回复: Suspicious.Trojan.Win32.Downldr.a解决方法
遍历进程试图结束并在注册表HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\下添加键值映像劫持以下进程其"Debugger"值均为 "ntsd -d":
360rpt.exe
360Safe.exe
360safebox.exe
360tray.exe
adam.exe
AgentSvr.exe
AntiArp.exe
AppSvc32.exe
arswp.exe
AST.exe
autoruns.exe
avcenter.exe
avconsol.exe
avgnt.exe
avgrssvc.exe
AvMonitor.exe
avp.com
avp.exe
CCenter.exe
ccSvcHst.exe
DrvAnti.exe
EGHOST.exe
FileDsty.exe
filemon.exe
FTCleanerShell.exe
FYFireWall.exe
GFRing3.exe
GFUpd.exe
HijackThis.exe
IceSword.exe
iparmo.exe
Iparmor.exe
isPwdSvc.exe
kabaload.exe
KASMain.exe
KASTask.exe
KAV32.exe
KAVDX.exe
KAVPF.exe
KAVPFW.exe
KAVSetup.exe
KAVStart.exe
KISLnchr.exe
KMailMon.exe
KMFilter.exe
KPFW32.exe
KPFW32X.exe
KPfwSvc.exe
Kregex.exe
KRepair.com
KsLoader.exe
KvDetect.exe
KvfwMcl.exe
kvol.exe
kvolself.exe
KVSrvXP.exe
kvupload.exe
kvwsc.exe
KvXP.kxp
KWatch.exe
KWatch9x.exe
KWatchX.exe
MagicSet.exe
mcconsol.exe
McNASvc.exe
McProxy.exe
Mcshield.exe
mcsysmon.exe
mmqczj.exe
mmsk.exe
MpfSrv.exe
Navapsvc.exe
Navapw32.exe
NAVSetup.exe
nod32.exe
nod32krn.exe
nod32kui.exe
NPFMntor.exe
PFW.exe
PFWLiveUpdate.exe
ProcessSafe.exe
procexp.exe
QHSET.exe
QQDoctor.exe
QQDoctorMain.exe
QQKav.exe
Ras.exe
Rav.exe
RavMon.exe
RavMonD.exe
RavStub.exe
RavTask.exe
RawCopy.exe
RegClean.exe
regmon.exe
RegTool.exe
rfwcfg.exe
rfwmain.exe
rfwProxy.exe
rfwsrv.exe
rfwstub.exe
RsAgent.exe
Rsaupd.exe
RStray.exe
rstrui.exe
Rtvscan.exe
runiep.exe
safeboxTray.exe
safelive.exe
scan32.exe
SelfUpdate.exe
shcfg32.exe
SmartUp.exe
SREng.exe
SuperKiller.exe
symlcsvc.exe
SysSafe.exe
taskmgr.exe
TrojanDetector.exe
Trojanwall.exe
TrojDie.exe
UIHost.exe
UmxAgent.exe
UmxAttachment.exe
UmxCfg.exe
UmxFwHlp.exe
UmxPol.exe
upiea.exe
UpLive.exe
USBCleaner.exe
vsstat.exe
webscanx.exe
WoptiClean.exe
zxsweep.exe
联网连接以下IP下载其他病毒木马:
222.215.119.43
219.153.71.185
61.164.109.68
清理方法:
结束进程2.exe、atpx.exe;
删除文件:
%Temp%\atpx.exe
%Temp%\index.dat
%Temp%\systemInfomations.ini
%Temp%\urlm0n.dll
%windir%\Tasks\绿化.bat
以及样本文件具体所在路径(该样本并未有删除自身行为);
删除注册表
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations;
修复IFEO映像劫持(有工具);
修复安全模式(有工具);
检查各个压缩包,解压后删除包内的"绿化.bat";
注：%System32%是一个可变路径。病毒通过查询操作系统来决定当前System文件夹的位置。
%Windir% WINDODWS所在目录
%DriveLetter% 逻辑驱动器根目录
%ProgramFiles% 系统程序默认安装目录
%HomeDrive% 当前启动的系统的所在分区
%Documents and Settings% 当前用户文档根目录
%Temp% \Documents and Settings
\当前用户\Local Settings\Temp
%System32% 系统的 System32文件夹
Windows2000/NT中默认的安装路径是C:\Winnt\System32
windows95/98/me中默认的安装路径是C:\Windows\System
windowsXP中默认的安装路径是C:\Windows\System32
另:该方法不能解决其下载并运行的木马群
