朋友的一台电脑,打开任何Excel(Office2003版本)都会弹出两个Excel文档,一个是希望打开的文档,另一个是:startup.xls
看startup.xls的内容,马上意识到中了病毒了.(看这个startup,貌似是删除组件用的,也许是病毒作用后的清理?)
打开希望打开的正常的那个文档,Alt-F11,看有宏代码,模块名是:Knight
后来发现,下列路径有下列可疑文件,将之手工删除,Excel恢复正常.
C:\Documents and Settings\Administrator\Application Data\Microsoft\Excel\Excel11.xlb
C:\Documents and Settings\Administrator\Application Data\Microsoft\Excel\XLSTART\MEMO1.xls
C:\Documents and Settings\Administrator\Application Data\Microsoft\Excel\XLSTART\startup.xls

后来,在其他电脑上,用McAfee检查,发现MEMO1.xls确实有问题
----MEMO1.xls有病毒(木马)----
Workbook X97M/Laroux.kz.gen

----startup.xls的内容----
Sub auto_open()
On Error Resume Next
Application.ScreenUpdating = False
ActiveWindow.Visible = False
n$ = ActiveWorkbook.Name
Workbooks(n$).Close (False)
Application.OnSheetActivate = "StartUp.xls!cop"
End Sub
Sub cop()
On Error Resume Next
Dim VBC As Object
Dim Name As String
Dim delComponent As VBComponent
Name = "StartUp"
For Each book In Workbooks
Set delComponent = book.VBProject.VBComponents(Name)
book.VBProject.VBComponents.Remove delComponent
Next
End Sub

ITPub博客

遭遇Excel的宏病毒

最新文章