奇怪的C盘文件

zhuweiming

一次朋友借用了自己的电脑去用了一下，回来发现C盘的目录下出现了两个陌生的文件，名字分别是MicroSoft.bat和MicroSoft.vbs，我电脑装的是小红伞，用最新的病毒库下的小红伞扫描这两个文件，没有报什么，用Dr. Web绿色版扫描也没事，到底是什么来的呢？希望哪位高手指点迷津。（附可疑文件）

ndd200

你用记事本打开看看不就知道了，两个脚本……

ndd200

MicroSoft.vbs内容：
Set Cuteqqcn = CreateObject("Wscript.Shell")
Cuteqqcn.run "cmd /c C:\MicroSoft.bat",vbhide

意思是，后台运行MicroSoft.bat，不显示界面。

MicroSoft.bat内容：
cmd.exe /c C:\MicroSoft.pif

调用cmd来运行MicroSoft.pif


你是不是少发了一个C:\MicroSoft.pif
这么做好麻烦，做病毒的人也太……

真正有问题的是C:\MicroSoft.pif，那两个脚本不过用来隐藏运行别的东西而已。

周杰伦

建议删除了吧，有问题的呢
我会上报的，让红伞分析看看

复制贝多芬

不是很清楚

zhuweiming

原帖由 ndd200 于 2007-12-3 02:26 发表
MicroSoft.vbs内容：
Set Cuteqqcn = CreateObject("Wscript.Shell")
Cuteqqcn.run "cmd /c C:\MicroSoft.bat",vbhide

意思是，后台运行MicroSoft.bat，不显示界面。

MicroSoft.bat内容：
cmd.exe /c C:\Mi ...

我已经查看了C盘的隐藏文件，都没有什么pif文件哦，奇怪了。我看到小红伞的报告里面，说之前我朋友上网，碰了很多挂病毒的网页，我设置了自动处理的，到底是怎样子的了，那两个奇怪的文件？

Graybird

Filename	Result
MicroSoft.bat	DAMAGED FILE (UNKNOWN)

The file 'MicroSoft.bat' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.

Filename	Result
MicroSoft.vbs	DAMAGED FILE (UNKNOWN)

The file 'MicroSoft.vbs' has been determined to be 'DAMAGED FILE (UNKNOWN)'. In particular this means that this file is damaged and not working properly. We could not find any malicious content. However the heuristic detection module may still detect this particular file even though it is damaged. In that case we will not adjust and remove detection for this damaged file.