【病毒】又一隻 autorun.inf 病毒

[kevinkom]

又一隻 autorun.inf 病毒
解壓密碼 0000

[juijui]

紅傘點下載報 Virus or unwanted program 'TR/VB.bjw [TR/VB.bjw]'

[upside]

調用: %Windows%\services.exe
生成: C:\smss.exe C:\AUTORUN.INF

創建:
進程:C:\WINDOWS\system32\ctfmon.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
internat.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Run
nav_x = "c:\smss.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run
nav_x = "C:\smss.exe"

HKEY_CLASSES_ROOT\inifile\shell\open\command
{default} = "c:\smss.exe"

AUTORUN.INF 內容
[autorun]
open=ms-dos\ntdlr.com
shell\Open=Open
shell\Open\command=ms-dos\ntdlr.com
shell\Explore=Explore
shell\Explore\command=ms-dos\ntdlr.com