pegefile.pif病毒手动清除方法及专杀工具下载

wxdqz · 发表于 2008-4-14 01:14:55

PegeFile.pif病毒解决办法详细步骤： 　　　　一：1.到down.45it.com下载费尔木马强制删除器工具.zip,解压缩打开PowerRmv.exe,在文件名处依次输入

<TABLE borderColor=#cccccc cellSpacing=0 cellPadding=3 width=500 align=center bgColor=#ffffff border=2 heihgt="">
<TBODY>
<TR>
<TD> C:\Program Files\Internet Explorer\PLUGINS\NewTemp.bak C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll 以及所有分区下的PegeFile.pif和autorun.inf文件</TD></TR></TBODY></TABLE>
,并勾选"抑制文件再次生成"最后点击清除来删除该文件。
　　二：ctrl＋alt＋del打开任务管理器，结束explorer.exe 进程然后删除以下文件（参考步骤一）

<TABLE borderColor=#cccccc cellSpacing=0 cellPadding=3 width=500 align=center bgColor=#ffffff border=2 heihgt="">
<TBODY>
<TR>
<TD> C:\DOCUME~1\TestUser\LOCALS~1\Temp\2.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\1.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\mhso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\mhso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\3.exe C:\WINDOWS\system32\ztinetzt.exe C:\WINDOWS\system32\ztinetzt.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\4.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\rxso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\rxso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\5.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\6.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\qjso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\qjso0.dll C:\WINDOWS\system32\Ravasktao.exe C:\WINDOWS\system32\Ravasktao.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\7.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\tlso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\tlso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\8.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\daso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\daso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\7.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\8.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\9.exe C:\Program Files\Internet Explorer\PLUGINS\System64.Jmp C:\Program Files\Internet Explorer\PLUGINS\System64.Sys C:\DOCUME~1\TestUser\LOCALS~1\Temp\10.exe C:\WINDOWS\system32\Drivers\usbinte.sys C:\WINDOWS\system32\visin.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\11.exe C:\WINDOWS\system32\mydata.exe C:\WINDOWS\system32\moyu103.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\13.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\wlso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\wlso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\14.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\wgso.exe C:\DOCUME~1\TestUser\LOCALS~1\Temp\wgso0.dll C:\DOCUME~1\TestUser\LOCALS~1\Temp\15.exe C:\WINDOWS\system32\wuclmi.exe C:\WINDOWS\system32\wincfg.exe C:\WINDOWS\system32\mvdbc.exe C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\wanpacket.dll C:\WINDOWS\system32\wpcap.dll C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\npf_mgm.exe C:\WINDOWS\system32\daemon_mgm.exe C:\WINDOWS\system32\NetMonInstaller.exe C:\WINDOWS\system32\rpcapd.exe C:\WINDOWS\system32\capinstall.exe</TD></TR></TBODY></TABLE>
　　三：开始菜单－运行－输入“regedit”打开注册表删除以下标橙色的项

<TABLE borderColor=#cccccc cellSpacing=0 cellPadding=3 width=500 align=center bgColor=#ffffff border=2 heihgt="">
<TBODY>
<TR>
<TD>   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run "wosa" = %TEMP%WOSO.EXE "mhsa" = %TEMP%MHSO.EXE "Microsoft Autorun14" = %SYSTEM%\ZTINETZT.EXE "rxsa" = %TEMP%RXSO.EXE "qjsa" = %TEMP%QJSO.EXE "Microsoft Autorun9" = %SYSTEM%\RAVASKTAO.EXE "tlsa" = %TEMP%TLSO.EXE "dasa" = %TEMP%DASO.EXE "wlsa" = %TEMP%WLSO.EXE "wgsa" = %TEMP%WGSO.EXE
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run "visin" = %SYSTEM%\VISIN.EXE
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks "{0EA66AD2-CF26-2E23-532B-B292E22F3266}" = "{754FB7D8-B8FE-4810-B363-A788CD060F1F}" = 
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nm (Display Name)Network Monitor Driver = (IMAGEPATH)SYSTEM32\DRIVERS\NMNT.SYS     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF (Display Name)NetGroup Packet Filter Driver = (IMAGEPATH)SYSTEM32\DRIVERS\NPF.SYS     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rpcapd (Display Name)Remote Packet Capture Protocol v.0 (experimental) = (IMAGEPATH)"%PROGRAMFILES%\WINPCAP\RPCAPD.EXE" -D -F "%PROGRAMFILES%\WINPCAP\RPCAPD.INI"
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys
    HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0EA66AD2-CF26-2E23-532B-B292E22F3266}     HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{425882B0-B0BF-11CE-B59F-00AA006CB37D}     HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{754FB7D8-B8FE-4810-B363-A788CD060F1F}     HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{944AD531-B09D-11CE-B59C-00AA006CB37D}     HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{D413C502-3FAA-11D0-B254-444553540000}</TD></TR></TBODY></TABLE>
pegefile.pif病毒专杀工具下载地址：<A href="http://www.hotbus.cn/it/200706/2213.html">/it/200706/2213.html</A>

raymanlion · 发表于 2008-11-24 08:00:09

xbbgame · 发表于 2009-2-8 08:00:03

账号		自动登录	找回密码
密码			注册账户

pegefile.pif病毒手动清除方法及专杀工具下载

相关帖子