最近装大智慧装出hijack病毒，在system32目录下变幻产生一些dll，ini，ini2等形式的文件，如rqromnl.dll，qopoo.dll，gaoqonbs等，使用VundoFix.ex...

方法一：
Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Put a check next to Run VundoFix as a task.
• You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
• When VundoFix re-opens, click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

方法二（一不奏效的话）：
Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning.
  It should look like this
  
  QUOTE
  VundoFix V2.15 by Atri
  By using VundoFix you agree that you are doing so at your own risk
  Press enter to continue....
  
• At this point press enter one time.
• Next you will see:
  
  QUOTE
  Please Type in the filepath as instructed by the forum staff
  and then press enter:
• At this point please type the following file path (make sure to enter it exactly as below!): C:\WINDOWS\System32\khheb.*

Press Enter to continue with the fix. Next you will see:

QUOTE

Please type in the second filepath as instructed by the forum
staff then press enter:

At this point please type the following file path (make sure to enter it exactly as below!): C:\WINDOWS\System32\behhk.*Press Enter to continue with the fix. The fix will run then HijackThis will open, if it does not open automatically please open it manually. In HiJackThis, please place a check next to the following items and click FIX CHECKED: O2 - BHO: Internet_Explorer_Service - {9E1E1371-9D8F-4421-81B9-F8D2E1773A59} - C:\WINDOWS\system32\HelperService.dll
O2 - BHO: DPCUpdater Object - {E291663A-2D6F-4B56-B9DF-AE239AEF6A5B} - C:\WINDOWS\System32\khheb.dll
O3 - Toolbar: ?µí3±ê×?°'??(&E) - {6B2455FD-3669-4555-8DF8-69FD5BC846F8} - C:\WINDOWS\system32\SystemToolbar.dll (file missing)
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O20 - Winlogon Notify: khheb - C:\WINDOWS\System32\khheb.dll
After you have fixed these items, close Hijackthis. Press enter to exit the program then manually reboot your computer. Once your machine reboots please continue with the instructions below.

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.

在线查毒：
http://www.pandasoftware.com/products/activescan.htm

转载于:https://www.cnblogs.com/spidertan/archive/2007/03/05/664158.html