[转载]AV终结者(随机八位数，映像劫持，破坏安全模式)病毒解决方案

:I5w%|P+B&K%^R0       1、运行病毒文件后，会生成以下文件：51Testing软件测试网K:uiC.aF^
          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dll (46163字节)51Testing软件测试网 xEg2IF/j*w&A
          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat (33363字节)51Testing软件测试网 PMQ:O.?{$r
          %SystemRoot%\Help\随机八位字符.chm                            (33363字节)
V`7G0aEN9J0          %SystemRoot%\随机八位字符.hlp                                    (33字节)51Testing软件测试网&]0L"M}VEs
          在除系统盘外的各盘根目录下生成
j&VA[&[0IL0          autorun.inf                                                     (172字节)
1Ju!^ H4f;U/a0          随机八位字符.exe                                              (33363字节)

       2、关闭运行的安全软件，监控并关闭以下含有以下字符串的文件夹、窗体、进程、服务、网页或文本：

!c5[
I.mYr'Q"^Yf0          AntiVirus、Trojan、Firewall、Kaspersky、JiangMin、KV200、kxp、Rising、RAV、RFW、KAV200、KAV6、51Testing软件测试网I"y.w8fda7}?lM OD,`
          McAfe、Network Associates、TrustPort、Norton、Symantec、SYMANT~1、Norton、SystemWorks、ESET、51Testing软件测试网5uK*]])g0a(y7j
          Grisoft、F-Pro、Alwil Software、ALWILS~1、F-Secure、ArcaBit、Softwin、ClamWin、DrWe、Fortine、
4g2^RAi1^0          anda Software、Vba3、TrendMicro、QUICKH~1、TRENDM~1、Quick Heal、eSaf、ewido、Prevx1、ersavg、
-EbPJA0YN0          Ikarus、Sopho、Sunbelt、PC-cilli、ZoneAlar、 Agnitum、WinAntiVirus、AhnLab、Norma、surfsecret、51Testing软件测试网m
EH%bTo1]Wj
          Bullguard、BlackICE、Armor2net、360safe、SkyNet、k2007、AntiyLabs、LinDirMicro Lab、Filseclab、ast、51Testing软件测试网6[#?7eOF~\r`3h
          System Safety Monitor、ProcessGuard、FengYun、Lavasoft、Defendio、kis6、Behead、sreng、IceSword、51Testing软件测试网 {$T1mS/?+\x.A
          HijackThis、killbox、procexp、Magicset、EQSysSecure、ProSecurity、Yahoo!、Google、baidu、P4P、51Testing软件测试网N8[L)i-JpZj
          Sogou PXP、yaskp.sys、BDGuard.sys、超级兔子、木马、KSysFilt.sys、KSysCall.sys、AVK、K7、Zondex、
8]-ZLrH O0          blcorp、TinyFirewall Pro、Jetico、HAURI、CA、kmx、PCClear_Plus、Novatix、Ashampoo、WinPatrol、51Testing软件测试网my'q+C.Ynan
          Spy Cleaner Gold、CounterSpy、EagleEyeOS、Webroot、BufferZone、avp、AgentSvr、Ccenter、Rav、
7TA8jP9{@:o8a0          RavMonD、RavStub、RavTask、rfwcfg、rfwsrv、RsAgent、Rsaupd、runiep、SmartUp、FileDsty、RegClean、51Testing软件测试网x;w6c\oU}
          360tray、360Safe、360rpt、kabaload、safelive、Ras、KASMain、KASTask、KAV32、KAVDX、KAVStart、
8mr`3g;}H0          KISLnchr、KmailMon、KMFilter、KPFW32、KPFW32X、KPFWSvc、KWatch9x、Kwatch、KwatchX、TrojanDetector、
RAn }C0          UpLive.EXE、KVSrvXP、KvDetect、KregEx、kvol、kvolself、kvupload、kvwsc、UIHost、IceSword、iparmo、
~6u5TKiR Ew.y0          mmsk、adam、MagicSet、PFWLiveUpdate、SREng、WoptiClean、scan32、shcfg32、mcconsol、HijackThis、51Testing软件测试网5i/GG!Z3{*g)t
          mmqcj、Trojanwall、FTCleanerShell、loaddll.、rfwProxy、KsLoader、KvfwMcl、autoruns.、AppSvc32、51Testing软件测试网 `'d7a+v\)Vi,z
          ccSvcHst、isPwdSvc、symlcsvc、nod32kui、avgrssvc、RfwMain、KAVPFW、Iparmor、nod32krn、PFW、RavMon、
2lS2]PhL4T)Y`0          KAVSetup、NAVSetup、SysSafe、QHSET、xsweep.、AvMonitor、UmxCfg、UmxFwHlp、UmxPol、UmxAgent、51Testing软件测试网-J:`5UQBv'Q|'q/X
          UmxAttachment、KPFW32、KPFW32X、KvXP_1、KVMonXP_1、KvReport、KVScan、KVStub、KvXP、KVMonXP、KVCenter、51Testing软件测试网C C+xC ws#m:Vn
          TrojDie、avp.com、krepair.COM、KaScrScn.SCR、Trojan、Virus、kaspersky、jiangmin、rising、ikaka、duba、
*d5@FoC|+}DE0          kingsoft、360safe、木马、木馬、病毒、杀毒、殺毒、查毒、防毒、反病毒、专杀、專殺、卡巴、江民、瑞星、
*z&l`;lZ7yP!d(vp0          卡卡社区、金山毒霸、毒霸、金山、社区、360安全、恶意软件、流氓软件、举报、报警、杀软、殺軟、防駭、微点、
w!M2}u
m&p&e J0          MSInfo、WinRAR、KvNative、bsmain、aswBoot
LR%kY*RQQ051Testing软件测试网$sd"X:O9C;mr2VuM

v v#Y3N6r9h-}g%xI0       3、删除以下注册表项破坏安全模式
V)O1H,X c0          HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网C6@ })o4S
          HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网{ zF egP&W2R
          HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网wK)hS*Eg:k;]/JH
?
          HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网GJSzoc+_i'O(Dyj
          修改系统隐藏属性:51Testing软件测试网b(k
U2?U(d!p
          改HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
2F.|0S)Y-Y,\0          Folder\Hidden\SHOWALL\CheckedValue值为051Testing软件测试网1g(wR {}D3Hc m+p8E
          //1为显示隐藏文件

2Jv5g0w9?/O-IvQ)}0       4、添加IFEO映像劫持项51Testing软件测试网 }@q,bDH"v x Vk!mn
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
7aTX?
y-N0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
UL7J au
{
usy6u0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
+_Wn qH e0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
dY}j"f-Z0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
:U7J%e5V8yk#t3o0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe51Testing软件测试网#u&eOT d!ZnH
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe51Testing软件测试网`J]CM
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
`QY4i&JIIK$m0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe51Testing软件测试网0U:C9_+[].P!m
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
+@ m tenQ7u@a0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com51Testing软件测试网\ J2T$kV Q P#V/r
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
2RXC1ar#f8J0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
~p1H8m
Jds0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe51Testing软件测试网c(X@2i ]G
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe51Testing软件测试网a2rR i5s;z0a
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
(].R*^_^5\#}0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
N gC;T8x!k9A0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe51Testing软件测试网M"~k$kwAMC s
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe51Testing软件测试网 P;a[,{3YIpJ?
`8IB
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe51Testing软件测试网D'ebVF(@
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe51Testing软件测试网%N2E*wYT2AJ-QB
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
Ms5FVY:]5v6Q.u~1b^ R0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR51Testing软件测试网4gab0h8a9VU
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe51Testing软件测试网']3Xh0Ad/Sw*Jd8B8[
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe
ZsiF| HN:G z]0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe
#wR&csg1_0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
@ }F?H0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe51Testing软件测试网a4~/^9]^+TLwV
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
8QdJyw"c2y8b!gaC0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
;u%@j ik|/K0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
}6H)I'S V o2_8@0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
;f.u2l6r+V9E2^w0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe51Testing软件测试网Y0m;}:J]0{Wn
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
2xM4T`@!c'mVt0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe
&w1@.Z Xc7Rn0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe51Testing软件测试网z Z:\-U-n)g,Rl~O
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe51Testing软件测试网S^2d W;|D V
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM51Testing软件测试网9q ??tA0m|DWT
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe
T4ZV\.D V].eC0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
7_6HAd+W6\`}[0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
y }9t&TQ`)\0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe51Testing软件测试网9tg.FZ4a E
[ F
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp51Testing软件测试网6pV-N4nD {
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp51Testing软件测试网5Q*jq?gC0p.~^
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe51Testing软件测试网:N}2Eie*L+tHk
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
)mFpe3\|0}0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp51Testing软件测试网C+f0KMy
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
.A'~7} ]$r G&BmR0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe51Testing软件测试网z3tV,_#t/M#S
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp51Testing软件测试网+Cwl_9O"hu8X|
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe
!n:e:q(F~0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe
B!W z2[?g9SO9z!q0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
xp#m7Wn$b['x8D,fj0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
eJ6\kr @#} ]$t4i0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe51Testing软件测试网I u\5[&E6@[
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe51Testing软件测试网#j ],jO#@i#Hu qNS
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe
4n%E{1N!U"X7e0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe
(Rp@!_iK1Qy {d0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe51Testing软件测试网
VnBD ~ W7Vwj
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
-gSs5J'q]0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe
q"hJ }C1Y/H0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
5A5Q@:s_ tzo0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe
D`#qdnk7m&R0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
$|.Mz/cC0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe51Testing软件测试网.Ly4bQ?ewCU
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe51Testing软件测试网_ WNN#o.U }9i
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe51Testing软件测试网WW8PQ&Qqrg
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe
*V ?K(F6Xe3|0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
#i-`2[[`C
t0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe51Testing软件测试网\J A_P!Q,\#M
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe51Testing软件测试网K4v G-H+^M
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe51Testing软件测试网&ArA(yj;z[~
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe51Testing软件测试网 h~ e@E-XFzzN5f(J
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe51Testing软件测试网an4J^'x/uH
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
Gd,IDZ-A7EA0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe
W]A5Ns}0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe
;tyK-l*}0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe51Testing软件测试网[n{dT@(k
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe51Testing软件测试网ez*q{K0E
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
?D8oD/Z,j*b0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe
I t;Q,y6Z y'M2@(K#]^0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
3Zt0["?f0f0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe51Testing软件测试网
k~M9O2G f? v
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe
0hr@6TZ0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe51Testing软件测试网 {&S jo},pk
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe51Testing软件测试网CTD+B6j_P
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe
CvN&k1~M0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe
wG l4upE+I0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe
R9j%C!hy&j[)[0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe51Testing软件测试网|/@/y9p^6f
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe
.I}1nQ&h0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp51Testing软件测试网
WaqL:@(Wp$P#Y
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe51Testing软件测试网2vVQ&Z&d
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe51Testing软件测试网/st)S+W]v'r"V
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe
?I(UL.UzG+?L0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe51Testing软件测试网U!Ib:Ib \
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe51Testing软件测试网O&~
yi`9_w
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe51Testing软件测试网&M2O+uqup}%k;OW f
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe

{ ^? |?SC`wM0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
4p/}3EY!]uXm0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe51Testing软件测试网c"K(wN4`GO-k
          以上键值均指向51Testing软件测试网f/}7uq"G(G
          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat

%Lf1`B{)L0       5、连接http://google.171738.org 和http://head.bodyhtml.biz/ani.js
j@3gsX0          下载ani.c (1,156 字节)Ani.c为ANI溢出程序，并通过该文件下载51Testing软件测试网I!X x?Gz
          http://head.bodyhtml.biz/update.exe。51Testing软件测试网y7a'Q e3VcLL]Y
          通过连接http://www.cnzz.com/stat/website.php?web_id=518199记录访问量。

0bF~2x7v"wR0       6、update.exe文件会从http://head.bodyhtml.biz上下载大量木马与病毒。51Testing软件测试网%Z}0U3LW
          其中包括AV终结者变种，病毒如下：%CommonProgramFiles%\system\jbtmfqq.exe          (25240字节)51Testing软件测试网 }c2KYL
          %CommonProgramFiles%\microsoft shared\ytbikec.exe                                (25240字节)
pR!y R\,J}T9g0          在除系统盘根目录下

y6YHZo"? e[M0          autorun.inf

n-u`3k_J*D0          hsomklg.exe             (28672字节)
zh$K'O x$Y-~9rBJV0          %temp%目录下51Testing软件测试网 \$cVgtJ ~7K:c2Z
          LYLOADER.EXE            (10196字节)51Testing软件测试网){"z_$[n
          LYMANGR.DLL              (2816字节)
+QM3X;|7pJ*L9^0          MSDEG32.DLL              (4999字节)51Testing软件测试网kKQmYK7Plq5d
          ~SM3.tmp                (19504字节)
2[2px&Y B}0          ~SM4.tmp                (19504字节)51Testing软件测试网|7dsYI
          ~SM5.tmp                (19504字节)51Testing软件测试网rTq
V6e!d,W0b
          ~SM6.tmp                (19504字节)51Testing软件测试网$VD;h/^yn7q-z J
          ~SM7.tmp                (19504字节)51Testing软件测试网sh*M6GO,LjB
          以上文件会采用添加自身到启动项或插入explorer.exe进程进行自我保护，还会下载其他盗取网游帐号的木马。51Testing软件测试网_L|&|0m&RYP(g5X

 51Testing软件测试网8ob$\ux?5w6G

kE:ib%d$A}UV0    1、先找突破点。因为映像劫持(image File Execution Options Hijack)只是针对文件名，所以只要更改变文件名，就51Testing软件测试网]y1a{:fA0dc
      可以使它失效。为了防止刚清理的病毒又被重新生成或者安全软件不能使用。我们先解除映像支持，使用超级巡警中51Testing软件测试网z#U3U3OYHy
      新发布的IFEO修复功能(“安全优化”中“系统修复”下的“Fix IFEO”) 即可。因为AST可能已经被映像劫持，所以51Testing软件测试网c0{)l7K"K,y)B
      推荐使用超级巡警团队针对此类病毒新推出的“ToolsLoader”(详见http://www.dswlab.com/d3.html)。51Testing软件测试网4\:[*K\j8u8e7]c

51Testing软件测试网4P\v2}gy%^*V
    2、清出内存病毒和病毒文件。找到加载到 explorer.exe 的dll文件(文件名应该与就是刚才记着的相同)，用超级巡警
5~7JX5YF
L3u
l-d+k9R0      ToolsLoader卸载它。然后删除掉dll文件和同目录下的扩展名为dat的文件(因为病毒会监控以上文件的目录，所以推51Testing软件测试网ik8xJ/vS9zP)R$V
      荐使用巡警中的“文件粉碎机”删除以上文件)。 然后用 win+e 打开资源管理器，找到根目录下的 autorun.inf 和51Testing软件测试网s+]T;ib
      autorun.inf 里面记录的exe文件(注意： 不要双击盘符或单击盘符右键选打开，这样让autorun.inf失效，然后使用51Testing软件测试网Obf@1v&} lv1U(SR
      巡警中的“文件粉碎机”删除这两个文件)。现在病毒的主文件已经都清理了。剩下的可以用病毒文件的文件名(不要
8|b7Yc9ge0      扩展名)和病毒文件生成时间进行全盘搜索，找到的文件都删除掉。此病毒还会连接一些网站，下载大量盗号软件 ，51Testing软件测试网/zIOQXo3x
      这些盗号软件目的是盗取游戏程序或其他程序的帐号与密码，清除不会很复杂。它们一般都采用加载启动的方法，达51Testing软件测试网-S:bO X[U
      到开机运行的效果。所以只要删除了启动项及其对应的文件，就可解决。这些病毒文件产生的dll文件和垃圾文件 ，51Testing软件测试网 }&F*l8pZmC(R
      就可以交给杀毒软件处理了。51Testing软件测试网S@]#ezbL

"]E(]%X.Vlp051Testing软件测试网8i.J!gE(m@ N
    3、全面修复。修复隐藏属性：使[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\51Testing软件测试网%L c d8o7rY F2{
      Explorer\Advanced\Folder\Hidden\SHOWALL]下的"CheckedValue"= dword:00000001。修复安全模式，可以用超级巡51Testing软件测试网-SDOB9r:QQ-oAn
      警的安全修复(“安全优化”中“系统修复”下的“Fix IFEO”)。也可以先在能进入安全模式的机器中导出
3f&?{
m7?MGq0      HKLM\SYSTEM\ControSet001\Control\SafeBoot\
0YgBw*\3N'A1L0      HKLM\SYSTEM\ControSet003\Control\SafeBoot\
aa{8E#S o;?0      HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\然后复制到本机上导入。51Testing软件测试网%M0mAEPA2j
      修复映像劫持：这个在第一步已经做了。

8]:@KCWU NN0
a4bL7WR:C0    4、安全模式杀毒。确保杀毒软件升级到最新，确保打上了最新的系统补丁(用巡警的补丁检查功能，没打的补丁一定要
v$o!_0dE"{+I9R
]+Xv(F*r\0      打上)，进入安全模式(推荐断开网络)，使用超级巡警进行全盘扫描，彻底清除各种病毒。

Z0g#n#a9w_O#A0
.Iad%o/Yc;~9^/I:\0    5、使用超级巡警屏蔽网站http://head.bodyhtml.biz