eva.vbs

gzg

应该是U盘感染的，在所有盘生成autorun.inf及eva.vbs

autorun.inf内容如下：
[autorun]
open=
shell\n=更换图标
shell\open=打开(&O)
shell\open\Command=WScript.exe eva.vbs
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=WScript.exe eva.vbs

用autorun专杀清除，重启后又有了

HC303

Begin scan in 'C:\Documents and Settings\He Chao\桌面\eva.rar'
C:\Documents and Settings\桌面\eva.rar
  [0] Archive type: RAR
  --> eva.vbs
      [DETECTION] Contains detection pattern of the worm WORM/VBS.AutoRun.AK
      [INFO]      The file was deleted!

gaojun7206

已删除：病毒 Virus.VBS.AutoRun.ak        文件: C:\Documents and Settings\Administrator\桌面\eva.rar/eva.vbs

BING126

McAfee  MISS

冷冷

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup\0]
"GPO-ID"="LocalGPO"
"SOM-ID"="Local"
"FileSysPath"="%WinDir%\\System32\\GroupPolicy\\Machine"
"DisplayName"="Local Group Policy"
"GPOName"="Local Group Policy"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup\0\0]
"Script"="%WinDir%\\system32\\prncfg.vbs"
"Parameters"=""
"ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0]
"GPO-ID"="LocalGPO"
"SOM-ID"="Local"
"FileSysPath"="%WinDir%\\System32\\GroupPolicy\\Machine"
"DisplayName"="Local Group Policy"
"GPOName"="Local Group Policy"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Startup\0\0]
"Script"="%WinDir%\\system32\\prncfg.vbs"
"Parameters"=""
"ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

终止防火墙的服务。。。之类的

qigang

rising20.39.42未杀！

Palkia

咔嚓~

卡江东N

NOD32 pass
F-prot pass

allinwonderi

VB了。

[Scanning : C:\Documents and Settings\All Users\Documents\Test]


C:\Documents and Settings\All Users\Documents\Test\eva.rar<RAR>:eva.vbs <- VBS.Silly.A : No action



Scanned objects : 4

Infected objects : 1

allinwonderi

上报。