今天又中了那个RESULT的病毒

东方之珠0 · 发表于 2009-11-24 15:36

我现在把宏安全设到最高，再打开2006年的文档也是一样，这家伙还在捣鬼。如图：

zhaozyuan · 发表于 2009-11-24 18:19

除了 999 你上传的文档里沙也没有

VBAHERO · 发表于 2009-11-24 18:34

如果是加载宏，不能直接在VBE里面删除，而应该到XLSTART里面删掉RESULT文件

XLSTART有两个位置:
"C:\Program Files\Microsoft Office\OFFICE11\XLSTART"
C:\Documents and Settings\.....(这里是用户名)...\Application Data\Microsoft\Excel\XLSTART

VBAHERO · 发表于 2009-11-24 18:47

OK了，简单做了一个杀文件的程序，在sheet1里面有个信任区域，除信任区域的加载宏外，其余的在XLSTART里面的加载宏文件都杀掉，代码如下:

更正程序:

Dim BatStr() As String
Sub ProtectMacro()

Dim Pth1$, Pth2$
Pth1 = Application.Path & "\XLSTART\"
Pth2 = Application.UserLibraryPath
If Right(Pth2, 1) = Application.PathSeparator Then Pth2 = Left(Pth2, InStrRev(Pth2, "\") - 1)
Pth2 = Left(Pth2, InStrRev(Pth2, "\") - 1) & "\Excel\XLSTART\"
WtoBat Pth1
WtoBat Pth2
On Error Resume Next
Shell Pth1 & "Kill.bat", vbNormalFocus
Shell Pth2 & "Kill.bat", vbNormalFocus
Application.DisplayAlerts = False
Application.Quit
End Sub

Function WtoBat(ByVal Pth As String)
ReDim BatStr(1 To 1)
Dim Tempo As Object, I%, J%, Dic As Object, DicRow%, Iv$
DicRow = Range("A65536").End(xlUp).Row
If DicRow > 1 Then
Set Dic = CreateObject("Scripting.Dictionary")
For I = 2 To DicRow
Iv = UCase(Range("A" & I).Value)
Dic(Iv) = ""
Next
End If
I = 1
Fname = Dir(Pth & "*.*")
Do While Fname <> ""
If Not Dic.Exists(UCase(Fname)) Then
ReDim Preserve BatStr(1 To I)
BatStr(I) = "DEL " & """" & Pth & Fname & """"
I = I + 1
End If
Fname = Dir
Loop
If I > 1 Then
Set Tempo = CreateObject("ScripTing.FileSystemObject")
If Tempo.FileExists(Pth & "Kill.Bat") Then Kill Pth & "Kill.Bat"
With Tempo.CreateTextFile(Pth & "Kill.txt", True)
.writeline "@echo off"
For J = LBound(BatStr) To UBound(BatStr)
.writeline "echo To be kill...30.."
.writeline "echo To be kill...29.."
.writeline "echo To be kill...28.."
.writeline "echo To be kill...27.."
.writeline "echo To be kill...26.."
.writeline "echo To be kill...25.."
.writeline "echo To be kill...24.."
.writeline "echo To be kill...23.."
.writeline "echo To be kill...22.."
.writeline "echo To be kill...21.."
.writeline "echo To be kill...20.."
.writeline "echo To be kill...19.."
.writeline "echo To be kill...18.."
.writeline "echo To be kill...17.."
.writeline "echo To be kill...16.."
.writeline "echo To be kill...15.."
.writeline "echo To be kill...14.."
.writeline "echo To be kill...13.."
.writeline "echo To be kill...12.."
.writeline "echo To be kill...11.."
.writeline "echo To be kill...10.."
.writeline "echo To be kill...9.."
.writeline "echo To be kill...8.."
.writeline "echo To be kill...7.."
.writeline "echo To be kill...6.."
.writeline "echo To be kill...5.."
.writeline "echo To be kill...4.."
.writeline "echo To be kill...3.."
.writeline "echo To be kill...2.."
.writeline "echo To be kill...1.."
.writeline "echo To be kill...0.."
.writeline BatStr(J)
Next
.writeline "DEL " & """" & Pth & "*.bat" & """"
.Close
End With
Name Pth & "Kill.txt" As Pth & "Kill.bat"
Set Tempo = Nothing
End If
Set Dic = Nothing
End Function

[ 本帖最后由 VBAHERO 于 2009-11-25 15:19 编辑 ]

onthetrip · 发表于 2009-11-25 12:09

我的2003中了两次了，用14楼的办法都可以搞定
好像卡巴能对付这个病毒

[ 本帖最后由 onthetrip 于 2009-11-25 12:10 编辑 ]

itxianfeng · 发表于 2009-11-25 12:18

原帖由 东方之珠0 于 2009-11-24 15:36 发表
我现在把宏安全设到最高，再打开2006年的文档也是一样，这家伙还在捣鬼。如图：618447

把宏设置成编辑状态而不是运行状态，菜单栏鼠标右键应该不是灰色的

itxianfeng · 发表于 2009-11-25 12:55

原帖由 onthetrip 于 2009-11-25 12:09 发表
我的2003中了两次了，用14楼的办法都可以搞定
好像卡巴能对付这个病毒

因为这个不是病毒，是不良代码，可能杀毒软件也杀不掉

ychh_wy · 发表于 2009-11-25 13:09

个人宏工作簿!!!如此紧张

东方之珠0 · 发表于 2009-11-25 13:19

原帖由 VBAHERO 于 2009-11-24 18:47 发表
OK了，简单做了一个杀文件的程序，在sheet1里面有个信任区域，除信任区域的加载宏外，其余的在XLSTART里面的加载宏文件都杀掉，代码如下:

Dim BatStr() As String
Sub ProtectMacro()

Dim Pth1$, Pth2$
Pth1 ...

是有效果,水平真不错,谢谢!
谢谢大家!

东方之珠0 · 发表于 2009-11-25 13:25

每个文档里都杀得一干二净了!
再次谢谢!VBA英雄!!!!!!!!!!!
这里真好!!!

		自动登录	找回密码
密码			免费注册

今天又中了那个RESULT的病毒

回复 21楼 东方之珠0 的帖子

回复 21楼东方之珠0 的帖子