来一个样本

gzg

扫扫看

mofunzone

挂，上报

BING126

NOD32挂了！

啊弥陀佛

微点砍掉

wangjay1980

DEL.exe_

No malicious code was found in this file.

kp2006

运行生成文件3750546.bat 调用cmd.exe

Echo Off
COLOR 2F
Echo 系统更新准备中......
Echo 如果出现文件保护，请不要管它。~~
Del /F %WINDIR%\system32\dllcache\ehres.dll
Copy %WINDIR%\ehome\ehres.dll %WINDIR%\ehome\ehres_backup.dll
C:\WINDOWS\SYSTEM32\MEND\InSTALL.exe
C:\WINDOWS\system32\MEND\unins000.exe /verysilent
Del /F %WINDIR%\system32\dllcache\ehres.dll
Ren %WINDIR%\ehome\ehres.dll ehres.old
Ren %WINDIR%\ehome\ehres_backup.dll ehres.dll
Del /F /S /Q %SYSTEMDRIVE%\*.tmp
Del /F /S /Q %SYSTEMDRIVE%\*._mp
Del /F /S /Q %SYSTEMDRIVE%\*.log
Del /F /S /Q %SYSTEMDRIVE%\*.gid
Del /F /S /Q %SYSTEMDRIVE%\*.chk
Del /F /S /Q %SYSTEMDRIVE%\*.old
Del /F /S /Q %SYSTEMDRIVE%\*.1
Del /F /S /Q %SYSTEMDRIVE%\RECYCLED\*.*
Del /F /S /Q %WINDIR%\*.BAK
Del /F /S /Q %WINDIR%\PREFETCH\*.*
Del /F /S /Q %WINDIR%\*.TMP
Del /F /S /Q %TEMP%\*.*
Del /F /S /Q %WINDIR%\system32\mediactr.cab
RD /S /Q %windir%\temp & md %windir%\temp
Del /F /Q %userprofile%\cookies\*.*
Del /F /Q %userprofile%\recent\*.*
Del /F /S /Q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
Del /F /S /Q "%userprofile%\Local Settings\Temp\*.*"
Del /F /S /Q "%userprofile%\recent\*.*"
Del /F /S /Q %TEMP%\*.BAT
TASKKILL /F /IM Del.EXE
Del %WINDIR%\SYSTEM32\Del.EXE
Echo 成功更新完毕！ 请重新启动计算机！
PAUSE
QUIT

changzheng2

不是病毒。
瑞星邮件服务中心。

uhthn2002

不是毒

Uhthn Anti-Spyware V3 Alpha
Version - 3.0.0
Standard Database - 364
Paranoia Database - 7024
Heuristics Analysis - Excessive
Scan in - C:\Documents and Settings\uhthn\Desktop\DEL.EXE

C:\Documents and Settings\uhthn\Desktop\DEL.EXE - OK

1 Files scanned
0 Infected files found
0 Suspected files found
0 Files cured
0 Files deleted

skyraise

瑞星没杀到！

wyl66887

NOD32挂了