{"id":7995,"date":"2008-03-15T14:15:00","date_gmt":"2008-03-15T14:15:00","guid":{"rendered":"http:\/\/melotopia.net\/b\/?p=7995"},"modified":"2008-03-15T14:15:00","modified_gmt":"2008-03-15T14:15:00","slug":"fun-xls-exe-%ec%b9%98%eb%a3%8c%eb%b2%95","status":"publish","type":"post","link":"http:\/\/melotopia.net\/b\/?p=7995","title":{"rendered":"fun.xls.exe \uce58\ub8cc\ubc95"},"content":{"rendered":"
\n \uc708\ub3c4XP\uae30\uc900\uc785\ub2c8\ub2e4.
\n
\n \ub2e8\uacc4\ubcc4\ub85c \ub530\ub77c \ud558\uc138\uc694.<\/p>\n

1.
\n
\n \uc548\uc804\ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04\ub2e4.
\n
\n \ubd80\ud305\ub420 \ub54c, \uc708\ub3c4\uc6b0 \ub85c\uace0 \ub098\uc624\uace0 \uc9c0\ub801\uc774\uac00 \uae30\uc5b4\uac00\ub294 \ud654\uba74 \ub098\uc624\uae30 \uc9c1\uc804\uc5d0 F8\uc744 \uc5f0\ud0c0\ud558\uba74 \ub4e4\uc5b4\uac08 \uc218 \uc788\ub2e4.
\n
\n \uadf8\uc911, \ucee4\ub9e8\ub4dc\ud504\ub86c\ud504\ud2b8 \ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04\ub2e4.
\n
\n \ub610\ub294, \uadf8\ub0e5 \uc548\uc804\ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04 \ud6c4 \uc2dc\uc791 -> \uc2e4\ud589 -> cmd (\uadf8\ub9ac\uace0 \uc5d4\ud130)<\/p>\n

2.
\n
\n \uadf8\ub7fc \uadf8\ub0e5 \uc2dc\uaebc\uba3c \ucc3d\uc774 \ud558\ub098 \ub728\uace0
\n <\/p>\n

\n C:\\>\n <\/p><\/blockquote>\n

\n \ub77c\uace0 \uc368 \uc788\uc744 \uac83\uc774\ub2e4.<\/p>\n

\n C:\\>dir \/a *.exe\n <\/p><\/blockquote>\n

\n \ub77c\uace0 \uce58\uc790.
\n
\n \uadf8\ub7fc fun.xls.exe\ub77c\ub294 \uac83\uc774 \ubcf4\uc778\ub2e4.<\/p>\n

3.
\n <\/p>\n

\n C:\\>attrib -r -h -s fun.xls.exe
\n
\n C:\\>del fun.xls.exe
\n
\n C:\\>attrib -r -h -s autorun.inf
\n
\n C:\\>del autorun.inf\n <\/p><\/blockquote>\n

\n \ub77c\uace0 \uce58\uc790. XP\uc5d0\uc11c\ub3c4 \uc774\uc81c \ud0ed\ud0a4 \uc790\ub3d9\uc644\uc131\uc774 \ub41c\ub2e4. fun\uae4c\uc9c0\ub9cc \uce58\uace0 TAB\ud0a4\ub97c \ub204\ub974\uba74 \uc804\uccb4\uac00 \uc790\ub3d9\uc644\uc131\ub41c\ub2e4.<\/p>\n

\uc774 \uacfc\uc815\uc740
\n
\n \ub2f9\uc2e0\uc774 \uac00\uc9c0\uace0 \uc788\ub294 \ubaa8\ub4e0 \ub514\uc2a4\ud06c \ub4dc\ub77c\uc774\ube0c\uc5d0 \ub300\ud574\uc11c \uc804\ubd80 \uc2e4\ud589\ud574\uc57c \ud55c\ub2e4
\n <\/span>
\n . \ud558\ub4dc\ub514\uc2a4\ud06c\uac00 \uc5ec\ub7ec\uac1c \uc788\uc73c\uba74 \uc788\ub294\ub300\ub85c, \ud30c\ud2f0\uc158\uc744 \ub098\ub234\uc73c\uba74 \ub098\ub208\ub300\ub85c, USB\ub098 MP3\ud50c\ub808\uc774\uc5b4, PMP\uac19\uc740 \uc678\uc7a5 \ub514\uc2a4\ud06c\uac00 \uc788\uc73c\uba74 \uc804\ubd80 \ub2e4 \ud574\uc57c \ud55c\ub2e4. \ud558\ub294 \ubc29\ubc95\uc740, \uac16\uace0 \uc788\ub294 \uac01\uac01\uc758 \ub514\uc2a4\ud06c \ub4dc\ub77c\uc774\ube0c\ub4e4\uc744 \uc62e\uaca8\ub2e4\ub2c8\uba74\uc11c \uc704\uc758 \uba85\ub839\uc5b4\ub97c \uce58\uba74 \ub41c\ub2e4. \ucee4\ub9e8\ub4dc \ud504\ub86c\ud504\ud2b8\uc5d0\uc11c \ub514\uc2a4\ud06c \ub4dc\ub77c\uc774\ube0c\ub97c \uc62e\uae30\ub294 \ubc29\ubc95\uc740
\n <\/p>\n

\n C:\\>d:
\n
\n D:\\>e:
\n
\n E:\\>\n <\/p><\/blockquote>\n

\n \ub4f1\uacfc \uac19\ub2e4. \ub9cc\uc57d \ud558
\n
\n \ub098\ub77c\ub3c4 \uac10\uc5fc\ub41c \ub514\uc2a4\ud06c\uac00 \ub0a8\uc544\uc788\uace0,
\n <\/span>
\n \uc774\uac83\uc774 XP\uc5d0 \ub07c\uc6cc\uc838\uc11c \uc790\ub3d9\uc2e4\ud589\uc774 \uc77c\uc5b4\ub098\uac8c \ub418\uba74 \ub2e4\uc2dc \uc2dc\uc2a4\ud15c \uc804\uccb4\uac00 \uac10\uc5fc\ub420 \uac83\uc774\ub2e4.<\/p>\n

4.
\n
\n \uc5ec\uae30\uae4c\uc9c0 \ub2e4 \ud588\uc73c\uba74,
\n <\/p>\n

\n C:\\>cd windows\\system32
\n
\n C:\\windows\\system32>del msfun82.exe
\n
\n C:\\windows\\system32>del msime82.exe
\n
\n C:\\windows\\system32>del algsrvs.exe\n <\/p><\/blockquote>\n

\n \uc8fc\uc758!
\n
\n alg.exe \ub294 \uc815\uc0c1\uc801\uc778 \uc708\ub3c4 \ud30c\uc77c
\n <\/span>
\n \uc774\uba70 \uaf64 \uc911\uc694\ud55c \ud30c\uc77c\uc774\ubbc0\ub85c \uc0ad\uc81c\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

5.
\n <\/p>\n

\n
\n\"\"
\n Anti Win-TrojanXema.45056.C.zip
\n <\/a>\n<\/div>\n

\uadf8\ub9ac\uace0 \uc704\uc758 \ud30c\uc77c\uc744 \ub2e4\uc6b4\ubc1b\uc544\uc11c \uc555\ucd95\uc744 \ud47c \ud6c4 \ubaa8\ub450 \ub354\ube14\ud074\ub9ad\ud574\uc11c \uc2e4\ud589\uc2dc\ud0a8\ub2e4. \uc704\uc758 \uac83\ub4e4\uc740 \uc228\uae40\ud30c\uc77c \ubcf4\uae30\uac00 \ubd88\uac00\ub2a5\ud560 \uacbd\uc6b0\uc5d0 \uc0ac\uc6a9\ud558\ub294 \ub808\uc9c0\uc2a4\ud2b8\ub9ac \ud30c\uc77c\ub4e4\uc774\ub2e4. \ub0b4\uac00 \uc368\ubcf8 \uacb0\uacfc, \ubcc4 \uc774\uc0c1 \uc5c6\ub294 \uc815\uc0c1\uc801\uc778 \uac83\ub4e4\uc778 \uac83 \uac19\ub2e4.<\/p>\n

6.
\n <\/p>\n

\n C:\\>msconfig\n <\/p><\/blockquote>\n

\n \ub9cc\uc57d \uc774\ub807\uac8c \ud588\uc744 \ub54c msconfig\uac00 \ub728\uc9c0 \uc54a\uc73c\uba74 \ub2e4\uc2dc \ubd80\ud305\ud574\uc11c, \uc2dc\uc791\uba54\ub274 -> \uc2e4\ud589 -> msconfig (\uc5d4\ud130\ud0a4 \ub204\ub974\uae30)
\n
\n \uadf8\ub7fc msconfig\uac00 \ub728\ub294\ub370 \uadf8\uc911 \uc2dc\uc791\ud504\ub85c\uadf8\ub7a8\uc5d0 \uac00\uc11c msime80.exe\uc640 msfun.82.exe\uc758 \uccb4\ud06c\ub97c \ud480\uc5b4\uc900\ub2e4.<\/p>\n

\uc804\uc124\uc5d0 \uc758\ud558\uba74 fun.xls.exe \ub300\uc2e0 tel.xls.exe \ud30c\uc77c\uc778 \uacbd\uc6b0\ub3c4 \uc788\uace0 sxs.exe \ub098 setup.exe \uac19\uc740 \ud504\ub85c\uadf8\ub7a8\uc73c\ub85c \uc704\uc7a5\ud558\uae30\ub3c4 \ud55c\ub2e4\uace0 \uc804\ud574\uc9c4\ub2e4.<\/p>\n

\uc774\ub807\uac8c \ud558\uba74, \ub300\uac15 \uc218\ub3d9\uc73c\ub85c \uc6dc \ubc14\uc774\ub7ec\uc2a4\ub97c \uc7a1\uc740 \uac83\uc774 \ub41c\ub2e4.<\/p>\n

\ubcf4\ub108\uc2a4
\n
\n \uc790\ub3d9\uc2e4\ud589 \ub044\uae30
\n <\/p>\n

\n C:\\>msconfig\n <\/p><\/blockquote>\n

\n \uc11c\ube44\uc2a4\uc5d0\uc11c Shell hardware detection \uc744 \ub044\uba74 \ub41c\ub2e4.<\/p>\n

\n
\n
\n\"\uc2e0\uace0\"
\n<\/a>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\uc708\ub3c4XP\uae30\uc900\uc785\ub2c8\ub2e4. \ub2e8\uacc4\ubcc4\ub85c \ub530\ub77c \ud558\uc138\uc694. 1. \uc548\uc804\ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04\ub2e4. \ubd80\ud305\ub420 \ub54c, \uc708\ub3c4\uc6b0 \ub85c\uace0 \ub098\uc624\uace0 \uc9c0\ub801\uc774\uac00 \uae30\uc5b4\uac00\ub294 \ud654\uba74 \ub098\uc624\uae30 \uc9c1\uc804\uc5d0 F8\uc744 \uc5f0\ud0c0\ud558\uba74 \ub4e4\uc5b4\uac08 \uc218 \uc788\ub2e4. \uadf8\uc911, \ucee4\ub9e8\ub4dc\ud504\ub86c\ud504\ud2b8 \ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04\ub2e4. \ub610\ub294, \uadf8\ub0e5 \uc548\uc804\ubaa8\ub4dc\ub85c \ub4e4\uc5b4\uac04 \ud6c4 \uc2dc\uc791 -> \uc2e4\ud589 -> cmd (\uadf8\ub9ac\uace0 \uc5d4\ud130) 2. \uadf8\ub7fc \uadf8\ub0e5 \uc2dc\uaebc\uba3c \ucc3d\uc774 \ud558\ub098 \ub728\uace0 C:\\> \ub77c\uace0 \uc368 \uc788\uc744 \uac83\uc774\ub2e4. C:\\>dir \/a *.exe \ub77c\uace0 \uce58\uc790. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9],"tags":[],"class_list":["post-7995","post","type-post","status-publish","format-standard","hentry","category-9"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8o6gA-24X","jetpack-related-posts":[],"jetpack_likes_enabled":true,"_links":{"self":[{"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=\/wp\/v2\/posts\/7995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7995"}],"version-history":[{"count":0,"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=\/wp\/v2\/posts\/7995\/revisions"}],"wp:attachment":[{"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7995"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/melotopia.net\/b\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}