Virus_LPK专杀

0x1 LPK专杀–readme

1.测试环境：XP虚拟机
2.使用方法：需要双击运行2次:
    第1次：正常开机时双击运行.
    第2次：重启开机按F8进入安全模式,双击运行.

    注:双击之前请关闭其他任何程序,并以管理员权限运行..

3.只做了简单的分析,虚拟机也不存在WinRAR

0x2 Code

@echo off
echo "清理准备开始,请按回车继续,继续之前请关闭其他任何程序..."

echo Windows Registry Editor Version 5.00 >KnownDLLLpk.reg
echo. >>KnownDLLLpk.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs] >>KnownDLLLpk.reg
echo "lpk"="lpk.dll" >>KnownDLLLpk.reg

regedit.exe /s KnownDLLLpk.reg
del /q KnownDLLLpk.reg


for /f "tokens=1,2 delims=:" %%a in ('reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Distribukcj" /v "ImagePath"') do (
    set "FilePathL=%%a"
    set "FilePathR=%%b"
)
set "FilePath=%FilePathL:~-1%:%FilePathR%"
echo %FilePath%

echo "Stop&DelService..."
net stop Distribukcj
sc delete Distribukcj

echo "DelVirusFiles..."
DEL /F /A /Q %FilePath%
DEL /F /A /Q C:\WINDOWS\Temp\SOFTWARE.LOG
::DEL /F /A /Q C:\WINDOWS\Temp\*.tmp
::DEL /F /A /Q "C:\Documents and Settings\PC\Local Settings\Temp\*.tmp"

for %%a in (c d e f g h i j k l m n o p q r s t u v w x y z) do (
    del /f /s /a /q  %%a:\lpk.dll
    del /f /s /a /q  %%a:\hra33.dll
    del /f /s /a /q  %%a:\RECYCLER\*.*
)

exit(0)

0x3 Sample

请确认样本只用来测试,密码国际惯例.
资源：(http://download.csdn.net/download/ahoo110/9930472)