MINI

files >> C:/Windows/Temp/VPN_0EEC/detectvm.vbs
 On Error Resume Next

Dim str

Set wmi_svc = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

Set items = wmi_svc.ExecQuery("Select * from Win32_BaseBoard")

For Each item in items
	str = str & item.Manufacturer
Next

Set items = Nothing

Set items = wmi_svc.ExecQuery("Select * from Win32_ComputerSystem")

For Each item in items
	str = str & item.Manufacturer
Next

Set items = Nothing

Set wmi_svc = Nothing

str = LCase(str)

Dim ret

ret = 0

if InStr(str, "microsoft corporation") > 0 then
	ret = 1
end if

if InStr(str, "vmware") > 0 then
	ret = 1
end if

if InStr(str, "virtualbox") > 0 then
	ret = 1
end if

if InStr(str, "virtualpc") > 0 then
	ret = 1
end if

if InStr(str, "xen") > 0 then
	ret = 1
end if

if InStr(str, "hvm") > 0 then
	ret = 1
end if

if InStr(str, "domu") > 0 then
	ret = 1
end if

if InStr(str, "kvm") > 0 then
	ret = 1
end if

if InStr(str, "oracle vm") > 0 then
	ret = 1
end if

if InStr(str, "qemu") > 0 then
	ret = 1
end if

if InStr(str, "parallels") > 0 then
	ret = 1
end if

if InStr(str, "xvm") > 0 then
	ret = 1
end if

if InStr(str, "virtual") > 0 then
	ret = 1
end if

if InStr(str, "bochs") > 0 then
	ret = 1
end if

wscript.quit ret