查杀www.my123.com

昨天晚上就中了，没以为有什么了不起，没理他，找到病毒文件，C:\WINNT\system32\drivers\exoowk26.sys 换操作系统；改名字。ok；搞定。 _i`h%\yF  
|_=T ;W  
今天白天看这么多帖子，也没注意，我今天一直用xp;刚刚回家，开2000，才发现，哦，昨天中的就是它。 m>Itq?2Gx  
;85aF+9E  
这个病毒文件大小是14.8kB, 15232字节，版本说明：disk driver;产品名称：Microsoft(R) Windows(R) Operating System )?$( Axz)  
T~ AMBo*  
还有，此文件是8位sys 文件位于\system32\drivers\目录下，后2位是数字，用unlocker删除；或进dos删除。 9dmNj:kS  
,7<;dkAnd  
重要补充：此文件在system32目录下还有一个同名dll文件，一起删除。大小：52kB 53248字节 版本说明：Battery Meter Helper DLL 5)%1 {A"  
D:?e}  
EXw@:es/  
加载到注册表的项： c,I}Zl;_6  
oh'bSz  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26] Z0J]wTx '`  
"Type"=dword:00000001 kvi?X  
"Start"=dword:00000000 Hqd 3PG$  
"ErrorControl"=dword:00000001 lFy&}j  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ 38RC/p*)  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ 6lp9 _K?C  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 *nCF# v]q[  
"DisplayName"="exoowk26" L_^%N)rJ  
"Group"="System Bus Extender" +TP
:6  
nz6h_^;Pd  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26\Security] tO!,,^l9\y  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ 3LZqM\  
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ rE}{FMU  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ l?f@m` F/  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ 4@w:+Ur\8  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ BQC)-y8E  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ UsPWM7f  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ U){.l`C  
00,01,01,00,00,00,00,00,05,12,00,00,00 "V5eEJCuv  
fa0>;OT  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26\Enum] ?>ak5R]g  
"0"="Root\\LEGACY_EXOOWK26\\0000" U8q2'1Kf  
"Count"=dword:00000001 o fTlo,X{  
"NextInstance"=dword:00000001 B</WkgY CG  
Wl$ uMpim  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\exoowk26] FY]4OW+s  
"Type"=dword:00000001 62t7|O"L  
"Start"=dword:00000000 8/u+"M  
"ErrorControl"=dword:00000001 dN@2F/  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ J`q\Hd :Ig  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ oa@i1?;  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 XMST5`Q  
"DisplayName"="exoowk26" >t52u u  
"Group"="System Bus Extender" a:*qLcHCn  
l.2@)%B%5  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\exoowk26\Security]
GD{!Z^  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\
hY[
!ux  
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ pz@R:c:de  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ NzWj{>aU  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ #i
y>l  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ #7m=3\)A  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ CTPda:]42J  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ 9WiB^@A7  
00,01,01,00,00,00,00,00,05,12,00,00,00 ~l[M K/F^
 
nXUR:99J  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26] HzL|~@U  
"Type"=dword:00000001 HivaTitx0  
"Start"=dword:00000000 L^CZI]km  
"ErrorControl"=dword:00000001 `5:~/zV?  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ 34Qq.7MG`"  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ PQyCL|A_  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 8X(r k]  
"DisplayName"="exoowk26" ~bD%Gs  
"Group"="System Bus Extender" 1-w8UtVE  
[ {qeUS-  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26\Security] _tc@ #"tV  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ 3Sh]j#2  
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 9+t"KElW  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ (20t,GYM]s  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ ,~r,%:O  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ d~-5+pw
t  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ Qt"d 6Ae6  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ 5K'W:y,fk  
00,01,01,00,00,00,00,00,05,12,00,00,00 oJnW<*K,  
9jgs!o)_  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26\Enum] zfEi'l8  
"0"="Root\\LEGACY_EXOOWK26\\0000" Nv8s0X${  
"Count"=dword:00000001 ~w el4  
"NextInstance"=dword:00000001 8ZC?14#~W  
oiX#l>C  
此病毒文件的查杀和删除办法，参见查杀ALLXUN的办法。 VH4ID6  
=Q`oFd