前几天论坛ID为“要爽由自己”的GG发了一个求助帖，反映病毒的问题……后来我在同学那里得到了病毒样本，研究了一下，写了个批处理。

使用方法：运行killvirus_step_1.bat，重启后运行killvirus_step_1.bat。若途中报告“接口错误”一类的东西，直接回车即可。

废话不说。见附件。
其中KillVirus.rar为杀毒文件。Virus.zip为病毒样本，供技术仔们做深层次研究。

本地测试环境：Windows 2003 Enterprise Edition。
测试结果：正常模式下运行病毒，重起，运行脚本，再重启，病毒已清理干净。如果哪位GG杀毒失败……那就多做善事，积累RP吧！

PS.卡巴斯基可杀此毒。未测其他杀毒软件。

请教这条命令：ntsd -c q -pn dllhost.exe
什么意思啊？
这是杀进程吗
其实这个病毒有个叫lsass专杀工具的东西可以杀
也有个批处理网上，如吓：不过这两虽然穿着一个马甲，应该不是一个版本的，传说中的变种
@echo off
taskkill /fi "services eq kkdc" /f
sc stop kkdc
net stop kkdc
sc delete kkdc
attrib -s -h -r c:\windows\lsass.exe
del c:\windows\lsass.exe /q
attrib -s -h -r c:\autorun.inf
attrib -s -h -r c:\autorun.pif
del c:\autorun.pif
del c:\autorun.inf
attrib -s -h -r c:\autorun.inf.tmp
del c:\autorun.inf.tmp
reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v C:\WINDOWS\lsass.exe /f
reg delete "HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\kkdc" /f
reg delete "HKLM\SYSTEM\ControlSet003\Services\kkdc" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_KKDC" /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\kkdc" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.com" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.com" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.com" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.com" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp" /va /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\kkdc" /va /f
reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v %windir%\lsass.exe /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\kkdc" /va /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List" /v %windir%\lsass.exe /f
rem 去除属性
attrib -s -h -r %windir%\cmd.exe.exe
attrib -s -h -r %windir%\lsass.exe
attrib -s -h -r %windir%\regedit.exe.exe
attrib -s -h -r %windir%\setuprs1.pif
attrib -s -h -r %windows%\dllhost.exe
rem 删除文件
del %windir%\cmd.exe.exe /q
del %windir%\lsass.exe /q
del %windir%\regedit.exe.exe /q
del %windir%\setuprs1.pif /q
del %windows%\dllhost.exe /q

rem 特殊处理
echo =============================================================== >>tmp.txt
echo     您的c:\windows这个目录下以 r 开头的可执行文件如下所示 >>tmp.txt
echo   请把你不能确定是不是病毒的文件名删除，最终留在这个文本文件 >>tmp.txt
echo   里的文件名所对应的文件将被该程序删除，把你认为是病毒的文件 >>tmp.txt
echo   名在这里删除之后，按Ctrl+S保存文本内容然后关闭该文本编辑器， >>tmp.txt
echo   继续下面的操作。 >>tmp.txt
echo   注意，在删除文件名时不要改变这些说明文字，否则可能出现错误。 >>tmp.txt
echo =============================================================== >>tmp.txt
for /f "tokens=1 delims= " %%j in ('dir %windir%\r*.exe /b /a') do echo %%j >>tmp.txt
%windir%\system32\dllcache\notepad.exe tmp.txt
for /f "tokens=1 skip=8 delims= " %%j in ('more tmp.txt') do attrib -s -h -r %windir%\%%j
set /p danger=[确定要删除的文件是这些吗？按"回车键"开始删除这些文件，按"B"退出程序]
if /i "%danger%"=="B" goto :exit
for /f "tokens=1 skip=8 delims= " %%j in ('more tmp.txt') do del %windir%\%%j /q
del tmp.txt /q
rem 恢复文件
copy %windir%\dllcache\regedit.exe %windir%\regedit.exe
copy %windir%\dllcache\msconfig.exe %windir%\pchealth\helpctr\binaries\msconfig.exe
for /D %%d in (d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\runauto...\nul attrib -s -h -r %%d:\runauto...\ /s /d
for /D %%d in (d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z) do if exist %%d:\runauto...\nul rd %%d:\runauto...\ /s /q
echo.
echo ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
echo.
set /p over=   病毒清除完毕，请按回车键退出该程序。
:exit
exit

我以前是从那个充满了病毒的计算机学院机房传过来的
貌似还会有cmd.exe.exe   和regedit.exe.exe 之类的东西
记不清了，但是dllhost.exe是印象深刻了……

LS的gg这么厉害哈,佩服一个哈
不过后面的那些太长了哈

LZ厉害

都很强啊，收藏 了

偶中了LZ所说的runauto..病毒，但是运行cmd时，显示windows无法找到cmd文件
5555请问LZ怎么才能修改回原来的路径，通过cmd运行LZ上传的那个东东．．．还请LS
的蝈蝈们指点一下．．．．．

Quote:

引用第6楼yshrike于2007-06-01 22:34发表的:
偶中了LZ所说的runauto..病毒，但是运行cmd时，显示windows无法找到cmd文件
5555请问LZ怎么才能修改回原来的路径，通过cmd运行LZ上传的那个东东．．．还请LS
的蝈蝈们指点一下．．．．．

楼主去拷一个cmd放在system32下就行了啊
实在不放心，把cmd.exe改为cmd.com再运行