文件名称: schedl.exe
文件大小: 223676 bytes
MD5: 1487e413823e8827f054020b7bb27da9
加壳: N/A
编写语言: VB
病毒名: kaspersky: Virus.Win32.VB.eu
rising: N/A
duba: Win32.Virut.n.84480
详细资料:
文件变化:
释放文件
%WINDOWS%\WINDOWS.exe
%WINDOWS%\Help\schedl.exe
X:\Documents and Settings\All Users\Documents\My Music\My Music.exe
X:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe
X:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe
X:\Documents and Settings\当前用户\My Documents\Downloads\Downloads.exe
X:\Documents and Settings\当前用户\My Documents\My Ducuments.exe
X:\Documents and Settings\当前用户\My Documents\My Music\My Music.exe
X:\Documents and Settings\当前用户\My Documents\My Pictures\My Pictures.exe
X:\Documents and Settings\Documents and Settings.exe
X:\Program Files\Program Files.exe
X:\RECYCLER\RECYCLER.exe
X = 系统盘依照盘符名称,在对应盘符根目录生成以盘符命名的病毒副本.
如下:
C:\C.exe
D:\D.exe
E:\E.exe
........
注册表变动:
病毒创建启动项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"schedl"="%WINDOWS%\Help\schedl.exe"
其他行为:
病毒在除系统盘以外的盘内,依据文件夹命名,在该文件夹内生成与文件夹命名相同的病毒副本
清除方法:
1. 结束进程
%WINDOWS%\Help\schedl.exe2. 删除病毒文件
%WINDOWS%\WINDOWS.exe
%WINDOWS%\Help\schedl.exe
X:\Documents and Settings\All Users\Documents\My Music\My Music.exe
X:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe
X:\Documents and Settings\All Users\Documents\My Videos\My Videos.exe
X:\Documents and Settings\当前用户\My Documents\Downloads\Downloads.exe
X:\Documents and Settings\当前用户\My Documents\My Ducuments.exe
X:\Documents and Settings\当前用户\My Documents\My Music\My Music.exe
X:\Documents and Settings\当前用户\My Documents\My Pictures\My Pictures.exe
X:\Documents and Settings\Documents and Settings.exe
X:\Program Files\Program Files.exe
X:\RECYCLER\RECYCLER.exe
3. 删除各盘符根目录病毒副本
4. 删除病毒创建启动项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"schedl"
5. 在删除各盘符根目录病毒副本时,查看一下病毒副本所创建的时间,搜索除系统盘以外盘符,搜索出来的文件大小为 223676 字节,图标为文件夹图标的.exe 文件全部删除
备注: N/A
用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; CIBA)
