[转帖]一个eplay员工对网页木马的终极防护（不可不看）
网页木马的终极防护（不可不看）
一个在eplay网吧娱乐平台工作的朋友编写的防护网页木马的VBS，经过我们测试了一些时间，经过他的允许放出来与大家分享，觉得很好，很强大，有如此员工，我们相信：eplay网吧娱乐平台的产品是很有技术保障的。(*^__^*) 嘻嘻……
在这里对他表示深深的感谢-----浩月。
具体的功能如下：
'功能:禁止在临时目录%temp%\*.*、%ietemp%\Content.IE5\*.*及其它指定路径中运行指定的后缀名
'如果与某个游戏不兼容时，也就是某个游戏会自动生成执行文件到被禁的目录，请把路径加到白名单中
'程序本身已兼容梦幻西游、大话西游更新，并自动取系统的临时目录和IE临时目录加入黑名单列表。
' - 网盟QQ交流群广西分群群主:浩月.net 编写
On Error Resume Next
Set objArgs = WScript.Arguments
If objArgs.Count = 0 Then
WScript.Quit
end if
If objArgs(0)="/s" Then
setupgpedit()
else
if objArgs(0)="/u" Then
ungpedit()
end if
end if
WScript.Quit
Function setupgpedit() '利用组策略的软件安全防止网站木马和恶意程序
On Error Resume Next
Dim WshShell, IETempPath, hjmlist, keypath, pathlist,num8
'------------------------------------------------------------------------↓开放运行的程序路径(白名单)
filepath="%temp%\gpatch.exe;"
'------------------------------------------------------------------------↓路径列表(黑名单路径)
pathlist = "%temp%\;%temp%\*\;"
'------------------------------------------------------------------------↓要禁止的后缀名列表(黑名单后缀)
hjmlist = "exe;com;bat;cmd;vbs;vbe;"
'------------------------------------------------------------------------↓禁止运行默认路径
keypath="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\"
'------------------------------------------------------------------------↓开放运行默认路径
keyfile="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\"
'------------------------------------------------------------------------↓分割后缀后列表
namelist=Split(hjmlist,";")
Set WshShell = WScript.CreateObject("WScript.Shell")
'------------------------------------------------------------------------↓取IE缓存路径并加入路径列表
pathlist=WshShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache") & "\Content.IE5\;"&pathlist
pathlist=WshShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache") & "\Content.IE5\*\;"&pathlist
'------------------------------------------------------------------------↓分割路径列表
pathlists=Split(pathlist,";")
'------------------------------------------------------------------------↓分割开放运行的列表
filepaths=Split(filepath,";")
'------------------------------------------------------------------------↓循环路径列表
WshShell.RegDelete keypath
'------------------------------------------------------------------------↓开始写开放策略
For w = 1 to int(UBound(filepaths)) step 1
'------------------------------------------------------------------------↓置随机种子
Randomize
'------------------------------------------------------------------------↓取6位随机数并转成16进制
num6=Str2Hex(Int((899999 * Rnd) + 100000))
'------------------------------------------------------------------------↓写注册表项
WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\",,"REG_SZ"
WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\LastModified",0,"REG_BINARY"
WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\Description","开放运行文件"&filepaths(w-1),"REG_SZ"
WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\SaferFlags",0,"REG_DWORD"
WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\ItemData",filepaths(w-1),"REG_EXPAND_SZ"
Next
'------------------------------------------------------------------------↓开放策略完毕
'------------------------------------------------------------------------↓开始写禁止策略
For o = 1 to int(UBound(pathlists)) step 1
'------------------------------------------------------------------------↓循环后缀名列表
For p = 1 to int(UBound(namelist)) step 1
'------------------------------------------------------------------------↓置随机种子
Randomize
'------------------------------------------------------------------------↓取6位随机数并转成16进制
num6=Str2Hex(Int((899999 * Rnd) + 100000))
'------------------------------------------------------------------------↓写注册表项
WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\",,"REG_SZ"
WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\LastModified",0,"REG_BINARY"
WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\Description","禁止运行本路径中的"&namelist(p-1)&"文件","REG_SZ"
WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\SaferFlags",0,"REG_DWORD"
WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\ItemData",pathlists(o-1)&"*."&namelist(p-1),"REG_EXPAND_SZ"
Next
Next
'------------------------------------------------------------------------↓结束指定进程
exitprocess("explorer.exe")
'------------------------------------------------------------------------↓更新组策略
WshShell.Run ("gpupdate /force"),0
'------------------------------------------------------------------------↓刷新桌面
WshShell.Run ("RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters")
End Function
Function ungpedit() '删除原来的策略
On Error Resume Next
'------------------------------------------------------------------------↓禁止运行默认路径
keypath="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\"
'------------------------------------------------------------------------↓开放运行默认路径
keyfile="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\"
'------------------------------------------------------------------------↓删除注册表项
Set WshShell = WScript.CreateObject("WScript.Shell")
WshShell.RegDelete keypath
WshShell.RegDelete keyfile
'------------------------------------------------------------------------↓结束指定进程
exitprocess("explorer.exe")
'------------------------------------------------------------------------↓更新组策略
WshShell.Run ("gpupdate /force"),0
'------------------------------------------------------------------------↓刷新桌面
WshShell.Run ("RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters")
End Function
Function exitprocess(exename)'结束指定进程,可以是程序名或程序路径
strComputer="."
Set objWMIService = GetObject ("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery ("SELECT * FROM Win32_process")
For Each objItem in colItems
if objitem.ExecutablePath<>"" then '=========================先判断命令路径是否符合
if instrs(objitem.ExecutablePath,exename) = False then '命令路径符合就结束
objItem.Terminate()
else
if instrs(objitem.Name,exename) = False then '命令路径不符合时判断程序名
objItem.Terminate()
end if
end if
else
if instrs(objitem.Name,exename) = False then '命令路径为空时直接判断程序名是否符合
objItem.Terminate()
end if
end if
Next
End Function
Function instrs(patrn, strng) '搜索指定字符是否存在
Dim regEx, retVal
Set regEx = New RegExp
regEx.Pattern = patrn
regEx.IgnoreCase = True ' 是否区分大小写。
retVal = regEx.Test(strng)
If retVal Then
instrs = False
Else
instrs = True
End If
End Function
Function Str2Hex(ByVal strHex) '返回16进制字符串
Dim sHex,tempnum
For i = 1 To Len(strHex)
sHex = sHex & Hex(Asc(Mid(strHex,i,1)))
Next
Str2Hex = sHex
End Function
防网页木马-设置策略
http://bbs.txwm.com/UploadFile/2008-2/2008222165843308.rar
防网页木马-删除策略
http://bbs.txwm.com/UploadFile/2008-2/2008222165912586.rar
![SiS001! Board - [第一会所 关闭注册]](images/green001/logo.png){kind=logo}
