trojan-gamethief.win32.magania.alsz病毒解决方案

 

trojan-gamethief.win32.magania.alsz病毒是卡巴报的库。

病毒特征是双击任何应用程序无反应，卡巴提示发现了此病毒，但是每打开一个文件即又弹出病毒提示。

这可能是一个混合病毒，具备木马特征，写入文件如下：

C:/WINDOWS/system32/System.exe

C:/PROGRAM FILES/INTERNET EXPLORER/58u1NtMe.2ys

2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1027437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1050156 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1071281 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1117203 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1293234 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1334593 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1355109 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1375625 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1396546 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1416875 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1437093 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1458250 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1479718 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1500343 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1521156 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1541796 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1562312 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1582812 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1609875 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1625234 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1645843 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1650734 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1666781 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1671000 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1691281 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1711625 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1714828 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1729421 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1731828 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1752031 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1756875 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1772218 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1777390 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1792578 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1797906 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/17989982 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18034312 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18055579 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18080018 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18102581 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18123332 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1813234 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18145614 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18167537 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1818687 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18189163 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18209633 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18230212 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18251057 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18272433 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18294528 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18339936 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1834218 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18361952 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18384328 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1838968 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18432752 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1854593 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1859125 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1874968 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1879406 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1895312 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1900187 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1920468 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1937640 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1940765 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1958265 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1961062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1979500 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1981343 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2001890 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2044203 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2064765 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2085593 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2136015 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3002781 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3043656 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3063921 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3084218 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3104546 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3124750 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3144953 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3165140 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3185484 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3205671 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3225859 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3246046 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3266234 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3286406 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3327437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3347750 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3368078 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3419062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4617312 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4659093 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4680187 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4700875 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4721890 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4742640 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4763375 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4784218 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4805265 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4826125 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4847156 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4868093 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4889234 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4910250 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4952828 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4973812 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/4994750 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/5042140 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/596031 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/637078 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/657578 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/677953 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/684671 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/694437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/698765 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/706437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/719078 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/725781 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/736281 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/746062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/749281 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/757218 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/766562 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/770312 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/787437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/791062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/807750 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/811937 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/829343 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/832421 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/850062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/853343 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/871062 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/873953 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/891640 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/912437 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/932921 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/956953 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/977859 OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho10.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho11.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho12.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho13.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho14.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho15.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho16.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho17.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho18.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho19.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1A.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1B.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1D.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1E.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho1F.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho2.tmp OK
2008-12-01 00:59:35 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho3.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho4.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho5.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho6.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho7.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/cho9.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choA.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choB.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choC.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choD.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choE.tmp OK
2008-12-01 00:59:36 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/choF.tmp OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1162125 OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/1775062 OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/18521616 OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/2180796 OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/3464750 OK
2008-12-01 00:59:51 - C:/DOCUMENTS AND SETTINGS/SUNTHING/LOCAL SETTINGS/Temp/5085906 OK
2008-12-01 00:59:51 - C:/WINDOWS/system32/06EA0A93.dll OK
2008-12-01 00:59:51 - C:/WINDOWS/system32/08223B03.dll OK
2008-12-01 00:59:51 - C:/WINDOWS/system32/122B901E.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/14F7F80A.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/2EF0D734.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/34A25F04.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/39349BEE.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/56BC86C7.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/5934EA2B.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/66AFCB56.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/950D1600.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/9CA963CA.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/A1A6BC2E.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/ARCHIBIDLL.DLL OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/ARCHIBIEXE.EXE OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/csrss.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/D7C79813.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/DA63E650.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/DFB3DAC5.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/dirLock.exe OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/E0D39066.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/E4814792.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/JVCRIPT32.DLL OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/LOCKFILEQY.DLL OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/pcpo32.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/pcpo32.exe OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/sr.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/vordisa.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/system32/wd1123.dll OK
2008-12-01 00:59:52 - C:/WINDOWS/Temp/~ms2BC.tmp OK
2008-12-01 00:59:52 - C:/WINDOWS/Temp/~ms2BE.tmp OK

2008-12-01 01:03:24 - C:/WINDOWS/system32/csrss.dll OK

在EXPLORER插入：yejkunlw.dll

在WINDOWS/system32/下写入：ttsh05008,ttsh05008.add,ttsh01023,ttsh01023.....等脚本文件

病毒替换掉系统原有的RPCSS.DLL库文件，致使系统无法粘贴、复制、拖动等，双击无法打开网页等。

 

解决方法：

1.使用ARSWP删除可疑的病毒文件，ARSWP的用法请自行搜索

2.顽固文件如yejkunlw.dll，及ttsh05008,ttsh05008.add等，使用PE系统删除，本人用的是SYSCHECK的DOS下删除

3.顽固文件删除完成后，进入正常模式再使用ARSWP扫描一遍，删除所有病毒残余

4.删除病毒完毕--恢复系统

因为病毒替换了原有系统的RPCSS.DLL文件，需从新的未感染的系统拷贝一个新的RPCSS.DLL文件到C:/WINDOWS/system32下，然后进入注册表，删除WD1123.DLL所有的值和项等，再到启动项（MSCONFIG）删除有关WD1123.DLL的项。

5.系统恢复完毕，测试粘贴和复制，正常。

 

其它方法：

1.可以手工删除以上罗列的所有病毒文件，然后再按4步骤恢复系统即可