机械狗病毒怎样防御,查杀

机械狗病毒怎样防御,查杀 病毒运行后： 文件变化: 释放文件 C:\WINDOWS\system32\wniapsvr.exe C:\WINDOWS\system32\wniapsvr.exe 启动IE连接网络 222.88.91.80:80下载木马 到%program files%下面 分别命名为pro1.exe~pro16.exe C:\WINDOWS\system32\AVPSrv.dll C:\WINDOWS\system32\dhapri.dll C:\WINDOWS\system32\Kvsc3.dll C:\WINDOWS\system32\MsIMMs32.dll C:\WINDOWS\system32\netsrvcs.dll C:\WINDOWS\system32\nslookupi.exe C:\WINDOWS\system32\ntsokele.exe C:\WINDOWS\system32\nwizwmgjs.exe C:\WINDOWS\system32\perefic.ini C:\WINDOWS\system32\RemoteDbg.dll C:\WINDOWS\system32\TIMHost.dll C:\WINDOWS\system32\upxdnd.dll C:\WINDOWS\system32\windhcp.ocx C:\WINDOWS\system32\wniapsvr.exe C:\WINDOWS\AVPSrv.exe C:\WINDOWS\Kvsc3.exe C:\WINDOWS\MsIMMs32.exe C:\WINDOWS\TIMHost.exe C:\WINDOWS\upxdnd.exe C:\Program Files\Internet Explorer\PLUGINS\System64.Jmp C:\Program Files\Internet Explorer\PLUGINS\System64.Sys C:\WINDOWS\system32\dhapri.dll 所有分区下生成hide.exe和autorun.inf E盘下面还生成sysauto.exe sysauto.exe跟C:\Program Files\Internet Explorer\PLUGINS\System64.Jmp C:\Program Files\Internet Explorer\PLUGINS\System64.Sys有关 是盗号木马 autorun.inf hide.exe sysauto.exe 注册服务Visual VSA WEB 服务相关键值 HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\Type: 0x00000110 HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\Start: 0x00000002 HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\ErrorControl: 0x00000000 HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\ImagePath: "C:\WINDOWS\system32\wniapsvr.exe -Run" HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\DisplayName: "Networ VSA" HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\ObjectName: "LocalSystem" HKLM\SYSTEM\CurrentControlSet\Services\Visual VSA WEB\Description: "允许对TCP/IP 上NetBios服务以及NetBT名称解析的支持。" 删除C:\WINDOWS\system32\verclsid.exe