防毒第二策略→锁不住的注册表→VBS版 - 中国DOS联盟论坛

Originally posted by qasa at 2007-4-4 10:49:

美中不足之处就是不能一观楼主的源代码，可惜~~~~~~~~


Dim WshSHell,FSO
On Error Resume Next
Set WshSHell = WScript.CreateObject("WScript.Shell")
Set FSO = CreateObject("Scripting.FileSystemObject")
Set WinVer = WshSHell.Environment("Process")
Set Args = WScript.Arguments
CloseTime = 5
FileName = WScript.ScriptName
FileFullName = WScript.ScriptFullName
FilePath = FSO.GetParentFolderName(FileFullName)
InsPath = FSO.GetSpecialFolder(1)
InsFullName = FSO.BuildPath(InsPath ,FileName)
LnkPathNT = WshSHell.SpecialFolders(2)
LnkPath9X = WshSHell.SpecialFolders(14)
LnkPathAll = WshSHell.SpecialFolders("StartMenu")
If WinVer("OS") = "Windows_NT" Then
OtherFileName="REGEDIT.XP"
else
OtherFileName="REGEDIT.9X"
end if
OtherFilePath=FSO.GetSpecialFolder(0)
TemFileName="regedit.com"
TemFilePath=FSO.GetSpecialFolder(2)
Copyright="玲珑科技"
QQ="QQ:25926183"
Email="Email:fty1995@163.com"
InsTitle="锁不住的注册表"
InsAnswer="解除/释放注册表"
RegPath1="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\"
RegForm1="REG_SZ"
RegPath2="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\command\"
RegValue2="wscript.exe "&InsFullName
RegForm2="REG_SZ"
RegPath3="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"
RegForm3="REG_DWORD"
RegPath4="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\HiddenReg-QQ25926183"
RegForm4="REG_DWORD"
if WshSHell.RegRead(RegPath3) = "1" then
RegValue1="释放注册表"
RegValue3 = 1
msgsrting="已锁定！"
else
RegValue1="锁定注册表"
RegValue3 = 0
msgsrting="未锁定！"
end if
IF FileFullName <> InsFullName then
intAnswer = MsgBox("【是】将“"+ InsAnswer +"”加入到我的电脑右键菜单，"&Chr(10)&Chr(10)&"【否】将“"+ InsAnswer +"”从我的电脑右键菜单删除。 ", vbQuestion + vbYesNoCancel, "安装 - "+ InsTitle +" - "+ Copyright)
    If intAnswer = vbYes Then
WshSHell.RegWrite RegPath1,RegValue1,RegForm1
WshSHell.RegWrite RegPath2,RegValue2,RegForm2
WshSHell.RegWrite RegPath3,RegValue3,RegForm3
WshSHell.RegWrite RegPath4,RegValue3,RegForm3
FSO.GetFile(FileFullName).Copy(InsFullName)
'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.exe")).Copy(FSO.BuildPath(OtherFilePath,"regedit.bak"))
'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.exe")'''删除原regedit.exe
If (FSO.FileExists(FSO.BuildPath(FilePath,OtherFileName))) Then
FSO.GetFile(FSO.BuildPath(FilePath,OtherFileName)).Copy(FSO.BuildPath(OtherFilePath,TemFileName))
else
If WinVer("OS") = "Windows_NT" Then
Call alltovbsy
else
Call alltovbse
end if
end if
Call CreateCodeFile
WshSHell.popup _
"添加脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _
"添加执行文件："+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _
"添加注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _
chr(10) &"当前注册表项："+ msgsrting +chr(10) + _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C)  " + Copyright +"   " & QQ &"   " + Email _
, CloseTime, "安装成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
        If intAnswer = vbNo Then
WshSHell.RegDelete RegPath4
WshSHell.RegDelete RegPath3
WshSHell.RegDelete RegPath2
WshSHell.RegDelete RegPath1
FSO.DeleteFile InsFullName
FSO.DeleteFile FSO.BuildPath(OtherFilePath,TemFileName)
'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.bak")'''卸载时删除修改过的regedit.exe
'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.bak")).Copy(FSO.BuildPath(OtherFilePath,"regedit.exe"))'''恢复原regedit.exe
WshSHell.popup _
"删除脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _
"删除执行文件："+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _
"删除注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C)  " + Copyright +"   " & QQ &"   " + Email _
, CloseTime, "卸载成功 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
        If intAnswer = vbCancel Then
end if
ELSE
if WshSHell.RegRead(RegPath3) = "1" then
WshSHell.RegWrite RegPath3, 0, "REG_DWORD"
WshSHell.RegWrite RegPath4, 0, "REG_DWORD"
WshSHell.RegWrite RegPath1,"锁定注册表"
WshShell.popup chr(10) &_
"注册表编辑器已解除锁定。"+ chr(10) &chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C)  " + Copyright +"   " & QQ &"   " + Email _
, CloseTime, "锁定系统注册表 - "+ InsTitle +" - "+ Copyright, 0 + 64
else
WshSHell.RegWrite RegPath3, 1, "REG_DWORD"
WshSHell.RegWrite RegPath4, 1, "REG_DWORD"
WshSHell.RegWrite RegPath1,"释放注册表"
WshShell.popup chr(10) &_
"注册表编辑器已经锁定。"+ chr(10) &chr(10) & _
chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _
chr(10) & "Copyright(C)  " + Copyright +"   " & QQ &"   " + Email _
, CloseTime, "解除注册表锁定 - "+ InsTitle +" - "+ Copyright, 0 + 64
end if
End IF
Set WshSHell = Nothing
Set FSO = Nothing
Set Args = Nothing
WScript.Quit(0)

为何病毒所不住注册表呢，因为正常锁定/解锁操作的注册表键值是DisableRegistryTools，值为1则锁定，0为解锁。
而修改过的regedit中的DisableRegistryTools值被更改为HiddenReg-QQ25926183，所以操作此HiddenReg-QQ25926183值为1或0才能锁定和解锁注册表。

[ Last edited by baomaboy on 2007-4-4 at 01:49 PM ]

第1楼　baomaboy	发表于 2007-03-17 16:22
银牌会员　发帖 554　积分 1,513
防毒第二策略→锁不住的注册表→VBS版在防毒第一策略中我们只是锁住了注册表Run项，这里我们要锁的是注册表全局（反过来也可以防止病毒锁注册表全局)。 IE默认首页被改，默认首选搜索页被改为病毒网址，运行regedit却出现”管理员禁用注册表编辑器。“窗口，虽然我们有多种办法（reg，js，vbs，inf，杀软)解锁注册表，但和病毒你争我夺很烦人，一劳永逸的办法是用十六进制编辑器修改regedit.exe中默认DisableRegistryTools值为其他值，这相当于换了一把锁，这样病毒就找不到入口而锁不住你的注册表。由于xp系统特有的系统文件保护功能，安装后可能提示系统文件被替换而自动恢复为原来的，所以添加了regedit.com备用，只运行regedit不加exe扩展名，由于com优先exe执行。上传两个文件：一个是从简考虑vbs文件集成了regedit.exe，但由于文件臃肿，可能配置低的机子加载时缓慢，（要等3、5秒）第二个将regedit.exe放在了同目录下，安装时直接复制不用读取生产新文件的代码了自然运行时毫无迟钝了，建议配置低的机子使用。明明只有98.4k却不让上传，说超过100k限制，可能计算方法不同吧，只好把第一个文件放到上传系统中了。第一个集成regedit.exe的文件: http://zhenlove.com.cn/cndos/fileup/files/Hidden_Registry1.rar [ Last edited by baomaboy on 2007-3-18 at 03:25 AM ] 附件 Hidden_Registry2.rar (56.49 KiB) 1.GIF (21.22 KiB)

第2楼　baomaboy	发表于 2007-03-17 16:38
银牌会员　发帖 554　积分 1,513
另外本来是分别为9x系统和xp系统分别准备了两个regedit.exe发帖前调试发现win9x下的同样可以用于xp系统，所以为了减小体积，只留下9x的使用。两个文件分别是： win9x中的124k winxp中的129k 如果有出现版本不兼容的情况，请告诉我。 [ Last edited by baomaboy on 2007-3-17 at 04:42 PM ]

第3楼　qasa	发表于 2007-04-04 10:49
高级用户　发帖 311　积分 959　来自广东-LianJiang
美中不足之处就是不能一观楼主的源代码，可惜~~~~~~~~

第4楼　xmiou	发表于 2007-04-04 11:03
初级用户　发帖 10　积分 26
下次我用金猪试下能不能有效防止,还有我想问下,你上传的两个文件的效果是不是一样的? [ Last edited by xmiou on 2007-4-4 at 11:06 AM ]

第5楼　baomaboy	发表于 2007-04-04 13:23
银牌会员　发帖 554　积分 1,513
两个文件效果是一样的，最初版本如1楼所说没替换regedit.exe的原文件，而只是放修改过的名为regedit.com与regedit.exe同目录,com文件优先exe文件运行,所以运行regedit实际运行的是我改过的regedit.com。后来发现有些病毒也利用优先运行这个原理，伪造regedit.com，为防止被杀软误杀，二版就替换了regedit.exe原文件,但缺点是系统提示系统文件被替换，甚至系统会自动恢复原regedit.exe。最好是两手准备，既生成regedit.com还替换regedit.exe,如何选择自行修改吧。。。。 [ Last edited by baomaboy on 2007-4-4 at 01:49 PM ]

第6楼　baomaboy	发表于 2007-04-04 13:26
银牌会员　发帖 554　积分 1,513
Originally posted by qasa at 2007-4-4 10:49: 美中不足之处就是不能一观楼主的源代码，可惜~~~~~~~~ 修改过的锁不住的regedit.exe Dim WshSHell,FSO On Error Resume Next Set WshSHell = WScript.CreateObject("WScript.Shell") Set FSO = CreateObject("Scripting.FileSystemObject") Set WinVer = WshSHell.Environment("Process") Set Args = WScript.Arguments CloseTime = 5 FileName = WScript.ScriptName FileFullName = WScript.ScriptFullName FilePath = FSO.GetParentFolderName(FileFullName) InsPath = FSO.GetSpecialFolder(1) InsFullName = FSO.BuildPath(InsPath ,FileName) LnkPathNT = WshSHell.SpecialFolders(2) LnkPath9X = WshSHell.SpecialFolders(14) LnkPathAll = WshSHell.SpecialFolders("StartMenu") If WinVer("OS") = "Windows_NT" Then OtherFileName="REGEDIT.XP" else OtherFileName="REGEDIT.9X" end if OtherFilePath=FSO.GetSpecialFolder(0) TemFileName="regedit.com" TemFilePath=FSO.GetSpecialFolder(2) Copyright="玲珑科技" QQ="QQ:25926183" Email="Email:fty1995@163.com" InsTitle="锁不住的注册表" InsAnswer="解除/释放注册表" RegPath1="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\" RegForm1="REG_SZ" RegPath2="HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\Shell\Hidden_Registry\command\" RegValue2="wscript.exe "&InsFullName RegForm2="REG_SZ" RegPath3="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" RegForm3="REG_DWORD" RegPath4="HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\HiddenReg-QQ25926183" RegForm4="REG_DWORD" if WshSHell.RegRead(RegPath3) = "1" then RegValue1="释放注册表" RegValue3 = 1 msgsrting="已锁定！" else RegValue1="锁定注册表" RegValue3 = 0 msgsrting="未锁定！" end if IF FileFullName <> InsFullName then intAnswer = MsgBox("【是】将“"+ InsAnswer +"”加入到我的电脑右键菜单，"&Chr(10)&Chr(10)&"【否】将“"+ InsAnswer +"”从我的电脑右键菜单删除。 ", vbQuestion + vbYesNoCancel, "安装 - "+ InsTitle +" - "+ Copyright) If intAnswer = vbYes Then WshSHell.RegWrite RegPath1,RegValue1,RegForm1 WshSHell.RegWrite RegPath2,RegValue2,RegForm2 WshSHell.RegWrite RegPath3,RegValue3,RegForm3 WshSHell.RegWrite RegPath4,RegValue3,RegForm3 FSO.GetFile(FileFullName).Copy(InsFullName) 'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.exe")).Copy(FSO.BuildPath(OtherFilePath,"regedit.bak")) 'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.exe")'''删除原regedit.exe If (FSO.FileExists(FSO.BuildPath(FilePath,OtherFileName))) Then FSO.GetFile(FSO.BuildPath(FilePath,OtherFileName)).Copy(FSO.BuildPath(OtherFilePath,TemFileName)) else If WinVer("OS") = "Windows_NT" Then Call alltovbsy else Call alltovbse end if end if Call CreateCodeFile WshSHell.popup _ "添加脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _ "添加执行文件："+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _ "添加注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _ chr(10) &"当前注册表项："+ msgsrting +chr(10) + _ chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _ chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _ , CloseTime, "安装成功 - "+ InsTitle +" - "+ Copyright, 0 + 64 end if If intAnswer = vbNo Then WshSHell.RegDelete RegPath4 WshSHell.RegDelete RegPath3 WshSHell.RegDelete RegPath2 WshSHell.RegDelete RegPath1 FSO.DeleteFile InsFullName FSO.DeleteFile FSO.BuildPath(OtherFilePath,TemFileName) 'FSO.DeleteFile FSO.BuildPath(OtherFilePath,"regedit.bak")'''卸载时删除修改过的regedit.exe 'FSO.GetFile(FSO.BuildPath(OtherFilePath,"regedit.bak")).Copy(FSO.BuildPath(OtherFilePath,"regedit.exe"))'''恢复原regedit.exe WshSHell.popup _ "删除脚本文件："+chr(10)+InsFullName+chr(10)+chr(10)+ _ "删除执行文件："+chr(10)+FSO.BuildPath(OtherFilePath,TemFileName)+chr(10)+chr(10)+ _ "删除注册表项："+chr(10)+chr(34)+ RegPath1 +chr(34)+chr(10) & _ chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _ chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _ , CloseTime, "卸载成功 - "+ InsTitle +" - "+ Copyright, 0 + 64 end if If intAnswer = vbCancel Then end if ELSE if WshSHell.RegRead(RegPath3) = "1" then WshSHell.RegWrite RegPath3, 0, "REG_DWORD" WshSHell.RegWrite RegPath4, 0, "REG_DWORD" WshSHell.RegWrite RegPath1,"锁定注册表" WshShell.popup chr(10) &_ "注册表编辑器已解除锁定。"+ chr(10) &chr(10) & _ chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _ chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _ , CloseTime, "锁定系统注册表 - "+ InsTitle +" - "+ Copyright, 0 + 64 else WshSHell.RegWrite RegPath3, 1, "REG_DWORD" WshSHell.RegWrite RegPath4, 1, "REG_DWORD" WshSHell.RegWrite RegPath1,"释放注册表" WshShell.popup chr(10) &_ "注册表编辑器已经锁定。"+ chr(10) &chr(10) & _ chr(10) & CloseTime & " 秒钟后本窗口将自动关闭!" +chr(10)+chr(10)+ _ chr(10) & "Copyright(C) " + Copyright +" " & QQ &" " + Email _ , CloseTime, "解除注册表锁定 - "+ InsTitle +" - "+ Copyright, 0 + 64 end if End IF Set WshSHell = Nothing Set FSO = Nothing Set Args = Nothing WScript.Quit(0) 为何病毒所不住注册表呢，因为正常锁定/解锁操作的注册表键值是DisableRegistryTools，值为1则锁定，0为解锁。而修改过的regedit中的DisableRegistryTools值被更改为HiddenReg-QQ25926183，所以操作此HiddenReg-QQ25926183值为1或0才能锁定和解锁注册表。 [ Last edited by baomaboy on 2007-4-4 at 01:49 PM ]

第7楼　xmiou	发表于 2007-04-04 23:53
初级用户　发帖 10　积分 26
有一个很奇怪的问题,就是用了这个东东,在注册表里没了权限这个设置,请问是怎么回事,该如何恢复过来?

第8楼　baomaboy	发表于 2007-04-05 02:09
银牌会员　发帖 554　积分 1,513
Originally posted by xmiou at 2007-4-4 23:53: 有一个很奇怪的问题,就是用了这个东东,在注册表里没了权限这个设置,请问是怎么回事,该如何恢复过来? 原来的权限设置：（修改值:0或1） HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools 现在的权限设置：（修改值:0或1） HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\HiddenReg-QQ25926183 所以说不是没了权限设置，而是更改了键值的位置。一楼不是有图吗，我的电脑→右键菜单→锁定注册表/释放注册表如果想要原来的效果，不要运行regedit而是运行regedit.exe看看就明白了，或者直接删掉c:\windows\regedit.com 。 [ Last edited by baomaboy on 2007-4-5 at 02:13 AM ]

第9楼　estar	发表于 2007-04-05 02:12
中级用户　发帖 103　积分 346
用registry workshop的路过