瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】Backdoor.Gpigeon.vbq ,瑞星杀不掉!(日志已附)【已解决】

12   2  /  2  页   跳转

【求助】Backdoor.Gpigeon.vbq ,瑞星杀不掉!(日志已附)【已解决】

【回复“俺叫金无忌”的帖子】
用修复如下项:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<DCOM Server 2236><C:\WINDOWS\system32\2236_27.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<kXUulKYZV><C:\WINDOWS\system32\kn.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<SysTray.Exbr><C:\WINDOWS\system32\hfdlpngf.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{2C1CD3D7-86AC-4068-93BC-A02304BB2236}><C:\WINDOWS\system32\2236_27.dll> []

[]
{196B9CB5-4C83-46F7-9B06-9672ECD9D99B} <C:\WINDOWS\system32\winbrume.dll, N/A>

[IExpress]
{27E96DE0-8211-42CF-9A1E-FA6246A95B77} <C:\WINDOWS\system32\iexpress.dll, N/A>

[NaviHelperObj Class]
{3E422F49-1566-40D3-B43D-077EF739AC32} <C:\WINDOWS\system32\NaviHelper.dll, N/A>

[]
{87185E78-A61B-4DB3-965A-3235BBD7A622} <C:\WINDOWS\system32\win32hp.dll, N/A>

[T2BHO Class]
{B1D147E7-873E-4909-8127-695D9BB78728} <C:\WINDOWS\Downloaded Program Files\barhelp24.0.dll, HDT, Inc.>

[免费精彩视频超流畅在线观看]
{022C4009-5283-4365-97BF-144054B40E2E} <http://itv.mop.com, N/A>

[完美网译通]
{F43BD772-ABDD-43b7-A96A-3E9E61946EC0} <C:\WINDOWS\WORLD2\TOOLBAR\hmtoolbar.dll, N/A>

[VeryCD超级搜索]
{F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll, www.yok.com>

[天下搜索]
{56A7DC70-E102-4408-A34A-AE06FEF01586} <C:\WINDOWS\Downloaded Program Files\iebar23.0.dll, >

[MediaGatewayX]
{8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} <C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll, 180solutions>

[pCastPanel Class]
{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <C:\WINDOWS\system32\pcastctl.dll, >

=====================

开始--控制面板--性能和维护--管理工具--服务
禁用[Routing and Remote Manager / RemAccMan]

开始--运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除RemAccMan文件夹

===============================

卸载
C:\Program Files\YOK.com\

=======================

删除
C:\Program Files\YOK.com\
C:\WINDOWS\system32\kn.dll
C:\WINDOWS\system32\hfdlpngf.dll
C:\WINDOWS\system32\2236_27.dll
C:\WINDOWS\system32\winbrume.dll
C:\WINDOWS\system32\iexpress.dll
C:\WINDOWS\system32\NaviHelper.dll
C:\WINDOWS\system32\win32hp.dll
C:\WINDOWS\Downloaded Program Files\barhelp24.0.dll
C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll
C:\WINDOWS\system32\pcastctl.dll
C:\WINDOWS\Downloaded Program Files\iebar23.0.dll
C:\WINDOWS\WORLD2\
C:\Program Files\Outlook Express\Operate2.exe

若能找到如下文件
同样删除之
Operate2.dll
Operate2key.dll
Operate2_hook.dll
gototop
 

已解决,多谢楼上兄台
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT