ccsvchst.exe_rundll32_ccsvchst.exe 硬盘

dl1.exe是病毒名叫worm.win32.delf.cc（德芙）在任务管理里中的进程!

中此病毒的症状为：

1.破坏安全模式

2.不能显示隐藏文件

3.结束常见杀毒软件以及常用杀毒工具进程

4.监控窗口

5.IFEO映像劫持

6.可以通过移动存储传播

病毒运行后

在C:\Program Files\Common Files\Microsoft Shared\MSInfo\下面释放一个同样由8个数字和字母组成的组合的文件名的dll 和一个同名的dat 文件

我这里是C:\Program Files\Common Files\Microsoft Shared\MSInfo\41115BDD.dll

该dll插入Explorer进程

结束（包括但不限于）以下进程

360rpt.exe

360Safe.exe

360tray.exe

adam.exe

AgentSvr.exe

AppSvc32.exe

autoruns.exe

avgrssvc.exe

AvMonitor.exe

avp.com

avp.exe

CCenter.exe

ccSvcHst.exe

FileDsty.exe

FTCleanerShell.exe

HijackThis.exe

IceSword.exe

iparmo.exe

Iparmor.exe

isPwdSvc.exe

kabaload.exe

KaScrScn.SCR

KASMain.exe

KASTask.exe

K32.exe

KDX.exe

KPFW.exe

KSetup.exe

KStart.exe

KISLnchr.exe

KMailMon.exe

KMFilter.exe

KPFW32.exe

KPFW32X.exe

KPFWSvc.exe

KRegEx.exe

KRepair.COM

KsLoader.exe

KVCenter.kxp

KvDetect.exe

KvfwMcl.exe

KVMonXP.kxp

KVMonXP_1.kxp

kvol.exe

kvolself.exe

KvReport.kxp

KVScan.kxp

KVSrvXP.exe

KVStub.kxp

kvupload.exe

kvwsc.exe

KvXP.kxp

KvXP_1.kxp

KWatch.exe

KWatch9x.exe

KWatchX.exe

loaddll.exe

MagicSet.exe

mcconsol.exe

mmqczj.exe

mmsk.exe

NSetup.exe

nod32krn.exe

nod32kui.exe

PFW.exe

PFWLiveUpdate.exe

QHSET.exe

Ras.exe

Rav.exe

RavMon.exe

RavMonD.exe

RavStub.exe

RavTask.exe

RegClean.exe

rfwcfg.exe

RfwMain.exe

rfwProxy.exe

rfwsrv.exe

RsAgent.exe

Rsaupd.exe

runiep.exe

safelive.exe

scan32.exe

shcfg32.exe

SmartUp.exe

SREng.exe

symlcsvc.exe

SysSafe.exe

TrojanDetector.exe

Trojanwall.exe

TrojDie.kxp

UIHost.exe

UmxAgent.exe

UmxAttachment.exe

UmxCfg.exe

UmxFwHlp.exe

UmxPol.exe

UpLive.EXE.exe

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-22108-1.html