[心得分享] 溫馨提示: 警告所有MSN用戶新病毒 [解決方法]

jwxie518

解決方法已更新請到第一貼的中間看看

我今日上網的時候有朋友突然給我一個file要我下載
但是我知道這肯定是病毒




1. 登入不久馬上第一件事叫你下載大約叫images.zip的檔案
2. 你問他他不會回應你

以前是LINK, 現在改用檔案, 因為大家認為朋友send一個files給你好像沒什麼大不了

這是一個病毒
雖然我沒有下載, 所以我自己沒有去檢驗一下裡面的毒性
但請大家注意一下


另外剛剛去看看學長們的解說
http://www.pczone.com.tw/vbb3/thread/28/135343/


謝謝ed_teck的分享, 我製作了一個教學

網址: http://www.jwxinst.q168.net/msm.htm

1. click on start
2. click on run
3. type "regedit" without the 2 "
4. press enter
5. press the + beside HKEY_LOCAL_MACHINE
6. press the + beside SOFTWARE
7. press the + beside Microsoft
8. press the + beside Windows
9. press the + beside CurrentVersion
10. press the + beside ShellServiceObjectDelayLoad
11. look for "rdfhost" or "rdihost" or "rdshost"
12. click on it
13. press the delete button
14. Restart computer

For #15 and 16, if you're not sure here's the alternative:
15-1. Click on start => run
15-2. type (everything after the -) - cmd
15-2.5 press enter
15-3. in the black window that popped up, type - cd %SYSTEMROOT%
15-3.5 press enter
15-4. type (follow the " marks exactly) - del "photo album.zip"
或者

del "photo img1756.zip"
del "photo images.zip"
del "photo images1756.zip"
del "album.zip"
del "img1756.zip"
del "images.zip"
del "images1756.zip"



15-4.5 press enter
16-1. type - cd system32
16-1.5 press enter
16-2. type (follow the question mark exactly as I placed it) - del rd?host.dll
16-2.5 press enter
16-3 type - exit
16-4 press enter

[ 本帖最後由 jwxie518 於 2007-8-9 12:00 PM 編輯 ]

jwxie518

Backdoor.Win32.SdBot.aad

Aliases
Backdoor.Win32.SdBot.aad (Kaspersky Lab) is also known as: W32/Sdbot.worm.gen.g (McAfee),   W32.Spybot.Worm (Symantec),   BackDoor.IRC.Sdbot.81 (Doctor Web),   W32/Rbot-AFW (Sophos),   Worm/RBot.53487 (H+BEDV),   Backdoor.SDBot.AWE (SOFTWIN),   Exploit.DCOM.Gen (ClamAV),   W32/Sdbot.DZX.worm (Panda)

jwxie518

剛剛用KIS

Kaspersky Internet Security 6.0

The requested URL http://www.pczone.com.tw/vbb3/attach...254.attachment is infected with Backdoor.Win32.SdBot.aad virus


真好用

cchinfatt

开唔到

YUYUME

唔該曬

ed_teck

1. click on start
2. click on run
3. type "regedit" without the 2 "
4. press enter
5. press the + beside HKEY_LOCAL_MACHINE
6. press the + beside SOFTWARE
7. press the + beside Microsoft
8. press the + beside Windows
9. press the + beside CurrentVersion
10. press the + beside ShellServiceObjectDelayLoad
11. look for "rdfhost" or "rdihost" or "rdshost"
12. click on it
13. press the delete button
14. Restart computer
15. Go to your windows directory. delete photo album.zip
16. Go to your system32 direcory. delete rdfhost.dll or rdihost.dll or rdshost.dll
17. Write me a $100 check to thank me.

For #15 and 16, if you're not sure here's the alternative:
15-1. Click on start => run
15-2. type (everything after the -) - cmd
15-2.5 press enter
15-3. in the black window that popped up, type - cd %SYSTEMROOT%
15-3.5 press enter
15-4. type (follow the " marks exactly) - del "photo album.zip"
15-4.5 press enter
16-1. type - cd system32
16-1.5 press enter
16-2. type (follow the question mark exactly as I placed it) - del rd?host.dll
16-2.5 press enter
16-3 type - exit
16-4 press enter

應該係類似的病毒, 不過唔算是新病毒.
症狀: 有朋友會send 個zip file 俾你, 並且會messenger 你話係佢的相.
如果你按 receive, 唔會有事(最好當朋友send 野俾你事問清楚是否有send 野俾你)
你unzip 後click 只file 就會領野(中毒)...
中毒後如果你唔開msn 就冇事, 如果你開就會hang 機 + 開始傳送個病毒俾你list 內的朋友

大家可以嘗試以上的方法, 我中過亦用以上的方法解決了.

bioo

thank you

jwxie518

更新了新增教學

g84527236

謝謝你阿:014:

16649

THANK

kingjames

thx 4 sharing

kingjames

nice yo

NWL86

我之前已经领教过了！
但是因为不会清除，
只好忍痛 reformat pc...

force2992

thanks

z0012854

想問現時來說 用Kaspersky Internet Security 6.0 or 7.0 好