Infected with assumer.exe, using image hijacking, shellexechook... The AV killer grhsgih. exe2

Infected with assumer.exe, using image hijacking, shellexechook... The AV killer grhsgih. exe2

EndurerOriginal
2008-01-201Version

From the log of pe_xscan, the tactics used by this AV killer are as follows:

Shard 1
Http://blog.csdn.net/Purpleendurer/archive/2008/01/07/2029442.aspx
Http://endurer.bokee.com/6595295.html
Http://blog.nnsky.com/blog_view_266928.html
Http://blog.sina.com.cn/s/blog_49926d910100859d.html

Similar, but two more moves:

Disable copy/paste
Infectious diseases: assumer.exe

Download the drweb cureit program that has always been good at dealing with infectious malware! Back up, download icesword, hijackthis from the http://endurer.ys168.com, download fileinfo and bat_do from the http://endurer.ys168.com, And Then disconnect the network cable.
Open Registry Editor regedit.exe and delete the items corresponding to o23, o24, and O26.
Running icesowrd is also disabled by the simulated buttons of malicious programs.
Run hijackthis and open the built-in process management tool to terminate the malicious process. However, after the termination, the process is reborn.
Therefore, hijackthis is used to repair F1, F2, O1, O2, and O4 items first.

Use fileinfo to extract the information of the red files displayed in the log, and add these files to bat_do. After the backup is packaged, the files will be deleted in a delayed manner ~

Run drweb cureit! Scan. First, the system prompts that assumer.exe is infected, and the repair operation is selected ...... Then drweb cureit! It is also disabled by virus processes ~ Run drweb cureit again !, After scanning for a while, it was disabled again ......
Or clear the temporary ie cache, the temporary system folder, and restart the computer ......
First try to enter safe mode, the result is a blue screen error, or start in normal mode.
Kingsoft drug overlord monitoring center icon appears again in the system tray area, copy/paste is also back to normal ~

Run drweb cureit again! Scanning and scanning ...... Wait until the scan is completed. It's time to go to work ~

Later, my friend said drweb cureit via QQ! More than 2000 scans/fixes ......

Ask the netizen to use icesword to check the red files displayed in the log. If yes, force the files to be deleted. Then run the: SFC/scannow command to repair the system files ......