档案位置
https://drive.google.com/open?id=0B7TH0pBsVfD4TUROdWZVd2o2QzA
使用说明
(1)在C:底下创立资料夹!test
(2)在C:\!test底下创立以下档案，不要空白档
1.jpg
1.pdf
1.xlsx
1.pptx
1.docx
1.txt
(3)再次确认上述六个档案存在
(4)点选monitor2.vbs
增加功能：
1. 多侦测txt, pdf，office系列档案
2. F槽也放一份shutdown.exe(未来才会用到）
未来可能要增加的功能
1. shutdown.exe 找不到或无法执行的例外处理
2. 检查档案hash值
以下是source code
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
WScript.Echo "WARNING! Please copy the file C:\Windows\System32\shutdown.exe
to F:\shutdown.exe"
WScript.Echo "WARNING! Please check these file existed C:\1.jpg, C:\1.pdf,
C:\1.xlsx, C:\1.pptx, C:\1.docx, C:\1.txt"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("Wscript.Shell")
Dim honeypotLoca(6)
honeypotLoca(0) = "C:\!test\1.jpg"
honeypotLoca(1) = "C:\!test\1.pdf"
honeypotLoca(2) = "C:\!test\1.xlsx"
honeypotLoca(3) = "C:\!test\1.pptx"
honeypotLoca(4) = "C:\!test\1.docx"
honeypotLoca(5) = "C:\!test\1.txt"
'check exist
Dim b(6)
Do
For count = 0 To 5
If Not fso.FileExists(honeypotLoca(count)) Then
ws.run "shutdown.exe -s -f -t 0" ,vbhide
ws.run "cmd /c F:\shutdown.exe -s -f -t 0" ,vbhide
End If
Next
wscript.sleep 15000
Loop
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
honeypotLoca阵列里路径可以自己调整
我是猜他会C