中毒了 ( w32.sbybot.exe)

[E7317123]

請問各位大大
norton 說有個病毒w32.sbybot.exe
卻無法移除
應怎麼移除?

[E7317123]

c:\windows\system\svchost.exe
無法刪除
安全模式也無法刪除
有哪為大大幫個忙吧

[HERO]

http://securityresponse.symantec.com...ybot.worm.html
The following instructions pertain to all current and recent Symantec antivirus
products, including the Symantec AntiVirus and Norton AntiVirus product lines.


Disable System Restore (Windows Me/XP).
關閉系統還原
Update the virus definitions.
更新病毒定義檔
Restart the computer in Safe mode or VGA mode.
在安全模式或VGA模式下啟動電腦
Run a full system scan, and delete all files that are detected as
W32.Spybot.Worm.
使用完整系統掃描並刪除被感染的檔案
Delete the value that was added to the registry.
刪除登錄檔
Delete any zero-byte files in the Startup folder.
刪除在啟動資料夾內 任何大小為 0 的檔案


To delete the value from the registry

WARNING: Symantec strongly recommends that you back up the registry before
making any changes to it. Incorrect changes to the registry can result
in permanent data loss or corrupted files. Modify the specified keys
only. Read the document, "How to make a backup of the Windows registry
," for instructions.
警告: 請先備份你的登錄檔

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit
按 開始 >> 執行 >> regedit

then click OK. (The Registry Editor opens.)


刪除登錄檔

Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete any values that refer to the file name that was
detected as infected with W32.Spybot.Worm.

刪除在 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 內
任何遭受感染檔案值值
Navigate to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce
同上
Navigate to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
同上
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
同上

Exit the Registry Editor.


刪除在啟動資料夾內 任何大小為 0 的檔案

使用搜尋搜尋 "tftp*.*"
注意: 請打開搜尋子資料夾及系統檔和隱藏檔的選項
刪除任何搜尋到並且在 ....\Startup 資料夾下的檔案

-----------------------------2-----------------------------------------

1.進入安全模式
2.如果你有賽門鐵克防毒軟體將他啟動執行全部掃描
3.如果發現該病毒將它刪除
4.按開始鍵-->執行-->輸入regedit
5.接著按確定.會出現登錄編輯程式視窗
6.依下列瀏覽樹狀資料夾找到該位置:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
7.在這個地方,刪除任何有關W32.Spybot.Worm.的檔案
8.依下列瀏覽樹狀資料夾找到該位置:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
9.在這個地方,刪除任何可疑的檔案.正常應該只有一個預設值 REG_SZ
10.離開登錄編輯畫面
11.刪除開始-->啟動資料夾裡的zero-byte檔案
注意:任何在開始--->啟動--->任何關於zero-byte檔案一定要刪除
最後:
開始-->搜尋--->C:\-->所有資料夾-->名稱-->tftp*.*
如果有找到將他刪除