| 手动查杀setup.exe microsoft.exe SP00LV.exe |
文件: k.exe 大小: 28672 字节 MD5: FBCE46FA53201B02CCC5C495829CB6D5 SHA1: 364C2DA684B30F44DC46E32DD4A93FB6681FDD54 CRC32: 386EF91A 释放 c:\setup.exe Size: 28,672 bytes c:\Documents and Settings\user\Local Settings\Temp\rs.bat Size: 105 bytes %windir%\system32\microsoft.exe Size: 28,672 bytes %windir%\system32\SP00LV.exe Size: 28,672 bytes %windir%\system32\drivers\svchost.exe Size: 28,672 bytes d:\setup.exe Size: 28,672 bytes e:\setup.exe Size: 28,672 bytes f:\setup.exe Size: 28,672 bytes 其中rs.bat内容 @echo off :start if not exist ""%1"" goto done del /F ""%1"" del ""%1"" goto start :done del /F %t 注册表添加HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Winnet COM+ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Internat" Type: REG_SZ Data: C:\windows\system32\microsoft.exe 顠|癓搢 ? 爧 笒 綴 弱 荎搢 怎 ( S - ▼ 5 - ( (? 7 2 搢 ?7 7 ? D? 顠|? T? 8 搢?搢?搢 ! ?搢?搢?蛈駷 | Wk苪X 鴐苪 捳抾 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Program Files" Type: REG_SZ Data: C:\windows\system32\SP00LV.exe 7 2 搢 ?7 7 旜 ? 伉 顠|? 桫 8 搢 ?搢0? @ 7 t e m 3 2 \ d r x 7 e r s \ s v o s t . e x e @? p97 2 搢 ?7 7 ? 顠|? l? x 7 ?搢H97 0? 袐 x 7 @ 7 x97 @ 修改HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL "CheckedValue" Old data: 01, 00, 00, 00 修改以使系统不显示隐藏文件 New data: 00, 00, 00, 00 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#PCI#VEN_8086&DEV_24C5&SUBSYS_4720414C&REV_02#3&13C0B0C5&0&FD#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\#Wave\Device Parameters\Mixer\0\ 使系统静音 关闭带有以下字符的窗口 安全卫士 扫描 专杀 注册表 process 进程 毒 木马 防御 防火墙 病毒 检测 firewall virus anti 金山 江民 卡巴斯基 worm 360 微点 micropoint 克星 广告 avk kaspersky f-secure escan Norton 诺顿 mcafee Virus panda 熊猫 trojan Door AVG 360tray.exe ravtask.exe ravstub.exe ravmond.exe ravmon.exe ccenter.exe rfwstub.exe rfwproxy.exe rfwsrv.exe rfwain.exe ras.exe runiep 反汇编一下。。发现: %s\psexec.exe \\%s -u %s -p %s -c %s\servrr.exe - 并且利用http://tools.hxstat.com/ip/ 获得ip地址 解决： 使用sreng删除启动项 [] [] 删除服务[Winnet COM+ / Winnet COM+][Stopped/Auto Start] 删除文件：*:\setup.exe c:\WINDOWS\system32\microsoft.exe c:\WINDOWS\system32\SP00LV.exe c:\WINDOWS\system32\drivers\svchost.exe 最后修复注册表 |
| 欢迎光临 IT家园 (http://bbs.it998.com/) | Powered by Discuz! 7.2 |