中医师承考试题库:CWS.LoadAdv.400.2924

间谍软件CWS.LoadAdv.400

检测和删除
手工删除
按照以下步骤从您的机器删除 CWS.LoadAdv.400。先备份您的注册表和系统，并设置一个还原点，防止发生错误。
停止运行进程:
利用任务管理器停止以下运行进程：
3.exe
adkhmhmd.exe
desktop.exe
dima.exe
hammer.exe
kl.exe
loadadv400.exe
ms1.exe
ms2.exe
ms3.exe
paytime.exe
sachostb.exe
sachostc.exe
sachosts.exe
sachostx.exe
spanner.exe
spysheriff.exe
tibs.exe
tmpf00.exe
tool2.exe
uninstall.exe

删除自动运行的引用:
访问 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

如果找到以下值
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\desktop
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\paytime
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\sninstall
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\windows installer
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\desktop
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\paytime
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sysmemory manager
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices\desktop

立即删除并重启机器。

撤消 DLL 的注册:
使用 Regsvr32 撤销以下 DLLs 的注册，然后重启：
appwiz.dll
cz.dll
desktop.dll
iesecurity.dll
msvcrl.dll
procmon.dll
tcpg4t.dll
winacpi.dll
winld32.dll
wins32.dll

清除注册表:
使用注册表编辑器清除以下注册项（如果存在）：
HKEY_CLASSES_ROOT\appid\{78364d99-a640-4ddf-b91a-67eff8373045}
HKEY_CLASSES_ROOT\clsid\{5e2121ee-0300-11d4-8d3b-444553540000}
HKEY_CLASSES_ROOT\clsid\{78364d99-a640-4ddf-b91a-67eff8373045}
HKEY_CLASSES_ROOT\interface\{5e2121ed-0300-11d4-8d3b-444553540000}
HKEY_CLASSES_ROOT\typelib\{5e2121e1-0300-11d4-8d3b-444553540000}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\desktop
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\paytime
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\sninstall
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\windows installer
HKEY_CURRENT_USER\software\mzs
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{78364d99-a640-4ddf-b91a-67eff8373045}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\desktop
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\paytime
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sysmemory manager
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices\desktop
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msudp4
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\vdmt16
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\winlow

删除文件:
使用资源管理器删除以下文件（如果存在）：
3.exe
adkhmhmd.exe
appwiz.dll
attrib.ini
base.avd
cz.dll
desktop.dll
desktop.exe
desktop.html
dima.exe
fltr.a3d
hammer.exe
hosts
hz.sys
i.a3d
iesecurity.dll
install.dat
kl.exe
loadadv400.exe
ms1.exe
ms2.exe
ms3.exe
msudp4.sys
msvcrl.dll
p2.ini
paytime.exe
procmon.dll
ps.a3d
redir.a3d
sachostb.exe
sachostc.exe
sachosts.exe
sachostx.exe
spanner.exe
spysheriff.dvm
spysheriff.exe
ssl
tcpg4t.dll
tibs.exe
tmp.edb
tmpf00.exe
tnfl.a3d
tool2.exe
uninstall.exe
winacpi.dll
winld32.dll
winlow.sys
wins32.dll

详细介绍请参阅：
http://www.kill.com.cn/security_serve/security_Spyware/1983.asp