華豐礦-病毒處理過程

發(fā)做日期：2005-12-29共有三個 2.nvidguiv.exew32.spybot.coorm3.eraseme_31868.exew32spybotworm服務(wù)器與客戶端wincc不能啟客戶端不能服務(wù)器wincc，服務(wù)報告，可能沒限使用網(wǎng)絡(luò)資源，請與這臺服務(wù)器的管理員聯(lián)系以查明您的權(quán)限，登錄失敗，未此用戶在此計算機上的請有三臺客戶機（1，82，83）較重，啟器藍(lán)屏，報告remon.sys錯 企業(yè)版客戶端掃描計算機，查出所有的將所有的文件修改的windows設(shè)置重新修改回Note:Tofullyremoveallassociatedmalware,performthecleansolutionforTROJ_ROOTKIT.S.MANUALREMOVALINSTRUCTIONSRestartinginSafeOnWindowsRestartyourPresstheF8key,whenyouseetheStartingWindowsbaratthebottomoftheChoosetheSafeModeoptionfromtheWindowsAdvanced thenpressOnWindowsRestartyourPressF8afterthePower-OnSelfTest(POST)isdone.IftheWindowsAdvancedOptionsdoesnotappear,tryrestartingandthenpressingF8severaltimesafterthePOSTChoosetheSafeModeoptionfromtheWindowsAdvancedOptionsthenpressOnWindowsServerRestartyourWhenyouarepromptedtoselecttheoperatingsystemtostart,pressOntheWindowsAdvancedOption,usethearrowkeystoselectSafeMode,andthenpressEnter.EditingtheThismalwaremodifiesthesystem'sregistry.Usersaffectedbythismalwaremayneedtomodifyordeletespecificregistrykeysorentries.Fordetailedinformationregardingregistryediting,pleaserefertothefollowingarticlesfrom:HOWTO:Backup,Edit,andRestoretheRegistryinWindowsHOWTO:BackUp,Edit,andRestoretheRegistryinWindowsXPandServerRemovingAutostartKeyfromtheRemovingautostartkeysfromtheregistrypreventsthemalwarefromexecutingatIftheregistrykeybelowisnotfound,themalwaremaynothaveexecutedasofdetection.Ifso,proceedtothesucceedingsolutionset.OpenRegistryEditor.ClickStart>Run,typeREGEDIT,thenpressIntheleftpanel,double-clickthefollowing:Stillintheleftpanel,locateanddeletetheRemovignOtherEntriesfromtheStillinRegistryEditor,intheleftpanel,double-clickthefollowing: >SecurityCenterIntherightpanel,locateanddeletethefollowingUpdatesDisableNotify= DisableNotify=FirewallDisableNotify= Override=FirewallOverride=Intheleftpanel,double-clickthefollowing:HKEY_USERS>.DEFAULT>Software>>Windows>Intherightpanel,locateanddeletetheDisableTaskMgr=DisableRegistryTools=Intheleftpanel,double-clickthefollowing:>WindowsFirewall>Intherightpanel,locateanddeletetheEnableFirewall=Intheleftpanel,double-clickthefollowing:Intherightpanel,locateanddeletetheEnableFirewall=Intheleftpanel,double-clickthefollowing:Intherightpanel,locateanddeletetheDoNotAllowXPSP2=Intheleftpanel,double-clickthefollowing:Intherightpanel,locateanddeletethefollowingAutoShareWks=AutoShareServer=Intheleftpanel,double-clickthefollowing:Intherightpanel,locateanddeletethefollowingAutoShareWks=AutoShareServer=Intheleftpanel,double-clickthefollowing:HKEY_LOCAL_MACHINE>SOFTWARE>>Windows>CurrentVersion>WindowsUpdate>AutoIntherightpanel,locatetheAUOptions=Right-clickonthesaidentryandchooseModify.ChangethevalueAUOptions=Intheleftpanel,double-clickthefollowing:Intherightpanel,locatetheStart=Right-clickonthesaidentryandchooseModify.ChangethevalueStart=Intheleftpanel,double-clickthefollowing:Intherightpanel,locatetheStart=Right-clickonthesaidentryandchooseModify.ChangethevalueStart=Intheleftpanel,double-clickthefollowing:Intherightpanel,locatetheStart=Right-clickonthesaidentryandchooseModify.ChangethevalueStart=Intheleftpanel,double-clickthefollowing:Intherightpanel,locatetheStart=Right-clickonthesaidentryandchooseModify.ChangethevalueStart=Intheleftpanel,double-clickthefollowing:Intherightpanel,locatetheWaitToKillServiceTimeout=Right-clickonthesaidentryandchooseModify.ChangethevalueWaitToKillServiceTimeout= andRestrictAnonymousRegistryThismalwaremodifies andRestrictAnonymousregistryentriestoacertainvalue.Toknowmoreaboutrestoringtheseregistriestotheiroriginalvalues,pleaserefertotheseCOMsecurityfrequentlyaskedHowtodisableDCOMsupportinHowtoUsetheRestrictAnonymousRegistryValueinWindowsThe"RestrictAnonymous"RegistryValueMayBreaktheTrusttoaWindows2000Torestorethisentrytoitsdefaultvalue,pleaseperformthefollowinginstructions:StillinRegistryEditor,intheleftpanel,double-clickthefollowing: Intherightpanel,locatethe=Right-clickonthisregistryentryandchooseModify.Changethevalueofthisentry=CloseRegistryImportantWindowsXPCleaningUsersrunningWindowsXPmustdisableSystemRestoretoallowfullscanningofinfectedUsersrunningotherWindowsversionscanproceedwiththesucceedingprocedureRunningTrendMicroIfyouarecurrentlyrunninginsafemode,pleaserestartyoursystemnormallybeforeperformingthefollowingsolution.ScanyoursystemwithTrendMicroantianddeletefilesdetectedasWORM_SDBOT.CTQ.Todothis,TrendMicrocustomersmustdownloadthelatestpatternfileandscantheirsystem.OtherInternetuserscanuseHouseCall,theTrendMicroonlinescanner.ApplyingThismalwareexploitsknownvulnerabilitiesinWindows.Downlo