快捷方式Ｕ盘病毒

benq80282

Avira AntiVir
1.rar
  [0] Archive type: RAR
    --> .vbs
      [DETECTION] Contains recognition pattern of the VBS/Autorun.GU VBS script virus
    [NOTE]      A backup was created as '4ad0ce04.qua'  ( QUARANTINE )
    [NOTE]      The file was deleted!

will

ThreatType:
Suspicious/Worm.Invader

Behavior:

Create        C:\.vbs
Hide          C:\.vbs
Create        C:\AutoRun.inf
Hide          C:\AutoRun.inf
Hide          C:\Documents and Settings
Create        C:\Documents and Settings.lnk
Hide          C:\Program Files
Create        C:\Program Files.lnk
Create        C:\Windows\explorer.exe:.vbs
Create        C:\Windows\System32\smss.exe:.vbs
Create        C:\Widnows\System\svchost.exe (Source:%Systemroot%\System32\Wscript.exe)
Hide          C:\Widnows\System\svchost.exe
   
ModifyRegistry
   HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
   Load
   C:\Widnows\System\svchost.exe "C:\Windows\System32\smss.exe:.vbs"

ModifyRegistry
   HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
   Ver
   1
   
ModifyRegistry
   HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
   Date
   %Infected_Date%

ModifyRegistry
   HKLM\Software\Classes\inifile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\inffile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\batfile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\cmdfile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\regfile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\chm.file\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\hlpfile\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" %1 %*
   
ModifyRegistry
   HKLM\Software\Classes\Applications\iexplore.exe\shell\open\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" OIE
   
ModifyRegistry
   HKLM\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" OIE
   
ModifyRegistry
   HKLM\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\Open\command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" OMC
   
ModifyRegistry
   HKLM\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\explore\command
   (default)
   %Systemroot%\system32\wscript.exe "C:\windows\explorer.exe:.vbs" OMC
   
ModifyRegistry
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NoHidden
   CheckedValue
   (DWORD)3
   
ModifyRegistry
   HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ShowAll
   CheckedValue
   (DWORD)2
   
ModifyRegistry
   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
   NoDriveTypeAutoRun
   (DWORD)0
   
DeleteRegistryValue:
   HKLM\Software\Classes\lnkfile
   IsShortcut
   
CreateProcess      "C:\Widnows\System\svchost.exe" C:\Windows\System32\smss.exe:.vbs

Hmilypojie

数据流~

62590423

程序：

C:\.VBS
C:\SANDBOX\ADMINISTRATOR\DEFAULTBOX\DRIVE\C\AUTORUN.INF
是可疑程序!
是否阻止该进程继续运行?

hehe83

恩  学习了   很好