CFEDAC5E.dll,CFEDAC5E.dat(Trojan- W.Win32.OnLineGames.mu)的清除方法
日期：2006-12-07 荐：
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
teYqiu【天下无毒】原创文章，转载请标明。http://hi.baidu.com/teyqiu
百度知道反病毒知识专家崔衍渠 授权。 『转载请保留此申明！』
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
本文的眼：IFEO劫持 比比皆是...
实战案例
问题：某同事WL，今天告诉我他的卡巴斯基启动不了，CAD也起不来。过去一看，发现很多EXE点击无反应，即使改成.com后缀也不行。一下就想到了 IFEO劫持，打开注册表一看（还好丫的没屏蔽regedit.exe），蔚为壮观，稍微有些名气的都挂了...如卡巴、瑞星、360safe等，hijackthis.exe也不能幸免。。
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \360rpt.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \360Safe.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \360tray.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \adam.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \AgentSvr.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \A vc32.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \autoru .exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \avgr vc.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \AvMonitor.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \avp.com]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \avp.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \CCenter.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \ccSvcHst.exe]
"Debugger"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\MSINFO\\CFEDAC5E.dat"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Optio \
标签：