W32.Spybot.Worm的問題

[愛跳舞]

我電腦內有個W32.Spybot.Worm這種病毒,刪除不了,我是用WIN2000,我找過NORTON的網站,找不到中文的解決法,只有連結到國外的NORTON站去,但一看到很多字我頭就昏了,找不到真正的解決法,請好心的大大幫幫忙,指點迷津,謝謝!!

這是趨勢的解決方法，也是英文，但是不會很難啦！
http://www.trendmicro.com/vinfo/zh-t...OT.ZA#solution

希望有所助益

解法：（文章太長，沒時間幫您翻譯．．．）

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

１．Disable System Restore (Windows Me/XP).
２．Update the virus definitions.
３．Restart the computer in Safe mode.
４．Run a full system scan and delete all the files detected as W32.　　Spybot.Worm.
５．Delete the value that was added to the registry.
６．Delete any zero-byte files in the startup folder.

For specific details on each of these steps, read the following instructions.

1. Disabling System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
"How to disable or enable Windows Me System Restore"
"How to turn off or turn on Windows XP System Restore"

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

2. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

3. Restarting the computer in Safe mode
Restart the computer in Safe mode. All the Windows 32-bit operating systems, except for Windows NT, can be restarted in Safe mode.

NOTE: The following instructions are basic and can vary slightly depending on the operating system.

If the computer is running, shut down Windows and then turn off the power.
Wait 30 seconds, and then turn on the computer.
Start tapping the F8 key.
When the Startup Menu appears, ensure that the Safe mode option is selected. In most cases, it is the first item in the list and is selected by default. (If it is not selected, use the arrow keys to select it.)
Press Enter. The computer will start in Safe mode. This can take a few minutes.
When you are finished with all the troubleshooting, close all the programs and restart the computer as you normally would.

4. Scanning for and deleting the infected files
Start your Symantec antivirus program and make sure that it is configured to scan all the files.
For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
Run a full system scan.
If any files are detected as infected with W32.Spybot.Worm.
Write down the filenames, and then click Delete.

5. Deleting the value from the registry

CAUTION: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

then click OK. (The Registry Editor opens.)


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete any values that refer to the filename that was detected as infected with W32.Spybot.Worm.


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce


In the right pane, delete any values that reference the filename in step d.


Exit the Registry Editor.

6. Delete the zero-byte files from the Startup Folder
Follow the instructions for your operating system:

NOTE: There may be legitimate files on your system that start with "tftp." Make sure to only delete the zero-byte files from the Startup folder.

Windows 95/98/Me/NT/2000
Click Start, point to Find or Search, and then click Files or Folders.
Make sure that "Look in" is set to (C and that "Include subfolders" is checked.
In the "Named" or "Search for..." box, type, or copy and paste, the file name, tftp*.*
Click Find Now or Search Now.
Delete the files that are zero-bytes and contained within any folder that ends with "Startup."

Windows XP
Click Start, and then click Search.
Click All files and folders.
In the "All or part of the file name" box, type, or copy and paste, the file names tftp*.*
Verify that "Look in" is set to "Local Hard Drives" or to (C.
Click "More advanced options."
Check "Search system folders."
Check "Search subfolders."
Click Search.
Delete the files that are zero-bytes and contained within any folder that ends with "Startup."

[愛跳舞]

剛我也有到NORTON看到樓上大大所貼出來的解法,當我要印出的時後,墨水沒囉,所以....呵呵,不過很感謝幫忙

[愛跳舞]

不過還是很希望能有中文看,看中文比較快啦

[愛跳舞]

其實...最大的問題不是在於我看不懂英文,是在於我進了REGEDIT之後,我找到了指示刪除修改的地方,我找不到Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete any values that refer to the filename that was detected as infected with W32.Spybot.Worm.


Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce


In the right pane, delete any values that reference the filename in step d.


Exit the Registry Editor.

6. Delete the zero-byte files from the Startup Folder
Follow the instructions for your operating system:

我電腦中找不到這個東西啦!! W32.Spybot.Worm.還有驅勢的網站我也看過,我找不到指示修改中的這個eth0 driver = EXEC.EXE ,所以病毒依舊存在,問題也沒解決,有沒好心點的高手大大幫個手啊!!

[GaMNiA]

按 [Ctrl] + [Alt] + [Del] 叫出工作管理員, 看看有沒有 EXEC.EXE 這個程式,
如果有的話, 就給它結束處理程序.
再用檔案總管直接搜尋 EXEC.EXE , 如果有找到就把它殺掉, 試試看吧...

[愛跳舞]

原文由 GaMNiA 所發表
按 [Ctrl] + [Alt] + [Del] 叫出工作管理員, 看看有沒有 EXEC.EXE 這個程式,
如果有的話, 就給它結束處理程序.
再用檔案總管直接搜尋 EXEC.EXE , 如果有找到就把它殺掉, 試試看吧...

還是找不到,有點傷腦

[bruce-yan]

這ㄍ我之前也中過....也把他結束處理程序和刪黨..但沒啥用...ㄑ查查英文字典ㄅ..ㄒㄒ..

[愛跳舞]

原文由 bruce-yan 所發表
這ㄍ我之前也中過....也把他結束處理程序和刪黨..但沒啥用...ㄑ查查英文字典ㄅ..ㄒㄒ..

為何要查英文字典?我看懂啊!只是找不到該刪的檔啊

[bruce-yan]

原文由 muffy2234 所發表
為何要查英文字典?我看懂啊!只是找不到該刪的檔啊

一ㄍ最快ㄉ方法......FDISK.......重灌...

[robert23]

轉貼 趨勢科技
http://www.trendmicro.com/vinfo/zh-t...=WORM_SPYBOT.C

我比較閒∼∼∼∼：P
幫你把重點挑出來翻譯

1.關閉ME跟XP的系統還原功能
2.更新病毒定義檔
3.重新開機進入安全模式
4.執行全系統掃瞄，並且殺掉所有偵測到中W32.Spybot.Worm.的檔案
5.殺掉病毒所增加的登陸檔機碼
6.在啟動資料夾中殺掉所有0位元大小的檔案


至於你說搜尋部分 他的大致上意思是這樣
到搜尋中 搜尋條件打*.* 而且要包含子資料夾
只要是跟啟動有關 符合0位元的檔案或資料夾 通通殺殺殺