[转载]又碰到一种类似的MSN尾巴病毒 提供手工清除方法
文章作者：Aceryt产生以下三个文件：gedit.exe、msscript.exe、systemr.exe。三个文件都在%systemroot%\SYSTEM32\下。
1、首先在任务管理器中，将gedit.exe及msscript.exe 两个病毒进程结束掉。
2、在注册表中删除以下数值：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Systemr c:\winnt\system32\gedit.exe"
HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Windows\"load c:\winnt\system32\msscript.exe"
3、搜索磁盘，将三个病毒文件清除。
这里练了个小脚本，还没实际运行，只在自己的xp下调试过：
A scripting for removing the MSN tail Virus
[code]'Created by Acer in Jun 17 2005 for Killing MSN Tail Virus
strComputer = "."
'判断是否使用本机管理员登录
Set Net = CreateObject("Wscript.Network")
If Net.UserName <> "Administrator" Then
Wscript.echo ("请使用本机管理员登录使用此脚本")
Wscript.Quit 1
End If
'取得环境变量
'[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/script56/html/wsproenvironment.asp[/url]
Set WshShell = CreateObject("Wscript.shell")
Set WshProcEnv = WshShell.Environment("Process")
Dim VFN, VirusFileName
'需要删除和结束进程的程序列表
VirusFileName = "gedit.exe/msscript.exe/systemr.exe/d11host.exe/N0TEPAD.exe/windll.dll"
VFN = split(VirusFileName,"/")
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objFSO = CreateObject("Scripting.FileSystemObject")
For i = 0 to UBound(VFN)
'结束病毒进程
Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = '" & VFN(i) & "'")
For each objProcess in colProcessList
objProcess.Terminate()
Next
Next
'删除磁盘上的病毒文件
windir = WshProcEnv("SYSTEMROOT")
For i = 0 to UBound(VFN)
file_fullpath = windir & "\system32\" & VFN(i)
If objFSO.FileExists(file_fullpath) Then
objFSO.DeleteFile(file_fullpath)
Wscript.echo file_fullpath & " 已经清除."
End If
file_fullpath = windir & "\" & VFN(i)
If objFSO.FileExists(file_fullpath) Then
objFSO.DeleteFile(file_fullpath)
Wscript.echo file_fullpath & " 已经清除."
End If
Next
'删除注册表键值
Const HKEY_LOCAL_MACHINE = &H80000002
Const HKEY_CURRENT_USER = &H80000001
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")
strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
strValue = "Systemr"
oReg.DeleteValue HKEY_LOCAL_MACHINE, strKeyPath, strValue
strKeyPath = "Software\Microsoft\Windows NT\CurrentVersion\Windows"
strValue = "load"
oReg.DeleteValue HKEY_CURRENT_USER, strKeyPath, strValue
Wscript.echo "已处理完毕，请重新启动计算机"[/code]
页:
[1]