瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我又中招了,recycler文件夹不能删除

12   2  /  2  页   跳转

[求助] 我又中招了,recycler文件夹不能删除

回复:我又中招了,recycler文件夹不能删除

c:\windows\system32\drivers\tsmapip.sys
c:\windows\system32\drivers\tppwrif.sys
c:\windows\system32\drivers\tdsmapi.sys
c:\windows\system32\drivers\d346prt.sys
c:\windows\system32\drivers\d346bus.sys

这些都是不该删的东西
此外还漏掉许多该删的东西。。。
gototop
 

回复:我又中招了,recycler文件夹不能删除

哦,好恐怖,吓死人了
我就上了个游戏,就中这么多毒 啊? 瑞星都没提示啊? 要预防a老大。。瑞星预防功能呢
gototop
 

回复:我又中招了,recycler文件夹不能删除

请教怎么修复,有没有直接点好操作的啊?简单行之有效的dd哇
gototop
 

回复: 我又中招了,recycler文件夹不能删除

1.用XDelBox删除以下文件:(XDelBox1.7版下载)
使用说明:先勾选抑制再生删除时复制第一步下面的路径,在待删除文件列表里点击右键选择从剪贴板导入不检查路径,导入后在要删除文件上点击右键,选择立刻重启删除,电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质(包括U盘,MP3,手机存储卡等)

C:\WINDOWS\system32\reg.exe 
C:\WINDOWS\system32\HBmhly.dll
C:\WINDOWS\system32\HBSOUL.dll
C:\WINDOWS\system32\dbi120.dll
C:\WINDOWS\system32\5CC10129.dll
C:\WINDOWS\system32\4BF9CBA3.dll
C:\WINDOWS\system32\7ADC2AB1.dll
C:\WINDOWS\system32\8566F82E.dll
C:\WINDOWS\system32\lweurqhx.dll
C:\WINDOWS\system32\369774CA.dll
C:\WINDOWS\system32\495271CA.dll
C:\WINDOWS\system32\xolehlpjh.dll
C:\WINDOWS\system32\CF8850CD.dll
C:\WINDOWS\system32\imgutilhx2.dll
C:\WINDOWS\system32\nwapi32dj.dll
C:\WINDOWS\system32\EBE50EA1.dll
C:\WINDOWS\system32\AF05A291.dll
C:\WINDOWS\system32\78B5E02E.dll
C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll
C:\WINDOWS\system32\nwapi32dj.dll
C:\WINDOWS\system32\lweurqhx.dll
C:\WINDOWS\system32\xolehlpjh.dll
C:\WINDOWS\system32\imgutilhx2.dll
C:\WINDOWS\system32\System.exe
C:\WINDOWS\system32\explore.exe
C:\WINDOWS\SoundMan.exe
C:\WINDOWS\system32\HBmhly.dll
C:\WINDOWS\system32\HB1000Y.dll
C:\WINDOWS\system32\HBWOOOL.dll
C:\WINDOWS\system32\HBXY2.dll
C:\WINDOWS\system32\HBJXSJ.dll
C:\WINDOWS\system32\HBSO2.dll
C:\WINDOWS\system32\HBFS2.dll
C:\WINDOWS\system32\HBXY3.dll
C:\WINDOWS\system32\HBSHQ.dll
C:\WINDOWS\system32\HBFY.dll
C:\WINDOWS\system32\HBWULIN2.dll
C:\WINDOWS\system32\HBW2I.dll
C:\WINDOWS\system32\HBKDXY.dll
C:\WINDOWS\system32\HBWORLD2.dll
C:\WINDOWS\system32\HBASKTAO.dll
C:\WINDOWS\system32\HBZHUXIAN.dll
C:\WINDOWS\system32\HBWOW.dll
C:\WINDOWS\system32\HBZERO.dll
C:\WINDOWS\system32\HBBO.dll
C:\WINDOWS\system32\HBCONQUER.dll
C:\WINDOWS\system32\HBSOUL.dll
C:\WINDOWS\system32\HBCHIBI.dll
C:\WINDOWS\system32\HBDNF.dll
C:\WINDOWS\system32\HBWARLORDS.dll
C:\WINDOWS\system32\HBTL.dll
C:\WINDOWS\system32\HBPICKCHINA.dll
C:\WINDOWS\system32\HBCT.dll
C:\WINDOWS\system32\HBGC.dll
C:\WINDOWS\system32\HBHM.dll
C:\WINDOWS\system32\HBHX2.dll
C:\WINDOWS\system32\HBQQHX.dll
C:\WINDOWS\system32\HBTW2.dll
C:\WINDOWS\system32\HBQQSG.dll
C:\WINDOWS\system32\HBQQFFO.dll
C:\WINDOWS\system32\HBZT.dll
C:\WINDOWS\system32\HBMIR2.dll
C:\WINDOWS\system32\HBRXJH.dll
C:\WINDOWS\system32\HBYY.dll
C:\WINDOWS\system32\HBMXD.dll
C:\WINDOWS\system32\HBSQ.dll
C:\WINDOWS\system32\HBTJ.dll
C:\WINDOWS\system32\HBFHZL.dll
C:\WINDOWS\system32\HBWLQX.dll
C:\WINDOWS\system32\HBLYFX.dll
C:\WINDOWS\system32\HBR2.dll
C:\WINDOWS\system32\HBCHD.dll
C:\WINDOWS\system32\HBTZ.dll
C:\WINDOWS\system32\HBQQXX.dll
C:\WINDOWS\system32\HBWD.dll
C:\WINDOWS\system32\HBZG.dll
C:\WINDOWS\system32\HBPPBL.dll
C:\WINDOWS\system32\HBXMJ.dll
C:\WINDOWS\system32\HBJTLQ.dll
C:\WINDOWS\system32\HBQJSJ.dll
C:\WINDOWS\system32\ace1f7.sys
C:\WINDOWS\system32\dbeaf7d.sys
C:\WINDOWS\system32\e5e3454.sys
C:\00353844\0035384C
C:\windows\system32\DRIVERS\HBKernel.sys
C:\windows\system32\DRIVERS\HBKernel32.sys


2.使用附件修复

3.删除重启后使用SREng修复下面各项:

启动项目-- 注册表  删除

<SoundMan><SoundMan.exe>  [1]
<HBService32><System.exe>  []
<HBService><explore.exe>  [N/A]
<{5CC10129-8B52-4248-A14D-E4099A943269}><5CC10129.dll>  []
  <{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}><4BF9CBA3.dll>  []
  <{7ADC2AB1-5C6A-4178-82DA-94863354AF7C}><7ADC2AB1.dll>  []
  <{8566F82E-03A4-416E-AEAC-66600D8881F1}><8566F82E.dll>  []
  <{71A78CD4-E470-4a18-8457-E0E0283DD507}><C:\WINDOWS\system32\lweurqhx.dll>  []
  <{369774CA-7CB4-4A3F-A9A9-77D6BC53CB3B}><369774CA.dll>  []
  <{495271CA-D0C6-4052-ABE6-5B01C73CDFB0}><495271CA.dll>  []
  <{F0930A2F-D971-4828-8209-B7DFD266ED44}><C:\WINDOWS\system32\xolehlpjh.dll>  []
  <{CF8850CD-885D-4380-9E1B-8C987F011437}><CF8850CD.dll>  []
  <{DA56B183-A731-402b-9235-2CB8803E212D}><C:\WINDOWS\system32\imgutilhx2.dll>  []
  <{A2C3BA54-DF75-4881-8EB3-E54B26BBBBC9}><C:\WINDOWS\system32\nwapi32dj.dll>  []
  <{EBE50EA1-89C8-463A-998A-69A05ECD2D26}><EBE50EA1.dll>  []
  <{AF05A291-7249-4C15-B212-3E8D8C02438D}><AF05A291.dll>  []
  <{78B5E02E-5F90-4D5F-869B-55351D5FBAAE}><78B5E02E.dll>  []
    <nwapi32dj.dll><C:\WINDOWS\system32\nwapi32dj.dll>  []
    <lweurqhx.dll><C:\WINDOWS\system32\lweurqhx.dll>  []
    <xolehlpjh.dll><C:\WINDOWS\system32\xolehlpjh.dll>  []
    <imgutilhx2.dll><C:\WINDOWS\system32\imgutilhx2.dll>  []

    <IFEO[360Loader.exe]><svchost.exe>  [(Verified)Microsoft Windows Component Publisher]
    <IFEO[360rpt.exe]><ntsd -d>  [N/A]
    <IFEO[360Safe.exe]><ntsd -d>  [N/A]
    <IFEO[360tray.exe]><ntsd -d>  [N/A]
    (带有IFEO这类的全部删除)

<HBService><; explore.exe>  [N/A]
    <HBService32><; System.exe>  []
    <IESAddr><; ?>  [N/A]
<yassistse><; C:\Program Files\Yahoo!\Assistant\yAssistSe.exe>  [(Verified)"Beijing Yahoo! Information and Technology Co., Ltd."]
    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [(Verified)"Beijing Yahoo! Information and Technology Co., Ltd."]

这一项注意
<AppInit_DLLs><HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBFS2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dll,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBDNF.dll,HBWARLORDS.dll,HBTL.dll,HBPICKCHINA.dll,HBCT.dll,HBGC.dll,HBHM.dll,HBHX2.dll,HBQQHX.dll,HBTW2.dll,HBQQSG.dll,HBQQFFO.dll,HBZT.dll,HBMIR2.dll,HBRXJH.dll,HBYY.dll,HBMXD.dll,HBSQ.dll,HBTJ.dll,HBFHZL.dll,HBWLQX.dll,HBLYFX.dll,HBR2.dll,HBCHD.dll,HBTZ.dll,HBQQXX.dll,HBWD.dll,HBZG.dll,HBPPBL.dll,HBXMJ.dll,HBJTLQ.dll,HBQJSJ.dll>  []
把<Appint_DLLs>的值改为<>即清空里面的东西


启动项目--服务--驱动程序  删除

(选中有问题的驱动/服务后,点"删除服务",点"设置"按钮即可。注意弹出的窗口中要点"否NO"才是确认删除)

[ace1f7 / ace1f7][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\ace1f7.sys><N/A>
[dbeaf7d / dbeaf7d][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\dbeaf7d.sys><N/A>
[e5e3454 / e5e3454][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\e5e3454.sys><N/A>
[xxxALLGUARD / xxxALLGUARD][Stopped/Manual Start]
  <\??\C:\00353844\0035384C><N/A>
[HBKernel Driver / HBKernel][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\HBKernel.sys><N/A>
[HBKernel32 Driver / HBKernel32][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\HBKernel32.sys><N/A>
[msiffei / msiffei][Stopped/Manual Start]
  <System32\Drivers\msiffei.sys><N/A>

系统修复--浏览器加载项  删除

[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, (Signed) Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, (Signed) yahoo! china>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, (Signed) yahoo! china>
[yFlashDl Class]
  {F166BC04-3C84-44cc-A6E9-2315EC4844B9} <C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll, (Signed) Yahoo! China>
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, (Signed) Yahoo! China>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/start.htm?source=yzs_icon&btn=yassistnew, N/A>


如果不想重装系统就按这个步骤来吧,其实也不麻烦的

弄完再上传新日志看看吧 删的东西确实不少,以免有遗漏

附件附件:

下载次数:89
文件类型:application/octet-stream
文件大小:
上传时间:2008-9-16 10:49:47
描述:rar

最后编辑fillix 最后编辑于 2008-09-16 10:59:26
gototop
 

回复:我又中招了,recycler文件夹不能删除

可以先修复一下系统,然后装个卡卡试试
gototop
 

回复:我又中招了,recycler文件夹不能删除

换杀软
gototop
 

雅虎助手 不一定要删除吧。

[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, (Signed) Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, (Signed) yahoo! china>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, (Signed) yahoo! china>
[yFlashDl Class]
  {F166BC04-3C84-44cc-A6E9-2315EC4844B9} <C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll, (Signed) Yahoo! China>
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll, (Signed) Yahoo! China>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/start.htm?source=yzs_icon&btn=yassistnew, N/A>
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT