mppds.dll病毒专杀

<BR><SPAN class=artcbody><FONT size=1>&nbsp;</FONT>
<P><FONT size=1>昨天早上开机不久,弹出个窗口:"Faulting&nbsp;application&nbsp;logo1_.exe,fault&nbsp;address&nbsp;0x000019ca!"<BR>不久又弹出个窗口,内容差不多,不过这回是"rundl132.exe"<BR>看名字就知道有古怪!感觉系统变慢,查之.</FONT></P>
<P><FONT size=1>运行hijackthis.exe(下载地址：<FONT color=#000000><U>/html/virus/shaduruanjian/20070221/1808.html</U></FONT>),<FONT class=artcbody color=#333399><U>发现</U></FONT>几个有趣的启动项:</FONT></P>
<P><FONT size=1>O4&nbsp;-&nbsp;HKLM\..\Run:&nbsp;[load]&nbsp;C:\<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>\uninstall\rundl132.exe<BR>O4&nbsp;-&nbsp;HKLM\..\Run:&nbsp;[wsvbs]&nbsp;C:\<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>\SMSS.EXE<BR>O4&nbsp;-&nbsp;HKLM\..\Run:&nbsp;[mppds]&nbsp;C:\<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>\SERVICES.EXE</FONT></P>
<P><FONT size=1>fix&nbsp;it!</FONT></P>
<P><FONT size=1>在<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>目录下按日期排列看到今天多了几个文件:<BR>SMSS.EXE<BR>SERVICES.EXE<BR>logo1_.exe<BR>richdll.dll<BR>杀之!<BR>richdll.dll杀不掉,信息是"正在应用"!<BR>打开cmd,输入:tasklist&nbsp;/m&nbsp;&gt;d:\check.txt<BR>在check.txt搜richdll.dll,原来在explorer.exe里面!<BR>看来是线程注入explorer.exe!<BR>没关系,上面那些主文件杀掉后,重起就注入不了啦!杀之~~~</FONT></P>
<P><FONT size=1><FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>目录还多了个文件夹:<BR>&nbsp;C:\<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>\uninstall\<BR>里边有rundl132.exe.<BR>delete&nbsp;folder!</FONT></P>
<P><FONT size=1>世界清静了!</FONT></P>
<P><FONT size=1>到了下午,Norton才<FONT class=artcbody color=#333399><U>发现</U></FONT>个<FONT class=artcbody color=#333399><U>病毒</U></FONT>尸体<BR>"C:\<FONT class=artcbody color=#333399><U>WINDOWS</U></FONT>\SYSTEM32\MPPDS.DLL"<BR>才知道此<FONT class=artcbody color=#333399><U>病毒</U></FONT>的名字叫:"Infostealer.Gampass"</FONT></P>
<P><FONT size=1>Norton整整慢了半天啊!<BR>这个时候我们的IT&nbsp;Admin出现了,因为其他电脑都报<FONT class=artcbody color=#333399><U>发现</U></FONT><FONT class=artcbody color=#333399><U>病毒</U></FONT>!<BR>他无非是进安全模式,扫杀!却怎么都杀不干净.因为已经感染很多文件啦~</FONT></P>
<P><FONT size=1>不关我事,我机无事!&nbsp;:)</FONT></P>
<P><FONT size=1>后记：c:\System&nbsp;Volume&nbsp;Information\&nbsp;这个地方一定要扫，防止死灰复燃！</FONT></P>
<P><FONT size=1>系统要打上最新补丁&nbsp;|&nbsp;patch&nbsp;it&nbsp;up!堵住<FONT class=artcbody color=#333399><U>病毒</U></FONT>入侵之门！</FONT></P></SPAN> <BR>

żɶʱ