usp10.dll木马群的手工杀毒流程

图13

注意：

1、appinit_dll项可能很难删除。用IceSword强制删除只就能。删除后，自己再重建一个，填上正常的字段即可（瑞星用户此字段是kmon.dll）

2、有中招者反映：中此毒后，系统程序ctfmon.exe和rpcss.dll被病毒替换。我这儿查过，对比中招前后的这两个文件的大小和MD5，均无改变。因此，未处理这两个文件。

如果有确实证据显示这两个文件被病毒搞了usp10.dll，请将其复原（从dllcache目录下拷贝到system32目录下；也可早已中此毒的手机中拷贝这两个文件到即将手工杀毒后的中招电脑中）。

————————————————————

附上我完全中招后找到的全部病毒文件列表（病毒文件名是差异的。此表仅供参考）：

C:/Documents and Settings/baohelin/Local Settings/Temp/109ef1.dll

C:/Documents and Settings/baohelin/Local Settings/Temp/1157238

C:/Documents and Settings/baohelin/Local Settings/Temp/5F.tmp.bat

C:/Documents and Settings/baohelin/Local Settings/Temp/b.bat

C:/Documents and Settings/baohelin/Local Settings/Temp/WowInitcode.dat

C:/Documents and Settings/baohelin/Local Settings/Temp/wsasystem.gif

C:/Documents and Settings/baohelin/Local Settings/Temp/11231237

C:/Documents and Settings/baohelin/Local Settings/Temp/1437460

C:/Documents and Settings/baohelin/Local Settings/Temp/1518277

C:/Documents and Settings/baohelin/Local Settings/Temp/1529262

C:/WINDOWS/system32/drivers/msiffei.sys

C:/WINDOWS/system32/drivers/beep.sys

c:/windows/system32/6BB957B4.dat

c:/windows/system32/anymie360.exe

c:/windows/system32/anymie360.dll

c:/windows/system32/anymie360.ini

c:/windows/system32/jgbpepnb.dll

c:/windows/system32/jkglggoa.dll

c:/windows/system32/jaijjgib.dll

c:/windows/system32/kmkkbnkf.dll

c:/windows/system32/mnmijfnp.dll

c:/windows/system32/mcfkkald.dll

c:/windows/system32/oohelamb.dll

c:/windows/system32/bmnejfck.dll

c:/windows/system32/cpjbmhmm.dll

c:/windows/system32/dpabnlge.dll

c:/windows/system32/finhiabn.dll

c:/windows/system32/fennkeag.dll

c:/windows/system32/bmnejfck.dll

c:/windows/system32/cpjbmhmm.dll

c:/windows/system32/dpabnlge.dll

c:/windows/system32/fennkeag.dll

c:/windows/system32/finhiabn.dll

c:/windows/system32/jaijjgib.dll

c:/windows/system32/jgbpepnb.dll

c:/windows/system32/jkglggoa.dll

c:/windows/system32/kmkkbnkf.dll

c:/windows/system32/mcfkkald.dll

c:/windows/system32/mnmijfnp.dll

c:/windows/system32/ooamfhbi.dll

c:/windows/system32/oohelamb.dll

c:/program files/internet explorer/powernent.onz

c:/windows/system32/Drivers/msiffei.sys

c:/windows/system32/6bb957b4.dat

c:/windows/system32/bmnejfck.dll

C:/windows/fonts/ComRes.dll

C:/windows/Tasks/1

e:/usp10.dll

c:/windows/fonts/comres.dll

c:/windows/system32/cpjbmhmm.dll

c:/windows/system32/dpabnlge.dll

c:/windows/system32/fennkeag.dll

c:/windows/system32/finhiabn.dll

c:/windows/system32/jaijjgib.dll

c:/windows/system32/jkglggoa.dll

c:/windows/system32/kmkkbnkf.dll

c:/windows/system32/mcfkkald.dll

c:/windows/system32/mnmijfnp.dll

c:/windows/system32/ooamfhbi.dll

c:/windows/system32/oohelamb.dll

C:/WINDOWS/Fonts/ctm01025.fon

C:/WINDOWS/Fonts/ctm01025.ttf

C:/WINDOWS/Fonts/ctm04004.fon

C:/WINDOWS/Fonts/ctm04004.ttf

C:/WINDOWS/Fonts/ctm07015.fon

C:/WINDOWS/Fonts/ctm07015.ttf

C:/WINDOWS/Fonts/ctm09003.fon

C:/WINDOWS/Fonts/ctm09003.ttf

C:/WINDOWS/Fonts/ctm11008.fon

C:/WINDOWS/Fonts/ctm11008.ttf

C:/WINDOWS/Fonts/ctm12004.fon

C:/WINDOWS/Fonts/ctm12004.ttf

C:/WINDOWS/Fonts/CtmRes.dll

附件就是XDELBOX 1.8usp10.dll，无密码。

附件: XDELBOX.rar

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-122807-1.html