点击我的电脑包括控制面板打开时间很长而且会在windows目录下创建文件怎么回事？

王朝知道·作者佚名 2009-10-15

宽屏版字体: 小|中|大|超大

分类: 电脑/网络 >> 操作系统/系统故障

问题描述:

点击我的电脑包括控制面板打开时间很长而且会在windows目录下创建文件怎么回事？创建的文件有update12.exe url_10_.ini downnew.ini

参考答案:

Trojan.DL.Agent.ltc手工清除方法

C:\WINDOWS\ss10202.EXE

释放

C:\Documents and Settings\mopery\Local Settings\Temp\nsiD.tmp

C:\Documents and Settings\mopery\Local Settings\Temp\nsz10.tmp

C:\WINDOWS\system\realsched.exe 疯狂在 C:\WINDOWS\System32\mscache\ 释放 .cpz 文件

C:\WINDOWS\system\vp_VM.dll

C:\WINDOWS\system32\Inte32.dll

C:\WINDOWS\system32\mssv131.exe

C:\WINDOWS\system32\~GLH0000.TMP

C:\WINDOWS\system32\~GLH0001.TMP

注册表

HKCR\AppID\{35A69597-0E2A-4100-A394-C6F6FC2535B9}

HKCR\AppID\InteSearch.DLL

HKCR\CLSID\{8462112E-2D10-4D27-AA0F-D0326D3CE7EF}

HKCR\CLSID\{9B840ED7-32C9-4121-B6C9-A9FF1DB76FE8}

HKCR\CLSID\{EBBC6E6D-7B65-46be-B509-86CED2D17876}

HKCR\CLSID\{EE09B8C3-BDB8-4301-BC8D-C13CE4664194}

HKCR\CLSID\{F8EB3B42-0665-4A7B-ADA5-B21B0C189FBD}

HKCR\Interface\{267C72E2-A8B2-41EB-AA53-CAC627B1BB40}

HKCR\Interface\{283AF4AE-CAAB-4680-A951-919A5471D4AD}

HKCR\Interface\{3454E70B-C820-40E9-A21C-66BB1743A9A3}

HKCR\Interface\{51B70EAE-A776-42C1-A494-***********D}

HKCR\Interface\{52F707BD-7D57-4AFD-8151-215ED7003D5D}

HKCR\InteSearch.DocumentEventsHandler

HKCR\InteSearch.DocumentEventsHandler.1

HKCR\InteSearch.Intruder

HKCR\InteSearch.Intruder.1

HKCR\InteSearch.Service

HKCR\InteSearch.Service.1

HKCR\InteSearch.Settings

HKCR\InteSearch.Settings.1

HKCR\InteSearch.WindowEventsHandler

HKCR\InteSearch.WindowEventsHandler.1

HKCR\TypeLib\{3548754C-4A57-4D1E-A0FD-5AFF***********}\1.0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

C:\WINDOWS\Setup_YH0016.exe 访问218.204.253.166:80

释放文件

C:\Documents and Settings\mopery\Local Settings\Temp\3481734.exe

C:\WINDOWS\svchost.exe 访问:218.204.253.166:9102 218.204.253.166:5929 218.204.253.166:80

218.204.253.217:80 218.204.253.216:80

打开:

C:\Documents and Settings\mopery\Local Settings\Temp\mmsassis01.exe

C:\Documents and Settings\mopery\Local Settings\Temp\Skymmstp.exe 访问:222.73.4.243:80

221.231.138.59:80

C:\Documents and Settings\mopery\Local Settings\Temp\bind_40061.exe

C:\Documents and Settings\mopery\Local Settings\Temp\bbmao_1002_XXXX.exe(bbmao助手)

C:\Documents and Settings\mopery\Local Settings\Temp\temp1.exe

C:\Documents and Settings\mopery\Local Settings\Temp\jmxkbsetup-x66.exe

C:\Documents and Settings\mopery\Local Settings\Temp\pack_tmp\progress.exe

C:\Documents and Settings\mopery\Local Settings\Temp\63065a4e.exe(傲讯插件)

C:\Documents and Settings\mopery\Local Settings\Temp\Setup_ws.exe

C:\Documents and Settings\mopery\Local Settings\Temp\IXP000.TMP\Setup.exe

C:\WINDOWS\cast.config

C:\WINDOWS\castp.dat

C:\WINDOWS\castvxml.dat

C:\WINDOWS\castxml.dat

C:\WINDOWS\downnew.ini

C:\WINDOWS\inf\hpsext.inf

C:\WINDOWS\KB910436.log

C:\WINDOWS\system32\32F77AC0.094

C:\WINDOWS\system32\Albus.DAT

C:\WINDOWS\system32\almms.dat

C:\WINDOWS\system32\alsmt.exe

C:\WINDOWS\system32\drivers\Albus.SYS

C:\WINDOWS\system32\EJMX.dll

C:\WINDOWS\system32\guid.vxd

C:\WINDOWS\system32\gunzip.exe

C:\WINDOWS\system32\iedetect.dll

C:\WINDOWS\system32\mscache

C:\Program Files\bbmao toolbar

C:\Program Files\Common Files\UPDATE2

C:\Program Files\MMSAssist

C:\WINDOWS\system32\1116

C:\WINDOWS\system32\msicn

C:\WINDOWS\system32\nt.sys

C:\WINDOWS\system32\spoolsv\spoolsv.exe

C:\WINDOWS\System32\std.ini

C:\WINDOWS\System32\stdd.ini

C:\WINDOWS\System32\stdup.dll

C:\WINDOWS\system32\svchost.dll

C:\WINDOWS\System32\updstdup.ini

C:\WINDOWS\system32\wbauninstall.exe

C:\WINDOWS\system32\wbem\ocmor.dat

C:\WINDOWS\system32\wbem\smtpconfs.dll

C:\WINDOWS\system32\wmpdrm.dll

C:\WINDOWS\system32\xenroer.dll

C:\WINDOWS\url_.ini

注册表

HKCR\CLSID\{6AE02E1C-8859-4F57-9097-5A55A56A4CAF}

HKCR\CLSID\{6F26ED6F-82C2-4B64-B1A7-40E644225E97}

HKCR\CLSID\{72BA415A-AE03-4279-ACAB-39A3DF73FD4E}

HKCR\CLSID\{A405D44C-4B7B-43EA-A3EA-7E0E3065220E}

HKCR\CLSID\{CAC068F3-A608-406B-8581-458788A67694}

HKCR\IeLunch.Webacc

HKCR\IeLunch.Webacc.1

HKCR\Interface\{18ACE3AA-4C9B-4800-AC8E-73BF91009B09}

HKCR\Interface\{B780481C-A4F7-493A-8586-6CAC39D812ED}

HKCR\Interface\{EB433BB6-139A-48AF-9836-09911F2E0847}

HKCR\Interface\{ECB449B4-6B1C-4C8A-871A-4A86F756CD84}

HKCR\Skymmstp.CFileDownload

HKCR\Skymmstp.CVirus

HKCR\ToolBand.XBTP05676

HKCR\ToolBand.XBTP05676.1

HKCR\TypeLib\{68A7C985-87D6-4635-B498-3290613C718E}\1.0

HKCR\TypeLib\{A67726D9-4100-4582-8620-5A7E27D3EC3B}\5b.0

HKCR\TypeLib\{B25E511B-2A57-41B1-B7AC-53E76E20D11C}\1.0

HKCR\XBTB05676.IEToolbar

HKCR\XBTB05676.IEToolbar.1

HKCR\XBTB05676.XBTB05676

HKCR\XBTB05676.XBTB05676.1

HKCU\Software\91cast

HKCU\Software\bbmao

HKCU\Software\XBTB05676

HKLM\SOFTWARE\Lamp\Update

HKLM\SOFTWARE\SECTEMP

C:\WINDOWS\system32\jmxsetup.exe调用C:\Documents and Settings\mopery\Local Settings\Temp\Setup.exe 运行.

释放文件

C:\Documents and Settings\mopery\Local Settings\Temp\IXP000.TMP\TMP4351$.TMP

C:\WINDOWS\system32\EJMX.dl_

C:\WINDOWS\system32\EJMX.dll

C:\WINDOWS\system32\duibi.txt

具体只测到这了..接下去的口头说说..

安装了非常多个流氓软件..雅虎 CNNIC 划词等等 ...

释放几个变态病毒..

威金落雪(LSASS.exe WINLOGON.EXE SMSS) QQpass 等病毒..

以下文件都是此病毒所下载的文件..只有大部分..有漏掉..

C:\WINDOWS\101371.exe

C:\WINDOWS\bind_40094.exe

C:\WINDOWS\Temp\mssoak.exe

C:\Documents and Settings\mopery\Local Settings\Temp\temp1.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\temp1.exe

C:\WINDOWS\system32\91di2fa.exe

C:\WINDOWS\Setup2.exe

C:\WINDOWS\ss10202.EXE

C:\WINDOWS\system32\mssv131.exe

C:\WINDOWS\system\realsched.exe

C:\Documents and Settings\mopery\Local Settings\Temp\2065968.exe

C:\Documents and Settings\mopery\Local Settings\Temp\mmsassis01.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\mmsassis01.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\53a03753.exe

C:\Documents and Settings\mopery\Local Settings\Temp\jmxkbsetup-x66.exe

C:\Documents and Settings\mopery\Local Settings\Temp\bind_40061.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\Skymmstp.exe

C:\WINDOWS\system32\s_bdextinsU217.exe

C:\WINDOWS\system32\loadsky.exe

C:\WINDOWS\system32\sysmini.exe

C:\Documents and Settings\mopery\Local Settings\Temp\bbmao_1002_XXXX.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\bind_40061.exe

C:\WINDOWS\Temp\regsvc.exe

C:\WINDOWS\Temp\jmxkbsetup-x66.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\IXP000.TMP\Setup.exe

C:\WINDOWS\svchost.exe

C:\WINDOWS\system32\SkymmstpRAR.exe

C:\WINDOWS\system32\loadsky.exe

C:\WINDOWS\Skymmstp017.exe

C:\WINDOWS\system32\ZW.exe

C:\WINDOWS\system32\jmxsetup.exe

C:\WINDOWS\system32\drivers\wl.sys

C:\DOCUME~1\mopery\LOCALS~1\Temp\24\setup.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\***********.exe

C:\WINDOWS\system32\zsdm.exe

C:\Program Files\DeskAdTop\Mrup.exe

C:\WINDOWS\system32\cxt.exe

C:\WINDOWS\system32\3.exe

C:\WINDOWS\system32\01SJHB17.exe

C:\WINDOWS\system32\17.exe

C:\Documents and Settings\mopery\Local Settings\Temp\RarSFX0\Gapr11.exe

C:\WINDOWS\system32\ppgaxea.dll

C:\WINDOWS\system32\bdcjins.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\WINDOWS\system32\iebar.exe

C:\WINDOWS\system32\8004avpa.exe

C:\WINDOWS\system32\SetupCmd.exe

C:\WINDOWS\system32\bind_40258.exe

C:\WINDOWS\system32\SETUPCMD.EXE

C:\WINDOWS\system32\Kuaiso.exe

C:\WINDOWS\realupdate.exe

C:\WINDOWS\Temp\ie.exe

C:\WINDOWS\system32\BIND_4~1.EXE

C:\WINDOWS\system32\huacai906.exe

C:\WINDOWS\winampa.exe

C:\WINDOWS\system32\sysmini.exe

C:\logo1_.exe

C:\WINDOWS\system32\yybar.exe

C:\Program Files\ybar.exe

C:\WINDOWS\system32\sysdmins.exe

C:\WINDOWS\system32\hbrich.exe

C:\Documents and Settings\mopery\Local Settings\Temp\RarSFX0\downl.exe

C:\DOCUME~1\mopery\LOCALS~1\Temp\BTSearch.exe

C:\Documents and Settings\mopery\Local Settings\Temp\cncnew.exe

C:\WINDOWS\system32\rjzc008_cns_yassist.exe

C:\Documents and Settings\mopery\Local Settings\Temp\103126.exe

C:\WINDOWS\system32\bdcj01.exe

C:\WINDOWS\system32\dxkr.exe

C:\Documents and Settings\mopery\Local Settings\Temp\64\setup.exe

C:\WINDOWS\system32\13528.exe

C:\WINDOWS\system32\IELink.exe

C:\WINDOWS\system32\cmd1054.exe

C:\WINDOWS\system32\SETUP5~1.EXE

C:\WINDOWS\system32\Setup5003.exe

C:\WINDOWS\system32\TOTO.exe

c:\Program Files\system2.exe

C:\WINDOWS\system\king.exe

C:\WINDOWS\system\aa1.exe

C:\WINDOWS\system\001.exe

C:\WINDOWS\LSASS.exe

C:\WINDOWS\system\aa3.exe

C:\WINDOWS\system32\SVOHOST.exe

C:\WINDOWS\system32\intenet.exe

C:\WINDOWS\system\aa4.exe

C:\WINDOWS\SMSS.EXE

C:\WINDOWS\system\09.exe

C:\WINDOWS\system32\winscok.dll

C:\WINDOWS\system32\myrx.dll

C:\WINDOWS\WINLOGON.EXE

C:\WINDOWS\system32\Launcher.exe

C:\WINDOWS\system32\sctongji06.exe

C:\windows\system32\SVOHOST.exe

C:\windows\system32\winscok.dll

C:\WINDOWS\Logo1_.exe

总之你是中毒了

抓紧查杀！ ewido