Wmps32.exe木马病毒的清除（鼠标乱动&失去控制）
<div style="PADDING-RIGHT: 0px; MARGIN-TOP: 10px; FONT-SIZE: 12pt; OVERFLOW-X: hidden; WIDTH: 97%; WORD-BREAK: break-all; TEXT-INDENT: 30px; LINE-HEIGHT: normal; HEIGHT: 200px; WORD-WRAP: break-word;"><p><font size="4">Wmps32.exe木马病毒的清除指南(鼠标乱动&失去控制）（Backdoor.Win32.Delf.avu）</font></p><p><font size="4">File: </font><font size="4"><strong><font color="#ff0000">Wmps32.exe <br/></font></strong>Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) <br/>MD5 <font color="#0000ff">b698a6eab4f29bc190792ef66f782904</font> <br/>Packers detected: -</font> </p><p><table class="servicetable" cellspacing="2" cellpadding="2" width="90%" border="0"><tbody><tr><td align="center" colspan="2"><div class="columnheader"><font size="3">Scanner results </font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">AntiVir </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">ArcaVir </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">Avast </font></td><td class="resultcell"><div><font size="3">Found <span class="attention"><strong>Win32:Small-AMI</strong></span> </font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">AVG Antivirus </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">BitDefender </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">ClamAV </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">Dr.Web </font></td><td class="resultcell"><div><font size="3">Found <span class="attention"><strong>Trojan.DownLoader.4293</strong></span> </font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">F-Prot Antivirus </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">F-Secure Anti-Virus </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">Fortinet </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">Kaspersky Anti-Virus </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">NOD32 </font></td><td class="resultcell"><div><font size="3">Found <span class="attention">probably unknown <strong>NewHeur_PE</strong></span><strong> </strong>(probable variant) </font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">Norman Virus Control </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">VirusBuster </font></td><td class="resultcell"><div><font size="3">Found nothing</font></div></td></tr><tr><td class="resultcell" align="right" width="250"><font size="3">VBA32 </font></td><td class="resultcell"><div><font size="3">Found <span class="attention"><strong><font color="#ff0000">MalwareScope.Backdoor.Hupigon.6</font></strong></span> </font></div></td></tr><tr><td colspan="2"><font size="3"> </font></td></tr></tbody></table></p><p><font size="3"><strong>注意到卡巴斯基没反应。Kaspersky 6.xxx No act.....</strong></font></p><p><strong><font size="3">具有windows media player媒体文件的图标，具有隐藏属性（且不可取消）如下图：</font></strong></p><p> <br/><img src="http://setn.cn/bbs/skins/default/filetype/jpg.gif" border="0" alt=""/>此主题相关图片如下：<br/><a id="ImgSpan" href="http://setn.cn/bbs/UploadFile/2007-2/2007221624487337.jpg" target="_blank"><img alt="按此在新窗口浏览图片" src="http://setn.cn/bbs/UploadFile/2007-2/2007221624487337.jpg" border="0"/></a><br/><br/><img src="http://setn.cn/bbs/skins/default/filetype/jpg.gif" border="0" alt=""/>此主题相关图片如下：<br/><a id="ImgSpan" href="http://setn.cn/bbs/UploadFile/2007-2/2007221625852319.jpg" target="_blank"><img alt="按此在新窗口浏览图片" src="http://setn.cn/bbs/UploadFile/2007-2/2007221625852319.jpg" border="0"/></a><br/></p><p><font size="3"><strong>发作特征：<font color="#ff0000">鼠标自己疯狂动作，一次能随机打开几十个文件。</font></strong></font></p><p><font size="3">病毒创建了一个NT服务以实现开机自动启动。</font></p><p><font size="3">SREng日志中可见</font></p><p><font size="3"><font color="#993300"></font><br/> <<strong><font color="#ff0000">C:\Program Files\Common Files\Microsoft Shared\MSINFO\Wmps32.exe</font></strong>><N/A></font></p><p><font size="3"><strong>清除方法</strong>：</font></p><p><font size="3">用SREng删除该NT服务即可。方法参考 <font face="Verdana"><a href="http://www.anti-malware.cn/News/20061220105753.html"></a><a href="http://www.anti-malware.cn/News/20061220105753.html" target="_blank">http://www.anti-malware.cn/News/20061220105753.html</a><a></a></font></font></p></div> 另外，可以尝试用“金山毒霸系统清理专家”<br/><a href="http://www.duba.net/zt/ksc/down.shtml">http://www.duba.net/zt/ksc/down.shtml</a><br/>使用里面的“清理隐藏程序”进行清除
页:
[1]