1 Star 0 Fork 1

White_mu / Folder-exe-virus-killer

加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
贡献代码
同步代码
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README
Apache-2.0

前言

文件夹exe病毒是一种流传甚广的病毒,经常由于用户的安全性不高而导致感染

如果您观察到您的U盘/硬盘分区有下列情形的时候,那么您的U盘/硬盘分区就感染了文件夹exe病毒

img

你可以看到这张截图有“两个”同名的“文件夹”,但是下面的“文件夹”大小仅1,127KB,图标为WindowsXP文件夹的图标(上图截图环境为Windows7),类型为应用程序(文件夹不是应用程序,简单来说,文件夹没有后缀名)。由此我们得知,下面的“文件夹”(电影.exe)不是一个真正的文件夹。

打开假文件夹,它表面上看会打开真正的文件夹,但是实际上,它在后台偷偷下载了病毒文件并试图感染更多的文件夹,此病毒会隐藏真正的文件夹,创建一个虚拟的文件夹(传播途径,也就是假文件夹)

由于此病毒年代过于久远,看不到此病毒的源码,因此我们不知道它会不会在某一个时间点格式化您的硬盘或删除您宝贵的数据,因此,解决掉此病毒非常重要

关于这个病毒的更多信息:文件夹EXE病毒_百度百科 (baidu.com)

2021.10.23更新:据White_mu最新研究发现,目前学校电脑上的文件夹exe病毒为变种版本,因此百科上内容不适用,因此我们推荐查看病毒运行详细分析:微步在线云沙箱 (threatbook.cn)

事实上,这个病毒已经被各大杀毒软件列为危险项,杀毒软件会自动删除它,但是在没有安装杀毒软件的系统上,此类病毒非常广泛,因此,我们需要安装杀毒软件来消除此病毒

但有些时候,杀毒软件可能不会工作(比如学校电脑的冰点还原+落后的Windows Defender),让此类病毒拥有更广阔的传播空间,因此,WhitemuTeam在9个小时的努力后写出了一款程序,使其能够暂时在一定范围内撑过一段时间不被感染文件夹exe病毒

路径

我们发现此病毒的主程序路径为(Windows Media Player下一目录可能随机):

C:\Program Files\Windows Media Player\e\b\0\3\3\9\1\4\a\b\e\3\0\2\4\2\1\1\e\5\a\d\5\9\9\3\6\9\b\6\2\b\autorun.inf\svchost.exe

因为某种原因,autorun.inf实际上是一个文件夹,但是被赋予了删除属性,直接打开会打开回收站,因此你需要通过以下代码查看autorun.inf中的文件(我现在把autorun.inf前的文件夹拷贝到我的U盘中了)

G:\c>cd autorun.inf
G:\c\autorun.inf>dir
 驱动器 G 中的卷是 White_mu
 卷的序列号是 0EAF-06B4
 G:\c\autorun.inf 的目录
2021/10/21  17:57    <DIR>          ..
2011/04/22  14:08         1,148,978 svchost.exe
               1 个文件      1,148,978 字节
               1 个目录 29,763,551,232 可用字节
G:\c\autorun.inf>copy svchost.exe ..
已复制         1 个文件。

你可以注意到此病毒主程序为svchost.exe,如果您运行文件夹exe病毒(任何文件夹.exe),此svchost.exe就会在后台运行,但是真正的svchost.exe是系统进程,我们需要辨别哪个svchost.exe是病毒主程序来终止它的进程,打开任务管理器

找到svchost.exe,看到后面用户名一栏是不是seewo(非System),若是,终止它的进程,若不是,那就不是病毒主程序,不用终止,而且终止前要勾选一个选项后才能终止进程,然后蓝屏:(

病毒运行详细分析:微步在线云沙箱 (threatbook.cn)

使用

使用此工具的系统环境应该为Windows7 x64或以上,达不到的请使用源码编译或直接运行此工具

请注意:此工具会删除分区根目录下与文件夹同名的文件,请注意有没有珍贵文件需要备份

运行GUI.exeGUI.py(Python环境下)

首先我们点击“清除电脑中的文件夹exe病毒”,这会读取注册表并找出病毒的主文件名并结束病毒进程,删除病毒主文件及其依赖文件(包括易语言支持库和临时文件),这还会删除所有的假文件夹,显示隐藏的真文件夹

上述操作完成后,部分文件夹exe病毒可能需要您手动删除,删除XP图标的文件夹exe即可

然后我们点击阻止病毒继续感染按钮,这会在病毒主程序存放的目录下(C:\Program Files\Windows Media)新建一个名为'c'的文件夹,此文件夹权限锁死,Everyone被禁止拥有此文件夹的所有权限,此时文件夹exe尝试感染电脑时就会停止工作

请注意:点阻止病毒继续感染按钮后请不要再次使用"清除电脑中的文件夹exe病毒",这会导致阻止功能失效!!!如果阻止功能失效,请发issus给我并附上Windows Media Player下的目录(打开显示隐藏文件功能)

源码

为保证安全性,我们开源了此程序:

程序源码:main.py(主程序) GUI.py(GUI支持)

WhitemuTeam/Folder-exe-virus-killer: 文件夹exe专杀器(针对某高中的拉跨系统制作) (github.com)

Folder-exe-virus-killer: 文件夹exe专杀器(针对某高中的拉跨系统制作) (gitee.com)

吐槽

正如开源地址上面写的,某高中的系统真的是拉跨,具体表现为:

冰点还原程序没有发挥防病毒的作用(在虚拟机释放此系统wim文件,会因为冰点还原的dll文件而蓝屏)

Windows Defender没有发挥防病毒的作用(而且一个主流杀毒软件都没有)

但现在我们准备攻破冰点还原....准备给电脑装杀毒软件

关于

版本:v2.0

作者:White_mu(WhitemuTeam):高一,负责程序开发,文件夹exe病毒受害者

邮箱:master@muspace.top

博客:沐の空间 - 做自己的学习笔记 (muspace.top)

Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

简介

文件夹exe专杀器(针对某高中的拉跨系统制作) 展开 收起
Python
Apache-2.0
取消

发行版

暂无发行版

贡献者

全部

近期动态

加载更多
不能加载更多了
Python
1
https://gitee.com/WhitemuTeam/Folder-exe-virus-killer.git
git@gitee.com:WhitemuTeam/Folder-exe-virus-killer.git
WhitemuTeam
Folder-exe-virus-killer
Folder-exe-virus-killer
main

搜索帮助