瑞星卡卡安全论坛

附件: 桌面.rar (2008-7-20 17:44:17, 28.92 K)
该附件被下载次数 383

请帮忙下 谢谢

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

附件: 日志及错误提示.rar

删除启动项
    <IFEO[Brood.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CS.exe]
    <IFEO[CS.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cstrike.exe]
    <IFEO[cstrike.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Diablo II.exe]
    <IFEO[Diablo II.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\empires2.exe]
    <IFEO[empires2.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe]
    <IFEO[freecell.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\game.exe]
    <IFEO[game.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hl.exe]
    <IFEO[hl.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hlds.exe]
    <IFEO[hlds.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplayerc.exe]
    <IFEO[mplayerc.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshearts.exe]
    <IFEO[mshearts.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAL3.exe]
    <IFEO[PAL3.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realplay.exe]
    <IFEO[realplay.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sol.exe]
    <IFEO[sol.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spider.exe]
    <IFEO[spider.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StarCraft.exe]
    <IFEO[StarCraft.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TTPlayer.exe]
    <IFEO[TTPlayer.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vc2.exe]
    <IFEO[Vc2.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winkawaks.exe]
    <IFEO[winkawaks.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmine.exe]
    <IFEO[winmine.exe]><C:\WINDOWS\system32\Error.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe]
    <IFEO[wmplayer.exe]><C:\WINDOWS\system32\Error.exe>  []

请把C:\WINDOWS\system32\Error.exe这个文件压缩并把压缩包上传，此病毒很有新意……:default6:

个人觉得IFEO的设置是专门针对游戏及播放器等娱乐软件而量身定做的，个人估计是人为设计而非病毒篡改，呵呵:default6:

难道病毒是不存在的？
虚拟的？

被IFEO的应用程序有：

（一）游戏
暗黑破坏神2、反恐精英（一代和1.5）、半条命等
（二）媒体播放器
realplayer播放器、WMP播放器等

估计楼主上网游戏和看电影的瘾太大，个人分析可能是家长或电脑所有者采用了限制措施……:default14:

汗了  连扑克牌都给封了  楼主估计比较贪玩

当家长的真不容易啊:default3: