【求助】WORM_AGOBOT.FX 已試著找尋解決法



贊助商連結


29988122
2004-01-30, 02:08 PM
http://www.trendmicro.com/vinfo/zh-cn/virusencyclo/default5.asp?VName=WORM_AGOBOT.FX


--------------------網站中的解毒辦法---------------------------------
Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing during startup.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
WinFX = "cssrs.exe"
Display Drivers = "cssrs.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>
CurrentVersion>RunServices
In the right panel, locate and delete the entry:
WinFX = "cssrs.exe"
Display Drivers = "cssrs.exe"
In the left panel, locate and delete the following:
HKEY_LOCAL_MACHINE>System>CurrentControlSet>
Services>Driver
Close Registry Editor.
NOTE:Since the malware cannot be terminated manually, restart your system.
------------------------------------------------------------------
regedit開啟不能..被病毒關了
那我該如何清除..?感謝回應...

贊助商連結


ehawk
2004-01-30, 05:55 PM
我一直很想看看Stinger (http://vil.nai.com/vil/stinger/) 的威力, 試試看吧. 他對已中毒的系統尤其有效.

O/S如是ME/XP, 請先 Read this first (http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm) (關閉系統回復功能 - Disabling System Restore)

PS: 進入安全模式也不能開 Regedit嗎 ?
在工作管理員去關閉那Malware再開Regedit呢?

redhung
2004-02-03, 11:03 PM
有沒有試著COPY一份出來,然後把它改名成R.EXE之類的檔名,然後再執行看看,也許它只擋Regedit.EXE這個檔名而已歐!

ceosai
2004-02-08, 02:00 PM
去抓類似工作管理員的程式..

然後把疑似病毒的程序關掉就好了