes Then
WshSHell.RegWrite RegPath1,RegValue1,RegForm1
WshSHell.RegWrite RegPath2,RegValue2,RegForm2
WshSHell.RegWrite RegPath3,RegValue3,RegForm3
WshSHell.RegWrite RegPath4,RegValue3,RegForm3
FSO.GetFile(FileFullName).Copy(InsFullName)
'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.exe")).Copy(FSO.BuildPath(OtherFilePath,"regedit.bak"))
'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.exe")'''删除原regedit.exe
If (FSO.FileExists(FSO.BuildPath(FilePath,OtherFileName))) Then
FSO.GetFile(FSO.BuildPath(FilePath,OtherFileName)).Copy(FSO.BuildPath(OtherFilePath,TemFileName))
else
If WinVer("OS") = "Windows_NT" Then
Call alltovbsy
else
Call alltovbse
end if
end if
Call CreateCodeFile
WshSHell.popup _
"添加脚本文件:"+chr(10)+InsFullName+chr(10)+chr(10)+ _
"添加执行文件:"+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _
"添加注册表项:"+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _
chr(10) &"当前注册表项:"+ msgsrting +chr(10) + _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "安装成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
If intAnswer = vbNo Then
WshSHell.RegDelete RegPath4
WshSHell.RegDelete RegPath3
WshSHell.RegDelete RegPath2
WshSHell.RegDelete RegPath1
FSO.DeleteFile InsFullName
FSO.DeleteFile FSO.BuildPath(OtherFilePath,TemFileName)
'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.bak")'''卸载时删除修改过的regedit.exe
'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.bak")).Copy(FSO.BuildPath(OtherFilePath,"regedit.exe"))'''恢复原regedit.exe
WshSHell.popup _
"删除脚本文件:"+chr(10)+InsFullName+chr(10)+chr(10)+ _
"删除执行文件:"+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _
"删除注册表项:"+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "卸载成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
If intAnswer = vbCancel Then
end if
ELSE
if WshSHell.RegRead(RegPath3) = "1" then
WshSHell.RegWrite RegPath3, 0, "REG_DWORD"
WshSHell.RegWrite RegPath4, 0, "REG_DWORD"
WshSHell.RegWrite RegPath1,"锁定注册表"
WshShell.popup chr(10) &_
"注册表编辑器已解除锁定。"+ chr(10) &chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "锁定系统注册表 - "+ InsTitle +" - "+ Copyright, 0 + 64
else
WshSHell.RegWrite RegPath3, 1, "REG_DWORD"
WshSHell.RegWrite RegPath4, 1, "REG_DWORD"
WshSHell.RegWrite RegPath1,"释放注册表"
WshShell.popup chr(10) &_
"注册表编辑器已经锁定。"+ chr(10) &chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _
, CloseTime, "解除注册表锁定 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
End IF
Set WshSHell = Nothing
Set FSO = Nothing
Set Args = Nothing
WScript.Quit(0) 为何病毒所不住注册表呢,因为正常 锁定/解锁 操作的注册表键值是DisableRegistryTools,值为1则锁定,0为解锁。
而修改过的regedit中的DisableRegistryTools值被更改为HiddenReg-QQ25926183,所以操作此HiddenReg-QQ25926183值为1或0才能锁定和解锁注册表。
[ Last edited by baomaboy on 2007-4-4 at 01:49 PM ]
|