schedl.exe

MD5: 1487e413823e8827f054020b7bb27da9

基本介紹

• 軟體名稱：schedl.exe
• 軟體大小：223676 bytes
• 加殼：N/A
• 編寫語言：VB

病毒信息

檔案名稱稱: schedl.exe

檔案大小: 223676 bytes

加殼: N/A

編寫語言: VB

病毒名: kaspersky: Virus.Win32.VB.eurising: N/A

duba: Win32.Virut.n.84480

詳細資訊

檔案變化

釋放檔案%WINDOWS%\WINDOWS.exe

%WINDOWS%\Help\schedl.exe

c:\Documents and Settings\All Users\Documents\My Music\My Music.exe

c:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe

c:\Documents and Settings\All Users\Documents\My Videos\My Videos.exeX:\Documents and Settings\當前用戶\My Documents\Downloads\Downloads.exe

c:\Documents and Settings\當前用戶\My Documents\My Ducuments.exeX:\Documents and Settings\當前用戶\My Documents\My Music\My Music.exe

c:\Documents and Settings\當前用戶\My Documents\My Pictures\My Pictures.exe

c:\Documents and Settings\Documents and Settings.exe

c:\Program Files\Program Files.exeX:\RECYCLER\RECYCLER.exe

在對應盤符根目錄生成以盤符命名的病毒副本.如下:

C:\C.exe

D:\D.exe

E:\E.exe........

註冊表變動

病毒創建啟動項

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "schedl"="%WINDOWS%\Help\schedl.exe"

其他行為

病毒在除系統盤以外的盤內,依據資料夾命名,在該資料夾內生成與資料夾命名相同的病毒副本

清除方法

1. 結束進程 %WINDOWS%\Help\schedl.exe

2. 刪除病毒檔案

%WINDOWS%\WINDOWS.exe %WINDOWS%\Help\schedl.exe

c:\Documents and Settings\All Users\Documents\My Music\My Music.exe

c:\Documents and Settings\All Users\Documents\My Pictures\My Pictures.exe

c:\Documents and Settings\All Users\Documents\My Videos\My Videos.exeX:\Documents and Settings\當前用戶\My Documents\Downloads\Downloads.exe

c:\Documents and Settings\當前用戶\My Documents\My Ducuments.exeX:\Documents and Settings\當前用戶\My Documents\My Music\My Music.exe

c:\Documents and Settings\當前用戶\My Documents\My Pictures\My Pictures.exe

c:\Documents and Settings\Documents and Settings.exe

c:\Program Files\Program Files.exeX:\RECYCLER\RECYCLER.exe

3. 刪除各盤符根目錄病毒副本

4. 刪除病毒創建啟動項

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "schedl"

5. 在刪除各盤符根目錄病毒副本時,查看一下病毒副本所創建的時間,搜尋除系統盤以外盤符,搜尋出來的檔案大小為 223676 位元組,圖示為資料夾圖示的.exe 檔案全部刪除