瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 Adware.Win32.Agent.nrt该怎样彻底杀除?

12   2  /  2  页   跳转

Adware.Win32.Agent.nrt该怎样彻底杀除?

去天空软件站下载一个<木马清道夫>,安装好后按<扫描硬盘> 由于你没有付费注册,只能查毒而不能清楚.不过不要紧,因为你安装了木马清道夫,它会有一个<木马防火墙>,是配套的,你打开木马放火墙,然后按<内存监控--全面扫描木马>,如发现病毒,按清除(这个可以清chu病毒).我就是用这个杀了三个这种木马!!!
gototop
 

打开SREng-启动项目->注册表->删除以下启动项目
<sys71><C:\WINDOWS\system32\G17192.exe> [N/A]
<sys145151><C:\Program Files\32450.exe> [N/A]
<sys157812><C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\826.exe> [N/A]
<wsctf.exe><wsctf.exe> [N/A]
<sys72><C:\Documents and Settings\Administrator\My Documents\My Pictures\G6996.exe> [N/A]
<sys145151><C:\Program Files\32450.exe> [N/A]
<sys157812><C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\826.exe> [N/A]
<sys108021><C:\Program Files\17679.exe> [N/A]<rlfeiif><C:\WINDOWS\system32\rlfeiif.exe> []

==================================
SREng-启动项目->启动文件夹-删除
[rdhilg]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\rdhilg.lnk --> C:\WINDOWS\system32\rdhilgf.exe [N/A]><N>
[yegdgf]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\yegdgf.lnk --> C:\WINDOWS\system32\yegdgfj.exe [N/A]><N>
[WanSo]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WanSo.lnk --> C:\WINDOWS\system32\rundll32.exe [Microsoft Corporation]><N>
[yikldg]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\yikldg.lnk --> C:\Program Files\Realtek Sound Manager\yikldgl.exe [N/A]><N>
[sys71]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\sys71.lnk --> C:\WINDOWS\system32\G17192.exe [N/A]><N>
[sys72]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\sys72.lnk --> C:\Documents and Settings\Administrator\My Documents\My Pictures\G6996.exe [N/A]><N>
[ykikdc]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\ykikdc.lnk --> C:\PROGRA~1\REALTE~1\ykikdcf.exe [N/A]><N>
[ruango]

删除下面的服务(运行SRENG--->启动项目--->服务--->Win32服务应用程序--->选择要删除的服务--->选择删除服务--->点击设置--->出现提示里选择否,确认删除。)
[ms hlink / hlink][Running/Auto Start]
<C:\WINDOWS\system32\hlink.exe><N/A>
[error monitor / EmonSrv][Running/Auto Start]
<C:\WINDOWS\system32\lfrmewrk.exe><N/A>
[Fax 2Client / ms_2fax][Stopped/Auto Start]
<C:\WINDOWS\system32\4e011.exe><N/A>
[Internet Explorer Service / Internet Explorer][Stopped/Auto Start]
<C:\WINDOWS\svchost.exe><N/A>

重启 显示隐藏文件后删除以下文件

C:\WINDOWS\system32\GTIAPI.DLL
C:\WINDOWS\system32\hlink.exe
C:\WINDOWS\system32\lfrmewrk.exe
C:\WINDOWS\system32\4e011.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\rdhilgf.exe
C:\WINDOWS\system32\yegdgfj.exe
C:\Program Files\Realtek Sound Manager\yikldgl.exe
C:\WINDOWS\system32\G17192.exe
C:\Documents and Settings\Administrator\My Documents\My Pictures\G6996.exe
C:\PROGRA~1\REALTE~1\ykikdcf.exe
<C:\WINDOWS\system32\G17192.exe
C:\Program Files\32450.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\826.exe
C:\WINDOWS\system32\wsctf.exe
C:\Documents and Settings\Administrator\My Documents\My Pictures\G6996.exe
C:\Program Files\32450.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\826.exe
C:\Program Files\17679.exe

下载arswp(Windows清理助手)清理下
http://www.arswp.com/download/arswp/arswp.rar

gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT