一个VBS样本

尤金卡巴斯基

2009/2/28 22:45:13        已清除        病毒 Worm.VBS.Headtail.a        G:\Temp\Virus\Administrator.rar/Administrator.vbs

wsmurderer

程序：
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\ADMINISTRATOR.VBS
2) C:\AUTORUN.INF
3) C:\IESUPER.VBS
4) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SMART TAG\CHINESE MEASUREMENT CONVERTER\1028\CHMCABT.HTM
5) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SMART TAG\CHINESE MEASUREMENT CONVERTER\1033\CHMCABT.HTM
6) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SMART TAG\CHINESE MEASUREMENT CONVERTER\2052\CHMCABT.HTM
7) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\STATIONERY\空白.HTM
8) C:\PROGRAM FILES\COMMON FILES\SYSTEM\ADO\MDACREADME.HTM
9) C:\PROGRAM FILES\KWMUSIC\HTML\NOMV.HTM
10) C:\PROGRAM FILES\KWMUSIC\HTML\WEBERROR.HTM
11) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\INTLBAND.HTM
12) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\2052\OFREADME.HTM
13) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\2052\PPREADME.HTM
14) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\2052\PVREADME.HTM
15) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\2052\WDREADME.HTM
16) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\2052\XLREADME.HTM
17) C:\PROGRAM FILES\NETMEETING\NETMEET.HTM
18) C:\PROGRAM FILES\THE WORLD 2.1\PLUGIN\ALEXA\ALEXA.HTM
19) C:\PROGRAM FILES\THE WORLD 2.1\PLUGIN\SAVEMEDIA\SAVEMEDIA.HTML
20) C:\PROGRAM FILES\THUNDER\COMPONENTS\COMMUNITY\LOCAL\DEFAULT.HTML
21) C:\PROGRAM FILES\THUNDER\COMPONENTS\P4PCLIENT\P4P_LOCAL.HTM
22) C:\PROGRAM FILES\THUNDER\PROGRAM\GETALLURL.HTM
23) C:\PROGRAM FILES\THUNDER\PROGRAM\GETURL.HTM
24) C:\PROGRAM FILES\WINRAR\ORDER.HTM
25) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\HEADLINES.HTM
26) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\HOMEPAGE__DESKTOP.HTM
27) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\HOMEPAGE__SERVER.HTM
28) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\ABOUT_SUPPORT.HTM
29) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\FAVORITES.HTM
30) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\FTSHELP.HTM
31) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\HISTORY.HTM
32) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\INDEX.HTM
33) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\ISUPPORT.HTM
34) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\KEYWORDHELP.HTM
35) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\OPTIONS.HTM
36) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\SEARCHBLURB.HTM
37) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\SEARCHTIPS.HTM
38) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\TOOLS.HTM
39) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\BLURBS\WINDOWS_NEWSGROUPS.HTM
40) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\COMPATCTR\ABOUTCOMPAT.HTM
41) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\COMPATCTR\COMPATMODE.HTM
42) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\COMPATCTR\COMPATOFFLINE.HTM
43) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\COMPATCTR\LEARNCOMPAT.HTM
44) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\DVDUPGRD\DVDUPGRD.HTM
45) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRMSG\ERRORMESSAGESOFFLINE.HTM
46) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\BADURL.HTM
47) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\CONNECTION.HTM
48) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\INDEXFIRSTLEVEL.HTM
49) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\NOTFOUND.HTM
50) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\OFFLINE.HTM
51) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\REDIRECT.HTM
52) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\ERRORS\UNREACHABLE.HTM
53) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\NETDIAG\DGLOGS.HTM
54) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\NETDIAG\DGLOGSHELP.HTM
55) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\ADVSEARCH.HTM
56) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\BLANK.HTM
57) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\CONTEXT.HTM
58) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\FIRSTPAGE.HTM
59) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\HHWRAPPER.HTM
60) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\MININAVBAR.HTM
61) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\NAVBAR.HTM
62) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\OPTIONS.HTM
63) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\REMOTEHELP.HTM
64) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SHAREHELP.HTM
65) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\TOPICS.HTM
66) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\CHANNELS.HTM
67) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\FAVORITES.HTM
68) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\HISTORY.HTM
69) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\INDEX.HTM
70) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\OPTIONS.HTM
71) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\SEARCH.HTM
72) C:\WINDOWS\PCHEALTH\HELPCTR\SYSTEM\PANELS\SUBPANELS\SUBSITE.HTM
73) C:\WINDOWS\SYSTEM32\PRNCNFG.VBS

是否删除木马程序及其衍生物?
程序：

C:\ADMINISTRATOR.VBS
C:\AUTORUN.INF
是可疑程序!
是否阻止该进程继续运行?

Palkia

大部分都可以杀了

嘉和

ZAV R9 發現  Autorun-VBS-Virus

sjducker

BitDefender 2009

This web page has been blocked by BitDefender Antivirus Real-time Protection!

The blocked web page included objects that were either infected or likely to be infected with a virus. Your system has NOT been infected.

黑衣~魂

DR.WEB
Administrator.vbs - infected with VBS.Antipron

dd102

我的怎么没提示，难道我哪次点的允许运行

328397663

卡巴 红伞全砍

[ 本帖最后由 328397663 于 2009-3-3 16:43 编辑 ]