[转载]AV终结者(随机八位数，映像劫持，破坏安全模式)病毒解决方案

k(bVE'EC BY1w-F0       1、运行病毒文件后，会生成以下文件：51Testing软件测试网)yw)M\v8y#cP)[
          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dll (46163字节)
i?fPL(G0          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat (33363字节)
4g3xiOum"e ot0          %SystemRoot%\Help\随机八位字符.chm                            (33363字节)51Testing软件测试网X.Ub*Rxo3Pu9Y
          %SystemRoot%\随机八位字符.hlp                                    (33字节)51Testing软件测试网A#Dq
mhU@? E
          在除系统盘外的各盘根目录下生成
xq!S
XSg-yIh0          autorun.inf                                                     (172字节)51Testing软件测试网Z#o
Y"hXy
          随机八位字符.exe                                              (33363字节)

       2、关闭运行的安全软件，监控并关闭以下含有以下字符串的文件夹、窗体、进程、服务、网页或文本：

          AntiVirus、Trojan、Firewall、Kaspersky、JiangMin、KV200、kxp、Rising、RAV、RFW、KAV200、KAV6、51Testing软件测试网R1\&A$P zD
Ck
          McAfe、Network Associates、TrustPort、Norton、Symantec、SYMANT~1、Norton、SystemWorks、ESET、51Testing软件测试网2YY7]R#],f$?7Et
          Grisoft、F-Pro、Alwil Software、ALWILS~1、F-Secure、ArcaBit、Softwin、ClamWin、DrWe、Fortine、51Testing软件测试网Me\*z/EY7M/P6QC@:g g
          anda Software、Vba3、TrendMicro、QUICKH~1、TRENDM~1、Quick Heal、eSaf、ewido、Prevx1、ersavg、
D3n'pl`0          Ikarus、Sopho、Sunbelt、PC-cilli、ZoneAlar、 Agnitum、WinAntiVirus、AhnLab、Norma、surfsecret、
%]0l2h2bBd_m1_"B]0          Bullguard、BlackICE、Armor2net、360safe、SkyNet、k2007、AntiyLabs、LinDirMicro Lab、Filseclab、ast、
z$TK`Tg ^!R2@0          System Safety Monitor、ProcessGuard、FengYun、Lavasoft、Defendio、kis6、Behead、sreng、IceSword、
D,F.Z9t#[9h3A1L
sm0          HijackThis、killbox、procexp、Magicset、EQSysSecure、ProSecurity、Yahoo!、Google、baidu、P4P、51Testing软件测试网S$Gen.h0U6v~RI
          Sogou PXP、yaskp.sys、BDGuard.sys、超级兔子、木马、KSysFilt.sys、KSysCall.sys、AVK、K7、Zondex、
*X4b4p7Z-Qv0^0          blcorp、TinyFirewall Pro、Jetico、HAURI、CA、kmx、PCClear_Plus、Novatix、Ashampoo、WinPatrol、51Testing软件测试网NAX1n:n:e B+lF
          Spy Cleaner Gold、CounterSpy、EagleEyeOS、Webroot、BufferZone、avp、AgentSvr、Ccenter、Rav、
-pUlkEA0          RavMonD、RavStub、RavTask、rfwcfg、rfwsrv、RsAgent、Rsaupd、runiep、SmartUp、FileDsty、RegClean、51Testing软件测试网.N5M;ITH9\M
          360tray、360Safe、360rpt、kabaload、safelive、Ras、KASMain、KASTask、KAV32、KAVDX、KAVStart、51Testing软件测试网!ErU1^so4L7\lL9V
          KISLnchr、KmailMon、KMFilter、KPFW32、KPFW32X、KPFWSvc、KWatch9x、Kwatch、KwatchX、TrojanDetector、51Testing软件测试网v1yM;S
~EF/M
          UpLive.EXE、KVSrvXP、KvDetect、KregEx、kvol、kvolself、kvupload、kvwsc、UIHost、IceSword、iparmo、
2k0_$g,i)A
b
~"t!e0          mmsk、adam、MagicSet、PFWLiveUpdate、SREng、WoptiClean、scan32、shcfg32、mcconsol、HijackThis、
:nc(D`2|\a0          mmqcj、Trojanwall、FTCleanerShell、loaddll.、rfwProxy、KsLoader、KvfwMcl、autoruns.、AppSvc32、
h(FC'eb0          ccSvcHst、isPwdSvc、symlcsvc、nod32kui、avgrssvc、RfwMain、KAVPFW、Iparmor、nod32krn、PFW、RavMon、51Testing软件测试网 Y;| ?_;S
          KAVSetup、NAVSetup、SysSafe、QHSET、xsweep.、AvMonitor、UmxCfg、UmxFwHlp、UmxPol、UmxAgent、51Testing软件测试网7k4LVd3zw
          UmxAttachment、KPFW32、KPFW32X、KvXP_1、KVMonXP_1、KvReport、KVScan、KVStub、KvXP、KVMonXP、KVCenter、
t!F9K~jJ0          TrojDie、avp.com、krepair.COM、KaScrScn.SCR、Trojan、Virus、kaspersky、jiangmin、rising、ikaka、duba、
}.Q3R9c5tW7?|0          kingsoft、360safe、木马、木馬、病毒、杀毒、殺毒、查毒、防毒、反病毒、专杀、專殺、卡巴、江民、瑞星、
8n rkEy,v0          卡卡社区、金山毒霸、毒霸、金山、社区、360安全、恶意软件、流氓软件、举报、报警、杀软、殺軟、防駭、微点、51Testing软件测试网B w"utpvl)V
          MSInfo、WinRAR、KvNative、bsmain、aswBoot
W0c,bE,[._K6b051Testing软件测试网AR,Z1H1V-^`_ K^

       3、删除以下注册表项破坏安全模式
muY st&o?0          HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
6l mX#ZsI!r0          HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网 DS)X])PT$`C)I
          HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}51Testing软件测试网n-~[)Z4h
          HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
4u h)z%C_0          修改系统隐藏属性:51Testing软件测试网_9D^5Ll%p
          改HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\51Testing软件测试网%u!nxM n-]([
          Folder\Hidden\SHOWALL\CheckedValue值为051Testing软件测试网kcv@,nw
          //1为显示隐藏文件

I }*N-V$_tj0       4、添加IFEO映像劫持项
s4G9g N`gk0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
WItC]gKQ k0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe51Testing软件测试网3q8A$wu,Tk-v
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
.Yc[5e;O _B0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe51Testing软件测试网7iSBU.sl @(K
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe51Testing软件测试网/E,W7boZ-`3w
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe51Testing软件测试网C*cm6T:G8{T*v1XN&E
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe51Testing软件测试网;N,VY;v9`Ut'o
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe51Testing软件测试网+A qsx[8{T5W
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe51Testing软件测试网9C@%A"a*z ?B m@7v
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
H*\!m*cYm{PE-M0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com51Testing软件测试网kL.G!T$bF }T.s
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe51Testing软件测试网
X+]EV*h;f
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe51Testing软件测试网X&n B_ aP
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
Ey
ix,_hc+I3@0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe
&{|'WrcmL4x.eq0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
W_km Z-W#AJ0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
)h\} }M.u d+k?0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe51Testing软件测试网K,~qv5pa$X p}+XU q
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe51Testing软件测试网X2Y$hrw
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe51Testing软件测试网F.xz p4QS^
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe
QFDrVN.^ V*~%g0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe51Testing软件测试网7~HG2CiE,c
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR51Testing软件测试网C8z+q\8AS+Uz"u
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe
nnrrc&gA0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe51Testing软件测试网(qlA7d+CThi
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe51Testing软件测试网&eks2Qe
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
wzz
M\"Zy0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe
't.~U5f}/R[:`0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
6x3vjV(\+b/rB0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe51Testing软件测试网nBbwbR)c5ju
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
~t_ H/@%XJ J}|/?2^0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
U-TQcW8`q0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe51Testing软件测试网D7mv/V1wr/F7C
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe51Testing软件测试网%Tam6^0Umy t
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe51Testing软件测试网V/r
fPb*_$F
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe
"f U8o6z2`G
~f'x0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
7swJH4zGJ,}@0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krepair.COM51Testing软件测试网 u'~4i*u'M$r
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe51Testing软件测试网#x8]OP+[P
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
4~$~*Rofy+I#b_8N0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
k$q)P/rm0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe51Testing软件测试网&hI7u9mc;y#u^
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp51Testing软件测试网:vJ0cZ&B%?Z
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp51Testing软件测试网&{_:q{f
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe51Testing软件测试网q%kRwk#w#pI#M
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
d v{K.J0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp
Q6G"a"|9ZzX0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
t7[Bm?u,tv%R0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
V`Mc8\.r9\9`_0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp
V_ JA\ n+t0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe51Testing软件测试网*En@Vq ^
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe51Testing软件测试网0Y/h"p3KAZ%s2l%S6\4Pi
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
_*@
{%o}&R8jnI!N%K0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
FIX6\*ZL&LdT(h"H;};P0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe51Testing软件测试网K9[ LtfA`0qk4vv[
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe51Testing软件测试网7DFN_3Q oH
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe51Testing软件测试网R(T
xc3k
Ty
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe51Testing软件测试网s7y2h$b6b6Gj!Z
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe51Testing软件测试网8JN5_^;Vq;v
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
2ehtV:Q0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe

x)r;|D.X:Zv![ur0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
;i Ud+x!U:Er3I6qN0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSetup.exe
+{3l#hX]*`-o$W n0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
wh)u8VLR0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
IF6z#s)g0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe51Testing软件测试网1@"igl)[7ZN`&S@
|
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
0e7m^
ff5{!w,c0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe51Testing软件测试网TM5vCH_r{B!`-qHU
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe51Testing软件测试网zpy-i w R
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
M%N
n6j3Za{#_A0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
4H-M"n,n+uA0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe51Testing软件测试网)^\e:{KN
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
"m Ghc*g ?b[c0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe51Testing软件测试网!v| r9h R
}
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
~2X!Z4GT8f Q0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe51Testing软件测试网.v0e1x0HC(h+^4L
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe
4aR~ru!aF0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe

io0?
l/P~K0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
jR w$^8n(Z4I0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe51Testing软件测试网cR1xj5FnYd
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe51Testing软件测试网 Ug*Z1fC+y3AL$D
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
d/y$SIC Hz\0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe
1w9yCV:k%L;o-f i0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe51Testing软件测试网 I9V-dp"Qa
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe51Testing软件测试网$v2K/} GSD7o2Kys
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe
f`7Qc1s~zt,j0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe51Testing软件测试网/{4w1Zh4Mf2fo"]
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe
M n0uJp:l1`3Pz%\r0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe
gh\^`*Z)w3C0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe
+k[t5SCz0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe51Testing软件测试网;Yh;k*jtI
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp51Testing软件测试网)Q
n3v?8aBo
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe51Testing软件测试网1{,?)}K?:?b\
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe51Testing软件测试网7k;e(|G
vj
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe51Testing软件测试网4G8YrLb;}
UDP(S
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe
yFAi:YZ@b2{!pP0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe
;K+c3`a$Zc0m}bjc:BG0          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe51Testing软件测试网1?Si'}:y]J)i]
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE.exe51Testing软件测试网qUb8A-_
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe51Testing软件测试网_&}5s:I?OD-zA#r
          HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe
,C0a,s%`|dH)w[0          以上键值均指向51Testing软件测试网^,A'L/J7R;Jl3N@K X3F
          %CommonProgramFiles%\Microsoft Shared\MSInfo\随机八位字符.dat51Testing软件测试网^_!YNV2]

&NO[E6W)`0       5、连接http://google.171738.org 和http://head.bodyhtml.biz/ani.js
-t.~D`\KW0          下载ani.c (1,156 字节)Ani.c为ANI溢出程序，并通过该文件下载51Testing软件测试网#S2BEJ%m)Jf
          http://head.bodyhtml.biz/update.exe。
c,Os x
wO*d0          通过连接http://www.cnzz.com/stat/website.php?web_id=518199记录访问量。51Testing软件测试网&C3[oK5I9o&dB

5kKP@@e!f0
?G/w s
Y5Q0       6、update.exe文件会从http://head.bodyhtml.biz上下载大量木马与病毒。
h0xK~q h/w#{O0          其中包括AV终结者变种，病毒如下：%CommonProgramFiles%\system\jbtmfqq.exe          (25240字节)
J(u'a a~5Q{0          %CommonProgramFiles%\microsoft shared\ytbikec.exe                                (25240字节)51Testing软件测试网 d9{9A*fDHV|/T _
          在除系统盘根目录下51Testing软件测试网tp.@u~A!gj
          autorun.inf51Testing软件测试网!G$U3{-fV3c6o8e
          hsomklg.exe             (28672字节)
.uq g._d
_lN|0          %temp%目录下51Testing软件测试网_S.d*{/d
          LYLOADER.EXE            (10196字节)
'iZ8DoZ0          LYMANGR.DLL              (2816字节)51Testing软件测试网!XIw5Jqnu7B-SD
          MSDEG32.DLL              (4999字节)51Testing软件测试网R6xnQ?/@i`
          ~SM3.tmp                (19504字节)
'r9}8N)Vn*by8S0          ~SM4.tmp                (19504字节)51Testing软件测试网
k5CywK
          ~SM5.tmp                (19504字节)
G)X@/IK[({0          ~SM6.tmp                (19504字节)
P&isZsl"y0          ~SM7.tmp                (19504字节)51Testing软件测试网 JOGNbr+bs
          以上文件会采用添加自身到启动项或插入explorer.exe进程进行自我保护，还会下载其他盗取网游帐号的木马。51Testing软件测试网(e5g1d4Jo

 51Testing软件测试网T-CLo3pu1d0r

y8|.CtfC;G8j0    1、先找突破点。因为映像劫持(image File Execution Options Hijack)只是针对文件名，所以只要更改变文件名，就51Testing软件测试网
X| yH:?d
      可以使它失效。为了防止刚清理的病毒又被重新生成或者安全软件不能使用。我们先解除映像支持，使用超级巡警中51Testing软件测试网:^s~,a3h@2w9t
      新发布的IFEO修复功能(“安全优化”中“系统修复”下的“Fix IFEO”) 即可。因为AST可能已经被映像劫持，所以51Testing软件测试网:~mP&uc5w zUck
      推荐使用超级巡警团队针对此类病毒新推出的“ToolsLoader”(详见http://www.dswlab.com/d3.html)。

/@d2r6c/YD051Testing软件测试网D}YW!kII0U
    2、清出内存病毒和病毒文件。找到加载到 explorer.exe 的dll文件(文件名应该与就是刚才记着的相同)，用超级巡警
V|#x iR S(k~],L0      ToolsLoader卸载它。然后删除掉dll文件和同目录下的扩展名为dat的文件(因为病毒会监控以上文件的目录，所以推
_SC$r%X;h0      荐使用巡警中的“文件粉碎机”删除以上文件)。 然后用 win+e 打开资源管理器，找到根目录下的 autorun.inf 和51Testing软件测试网'WD%LtQRuS
      autorun.inf 里面记录的exe文件(注意： 不要双击盘符或单击盘符右键选打开，这样让autorun.inf失效，然后使用
D dW G/_6O0      巡警中的“文件粉碎机”删除这两个文件)。现在病毒的主文件已经都清理了。剩下的可以用病毒文件的文件名(不要
%^q1@U8N0      扩展名)和病毒文件生成时间进行全盘搜索，找到的文件都删除掉。此病毒还会连接一些网站，下载大量盗号软件 ，51Testing软件测试网7^(w1|*LK
      这些盗号软件目的是盗取游戏程序或其他程序的帐号与密码，清除不会很复杂。它们一般都采用加载启动的方法，达
Xh"^4}z'm\|8q O:i0      到开机运行的效果。所以只要删除了启动项及其对应的文件，就可解决。这些病毒文件产生的dll文件和垃圾文件 ，51Testing软件测试网,S3UH#{~a,T%q8Z
      就可以交给杀毒软件处理了。51Testing软件测试网'j)j K2~N(}$oGE

rtb6}g~0    3、全面修复。修复隐藏属性：使[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\51Testing软件测试网W}*NYnA-^
      Explorer\Advanced\Folder\Hidden\SHOWALL]下的"CheckedValue"= dword:00000001。修复安全模式，可以用超级巡
:B8k+t8c*B,Hj0      警的安全修复(“安全优化”中“系统修复”下的“Fix IFEO”)。也可以先在能进入安全模式的机器中导出
}cLp&};S!H0      HKLM\SYSTEM\ControSet001\Control\SafeBoot\
}3i1EjH|:p0      HKLM\SYSTEM\ControSet003\Control\SafeBoot\51Testing软件测试网 L!o
J3LV
      HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\然后复制到本机上导入。
!WHc3Y5a4T0      修复映像劫持：这个在第一步已经做了。

"A(`d
S6gBF)ho(p3v-m051Testing软件测试网j^u5m3U
    4、安全模式杀毒。确保杀毒软件升级到最新，确保打上了最新的系统补丁(用巡警的补丁检查功能，没打的补丁一定要51Testing软件测试网Q9Gfk7jU$Ta+x
      打上)，进入安全模式(推荐断开网络)，使用超级巡警进行全盘扫描，彻底清除各种病毒。

{.j2mC }[wQ051Testing软件测试网1wQ cRo
Q
    5、使用超级巡警屏蔽网站http://head.bodyhtml.biz51Testing软件测试网Nu7h
Z4R?B