警惕AV终结者新变种！( 下载流氓软件以及完美世界等木马） - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛警惕AV终结者新变种！( 下载流氓软件以及完美世界等木马）

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12 3 4 5 6 7 8 »

1 / 9 页

跳转页

警惕AV终结者新变种！( 下载流氓软件以及完美世界等木马）

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:06 \| 只看楼主短消息资料字号：小中大 1楼警惕AV终结者新变种！( 下载流氓软件以及完美世界等木马）如果发现新变种，且以下的手动方法不可以请将样本压缩发送到newcenturymoon1986@yahoo.com.cn 加密123 AV终结者已经猖狂一段时间了，经过杀毒软件厂商的共同努力，其势头有所减弱，但最近突然发现又出现了小规模的爆发，并且用户反映目前可用的专杀也被杀掉了，今天拿到了这个新的变种，立即分析了一下。特别值得注意的是此变种开始下载各种流氓软件（以前一般是下载一些木马）分析报告： File: pmovrao.exe Size: 26816 bytes MD5: 8A43F7A2EB37728D5D808C4E72B65242 SHA1: A61CB036BC9A851A61E79F815A688DC04603C509 CRC32: 2B59AD2F 运行后在C:\Program Files\Common Files\Microsoft Shared 和C:\Program Files\Common Files\System下面分别生成两个随机7位字母组合成的exe 我此次测试是C:\Program Files\Common Files\System\gamkqme.exe和 C:\Program Files\Common Files\Microsoft Shared\vdiwghf.exe C:\Program Files\meex.exe C:\Program Files\syuhxcx.inf（随机7位字母组合）删除C:\WINDOWS\system32\verclsid.exe 遍历D~Z分区在根目录下生成 autorun.inf和随机7位字母组合成的exe（我这里是pmovrao.exe）右键菜单无变化检测有无如下文件如果有将其改名为随机7位字母各个分区下面的autorun.inf MSInfo\wniapsvr.exe MSInfo\Shell.exe MSInfo\Shell.pci system32\progmon.exe system32\internt.exe Web\css.css Com\lsass.exe IME\svchost.exe IME\smss.exe Debug\debug.exe Common Files\svchost.cnc Common Files\Relive.dll Internet Explorer\msvcrt.dll Internet Explorer\PLUGINS\SysWin64.Jmp Internet Explorer\PLUGINS\SysWin64.Sys Internet Explorer\PLUGINS\SysWin64.Tao 将HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess HKLM\SYSTEM\CurrentControlSet\Services\helpsvc HKLM\SYSTEM\CurrentControlSet\Services\wscsvc HKLM\SYSTEM\CurrentControlSet\Services\wuauserv 的启动选项改成已禁用删除 HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} 破坏安全模式修改HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue 值为0x00000000 破坏显示隐藏文件更改C:\Program Files\Common Files\Microsoft Shared C:\Program Files\Common Files\System的属性为隐藏 2007-08-06 18:28:03
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	分享到：

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:06 \| 只看楼主短消息资料字号：小中大 2楼添加如下IFEO值 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FYFireWall.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe 指向C:\Program Files\Common Files\Microsoft Shared 下面的随机7位字母的exe
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:07 \| 只看楼主短消息资料字号：小中大 3楼监视并关闭如下进程 avp.com avp.exe runiep.exe PFW.exe FYFireWall.exe rfwmain.exe rfwsrv.exe KAVPF.exe KPFW32.exe nod32kui.exe nod32.exe Navapsvc.exe Navapw32.exe avconsol.exe webscanx.exe NPFMntor.exe vsstat.exe KPfwSvc.exe RavTask.exe Rav.exe RavMon.exe mmsk.exe WoptiClean.exe QQKav.exe QQDoctor.exe EGHOST.exe 360Safe.exe iparmo.exe adam.exe IceSword.exe 360rpt.exe 360tray.exe AgentSvr.exe AppSvc32.exe autoruns.exe avgrssvc.exe AvMonitor.exe CCenter.exe ccSvcHst.exe FileDsty.exe FTCleanerShell.exe HijackThis.exe Iparmor.exe isPwdSvc.exe kabaload.exe KaScrScn.SCR KASMain.exe KASTask.exe KAV32.exe KAVDX.exe KAVPFW.exe KAVSetup.exe KAVStart.exe KISLnchr.exe KMailMon.exe KMFilter.exe KPFW32X.exe KPFWSvc.exe KRegEx.exe KRepair.com KsLoader.exe KVCenter.kxp KvDetect.exe KvfwMcl.exe KVMonXP.kxp KVMonXP_1.kxp kvol.exe kvolself.exe KvReport.kxp KVScan.kxp KVSrvXP.exe KVStub.kxp kvupload.exe kvwsc.exe KvXP.kxp KvXP_1.kxp KWatch.exe KWatch9x.exe KWatchX.exe loaddll.exe MagicSet.exe mcconsol.exe mmqczj.exe nod32krn.exe PFWLiveUpdate.exe QHSET.exe RavMonD.exe RavStub.exe RegClean.exe rfwcfg.exe RfwMain.exe RsAgent.exe Rsaupd.exe safelive.exe scan32.exe shcfg32.exe SmartUp.exe SREng.EXE symlcsvc.exe SysSafe.exe TrojanDetector.exe Trojanwall.exe TrojDie.kxp UIHost.exe UmxAgent.exe UmxAttachment.exe UmxCfg.exe UmxFwHlp.exe UmxPol.exe UpLive.exe upiea.exe AST.exe ArSwp.exe USBCleaner.exe rstrui.exe 过滤如下“关键字”，如果这些在窗口出现的话，那么会被关闭木马木馬病毒杀毒殺毒查毒防毒专杀專殺卡巴江民瑞星毒霸恶意软件流氓软件上报 QQ安全举报报警杀软殺軟防殺防杀专杀（这就是金山的专杀不能启动的原因，关键字也被过滤了） 360安全 QQ医生进程 System Microsoft Shared ** 上報舉報進程 Process Virus Trojan
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:07 \| 只看楼主短消息资料字号：小中大 4楼连接网络下载木马和流氓软件 http://www.xxxxx.com/soft/fox/GameSetup.exe http://www.xxxxx.com/soft/fox/Setup.exe 到program files下面分别命名为1AGameSetup.exe 和2BSetup.exe 两个分别是木马和流氓软件的安装包木马和流氓软件植入完毕后生成如下文件（包括但不限于） C:\WINDOWS\system32\drivers\809igndb.sys C:\WINDOWS\system32\drivers\acpidisk.sys C:\WINDOWS\system32\drivers\iExplorer.exe C:\WINDOWS\system32\drivers\kz0q8id6.sys C:\WINDOWS\system32\1b1.dll C:\WINDOWS\system32\60e41.exe C:\WINDOWS\system32\ad_2201.exe C:\WINDOWS\system32\b601.dll C:\WINDOWS\system32\bnkgqpadwh.dll C:\WINDOWS\system32\mprmsgse.axz C:\WINDOWS\system32\mscpx32r.det C:\WINDOWS\031.bmp C:\WINDOWS\3fa1.exe C:\WINDOWS\716dairx.exe C:\WINDOWS\716daiwm.exe C:\WINDOWS\716daiwow.exe C:\WINDOWS\716daizx.exe C:\WINDOWS\716dgj.exe C:\WINDOWS\716dwl.exe C:\WINDOWS\ad_2201.exe C:\WINDOWS\boolan95.exe C:\WINDOWS\dodolook386.exe C:\WINDOWS\fa7c1.txt C:\WINDOWS\kulionrx.dll C:\WINDOWS\kulionrx.exe C:\WINDOWS\kulionwl.dll C:\WINDOWS\kulionwm.dll C:\WINDOWS\kulionzx.dll C:\WINDOWS\kulionzx.exe C:\WINDOWS\my_70087.exe C:\WINDOWS\video.dll C:\WINDOWS\winow.dll C:\WINDOWS\winow.exe C:\WINDOWS\winwl.exe C:\WINDOWS\winwm.exe C:\WINDOWS\wmsj.exe C:\WINDOWS\齐看网Setup2.exe C:\Program Files\1AGameSetup.exe C:\Program Files\2BSetup.exe C:\PROGRA~1\yxry C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll 里面包括一些流氓软件和盗号木马 sreng日志表现如下服务 [Windows dcwd RunThem / dcwd][Running/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\yxry\ihbi.dll>< > [Fax 2Client / ms_2fax][Running/Auto Start] <C:\WINDOWS\system32\60e41.exe><N/A> 驱动程序 [809ignd / 809igndb][Running/Boot Start] <\SystemRoot\System32\DRIVERS\809igndb.sys><N/A> [acpidisk / acpidisk][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A> [kz0q8id6 / kz0q8id6][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers\kz0q8id6.sys><N/A> 浏览器加载项 [Info cache] {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司> [ff Class] {FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINDOWS\system32\b601.dll, TODO: <公司名>> 解决方法：一.清理病毒主程序由于相关专杀已经失效，所以只能手动查杀 1.下载Icesword这个软件 http://www.ttian.net/website/2005/0829/391.html 解压后把Icesword.exe改名运行点击菜单栏文件>设置钩选禁止进线程创建确定查看窗口中单击进程查找有无C:\Program Files\Common Files\Microsoft Shared 和C:\Program Files\Common Files\System下面的随机7位字母的进程（记住他们的名字）如果有分别结束他们另外如果装有瑞星防火墙需要结束rfwsrv.exe进程然后点击点击菜单栏文件>设置去掉禁止进线程创建的钩确定还是Icesword这个软件单击左下角的文件按钮找到刚才C:\Program Files\Common Files\Microsoft Shared 和C:\Program Files\Common Files\System的两个随机7位字母的exe 分别右键删除他们另外还需要删除如下文件 C:\Program Files\meex.exe C:\Program Files\syuhxcx.inf（随机7位字母组合）以及各个分区下面的autorun.inf和随机7位字母组合成的exe（一定不要忘记这步） 2.下载sreng http://download.kztechs.com/files/sreng2.zip 运行启动项目注册表删除所有红色的IFEO项目删除[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]下面的随机7位字母启动项目本次测试为如下键值 <syuhxcx><C:\Program Files\Common Files\System\gamkqme.exe> [] <pmovrao><C:\Program Files\Common Files\Microsoft Shared\vdiwghf.exe> [] sreng 修复>Windows shell/IE 选中显示隐藏文件单击下面的修复 sreng 修复>高级修复>修复安全模式在弹出的窗口中点击是二.清理下载的木马和流氓软件此时病毒主程序已经清理完毕下面清理下载的木马和流氓软件注意：由于病毒下载的木马和流氓软件各异，所以此清除办法仅供参考首先需要下载http://www.i170.com/attach/92EB2ED9-6D11-441D-8A28-2A9B08F0452E Xdelbox1.3这个软件然后重启计算机进入安全模式(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统) 打开sreng “启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”： Windows dcwd RunThem / dcwd Fax 2Client / ms_2fax 在“启动项目”-“服务”-“驱动程序”中点“隐藏经认证的微软项目”，选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”： acpidisk / acpidisk kz0q8id6 / kz0q8id6 系统修复－浏览器加载项－找到如下项目点击删除项目，在弹出的对话框中点“是” [ff Class] {FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINDOWS\system32\b601.dll, TODO: <公司名>> 双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击 “是” 然后确定点击菜单栏下方的文件夹按钮（搜索右边的按钮）从左边的资源管理器进入C盘删除如下文件 C:\Program Files\yxry文件夹 C:\WINDOWS\system32\1b1.dll C:\WINDOWS\system32\60e41.exe C:\WINDOWS\system32\ad_2201.exe C:\WINDOWS\system32\b601.dll C:\WINDOWS\system32\mprmsgse.axz C:\WINDOWS\system32\mscpx32r.det C:\WINDOWS\031.bmp C:\WINDOWS\3fa1.exe C:\WINDOWS\716dairx.exe C:\WINDOWS\716daiwm.exe C:\WINDOWS\716daiwow.exe C:\WINDOWS\716daizx.exe C:\WINDOWS\716dgj.exe C:\WINDOWS\716dwl.exe C:\WINDOWS\ad_2201.exe C:\WINDOWS\boolan95.exe C:\WINDOWS\dodolook386.exe C:\WINDOWS\fa7c1.txt C:\WINDOWS\kulionrx.dll C:\WINDOWS\kulionrx.exe C:\WINDOWS\kulionwl.dll C:\WINDOWS\kulionwm.dll C:\WINDOWS\kulionzx.dll C:\WINDOWS\kulionzx.exe C:\WINDOWS\my_70087.exe C:\WINDOWS\video.dll C:\WINDOWS\winow.dll C:\WINDOWS\winow.exe C:\WINDOWS\winwl.exe C:\WINDOWS\winwm.exe C:\WINDOWS\wmsj.exe C:\WINDOWS\齐看网Setup2.exe C:\Program Files\1AGameSetup.exe C:\Program Files\2BSetup.exe C:\WINDOWS\system32\drivers\acpidisk.sys C:\WINDOWS\system32\drivers\iExplorer.exe C:\WINDOWS\system32\drivers\kz0q8id6.sys 打开Xdelbox1.3 把下列文件输入进去 C:\WINDOWS\system32\drivers\809igndb.sys C:\WINDOWS\system32\bnkgqpadwh.dll C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll 添加然后选中3个文件立即重启执行删除再次重启后恭喜你，所有病毒都被干掉了！
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:09 \| 只看楼主短消息资料字号：小中大 5楼附图附件: 文件名:5543452007721165838.jpg 下载次数:550 文件类型:image/pjpeg 文件大小: 上传时间:2007-7-21 17:09:00 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:09 \| 只看楼主短消息资料字号：小中大 6楼附图附件: 文件名:5543452007721165858.jpg 下载次数:545 文件类型:image/pjpeg 文件大小: 上传时间:2007-7-21 17:09:20 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

火影忍者横据古稀狮帖子:7855 注册: 2006-06-29 来自:火星	发表于： 2007-07-21 17:09 \| 短消息资料字号：小中大 7楼默默的支持一下
火影忍者横据古稀狮帖子:7855 注册: 2006-06-29 来自:火星

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:09 \| 只看楼主短消息资料字号：小中大 8楼附图附件: 文件名:5543452007721165913.jpg 下载次数:586 文件类型:image/pjpeg 文件大小: 上传时间:2007-7-21 17:09:36 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

桃子CiCi 飘泊而立狮帖子:547 注册: 2007-01-30 来自:	发表于： 2007-07-21 17:09 \| 短消息资料字号：小中大 9楼多谢阳光兄,转了哈
桃子CiCi 飘泊而立狮帖子:547 注册: 2007-01-30 来自:

newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:	发表于： 2007-07-21 17:10 \| 只看楼主短消息资料字号：小中大 10楼附图附件: 文件名:5543452007721165954.jpg 下载次数:582 文件类型:image/pjpeg 文件大小: 上传时间:2007-7-21 17:10:17 描述: 预览信息:EXIF信息 User Comment : LEAD Technologies Inc. V1.01
newcenturymoon 社区嘉宾帖子:15158 注册: 2005-08-03 来自:

<<上一主题|下一主题>>

12 3 4 5 6 7 8 »

1 / 9 页

跳转页

页面顶部

Powered by Discuz!NT