（已解决）请大家看下这病毒怎么杀，红伞刚才已经被干掉了！

风野胤

这种病毒首先是断根
要不杀了没用的

右键进每个盘
找到每个盘的autorun.inf
先打开看它指向的exe
删掉
然后把那个inf文件删掉
然后在工具 文件夹选项 文件类型里面
把硬盘的打开类型改成explorer 设为默认
然后用sreng找病毒的自启动程序 删掉
再从服务项里面找病毒伪装的自启动的服务
把指向的文件删掉
病毒的服务删掉（从注册表里面删）
全部做完了再慢慢杀毒

jimmyleo

风野说的是 感谢回答

周杰伦

把样本发上来，让我们上报吧

0312072650

小红伞的隔离区在哪里呢？我不会弄出来呀！

stonejr

样本区有这玩意.
http://bbs.kafan.cn/viewthread.p ... p;extra=&page=2
红伞能杀,不知道楼主怎么会中的

lqwoshifeng

真是有点邪门了，autorun这个病毒小红伞不是号称必杀吗？因为本人没有种过此毒，所以虽然使用红伞中，却没机会实战一下，杀不了吗？

aa11qq26

树大总会招风的

guigui_cs

这个病毒的分析我给你  你按照这个杀吧    这个病毒有 IFEO映像劫持 的  所以导致你很多软件都开不了



Win32.PSWTroj.QQPass
Win32.PSWTroj.QQPass
   

病毒别名： 处理时间：2007-03-30 威胁级别：★
中文名称： 病毒类型：木马 影响系统：Win 9x/ME,Win 2000/NT,Win XP,Win 2003
病毒行为:
该病毒是一个QQ盗号木马。

1、生成的文件
%SystemRoot%\system32\severe.exe
%SystemRoot%\system32\mmlucj.exe
%SystemRoot%\system32\drivers\avipit.exe
%SystemRoot%\system32\drivers\conime.exe
%SystemRoot%\system32\mmlucj.dll

2、添加启动项
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"mmlucj" = "%SystemRoot%\system32\severe.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"avipit" = "%SystemRoot%\system32\mmlucj.exe"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell" = "%SystemRoot%\system32\drivers\conime.exe"

3、结束下列进程
PFW.exe,Kav.exe,KVOL.exe,KVFW.exe,adam.exe,qqav.exe,qqkav.exe,TBMon.exe,kav32.exe,kvwsc.exe,CCAPP.exe,KRegEx.exe,kavsvc.exe,VPTray.exe,RAVMON.exe,EGHOST.exe,KavPFW.exe,SHSTAT.exe,RavTask.exe,TrojDie.kxp,Iparmor.exe,MAILMON.exe,MCAGENT.exe,KAVPLUS.exe,RavMonD.exe,Rtvscan.exe,Nvsvc32.exe,KVMonXP.exe,Kvsrvxp.exe,CCenter.exe,KpopMon.exe,RfwMain.exe,KWATCHUI.exe,MCVSESCN.exe,MSKAGENT.exe,kvolself.exe,KVCenter.kxp,kavstart.exe,RAVTIMER.exe,RRfwMain.exe,FireTray.exe,UpdaterUI.exe,KVSrvXp_1.exe,RavService.exe

4、修改注册表使系统总是不显示隐藏文件。
software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall
"CheckedValue" = "0"

5、该病毒在d，e，f，g，h，i盘生成autorun.inf和OSO.exe作成autorun启动。
--------------------------------
[AutoRun]
open=OSO.exe
shellexecute=OSO.exe
shell\Auto\command=OSO.exe
---------------------------------

6、使用互斥体，使下列进程不能运行
A}cNqqc{[TWQkgdfv7(3 = ExeMutex_QQRobber2.0
@ijNqqc{[TWQkgdfv7(3 = DllMutex_QQRobber2.0
AntiTrojan3721
ASSISTSHELLMUTEX
SKYNET_PERSONAL_FIREWALL
KingsoftAntivirusScanProgram7Mutex

7、访问下列网址，并会尝试下载@#$#.htm、30w.txt、dqhx1.txt、down.txt、dqhx3.txt等文件。
lqrs>*)tsr(``642*fin = http://***.cd321.com
lqrs>*)tsr(``642*kcw = http://***.cd321.net
lqrs>*)tsr(532?43+eli = http://***.677977.com
lqrs>*)tsr(`ps757+eli = http://***.ctv163.com
lqrs>*)tsr(``642*kcw+66t*q~w = http://***.cd321.net/30w.txt
lqrs>*)tsr(`ps757+eli*ggilh,`jqm*q~w = http://***.cd321.com/admin/down.txt
8、生成并执行hx1.bat处理文件，设置系统时间为2004-1-22。

9、调用sc.exe程序停止相关反病毒软件服务和禁止启动运行
-----------------------------------------
stop KVWSC
config KVWSC start= disabled
stop KVSrvXP
config KVSrvXP start= disabled
stop kavsvc
config kavsvc start= disabled
stop RsCCenter
config RsCCenter start= disabled
stop RsRavMon
------------------------------------------

10、映像劫持，使得不能使用下列软件
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.com
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32.exe
"Debugger" = "%SystemRoot%\system32\drivers\avipit.exe"

11、修改host文件，屏蔽下列网址
127.0.0.1 localhost
127.0.0.1 mmsk.cn
127.0.0.1 ikaka.com
127.0.0.1 safe.qq.com
127.0.0.1 360safe.com
127.0.0.1 www.mmsk.cn
127.0.0.1 www.ikaka.com
127.0.0.1 tool.ikaka.com
127.0.0.1 www.360safe.com
127.0.0.1 zs.kingsoft.com
127.0.0.1 forum.ikaka.com
127.0.0.1 up.rising.com.cn
127.0.0.1 scan.kingsoft.com
127.0.0.1 kvup.jiangmin.com
127.0.0.1 reg.rising.com.cn
127.0.0.1 update.rising.com.cn
127.0.0.1 update7.jiangmin.com
127.0.0.1 download.rising.com.cn
127.0.0.1 dnl-us1.kaspersky-labs.com
127.0.0.1 dnl-us2.kaspersky-labs.com
127.0.0.1 dnl-us3.kaspersky-labs.com
127.0.0.1 dnl-us4.kaspersky-labs.com
127.0.0.1 dnl-us5.kaspersky-labs.com
127.0.0.1 dnl-us6.kaspersky-labs.com
127.0.0.1 dnl-us7.kaspersky-labs.com
127.0.0.1 dnl-us8.kaspersky-labs.com
127.0.0.1 dnl-us9.kaspersky-labs.com
127.0.0.1 dnl-us10.kaspersky-labs.com
127.0.0.1 dnl-eu1.kaspersky-labs.com
127.0.0.1 dnl-eu2.kaspersky-labs.com
127.0.0.1 dnl-eu3.kaspersky-labs.com
127.0.0.1 dnl-eu4.kaspersky-labs.com
127.0.0.1 dnl-eu5.kaspersky-labs.com
127.0.0.1 dnl-eu6.kaspersky-labs.com
127.0.0.1 dnl-eu7.kaspersky-labs.com
127.0.0.1 dnl-eu8.kaspersky-labs.com
127.0.0.1 dnl-eu9.kaspersky-labs.com
127.0.0.1 dnl-eu10.kaspersky-labs.com

wu19934718

我还有EQ,哈哈,不用怕的,啦啦

如今的杀软都被病毒给杀了，唉，这是啥世道啊