精选栏目: 装机必备 专题大全 常用工具 系统集锦

55550.dll,nm071009.dll,rsmyepm.dll,rsmyepm.dll,rsmyesp.exe等

栏目: 病毒学院 已有人学习|编辑:admin; 来源:未知;

 现在的木马不都是下载一堆木马群,进行感染。导致用户的杀软和一般的删除根本无法完全解决问题。
建议使用一些强制类删除工具,或DOS下的删除工具,如:xdelbox,冰刃,费尔木马强制删除工具等(均可到down.45it.com下载)。

  该文章,仅供参考,不保证你所中的病毒和此分析日志所得内容完全一致。

  解决步骤:

  1.建议使用XDelBox删除以下app彩票软件:(可到down.45it.com下载 )

  使用说明:删除时复制所有要删除app彩票软件的路径,在待删除app彩票软件列表里点击右键选择从剪贴板导入,导入后在要删除app彩票软件上点击右键,选择立刻重启删除,电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质(包括U盘,MP3,手机存储卡等)。
 

 c:windowssystem32rsmyesp.exe
c:windowssystem32rsmyepm.dll
c:windowssystem32lymangr.dll
c:program filesinternet explorerpluginswinsys88.sys
c:windowssystemnm071009.dll
c:windowssystem32dh3oor0.dll
c:windowssystem32msimms32.dll
c:windowssystem32nvdispdrv.dll
c:windowssystem32zhjtrx.dll
c:windowssystem32genprotect.dll
c:windowssystem32kvsc3.dll
c:windowssystem32upxdnd.dll
c:program filescommon filesmicrosoft sharedmsinfosystem6.ins
c:program filescommon filesfjos0r.dll
c:program filesinternet exploreronlo0r.dll
c:windowssystem3255550.dll
c:windowssystem32cqdoor0.dll
c:windowssystem32csdoor0.dll
c:windowssystem32dadoor0.dll
c:windowssystem32mhdoor0.dll
c:windowssystem32mydoor0.dll
c:windowssystem32qhdoor0.dll
c:windowssystem32qjdoor0.dll
c:windowssystem32rxdoor0.dll
c:windowssystem32tldoor0.dll
c:windowssystem32wddoor0.dll
c:windowssystem32wgdoor0.dll
c:windowssystem32wldoor0.dll
c:windowssystem32wodoor0.dll
c:windowssystem32zxdoor0.dll
c:windowssystem32rsmyepm.dll
c:windowssystemnm071009.dll
c:windowssystem32lyloadqr.exe
c:windowssystem32lyloadhr.exe
c:windowssystem32lyloadmr.exe
c:windowssystem32lyloadar.exe
c:windowssystem32lyloador.exe
c:windowssystem32lyleador.exe
c:windowssystem32lyloadbr.exe
c:windowssystem32lyloader.exe
c:windowskvsc3.exe
c:windowsgenprotect.exe
c:windowsupxdnd.exe
c:windowsmsimms32.exe
c:windowsnvdispdrv.exe
c:windowssystem32drivers8bjfdr.sys
c:windowssystem32driversqe6i.sys
E:AutoRun.exe
e:autorun.inf


  2.删除重启后使用SREng(可到down.45it.com下载)修复下面各项:

      启动项目 -- 注册表之如下项删除:
[{09F8A0EB-ED61-4714-B0AD-7EAFF5361A8B}]      <C:WINDOWSsystem32zhjtrx.dll>
[{37C3125C-9CB6-4503-8F38-63D80ADEFA07}]      <C:Program FilesCommon FilesMicrosoft SharedMSINFOSystem6.ins>
[{5E32FA58-3453-FA2D-BC49-F340348ACCE5}]      <C:WINDOWSsystem32rsmyepm.dll>
[{E418E9ED-9221-4661-B1F3-4AA35BD83832}]      <C:Program FilesInternet ExplorerPLUGINSWinSys88.Sys>
[{04A0CB31-FDEB-4EB8-889B-E00ED87BCE23}]      <C:WINDOWSsystem32cqdoor0.dll>
[{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}]      <C:WINDOWSsystem32qhdoor0.dll>
[{EDFF29C1-5A70-4460-AC1D-16DCB4B672F0}]      <C:WINDOWSsystem32rxdoor0.dll>
[{68F7767A-090C-4BBF-A015-720ACC6706E2}]      <C:WINDOWSsystem32wddoor0.dll>
[{08E909A4-B236-48DD-8BCC-90A604B93E68}]      <C:WINDOWSsystem32tldoor0.dll>
[{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}]      <C:WINDOWSsystem32zxdoor0.dll>
[{4E3FBFA4-F1CC-4B66-B333-B9F0FF4B4748}]      <C:WINDOWSsystem32mydoor0.dll>
[{6826A3DB-EA8E-4E67-880D-53D04C7C0BD8}]      <C:WINDOWSsystem32qjdoor0.dll>
[{D8CC4845-441C-44F8-9053-28F2EF67655B}]      <C:WINDOWSsystem32dadoor0.dll>
[{A120A1D0-CBCC-4F9B-A183-78B27E4C1B5C}]      <C:WINDOWSsystem32dh3oor0.dll>
[{A3C95A74-638D-4C6B-A856-4B27664A7F47}]      <C:WINDOWSsystem32wgdoor0.dll>
[{E03C23BD-35B7-49C2-BBCA-6D8CEC2507E3}]      <C:WINDOWSsystem32wldoor0.dll>
[{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}]      <C:WINDOWSsystem32wodoor0.dll>
[{11DB88F9-409B-475E-8FD7-411653F6D367}]      <C:WINDOWSsystem3255550.dll>
[{32C4BAF4-0411-4000-BDFB-A6F71E669F8C}]      <C:WINDOWSsystem32csdoor0.dll>
[{3422FB0F-95EB-458A-8B56-39552017A4EF}]      <C:WINDOWSsystem32mhdoor0.dll>
注意该项[AppInit_DLLs]修改:把<rsmyepm.dll>修改为<>即清空
[downf]      <rundll32.exe C:WINDOWSsystemnm071009.dll mymain>
[MSDQG32]      <LYLoadqr.exe>
[MSDHG32]      <LYLoadhr.exe>
[MSDMG32]      <LYLoadmr.exe>
[MSDSG32]      <LYLoadar.exe>
[MSDOG32]      <LYLoador.exe>
[MSDCG32      ]      <LYLeador.exe>
[MSDWG32]      <LYLoadbr.exe>
[MSDEG32]      <LYLoader.exe>
[Kvsc3]      <C:WINDOWSKvsc3.exe>
[GenProtect]      <C:WINDOWSGenProtect.exe>
[upxdnd]      <C:WINDOWSupxdnd.exe>
[MsIMMs32]      <C:WINDOWSMsIMMs32.exe>
[NVDispDrv]      <C:WINDOWSNVDispDrv.exe>
[{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}]      <C:Program FilesInternet ExplorerOnlO0r.dll>

      启动项目 -- 服务-- 驱动程序之如下项删除:
[8bjfdr / 8bjfdr]      <??C:WINDOWSsystem32drivers8bjfdr.sys>
[qe6 / qe6i]      <SystemRootSystem32DRIVERSqe6i.sys>


  之后:清理系统临时app彩票软件和IE临时app彩票软件夹,到down.45it.com下载360安全卫士进行系统清理.

  最后卸载QQ,重新安装,并修改QQ密码。

  PS:由于木马群对应的app彩票软件比较多,所以删除,尽量认真,争取删除完全。之后的一些sreng修复操作也尽量完整!并建议解决完成后,更新杀软的病毒,全盘扫描确保系统的安全和干净。
收藏 赞() 踩()
本文地址:http://planislam.com/hack/bdxy/6794.html
本文标签:55550dll nm071009dll rsmyepm
评论