新人隔离区小白问题。

笑疯癫

先抱怨下，等了一个星期才申请到的ID

图片发不上来

我原来用的是破解版中文F-secure 还可以，就是有点费内存

才装的小红伞，全盘手动杀第一次毒后，隔离区出现了好多东西，不看直接删除

再杀一遍，隔离区出现同样的东西，再删，再杀，还是同样的东西

我该怎么办？

txy

试试在安全模式下杀行不？

笑疯癫

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
Begin scan in 'D:\' <娱乐>
D:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP143\A0034068.dll
    [DETECTION] Contains recognition pattern of the WORM/AdAgent.H.378880 worm
    [NOTE]      A backup was created as '48bc4919.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55f62.qua'  ( QUARANTINE )
Begin scan in 'E:\' <驱动>
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP103\A0009663.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48bc4a40.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c39.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP103\A0009704.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48bc4a41.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c3a.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010153.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc4a45.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c3e.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010158.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '48bc4a46.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c3f.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010239.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc4a48.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c31.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010244.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '49165c49.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '48bc4a4a.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP114\A0014184.exe
    [DETECTION] Is the TR/Agent.915375 Trojan
    [NOTE]      A backup was created as '48bc4a54.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c2d.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP138\A0029477.exe
    [DETECTION] Is the TR/Banbra.FGB Trojan
    [NOTE]      A backup was created as '48bc4a5a.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c23.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP142\A0031873.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc4a5d.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c26.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP142\A0031878.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '49165c5e.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '48bc4a5f.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP143\A0033906.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '48bc4a60.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac55c19.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP143\A0033911.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '49165c61.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '48bc4a62.qua'  ( QUARANTINE )
E:\下载软件\ppstream\xpsp2\XPSP2Patch.exe
      --> Object
        [1] Archive type: RSRC
        --> Object
          [DETECTION] Contains recognition pattern of the APPL/Tool.EvID4226.A application
    [NOTE]      A backup was created as '48df4a9d.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4aa65ce6.qua'  ( QUARANTINE )
E:\下载软件\web迅雷\historyinfo_manage.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '48ff4ab9.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4a874462.qua'  ( QUARANTINE )
E:\下载软件\web迅雷\WebThunder_SetupHelper.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48ee4ab6.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4a96446f.qua'  ( QUARANTINE )
Begin scan in 'F:\' <文件>
F:\歌\张学友 吻别 .mp3
    [DETECTION] Contains recognition pattern of the HTML/StartPage.O HTML script virus
    [NOTE]      A backup was created as '9c57a5d6.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '9e20a2ef.qua'  ( QUARANTINE )
F:\歌\王菲\只爱陌生人 .mp3
    [DETECTION] Contains recognition pattern of the HTML/StartPage.O HTML script virus
    [NOTE]      A backup was created as 'ded8bca3.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as 'dca0b27c.qua'  ( QUARANTINE )
F:\歌\韩国\从开始到现在.mp3
    [DETECTION] Contains recognition pattern of the HTML/StartPage.O HTML script virus
    [NOTE]      A backup was created as 'a257a974.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as 'a02fa7ad.qua'  ( QUARANTINE )

求助。。。删了  杀后隔离区又出来

笑疯癫

我把那几个歌找到删除后  后面3个没有了  
不会自己一个个找吧

jiangchuan

很多都是系统备份里的
推测 把自动还原关掉是不是就好了
期待高手给个准确答复

txy

相关注册表项是否被修改?是否有可疑服务项?
这些问题比较复杂,望高手解答.

笑疯癫

安全模式下杀 D盘的仍然存在 E盘的只有web迅雷的和pps的 共5个

gjno1

你竟然还开着系统还原 最鸡肋的功能 马上关闭 然后到安全模式下全盘杀一遍~

笑疯癫

关闭系统还原  安全模式下查杀没有   

重启再次查杀  隔离区依然有

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!
Begin scan in 'D:\' <娱乐>
Begin scan in 'E:\' <驱动>
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP103\A0009663.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48bc881f.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac48558.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP103\A0009704.exe
    [DETECTION] Is the TR/Dropper.Gen Trojan
    [NOTE]      A backup was created as '48bc8821.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac4855a.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010153.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc8825.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac5855e.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010158.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '491105fe.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '48bc8827.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010239.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '491105f0.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac58550.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP105\A0010244.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '48bc8828.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac58551.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP114\A0014184.exe
    [DETECTION] Is the TR/Agent.915375 Trojan
    [NOTE]      A backup was created as '48bc8834.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac5854d.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP138\A0029477.exe
    [DETECTION] Is the TR/Banbra.FGB Trojan
    [NOTE]      A backup was created as '48bc883a.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac58543.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP142\A0031873.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc883d.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac58546.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP142\A0031878.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '491105e6.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '48bc883f.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP143\A0033906.dll
    [DETECTION] Contains recognition pattern of the APPL/WebThunder.H application
    [NOTE]      A backup was created as '48bc8840.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac58539.qua'  ( QUARANTINE )
E:\System Volume Information\_restore{7619898A-B5C3-490F-A9B0-454B4418678B}\RP143\A0033911.dll
    [DETECTION] Contains recognition pattern of the SPR/Tool.WebThunder.B program
    [NOTE]      A backup was created as '48bc8841.qua'  ( QUARANTINE )
    [NOTE]      Attempting to perform action using the ARK lib.
    [NOTE]      A backup was created as '4ac5853a.qua'  ( QUARANTINE )
Begin scan in 'F:\' <文件>

笑疯癫

   看来 还是要自己解决了。。。

手动找到上面文件。。。删除

对了 是不是因为我装了 一键还原？？ 里面的文件有毒。。