完全搞定pagefile.pif(ExERoute木马)病毒

你是否正在寻找关于pagefile.pif的内容？让我把最俱价值的东西奉献给你：

日期：2006-8-5

来自：

Trojan.PSW.Lmir.iux)，。于是花了一些时间研究恢复方法：

主要分五步：

1．杀毒。

可以用软件，也可以手动。

下面是卡巴杀掉的结果：

@echo ===============================================

@echo Delete Trojan.PSW.Lmir.iux By o__4pollo

@echo ===============================================

@echo Start...

@echo ===============================================

@echo Execute ATTRIB...

@echo off

attrib -s -r -a -h c:/windows/1.com

attrib -s -r -a -h c:/windows/services.exe

attrib -s -r -a -h c:/windows/explorer.com

attrib -s -r -a -h c:/windows/finder.com

attrib -s -r -a -h c:/windows/exeroute.exe

attrib -s -r -a -h c:/windows/debug/debugprogram.exe

attrib -s -r -a -h c:/windows/system32/regedit.com

attrib -s -r -a -h c:/windows/system32/dxdiag.com

attrib -s -r -a -h c:/windows/system32/msconfig.com

attrib -s -r -a -h c:/windows/system32/command.pif

attrib -s -r -a -h c:/windows/system32/finder.com

attrib -s -r -a -h c:/windows/system32/rundll32.com

attrib -s -r -a -h c:/windows/system32/i.com

attrib -s -r -a -h c:/progra~1/common~1/iexplore.pif

attrib -s -r -a -h c:/progra~1/intern~1/iexplore.com

attrib -s -r -a -h d:/pagefile.pif

rem ===============================================

@echo Execute DELETE...

@echo off

del c:/windows/1.com

del c:/windows/services.exe

del c:/windows/explorer.com

del c:/windows/finder.com

del c:/windows/exeroute.exe

del c:/windows/debug/debugprogram.exe

del c:/windows/system32/regedit.com

del c:/windows/system32/dxdiag.com

del c:/windows/system32/msconfig.com

del c:/windows/system32/command.pif

del c:/windows/system32/finder.com

del c:/windows/system32/rundll32.com

del c:/windows/system32/i.com

del c:/progra~1/common~1/iexplore.pif

del c:/progra~1/intern~1/iexplore.com

del d:/pagefile.pif

@pause

@echo ===============================================

@echo End...

@echo ===============================================

2.回复exe关联

执行命令：assoc .exe=exefile

3.注册表操作

(5) 删除病毒添加的文件关联信息和启动项：

[HKEY_CLASSES_ROOT/winfiles]

[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run]

"Torjan Program"="%Windows%/services.exe"

[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunServices]

"Torjan Program"="%Windows%/services.exe"

[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/WindowsNT/CurrentVersion/Winlogon]

"Shell"="Explorer.exe 1"

改为

"Shell"="Explorer.exe"

完事了吗？不一定哟~~~

4.回复右键菜单的：打开方式--选择程序

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT/Unknown]

"AlwaysShowExt"=""

"QueryClassStore"=""

[HKEY_CLASSES_ROOT/Unknown/shell]

@="openas"

[HKEY_CLASSES_ROOT/Unknown/shell/openas]

[HKEY_CLASSES_ROOT/Unknown/shell/openas/command]

@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,/

00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,75,00,/

6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,25,00,53,/

00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,00,5c,00,73,00,/

79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,65,00,6c,00,6c,/

00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,4f,00,70,00,65,00,6e,00,41,00,/

73,00,5f,00,52,00,75,00,6e,00,44,00,4c,00,4c,00,20,00,25,00,31,00,00,00

5．回复桌面的IE

regsvr32 appwiz.cpl

regsvr32 mshtml.dll

regsvr32 jscript.dll

regsvr32 msi.dll

regsvr32 "C:/Program Files/Common Files/System/Ole DB/Oledb32.dll"

regsvr32 "C:/Program Files/Common Files/System/Ado/Msado15.dll"

regsvr32 mshtmled.dll

regsvr32 /i shdocvw.dll

regsvr32 /i shell32.dll

总结：

啊哈哈哈哈~~~

参考资料：

?ArticleID=370

?id=28

?bid=108950&aid=2835

以上就是关于pagefile.pif的全部内容，相信你一定会非常满意。

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/ruanjian/article-4128-1.html