PCの修理が必要ですか?
専門家に頼む
????TR/VB.BG
????03/03/2004
?????????
?????????
?????
???????
??????????????
?????????????
????????131.116 ???
MD5???????e4a6af3171e95e337527bbffc1201382
VDF???????6.24.00.39

 ???? ????
   • ????????????


??
   •  Kaspersky: Virus.Win32.VB.bg
   •  F-Secure: Virus.Win32.VB.bg
   •  Grisoft Worm/VB.ZU
   •  Eset Win32/VB.DA


????????/OS?
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003


???
   • ???????????
   • ????????????????
   • ?????????

 ???? ??????????????????
   • C:\mig2.exe
   • %WINDIR%\mig2.exe
   • %SYSDIR%\shell.exe
   • %SYSDIR%\MrHelloween.scr
   • %SYSDIR%\IExplorer.exe
   • %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Empty.pif
   • %HOME%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
   • %HOME%\Local Settings\Application Data\WINDOWS\CSRSS.EXE
   • %HOME%\Local Settings\Application Data\WINDOWS\SERVICES.EXE
   • %HOME%\Local Settings\Application Data\WINDOWS\LSASS.EXE
   • %HOME%\Local Settings\Application Data\WINDOWS\SMSS.EXE
   • %????% \Data %???????%.exe
   • %?????????%\%??????????%.exe
   • %????% \mig2\New Folder.exe



????????????????
   • %????% \mig2



???????????????

C:\Untukmu.txt ?????????????????????????????
   • Untukmu
     
     Apa yang aku lakukan tak akan kau rasakan
     Apa yang kau lakukan tak akan aku rasakan
     Benar-benar jauh, jarak kita
     Aku terpaksa,lakukan ini krana kau yang mengawali..
     
     Senyummu adalah sedihku
     Sedihmu adalah tawaku
     
     Tangisku bukan milikmu
     Tangismu adalah milikku
     
     masih ada lagi yang ku kejar saat ini
     saat,ini aku akan mulai mengejar yang lain
     Lepaskan Dendam dan tawaku saat ini
     JUST, 4u MIG - MIG

%WINDIR%\msvbvm60.dll
%SYSDIR%\msvbvm60.dll
%????% \mig2\Folder.htt
%????% \desktop.ini

 ????? ??????????????????????????????????????????

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "Logon%???????%"="%HOME%\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
   • "System Monitoring"="%HOME%\Local Settings\Application Data\WINDOWS\LSASS.EXE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "mig2"="%WINDIR%\mig2.exe"
   • "Service%???????%"="%HOME%\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
   • "MSMSGS"="%HOME%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"



???????????????????

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   ???
   • "Shell"="Explorer.exe"
   • "Userinit"="%SYSDIR%\userinit.exe"
   ????
   • "Shell"="Explorer.exe "%SYSDIR%\IExplorer.exe""
   • "Userinit"="%SYSDIR%\userinit.exe,%SYSDIR%\IExplorer.exe"

[HKCR\exefile]
   ???
   • @="Application"
   ????
   • @="File Folder"

[HKCR\exefile\shell\open\command]
   ???
   • @=""%1" %*"
   ????
   • @="%SYSDIR%\shell.exe" "%1" %*"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
   ???
   • "Auto"="1"
   • "Debugger"="drwtsn32 -p %ld -e %ld -g"
   ????
   • "Auto"="1"
   • "Debugger"="%SYSDIR%\Shell.exe"

????Explorer???:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
   ???
   • "Hidden"=%?????%
   • "HideFileExt"=%?????%
   • "ShowSuperHidden"=%?????%
   ????
   • "Hidden"=dword:00000000
   • "HideFileExt"=dword:00000001
   • "ShowSuperHidden"=dword:00000000

[HKCU\Control Panel\Desktop]
   ???
   • "ScreenSaverIsSecure"="1"
   • "SCRNSAVE.EXE"=%?????%
   ????
   • "ScreenSaverIsSecure"="0"
   • "SCRNSAVE.EXE"="%SYSDIR%\MRHELL~1.SCR"

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot]
   ???
   • "AlternateShell"="cmd.exe"
   ????
   • "AlternateShell"="%WINDIR%\mig2.exe"

[HKCR\lnkfile\shell\open\command]
   ???
   • @=" "%1" %*"
   ????
   • @=" "%SYSDIR%\shell.exe" "%1" %*"

[HKCR\piffile\shell\open\command]
   ???
   • @=""%1" %*"
   ????
   • @="%SYSDIR%\shell.exe" "%1" %*"

[HKCR\batfile\shell\open\command]
   ???
   • @=""%1" %*"
   ????
   • @="%SYSDIR%\shell.exe" "%1" %*"

[HKCR\comfile\shell\open\command]
   ???
   • @=""%1" %*"
   ????
   • @="%SYSDIR%\shell.exe" "%1" %*"

Regedit??????????????????????????????
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
   ???
   • "DisableCMD"=%?????%
   • "DisableTaskMgr"=%?????%
   • "DisableRegistryTools"=%?????%
   ????
   • "DisableCMD"=dword:00000001
   • "DisableTaskMgr"=dword:00000001
   • "DisableRegistryTools"=dword:00000001

????Explorer???:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
   ???
   • "NoFolderOptions"=%?????%
   ????
   • "NoFolderOptions"=dword:00000001

[HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
   ???
   • "DisableConfig"=%?????%
   • "DisableSR"=%?????%
   ????
   • "DisableConfig"=dword:00000001
   • "DisableSR"=dword:00000001

[HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer]
   ????
   • "LimitSystemRestoreCheckpointing"=dword:00000001
   • "DisableMSI"=dword:00000001

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
   CabinetState]
   ????
   • "FullPathAddress"=dword:00000001

 ?????? ???????????????
   • regedit.exe; AVP.exe; rtvscan.exe; NAV.exe; VSHWIN32.exe;
      ProcessManager.exe; RegistryEditor.exe; Msiexec.exe; avgemc.exe;
      nvcoas.exe; mcvsescn.exe; firefox.exe; TASKMGR.EXE; setup.exe;
      Opera.exe; avguad.exe.; avgnt.exe; killvb.exe; Msi.exe

?????????????????????
   • ANT; BRO; VIR; TASK; REG; ASM; DBG; W32; BUG; HEX; DETEC; PROC; WALK;
      REST; AVS; OPTIONS; AVG; SYMANTEC; PANDA; MCAFEE; PC-CILLIN; F-PROT;
      KASPERSKY; VAKSIN; ANTI; VIRUS

????????????????????????????
   • RegEdit_RegEdit
   • Registry Editor
   • Folder Options
   • Local Settings


????????????????
   • System Restore

 ??????? ???????:
?????????????Visual Basic?????????

説明の挿入者 Adriana Popa の 2006年11月21日火曜日
説明の更新者 Adriana Popa の 2006年11月23日木曜日

戻る . . . .
https:// このウィンドウは暗号化されています。