瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我的c盘下出了一个wdns.exe文件,不知是什么东西,请教.....

1   1  /  1  页   跳转页

我的c盘下出了一个wdns.exe文件,不知是什么东西,请教.....

收藏
哈哈尔滨
头像
初生襁褓狮
  • 帖子:2
  • 注册: 2004-12-06
  • 来自:
发表于： 2005-08-22 15:39 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

我的c盘下出了一个wdns.exe文件,不知是什么东西,请教.....

删除以后,重启计算机还会出现,怎样删掉它呢???瑞星也不提示哎
最后编辑2005-08-22 15:54:38
分享到：
gototop
 
子阳
头像
雄霸杖朝狮
  • 帖子:14755
  • 注册: 2004-04-13
  • 来自:
发表于： 2005-08-22 15:41 | 短消息 资料
字号： 小 中 大 2楼

请下载并使用HijackThis1.99.1,把HijackThis
                  1.99.1生成的log日志文件的内容贴上来，方便大家分析。

                  有关操作方法可参考：
                  【推荐】反浏览器劫持的一些常用操作
                  http://forum.ikaka.com/topic.asp?board=67&artid=6490491
gototop
 
真命小虫
头像
初生襁褓狮
  • 帖子:424
  • 注册: 2005-08-04
  • 来自:
发表于： 2005-08-22 15:46 | 短消息 资料
字号： 小 中 大 3楼

楼主你好，这是baohe版主写的：

一、附件运行后，只能进入我的当前用户临时文件夹TEMP。无其它文件创建。HijackThis日志中可发现以下两处异常：

当前运行的进程：


C:\DOCUME~1\baohelin\LOCALS~1\Temp\Rar$EX05.533\wdns.exe



O4 - 启动项HKLM\\Run: [izone] C:\DOCUME~1\baohelin\LOCALS~1\Temp\Rar$EX05.533\wdns.exe

二、任务管理器进程列表中可见wdns.exe进程。可直接结束此进程。

三、注册表修改：

1、在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run下添加启动加载项：
"izone"="C:\\DOCUME~1\\baohelin\\LOCALS~1\\Temp\\Rar$EX05.533\\wdns.exe"
2、在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control下添加：
"izone"=hex:00,00,00,00,46,55,5e,9a,10,0e,00,00,00,00,00,00,d4,1a,cc,ee,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,01,00

3、将HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
下的"EnableFirewall"=dword:00000001改为"EnableFirewall"=dword:00000000。


四、查杀：结束进程wdns.exe；删除C:\DOCUME~1\baohelin\LOCALS~1\Temp\Rar$EX05.533\wdns.exe；恢复上述注册表改动。就行了。
gototop
 
哈哈尔滨
头像
初生襁褓狮
  • 帖子:2
  • 注册: 2004-12-06
  • 来自:
发表于： 2005-08-22 15:51 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

谢谢,回复这么快呀
gototop
 
真命小虫
头像
初生襁褓狮
  • 帖子:424
  • 注册: 2005-08-04
  • 来自:
发表于： 2005-08-22 15:54 | 短消息 资料
字号： 小 中 大 5楼

楼主过奖，如果系统运行慢的话，建议用瑞星扫描下c盘。
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT