遭遇Worm.Win32.Viking,Worm.Win32f.ysv,Trojan.PSW.Win32.OnlineGames等

最新推荐文章于 2022-12-16 19:01:26 发布
最新推荐文章于 2022-12-16 19:01:26 发布
阅读量3.4k 收藏
点赞数
分类专栏： 系统维护 文章标签： internet c microsoft 金山 windows installer
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Purpleendurer/article/details/1717519
版权

遭遇Worm.Win32.Viking,Worm.Win32f.ysv,Trojan.PSW.Win32.OnlineGames等

endurer 原创
2007-07-30 第1版

刚才，“遭遇Worm.Viking.tc,Trojan.PSW.Win32.OnlineGames等”一文中的朋友又来求援，说电脑又出现上次的症状……
过去一看，系统托盘区里小红伞的监控图标不见了，询问得知是他卸载了。
打开瑞星卡卡安全助手检查，发现这次中的标跟上次中的那个极其相似，不同的就是这次没有：

O23 - 服务: WindowsDown (Windows_SystemDown) - C:/WINDOWS/system32/servet.exe | 2007-7-22 15:20:28(自动)

多了：

O23 - 服务: Visual  WEB (NetworSVSA) - C:/WINDOWS/system32/wnipsvr.exe -Run | 2007-7-30 9:30:6(自动)

而 O20项则变成了：O20 - AppInit_DLLs = qhbpri.dll

这里就不贴 pe_xscan 的log了。

先把 这项服务及

O23 - 服务: 3CC81B56 (3CC81B56) - C:/WINDOWS/system32/70C59D59.EXE -3CC81B56 | 2007-7-30 16:15:46(自动)

O23 - 服务: 8810C4E6 (8810C4E6) - C:/WINDOWS/system32/27E3671A.EXE -k | 2007-7-23 8:13:10(自动)

停止并禁用了，重启电脑到带网络连接的安全模式。

由于Viking 是感染型病毒，所以还是先下载 DrWeb CureIt 来修复。

不过 DrWeb CureIt 下载速度比较慢（偶发现在网通的线路上下载速度很快），到 http://endurer.ys168.com 下载瑞星杀毒助手Aide4Rav，使用瑞星在线免费查毒扫描C盘，结果如下：
/---

2007-7-30 21:58:47　瑞星杀毒助手
Windows XP Service Pack 2(5.1.2600)
文件名 病毒名
C:/WINDOWS/system32/jhapri.dll Trojan.PSW.Win32.OnlineGames.dli
C:/WINDOWS/system32/upxdnd.dll Trojan.PSW.Win32.OnlineGames.dho
C:/WINDOWS/system32/wgdpri.dll Trojan.PSW.Win32.OnlineGames.doc
C:/WINDOWS/system32/mppds.dll Trojan.PSW.Win32.OnlineGames.dqc
c:/windows/system32/nslkupi.exe>>upack0.34 Hack.Win32.ArpCheater.d
c:/windows/system32/visin.exe>>upack0.39 Trojan.Win32.Agent.ine
c:/windows/system32/wnipsvr.exe>>upack0.34 Worm.Win32f.ysv
C:/WINDOWS/system32/6asx0.dll Trojan.PSW.Win32.XYOnline.co
c:/windows/system32/vbsdaas2.exe>>upack0.39 Trojan.PSW.Win32.WoWar.sz
C:/WINDOWS/system32/xk1s0.dll Trojan.PSW.Win32.WoWar.sz
C:/WINDOWS/system32/xk0s0.dll Trojan.PSW.Win32.OnlineGames.dnf
C:/WINDOWS/system32/xk8s0.dll Trojan.PSW.Win32.OnlineGames.dns
c:/windows/system32/eksdlfs5.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dng
C:/WINDOWS/system32/ls2o0.dll Trojan.PSW.Win32.OnlineGames.dng
c:/windows/system32/dsfids6.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
C:/WINDOWS/system32/9kxk0.dll Trojan.PSW.Win32.OnlineGames.dni
C:/WINDOWS/system32/xdxs0.dll Trojan.PSW.Win32.OnlineGames.dnp
c:/windows/system32/fsfjasj8.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
C:/WINDOWS/system32/as1x0.dll Trojan.PSW.Win32.OnlineGames.dnl
C:/WINDOWS/system32/88xk0.dll Trojan.PSW.Win32.OnlineGames.dnh
C:/WINDOWS/system32/9fdk0.dll Trojan.PSW.Win32.OnlineGames.dnb
C:/WINDOWS/system32/6lsd0.dll Trojan.PSW.Win32.AskTao.ah
C:/WINDOWS/system32/6ksx0.dll Trojan.PSW.Win32.TLOnline.n
C:/WINDOWS/system32/ax1o0.dll Trojan.PSW.Win32.XYOnline.bw
C:/WINDOWS/system32/3sak0.dll Trojan.PSW.Win32.OnlineGames.dnd
C:/WINDOWS/system32/x6dd0.dll Trojan.PSW.Win32.RocOnline.as
c:/windows/system32/27e3671a.exe>>Aspack212r Worm.Win32.Agent.ima
C:/WINDOWS/system32/A1FB9080.DLL Worm.Win32.Agent.ily
C:/WINDOWS/system32/70C59D59.EXE Trojan.IMMSG.Win32.TBMsg.iy
C:/WINDOWS/system32/cmdbcs.dll Trojan.PSW.Win32.OnlineGames.dmg
C:/WINDOWS/system32/DC4BE6F0.DLL Trojan.IMMSG.Win32.TBMsg.iy
c:/windows/system32/dfa73348.exe>>nspack Trojan.DL.Win32.VB.xev
C:/WINDOWS/system32/TIMHost.dll Trojan.PSW.Win32.RocOnline.t
c:/windows/system32/fsakfask9.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dnh
c:/windows/system32/oigdfgdfl1.exe>>upack0.39 Trojan.PSW.Win32.XYOnline.co
c:/windows/system32/dasxcsx13.exe>>upack0.39 Trojan.PSW.Win32.XYOnline.bw
C:/WINDOWS/system32/WinForm.dll Trojan.PSW.Win32.OnlineGames.dre
C:/WINDOWS/system32/Kvsc3.dll Trojan.PSW.Win32.SunOnline.z
c:/windows/system32/faskflxld3.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dnf
c:/windows/system32/fdaolfdos4.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
c:/windows/system32/slcskxsdl7.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
c:/windows/system32/afslkfasl10.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dnb
c:/windows/system32/kjgagklj11.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
c:/windows/system32/fsafsakx12.exe>>upack0.39 Trojan.PSW.Win32.AskTao.ah
c:/windows/system32/dsakfsak14.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dnd
c:/windows/system32/dasdsaads15.exe>>upack0.39 Trojan.PSW.Win32.RocOnline.as
c:/windows/system32/k11857832156.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/windows/system32/k11857832156.dat>>upack0.34 Trojan.PSW.Win32.OnlineGames.dlr
c:/windows/system32/k11857832145.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/windows/system32/k11857832167.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/windows/system32/k11857832145.dat>>upack0.34 Trojan.PSW.Win32.OnlineGames.dms
c:/windows/system32/k11857832167.dat>>upack0.34 Trojan.PSW.Win32.Zhuxian.y
c:/windows/system32/k118578322010.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/windows/system32/k118578322010.dat>>upack0.34 Trojan.PSW.Win32.WLOnline.jhr
c:/windows/system32/k118578322111.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/windows/system32/k118578322111.dat>>upack0.34 Trojan.PSW.Win32.OnlineGames.dle
C:/WINDOWS/system32/jzepri.dll Trojan.PSW.Win32.ZeroOnline.f
C:/WINDOWS/system32/qjepri.dll Trojan.PSW.Win32.OnlineGames.dod
C:/WINDOWS/system32/xyfpri.dll Trojan.PSW.Win32.XYOnline.cc
C:/WINDOWS/system32/mycpri.dll Trojan.PSW.Win32.RocOnline.ax
C:/WINDOWS/system32/dhbpri.dll Trojan.PSW.Win32.XYOnline.bx
C:/WINDOWS/system32/wdbpri.dll Trojan.PSW.Win32.AskTao.aj
C:/WINDOWS/system32/tllpri.dll Trojan.PSW.Win32.TLOnline.o
C:/WINDOWS/system32/zxepri.dll Trojan.PSW.Win32.OnlineGames.dnj
C:/WINDOWS/system32/tlmpri.dll Trojan.PSW.Win32.OnlineGames.dqr
C:/WINDOWS/system32/wldpri.dll Trojan.PSW.Win32.OnlineGames.dlx
C:/WINDOWS/system32/qhbpri.dll Trojan.PSW.Win32.QQHX.j
C:/WINDOWS/mppds.exe Trojan.PSW.Win32.OnlineGames.drg
c:/windows/~temp546.tmp>>upx_c Trojan.PSW.Win32.OnlineGames.dpp
C:/WINDOWS/RichDll.dll Worm.Win32.Viking.a
C:/WINDOWS/Logo1_.exe Worm.Win32.Viking.b
c:/windows/~tmp6152.exe>>upack0.34 Worm.Win32f.ysv
c:/windows/~tmp7634.exe>>upack0.34 Worm.Win32f.ysv
C:/WINDOWS/TIMHost.exe Trojan.PSW.Win32.RocOnline.t
c:/windows/winform.exe>>upx_c Trojan.PSW.Win32.OnlineGames.dre
c:/windows/kvsc3.exe>>upx_c Trojan.PSW.Win32.SunOnline.z
c:/windows/cmdbcs.exe>>upx_c Trojan.PSW.Win32.OnlineGames.dmg
c:/windows/msimms32.exe>>upx_c Trojan.PSW.Win32.OnlineGames.drj
c:/windows/windcp32.exe>>upx_c Trojan.PSW.Win32.OnlineGames.drj
C:/WINDOWS/uninstall/rundl132.exe Worm.Win32.Viking.b
c:/windows/upxdnd.exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dho
C:/UPDATE/WINDOWSXP-KB834707-X86-CHS.EXE Worm.Win32.Viking.a
c:/documents and settings/administrator/local settings/temp/go.exe>>upx_c Worm.Win32f.ysd
C:/Documents and Settings/Administrator/Local Settings/Temp/system22.exe Worm.Win32.Viking.a
C:/Documents and Settings/Administrator/Local Settings/Temp/woso.exe Trojan.PSW.ZhengTu.jzd
C:/Documents and Settings/Administrator/Local Settings/Temp/woso0.dll Trojan.PSW.Win32.OnlineGames.dfu
C:/Documents and Settings/Administrator/Local Settings/Temp/woso1.dll Trojan.PSW.Win32.OnlineGames.dfu
c:/documents and settings/administrator/local settings/temp/ztso.exe>>spack_a Trojan.PSW.ZhengTu.jzd
C:/Documents and Settings/Administrator/Local Settings/Temp/ztso0.dll Trojan.PSW.Win32.OnlineGames.dfh
c:/documents and settings/administrator/local settings/temp/rxso.exe>>spack_a Trojan.PSW.Win32.SunOnline.b
C:/Documents and Settings/Administrator/Local Settings/Temp/rxso0.dll Trojan.PSW.Win32.OnlineGames.djd
c:/documents and settings/administrator/local settings/temp/wdso.exe>>spack_a Trojan.PSW.Win32.SunOnline.b
C:/Documents and Settings/Administrator/Local Settings/Temp/wdso0.dll Trojan.PSW.Win32.OnlineGames.dqn
C:/Documents and Settings/Administrator/Local Settings/Temp/zxso0.dll Trojan.PSW.Win32.OnlineGames.dft
c:/documents and settings/administrator/local settings/temp/qjso.exe>>spack_a Trojan.PSW.WLOnline.jed
C:/Documents and Settings/Administrator/Local Settings/Temp/qjso0.dll Trojan.PSW.Win32.OnlineGames
c:/documents and settings/administrator/local settings/temp/tlso.exe>>spack_a Trojan.PSW.OnlineGames.bto
C:/Documents and Settings/Administrator/Local Settings/Temp/tlso0.dll Trojan.PSW.Win32.OnlineGames.dfq
c:/documents and settings/administrator/local settings/temp/wlso.exe>>spack_a Trojan.PSW.ZhengTu.jzd
C:/Documents and Settings/Administrator/Local Settings/Temp/wlso0.dll Trojan.PSW.Win32.OnlineGames.dfr
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/h8sz1hkp/4[1].exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dho
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/h8sz1hkp/7[1].exe>>upack0.34 Trojan.PSW.Win32.OnlineGames.dli
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/h8sz1hkp/13[1].exe>>upack0.34 Trojan.PSW.Win32.ZeroOnline.g
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/h8sz1hkp/15[1].exe>>upack0.34 Trojan.PSW.Win32.QQHX.j
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/h8sz1hkp/s368[1].exe>>upx_c Trojan.PSW.Win32.OnlineGames.dpp
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/idfod4z6/5[1].exe>>upack0.34 Trojan.PSW.Win32.AskTao.aj
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/4xyn816j/12[1].exe>>upack0.34 Trojan.PSW.Win32.OnlineGames.doc
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/4xyn816j/14[1].exe>>upack0.34 Trojan.PSW.Win32.XYOnline.bt
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/4xyn816j/16[1].exe>>upack0.34 Hack.Win32.ArpCheater.d
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o523ox27/go[1].exe>>upx_c Worm.Win32f.ysd
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o523ox27/3[1].exe>>upack0.34 Trojan.PSW.Win32.XYOnline.ca
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/O12BOPE3/1[1].exe Dropper.Win32.XYOnline.e
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/10[1].exe>>upack0.34 Trojan.PSW.Win32.OnlineGames.dse
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/qq[1].exe>>upack0.34 Worm.Win32f.ysv
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/7[1].exe>>spack_a Trojan.PSW.WLOnline.jed
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/11[1].exe>>spack_a Trojan.PSW.OnlineGames.bto
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/20[1].exe>>upack0.34 Hack.Win32.ArpCheater.d
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/zt0616[1].exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/o12bope3/wd0618[1].exe>>upx_c Trojan.PSW.Win32.OnlineGames.drj
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/O12BOPE3/update3[1].exe Trojan.IMMSG.Win32.TBMsg.iy
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/EDPMBQHK/9[1].exe Trojan.PSW.ZhengTu.jzd
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/edpmbqhk/1[1].exe>>upack0.34 Trojan.PSW.Win32.XYOnline.cc

c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/edpmbqhk/8[1].exe>>spack_a Trojan.PSW.WLOnline.jed
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/edpmbqhk/12[1].exe>>spack_a Trojan.PSW.ZhengTu.jzd
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/EDPMBQHK/wow0617[1].exe Trojan.PSW.Win32.OnlineGames.drg
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/edpmbqhk/wl0618[1].exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dpq
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/17[1].exe>>upack0.39 Trojan.Win32.Agent.ine
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/8[1].exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dqa
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/TFVVL9OE/3[1].exe Trojan.DL.Win32.Agent.xas
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/5[1].exe>>spack_a Trojan.PSW.Win32.SunOnline.b
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/14[1].exe>>nspack Trojan.PSW.Win32.QQPass.qns
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/mh0618[1].exe>>upx_c Trojan.PSW.Win32.OnlineGames.dre
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/tfvvl9oe/qj0617[1].exe>>upx_c Trojan.PSW.Win32.SunOnline.z

c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/cv97embh/2[1].exe>>spack_a Trojan.PSW.ZhengTu.jzd
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/cv97embh/6[1].exe>>spack_a Trojan.PSW.Win32.SunOnline.b
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/CV97EMBH/9[1].exe Trojan.PSW.Win32.OnlineGames.dkh
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/cv97embh/16[1].exe>>upack0.39 Trojan.PSW.Win32.OnlineGames.dqa
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/cv97embh/jh0619[1].exe>>upx_c Trojan.PSW.Win32.OnlineGames.dmg
C:/Documents and Settings/Administrator/Local Settings/Temporary Internet Files/Content.IE5/CV97EMBH/my0616[1].exe Trojan.PSW.Win32.RocOnline.t
c:/documents and settings/administrator/local settings/temporary internet files/content.ie5/cv97embh/fy0619[1].exe>>upx_c Trojan.PSW.Win32.OnlineGames.drj
c:/program files/common files/relive.dll>>upx_c Trojan.PSW.Win32.OnlineGames.dlc
c:/program files/internet explorer/msvcrt.bak>>upx_c Trojan.PSW.Win32.OnlineGames.dlc
c:/program files/internet explorer/msvcrt.dll>>upx_c Trojan.PSW.Win32.OnlineGames.dlc
c:/program files/internet explorer/plugins/newtemp.dll>>upx_c Worm.Win32f.ysd
c:/program files/internet explorer/plugins/newtemp.bak>>upx_c Worm.Win32f.ysd
c:/program files/internet explorer/plugins/syswin64.jmp>>nspack Trojan.PSW.Win32.QQPass.qns
C:/Program Files/Internet Explorer/PLUGINS/SysWin64.Sys Trojan.PSW.Win32.QQPass.qns
C:/Program Files/Lenovo/隐藏分区管理/sysdll/AfterSecStart.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/隐藏分区管理/sysdll/RebootSystem.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/隐藏分区管理/sysdll/WindowsServer2003-KB898439-x64-ENU.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/隐藏分区管理/sysdll/WindowsXP-KB898439-x64-ENU.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/隐藏分区管理/sysdll/WindowsXP-KB898439-x86-CHS.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/隐藏分区管理/sysdll/WindowsXP-KB898439-x86-ENU.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/智能维护3.0/bpd.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/CallZNBS.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/智能维护3.0/drvinst.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/DRVRepair.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/GetPCIX.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/智能维护3.0/LEOSIO.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/LocalRestoreWizard.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/Repair.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/SmartNavigation.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/智能维护3.0/softinst.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/金山词霸2005/KSSetting.exe Worm.Win32.Viking.f
C:/Program Files/Lenovo/金山词霸2005/RegDict.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/金山词霸2005/xdict.exe Worm.Win32.Viking.f
C:/Program Files/Lenovo/金山词霸2005/NewWord.exe Worm.Win32.Viking.f
C:/Program Files/Lenovo/金山词霸2005/RegFixSetup.exe Worm.Win32.Viking.a
C:/Program Files/Lenovo/金山词霸2005/XdictOln.exe Worm.Win32.Viking.f
C:/Program Files/Lenovo/Validate.exe Worm.Win32.Viking.b
C:/Program Files/Lenovo/RegFix.exe Worm.Win32.Viking.a
C:/Program Files/Realtek AC97/alcrmv.exe Worm.Win32.Viking.b
C:/Program Files/Realtek AC97/alcrmv64.exe Worm.Win32.Viking.b
C:/Program Files/Realtek AC97/ChCfg.exe Worm.Win32.Viking.a
C:/Program Files/Realtek AC97/CPLUtl64.exe Worm.Win32.Viking.a
C:/Program Files/Realtek AC97/RTLCPL.exe Worm.Win32.Viking.f
C:/Program Files/Realtek AC97/SoundMan.exe Worm.Win32.Viking.b
C:/Program Files/AvRack/rtlrack.exe Worm.Win32.Viking.b
C:/Program Files/Kingsoft/AntiVirus/KAV2005IS/KAVSetup.EXE Worm.Win32.Viking.f
C:/Program Files/Tencent/Viewpoint Media Player/MtsAxInstaller.exe Worm.Win32.Viking.c
C:/Program Files/极品五笔/unins000.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/update/XYUpdate.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/download/GameHallsetup.exe Worm.Win32.Viking.b
C:/Program Files/gamechannel/download/UninstHall.exe Worm.Win32.Viking.a
C:/Program Files/gamechannel/download/gzthsetup.exe Worm.Win32.Viking.b
C:/Program Files/gamechannel/download/gxngsetup.exe Worm.Win32.Viking.b
C:/Program Files/gamechannel/download/zgxqsetup.exe Worm.Win32.Viking.b
C:/Program Files/gamechannel/download/gamedl.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/gzth/UNWISE.EXE Worm.Win32.Viking.b
C:/Program Files/gamechannel/gzth/gzth.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/gxng/UNWISE.EXE Worm.Win32.Viking.b
C:/Program Files/gamechannel/gxng/gxng.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/zgxq/UNWISE.EXE Worm.Win32.Viking.b
C:/Program Files/gamechannel/zgxq/zgxq.exe Worm.Win32.Viking.f
C:/Program Files/gamechannel/UNWISE.EXE Worm.Win32.Viking.b
C:/Program Files/Real/RealPlayer/Setup/setup.exe Worm.Win32.Viking.b
C:/Program Files/Real/RealPlayer/realjbox.exe Worm.Win32.Viking.b
C:/Program Files/Real/RealPlayer/rphelperapp.exe Worm.Win32.Viking.a
C:/Program Files/Real/RealPlayer/fixrjb.exe Worm.Win32.Viking.a
C:/Program Files/ESET/Install/setup.exe Worm.Win32.Viking.b
C:/Program Files/KLPlayer/ac3/ac3config.exe Worm.Win32.Viking.a
C:/Program Files/KLPlayer/SetActiveX.exe Worm.Win32.Viking.b
C:/Program Files/pro14.exe Worm.Win32.Viking.b
C:/deploy/Setup.exe Worm.Win32.Viking.f
c:/pegefile.pif>>upx_c Worm.Win32f.ysd
C:/Hide.exe Worm.Win32.Viking.b
C:/Downloads/Setup.exe Worm.Win32.Viking.f
---/
看来被Viking感染的不少。

用DrWeb CureIt扫描全部磁盘并修复。

重启电脑，进入带网络的安全模式，再次安装 小红伞，可惜升不了级，再次全盘扫描，然后重启电脑到安全模式下，用卡卡安全助手删除 O4，O20，O23，O24等项。


文件说明符 : C:/auto.exe
属性 : --H-
语言 : 英语(美国)
文件版本 :
说明 :
版权 : (C) Microsoft Corporation. All rights reserved.
备注 :
产品版本 :
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
合法商标 :
内部名称 :
源文件名 :
创建时间 : 2007-7-30 16:13:28
修改时间 : 2007-7-23 8:13:10
访问时间 : 2007-7-30 0:0:0
大小 : 21555 字节 21.51 KB
MD5 : 1abb026104f19a8b39ec8a5f8e8a73d5

d:/auto.exe、e:/auto.exe、f:/auto.exe 与 C:/auto.exe 相同。


文件说明符 : C:/WINDOWS/system32/wnipsvr.exe
属性 : A---
语言 : 英语(美国)
文件版本 : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
说明 : Windows XP SP installer downgrade tasks
版权 : ? Microsoft Corporation. All rights reserved.
备注 :
产品版本 : 5.1.2600.2180
产品名称 : Microsoft? Windows? Operating System
公司名称 : Microsoft Corporation
合法商标 :
内部名称 : spdwnwxp
源文件名 : spdwnwxp
创建时间 : 2007-7-30 9:30:5
修改时间 : 2007-7-30 9:30:6
访问时间 : 2007-7-30 0:0:0
大小 : 24508 字节 23.956 KB
MD5 : a897b38b5a60ed3671accd3c26fd3544

紫郢剑侠
关注
专栏目录
昨天才提醒，今天就有网友点击QQ信息中的网址，中Worm.Viking.pk/Worm.Win32.Viking.jg了
Purpleendurer@CSDN
03-20 1万+
endurer 原创2007-03-20 第1版 昨天才提醒大家小心QQ信息中的网址会传播维金/Viking等病毒：小心QQ信息中的网址传播维金Worm.Win32.Viking.ix/Worm.Viking.pg http://endurer.bokee.com/6171794.htmlhttp://blog.csdn.net/Purpleendurer/archive/2007/0
遭遇Worm.Win32.Viking.lm/Worm.Viking.tc,Trojan.PSW.Win32.OnlineGames等2
Purpleendurer@CSDN
07-26 1998
遭遇Worm.Win32.Viking.lm/Worm.Viking.tc,Trojan.PSW.Win32.OnlineGames等2endurer 原创2007-07-26 第1版看到 C:/WINDOWS/RichDll.dll 和 O4 - HKLM/../Run: [load] C:/WINDOWS/uninstall/rundl132.exe，就让偶想起Viking……停止
alcrmv.exe
09-24
alcrmv.exe
几个比较新的恶意程序……AntiVir全报，kaspersky保持沉默的时候多
Purpleendurer@CSDN
12-16 4882
endurer 原创2006-12-16 第1版在线扫描几个从网上下载的恶意程序文件的结果。文件说明符 : D:/cl.exe属性 : A---获取文件版本信息大小失败!创建时间 : 2006-12-16 12:58:44修改时间 : 2006-12-16 12:58:45访问时间 : 2006-12-16 13:5:1大小 : 71168 字节 69.512 KBMD5 : c59f
html.win32.scipt病毒,用vbs实现的一款Worm.Win32.VB.fw病毒专杀工具
weixin_35683614的博客
06-29 395
在写了《Worm.Win32.VB.fw分析与清除方案》后，也没想到要写什么专杀，不过这些天好多同学都说中了这只病毒，我要是一个一个去解决，非忙死我不可！感染范围挺大的！我之前写了一篇《VBS编程打造自己的病毒专杀工具》 ，VBS相对来说熟悉点，所以这次就用VBS来写个专杀吧……下面代码不懂的，请参考那篇介绍如何写自己的病毒专杀的文章吧。复制代码 代码如下:onerrorresumenext...
病毒之Worm.Win32.AutoRun
BYTEDANCE的博客
12-16 4832
解决Worm.Win32.AutoRun之暴力删除 Autorun.inf 文件，那年我双手插兜，不知道什么叫做对手
PE文件附加数据感染之Worm.Win32.Agent.ayd病毒分析
Fly20141201. 的专栏
04-16 2056
一、基本信息 样本名称：1q8JRgwDeGMofs.exe病毒名称：Worm.Win32.Agent.ayd文件大小：165384 字节文件MD5：7EF5D0028997CB7DD3484A7FBDE071C2 文件SHA1：DA70DDC64F517A88F42E1021C79D689A76B9332D 二、分析样本使用的工具 IDA5.5OnlyDebugRadAS
解决Worm.Win32.AutoRun.soq 病毒
LaySolitary的博客
06-05 5505
X: 回车  X盘符1.搜索attrib –s –r –a –h autorun.inf2.删除del autorun.inf3.回复文件attrib -H -S X:\* /s /d
net.worm.win32.kido专杀工具
06-25
手动移除方法 ...1、删除如下注册表项： [HKLM\SYSTEM\CurrentControlSet\Services\netsvcs] 2、从系统注册表项中删除如下所示"%System%\<rnd>.dll"： [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost...
Net-Worm.Win32.Kido.ih 专杀工具
06-07
Net-Worm.Win32.Kido.ih 是一种广泛传播的蠕虫病毒，它主要通过网络进行扩散，对用户的计算机系统安全构成严重威胁。这个病毒能够影响Windows操作系统，导致各种问题，比如网络连接受阻，尤其是可能导致无法访问微软...
delphi Email-Worm.Win32.Canbis
05-02
delphi Email-Worm.Win32.Canbis
delphi Virus.Win32.HLLW.Delf.k.
05-02
标题 "delphi Virus.Win32.HLLW.Delf.k." 指的是一种特定的计算机病毒，它属于 Delphi 编程语言编写并且在 Windows 32 位平台上运行的 HLLW（High Level Language Worm）类病毒。这种病毒通常会自我复制并利用系统...
Termite-Beta1.0跳板机_WORM_SameSame_termite_Termite.exe_
10-02
【标题】"Termite-Beta1.0跳板机_WORM_SameSame_termite_Termite.exe_" 提供的关键信息是“Termite”程序的早期版本（Beta 1.0）被用作跳板机，并且它与一种名为“WORM_SameSame”的蠕虫病毒有关。"Termite.exe"是这...
最新Viking(维金)病毒专杀工具，纯VB编写。
热门推荐
迈克揉索芙特
10-11 1万+
      (声明：魏滔序原创，转贴请注明出处。)       Viking的肆虐让很多受害者忍无可忍，更可气的是专业软件公司提供的专杀工具竟然无法彻底清除。      无奈之余自己动手写了一个，请需要的朋友到这里下载：http://www.chenoe.com       该工具可以有效解除被感染的exe中的病毒并还原exe文件，网上的大部分工具是直接删除exe文件。另外，本工具还具有Vikin
Virus.Win32.Tc专杀方案
Just4's Bookee
09-03 3037
Virus.Win32.Tc.bat 恶意病毒专杀处理方案
K8s 很难么？带你从头到尾捋一遍，不信你学不会
民工哥的博客
02-23 9032
点击关注公众号，回复“1024”获取2TB学习资源！为什么要学习 Kubernetes?虽然 Docker 已经很强大了，但是在实际使用上还是有诸多不便，比如集群管理、资源调度、文件管理等...
10天智能锁项目实战第1天（了解单片机STM32F401RET6和C语言基础）
北豼不太皮的博客
02-21 3580
10天智能锁项目实战第1天（了解单片机STM32F401RET6和C语言基础）一、学习目标二、了解单片机STM32F401RET6三、C语言基础 一、学习目标 二、了解单片机STM32F401RET6 4、STM32F401RE特征 三、C语言基础 1.数据类型 常用2的次方： 2^7 = 128 2^8 = 256 2^15 = 32768 2^16= 65536 51单片机常见的数据类型： char: 占内存1字节 取值范围：-128~127 -2^7 ~ 2
Android开发（1） | Fragment 的应用——新闻应用
Jormungand_V的博客
02-21 7089
文章目录 news_item.xml： <TextView xmlns:android="http://schemas.android.com/apk/res/android" android:id="@+id/news_title" android:layout_width="match_parent" android:layout_height="wrap_content" android:lines="1" android:ellipsize="
Worm.wantjob.57345 “求职信”手工清除的方法
最新发布
05-11
Worm.wantjob.57345 是一种恶意软件，它会通过电子邮件或其他方式传播，尝试感染您的计算机。如果您的计算机已经感染了这种恶意软件，您可以采取以下步骤手动清除它： 1. 关闭所有正在运行的程序和文件，并断开与...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

紫郢剑侠

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值