昨天中午帮MM弄电脑时抓到的``

 

随机7，也就是AV终结者`

 

不写详细了``想看的在我博客自己翻下哈``（标题随机7什么的``）

 

其实随机7是进程守护技术``以前写的那些方法可以通杀```

 

木马群就不一样了``=。=

 

 

DubaTool_AV_Killer.COM 271KB

 

 

 

专杀后，下载SREng：

 

sreng2.5.zip 780KB

 

 

执行以下操作时先全部清空临时文件：

 

我的电脑-系统盘(C盘?)-属性-磁盘清理-全部勾选上-点确定即可

 

执行上面操作后,往下..

 

SRENG操作方法:

(先看懂了再执行下面操作...)

用SREng 删除如下各项:

 

 

 

      <uvmmind><C:\winnt\system32\wocfiba.exe>    []
      <oymejto><C:\winnt\system32\gnkjkrl.exe>    []
      <ztsa><C:\DOCUME~1\admin\LOCALS~1\Temp\ztso.exe>    []
      <TIMHost><C:\winnt\TIMHost.exe>    []
      <rxsa><C:\DOCUME~1\admin\LOCALS~1\Temp\rxso.exe>    []
      <wdsa><C:\DOCUME~1\admin\LOCALS~1\Temp\wdso.exe>    []
      <zxsa><C:\DOCUME~1\admin\LOCALS~1\Temp\zxso.exe>    []
      <qjsa><C:\DOCUME~1\admin\LOCALS~1\Temp\qjso.exe>    []
      <mppds><C:\winnt\mppds.exe>    []
      <RAV0095><C:\winnt\system32\RAV0095.exe>    []
      <RAV008C><C:\winnt\system32\RAV008C.exe>    []
      <MsIMMs32><C:\winnt\MsIMMs32.exe>    []
      <RAV00AE><C:\winnt\system32\RAV00AE.exe>    []
      <RAV00B2><C:\winnt\system32\RAV00B2.exe>    []

 

      <{713AF41A-21B1-131B-1BFC-D2A90DF4A2B7}><C:\winnt\system32\xyfpri.dll>    []
      <{22311A42-AC1B-158F-FD32-5674345F23A2}><C:\winnt\system32\dhbpri.dll>    []
      <{91B1E846-2BEF-4345-8848-7699C7C9935F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll>    []
      <{D544C22D-1F70-4B1E-873D-D8DABEB26695}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll>    []
      <{3495D328-661A-4FB0-BA67-8ACDD1704D1E}><C:\winnt\system32\9222.dll>    []

 

的IFEO键，全部删除。

 

强制删除工具 PowerRMV

下载地址: http://free.ys168.com/?gudugengkekao

(其他工具-PowerRMV.com 大小101.4KB)

 

C:\Windows\system32\wocfiba.exe
C:\Windows\system32\gnkjkrl.exe
C:\Documents and Settings\你的用户名\Local Settings\Temp\ztso.exe
C:\Windows\TIMHost.exe
C:\Documents and Settings\你的用户名\Local Settings\Temp\rxso.exe
C:\Documents and Settings\你的用户名\Local Settings\Temp\wdso.exe
C:\Documents and Settings\你的用户名\Local Settings\Temp\zxso.exe
C:\Documents and Settings\你的用户名\Local Settings\Temp\qjso.exe
C:\Windows\mppds.exe
C:\Windows\system32\RAV0095.exe
C:\Windows\system32\RAV008C.exe
C:\Windows\MsIMMs32.exe
C:\Windows\system32\RAV00AE.exe
C:\Windows\system32\RAV00B2.exe
C:\Windows\system32\xyfpri.dll
C:\Windows\system32\dhbpri.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll
C:\Windows\system32\9222.dll
C:\Documents and Settings\你的用户名\Local Settings\Temp\ztso0.dll
C:\Documents and Settings\你的用户名\Local Settings\Temp\rxso0.dll
C:\Documents and Settings\你的用户名\Local Settings\Temp\wdso0.dll
C:\Documents and Settings\你的用户名\Local Settings\Temp\zxso0.dll
C:\Documents and Settings\你的用户名\Local Settings\Temp\qjso0.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGwd2.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\atmQQ2.dll
C:\Windows\system32\RAV0095.DAT
C:\Windows\system32\RAV008C.DAT
C:\Windows\system32\MsIMMs32.dll
C:\Windows\system32\hgypmn.dll
C:\Windows\system32\qcqiyh.dll
C:\Windows\system32\RAV00AE.DAT
C:\Windows\system32\RAV00B2.DAT