查杀www.my123.com

昨天晚上就中了，没以为有什么了不起，没理他，找到病毒文件，C:\WINNT\system32\drivers\exoowk26.sys 换操作系统；改名字。ok；搞定。 u8pt0%,  
LZsQZi:  
今天白天看这么多帖子，也没注意，我今天一直用xp;刚刚回家，开2000，才发现，哦，昨天中的就是它。 z&_^79[  
 >N}yYj=  
这个病毒文件大小是14.8kB, 15232字节，版本说明：disk driver;产品名称：Microsoft(R) Windows(R) Operating System ~J60~uA+  
t;TLlxgV  
还有，此文件是8位sys 文件位于\system32\drivers\目录下，后2位是数字，用unlocker删除；或进dos删除。 Z>_zdT  
K$w#bdO-^  
重要补充：此文件在system32目录下还有一个同名dll文件，一起删除。大小：52kB 53248字节 版本说明：Battery Meter Helper DLL .tG6*  
HL$Drj`T  
x>e;rg8&:  
加载到注册表的项： y
;7{8>>  
adsf"'BU9  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26] EEf9k=A  
"Type"=dword:00000001 P<oZ,R  
"Start"=dword:00000000 W92T@ex}!  
"ErrorControl"=dword:00000001 [3~kYEcj  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ g]@ ZC  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ L520EHhvmG  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 E";QtP[  
"DisplayName"="exoowk26" 6tJn z  
"Group"="System Bus Extender" /0a$E!uZk  
?J7JIE0&X  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26\Security] ikReyEh$  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ Ym{Mq%(8  
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 914-Hu9$Y  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ |Huf7(  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ QcUibK  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ cXrOH|^iG  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ :;AU_wbwF  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ I~9[D)}  
00,01,01,00,00,00,00,00,05,12,00,00,00
CS 51  
vTGu@V-  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\exoowk26\Enum] byzYXr`{  
"0"="Root\\LEGACY_EXOOWK26\\0000" |`>%* J  
"Count"=dword:00000001 *=Cb[\  
"NextInstance"=dword:00000001 WL~zlfZi  
;[e?2;lo  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\exoowk26] OYcIa8OxO{  
"Type"=dword:00000001 @sgNjM(
9  
"Start"=dword:00000000 cb~+{f
<1|  
"ErrorControl"=dword:00000001 FjgcyOn  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ R[~[s5P~D  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ Ac1\
<x>4  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 o;1r*c ian  
"DisplayName"="exoowk26" sxv/'D< &  
"Group"="System Bus Extender" O<uG7b[D  
 Av+*xz  
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\exoowk26\Security] |Wj/#,Mk  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ aBa8   
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ t~9;VoTFt  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ RF;^TBD  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ N57I`f:  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ bEL3 ED&T  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ B 6mn3{  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ yY'U[d  
00,01,01,00,00,00,00,00,05,12,00,00,00 fgu@ ]eN  
r| $9#w S2  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26] Tz'cMu   
"Type"=dword:00000001 .R`b2\T  
"Start"=dword:00000000 u~\5]Kd%  
"ErrorControl"=dword:00000001 0Oh+w0bY  
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\ Nxp=tZAR  
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,65,00,78,00,6f,00,6f,00,77,00,6b,\ g{o[H&Q  
00,32,00,36,00,2e,00,73,00,79,00,73,00,00,00 T1<. L3M  
"DisplayName"="exoowk26" "E\A  
"Group"="System Bus Extender" k+/zX^)a=  
|=$iNH#.  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26\Security] O%-NBIS  
"Security"=hex:01,00,14,80,a0,00,00,00,ac,00,00,00,14,00,00,00,30,00,00,00,02,\ #S"qu  
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ &:N<Eu\'  
00,00,02,00,70,00,04,00,00,00,00,00,18,00,fd,01,02,00,01,01,00,00,00,00,00,\ %]&2O4mjk  
05,12,00,00,00,00,00,00,00,00,00,1c,00,ff,01,0f,00,01,02,00,00,00,00,00,05,\ ~](tvv:  
20,00,00,00,20,02,00,00,d2,33,bc,8e,00,00,18,00,8d,01,02,00,01,01,00,00,00,\ 6zsFi  
00,00,05,0b,00,00,00,20,02,00,00,00,00,1c,00,fd,01,02,00,01,02,00,00,00,00,\ BR;M5COjM  
00,05,20,00,00,00,23,02,00,00,d2,33,bc,8e,01,01,00,00,00,00,00,05,12,00,00,\ U"*.\C.  
00,01,01,00,00,00,00,00,05,12,00,00,00 \3sb  
Dr`k-m/  
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\exoowk26\Enum] p7K,NBh#V  
"0"="Root\\LEGACY_EXOOWK26\\0000" a6;*%B{*  
"Count"=dword:00000001 M`_$Lke  
"NextInstance"=dword:00000001 y`]iqb"v  
ssT=nF2I  
此病毒文件的查杀和删除办法，参见查杀ALLXUN的办法。 c3#Zj1BA'  
c?t-jzN