fun.xls.exe病毒分析、查杀及清除

大家经常用U盘, 也许就和我一样,遇到过这种叫fun.xls.exe的病毒.
fun.xle.exe是一种叫做U盘病毒tel.xls.exe的变种，会在电脑里注入文件,这个病毒目前应该有四个变种.用记事本打开AUTORUN是如下代码：
[AutoRun]
open=fun.xls.exe
shellexecute=fun.xls.exe
shellAutocommand=fun.xls.exe
shell=Auto
[VVflagRun]
aabb=kdkfjdkfk1
这个病毒瑞星暂不能查杀，我试了下用最新的卡巴可以杀掉，网上有人用国产的江民杀好象也能杀掉，笔者没有测试。
病毒分析

这是笔者从网上找的
系统症状
每次双击盘符出现一个新窗口
鼠标右键点盘符出现"Auto"字样
无法显示隐藏文件
样本分析
注册表中添加
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
[IMJPMIG8.2]msime82.exe.
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
[MsServer]msfun80.exe.
修改注册表
HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
[CheckedValue] 被清空..
释放文件
C:Documents and SettingsmoperyLocal SettingsTemp~DFA4C3.tmp
C:Documents and SettingsmoperyLocal SettingsTemp~DFC86B.tmp
C:WINDOWSsystem32algsrvs.exe
C:WINDOWSsystem32msfun80.exe
C:WINDOWSsystem32msime82.exe
C:WINDOWSufdata2000.log
每个盘符下释放
AUTORUN.INF
fun.xls.exe
AUTORUN.INF文件内容
[AutoRun]
open=fun.xls.exe
shellexecute=fun.xls.exe
shellAutocommand=fun.xls.exe
shell=Auto
[VVflagRun]
aabb=kdkfjdkfk1
解决方法
1.安全模式下.删除文件
C:Documents and SettingsmoperyLocal SettingsTemp~DFA4C3.tmp
C:Documents and SettingsmoperyLocal SettingsTemp~DFC86B.tmp
C:WINDOWSsystem32algsrvs.exe
C:WINDOWSsystem32msfun80.exe
C:WINDOWSsystem32msime82.exe
C:WINDOWSufdata2000.log
2.删除注册表
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
[IMJPMIG8.2]msime82.exe.
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
[MsServer]msfun80.exe.
3.恢复显示所有的文件项
开始=>运行=>regedit
找到HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL
删除 CheckedValue 键值 然后单击右键"新建" - "Dword值"，并命名为CheckedValue,然后修改它的键值为1
4.右键=>打开进入每个盘符 依次删除每个盘符里的文件
AUTORUN.INF
fun.xls.exe

autorun.inf fun.xls.exe的批文件清除方法
1.将下面这段代码保存为1.bat (保存类型要在显示后缀名情况下才能修改！在窗口-工具-文件夹-查看-高级设置-隐藏已知文件类型的扩展名（勾去掉）)双击即可  研究了一个晚上请多多支持啦
@echo on
taskkill /im explorer.exe /f
taskkill /im wscript.exe /f
taskkill /im algsrvs.exe /f
start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v IMJPMIG8.2 /f
start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v MsServer /f
start reg DELETE
HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHidden
SHOWALL /v CheckedValue /f
start reg add HKCUSOFTWAREMicrosoftWindowsCurrentVersionEXplorerAdvanced /v
ShowSuperHidden /t REG_DWORD /d 1 /f
start reg add
HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHidden
SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f
start reg import kill.reg
del c:autorun.* fun.xls.exe /f /q /as
del %SYSTEMROOT%system32autorun.* msime82.exe algsrvs.exe fun.xls.exe msfun80.exe /f /q
/as
del %temp%~DF8785.tmp ~DFD1D6.tmp ~DFA4C3 ~DFC86B.tmp /f /q /as
del %systemroot%ufdata2000.log
del d:autorun.* fun.xls.exe /f /q /as
del e:autorun.* fun.xls.exe /f /q /as
del f:autorun.* fun.xls.exe /f /q /as
del g:autorun.* fun.xls.exe /f /q /as
del h:autorun.* fun.xls.exe /f /q /as
del i:autorun.* fun.xls.exe /f /q /as
del j:autorun.* fun.xls.exe /f /q /as
del k:autorun.* fun.xls.exe /f /q /as
del l:autorun.* fun.xls.exe /f /q /as
start explorer.exe

2.下面这段是我刚刚修改的,没有成功的同志可以试一试!这个比较高级,有点长...呵呵
不能显示隐藏文件,和删除ratorun fun.xls.exe 病毒都行!

@echo off
title autorun专杀工具
color 9A
echo 欢迎使用米拉落草的青楼autorun专杀工具！
echo ------------------------
echo 如果你的光驱中有光盘请先弹出然后继续！
:n
echo 您要继续吗？输入y整机杀毒开始，输入u只杀u盘，输入n退出！
:retry
set /p c=请输入您的选择（y/u/n）：
if "%c%"=="y" goto s
if "%c%"=="u" goto b
if "%c%"=="n" goto t
goto retry
:b
set /p a=请输入你要查杀的盘符(e f g...):
if "%a%"=="e" goto e
if "%a%"=="f" goto f
if "%a%"=="g" goto g
if "%a%"=="h" goto h
if "%a%"=="i" goto i
if "%a%"=="j" goto j
if "%a%"=="k" goto k
if "%a%"=="l" goto l
echo 输入错误!请重新输入!&&goto b
:s
taskkill /im explorer.exe /f
taskkill /im wscript.exe /f
taskkill /im algsrvs.exe /f
start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v IMJPMIG8.2 /f
start reg DELETE HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun /v MsServer /f
start reg DELETE HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL /v CheckedValue /f
start reg add HKCUSOFTWAREMicrosoftWindowsCurrentVersionEXplorerAdvanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
start reg add HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL /v CheckedValue /t REG_DWORD /d 1 /f
start reg import kill.reg
attrib c:fun.xls.exe -h -r -a -s
attrib c:autorun.* -h -r -a -s
del c:autorun.* c:fun.xls.exe /f
attrib %SYSTEMROOT%system32fun.xls.exe -h -r -a -s
attrib %SYSTEMROOT%system32autorun.* -h -r -a -s
del %SYSTEMROOT%system32autorun.* %SYSTEMROOT%system32msime82.exe %SYSTEMROOT%system32algsrvs.exe %SYSTEMROOT%system32fun.xls.exe %SYSTEMROOT%system32msfun80.exe /f
del %temp%~DF8785.tmp %temp%~DFD1D6.tmp %temp%~DFA4C3 %temp%~DFC86B.tmp /f /q /as
del %systemroot%ufdata2000.log /f
attrib d:fun.xls.exe -h -r -a -s
attrib d:autorun.* -h -r -a -s
del d:autorun.* d:fun.xls.exe /f
attrib e:fun.xls.exe -h -r -a -s
attrib e:autorun.* -h -r -a -s
del e:autorun.* e:fun.xls.exe /f
attrib f:fun.xls.exe -h -r -a -s
attrib f:autorun.* -h -r -a -s
del f:autorun.* f:fun.xls.exe /f
attrib g:fun.xls.exe -h -r -a -s
attrib g:autorun.* -h -r -a -s
del g:autorun.* g:fun.xls.exe /f
attrib h:fun.xls.exe -h -r -a -s
attrib h:autorun.* -h -r -a -s
del h:autorun.* h:fun.xls.exe /f
attrib i:fun.xls.exe -h -r -a -s
attrib i:autorun.* -h -r -a -s
del i:autorun.* i:fun.xls.exe /f
attrib j:fun.xls.exe -h -r -a -s
attrib j:autorun.* -h -r -a -s
del j:autorun.* j:fun.xls.exe /f
attrib k:fun.xls.exe -h -r -a -s
attrib k:autorun.* -h -r -a -s
del k:autorun.* k:fun.xls.exe /f
attrib l:fun.xls.exe -h -r -a -s
attrib l:autorun.* -h -r -a -s
del l:autorun.* l:fun.xls.exe /f
start explorer.exe
cls
if exist c:autorun.reg echo 病毒没有清除！&&goto n
if exist c:fun.xls.exe echo 病毒没有清除！&&goto n
echo 杀毒成功！感谢您的支持！米拉之落真诚帮您杀毒！
set /p d=现在重新启动系统确定吗？（y/n）:
if "%d%"=="y" shutdown -r -t 0
exit
if "%d%"=="n"
echo  按任意键退出。
pause
exit
:t
echo 多谢您的支持！按任意键退出。
pause
exit
:e
attrib e:fun.xls.exe -h -r -a -s
attrib e:autorun.* -h -r -a -s
cls
if not exist e:autorun.* echo 您的u盘没有病毒！&&goto t
del e:autorun.* e:fun.xls.exe /f
cls
if exist e:autorun.reg echo 病毒没有清除！&&goto n
if exist e:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:f
attrib f:fun.xls.exe -h -r -a -s
attrib f:autorun.* -h -r -a -s
cls
if not exist f:autorun.* echo 您的u盘没有病毒！&&goto t
del f:autorun.* f:fun.xls.exe /f
cls
if exist f:autorun.reg echo 病毒没有清除！&&goto n
if exist f:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:h
attrib h:fun.xls.exe -h -r -a -s
attrib h:autorun.* -h -r -a -s
cls
if not exist h:autorun.* echo 您的u盘没有病毒！&&goto t
del h:autorun.* h:fun.xls.exe /f
cls
if exist h:autorun.reg echo 病毒没有清除！&&goto n
if exist h:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:i
attrib i:fun.xls.exe -h -r -a -s
attrib i:autorun.* -h -r -a -s
cls
if not exist i:autorun.* echo 您的u盘没有病毒！&&goto t
del i:autorun.* i:fun.xls.exe /f
cls
if exist i:autorun.reg echo 病毒没有清除！&&goto n
if exist i:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:j
attrib j:fun.xls.exe -h -r -a -s
attrib j:autorun.* -h -r -a -s
cls
if not exist j:autorun.* echo 您的u盘没有病毒！&&goto t
del j:autorun.* j:fun.xls.exe /f
cls
if exist j:autorun.reg echo 病毒没有清除！&&goto n
if exist j:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:k
attrib k:fun.xls.exe -h -r -a -s
attrib k:autorun.* -h -r -a -s
cls
if not exist k:autorun.* echo 您的u盘没有病毒！&&goto t
del k:autorun.* k:fun.xls.exe /f
cls
if exist k:autorun.reg echo 病毒没有清除！&&goto n
if exist k:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:l
attrib l:fun.xls.exe -h -r -a -s
attrib l:autorun.* -h -r -a -s
cls
if not exist l:autorun.* echo 您的u盘没有病毒！&&goto t
del l:autorun.* l:fun.xls.exe /f
cls
if exist l:autorun.reg echo 病毒没有清除！&&goto n
if exist l:fun.xls.exe echo 病毒没有清除！&&goto n
goto m
:m
cls
echo 杀毒成功，请重新弹出后在插入您的u盘！按任意键退出。谢谢你的支持！
pause