又中了KAVO的變種病毒(jwedsfdo0.dll)

ps.小弟推薦用新的方法,簡單又快速!
今天幫老爸換PC,基本裝好後,當然要裝防毒程式啦!誰知道一裝好就抓到jwedsfdo0.dll,在網路上找了一下,以下是解毒的方法:
Step 1.將以下的CODE貼到記事本

@echo off

title 清除kavo及同類型變種 XP版 (2008/08/09更新)

set A=C D E F G H I J K L M N O P Q R S T U V W X Y Z

set T=這個資料夾是用來防止病毒寫入的「請勿刪除！」怪貓...

echo 開始解除kavo木馬病毒，請按下任意鍵...

echo 請按任意鍵繼續.........

pause >nul 2>nul

rem 刪除個磁碟中的autorun.inf的自動執行檔，並建立同名的資料夾，用以防止病毒寫入，屬性改成「唯讀、隱藏、系統」

for %%x in (%A%) do (

if exist %%x:\autorun.inf attrib -r -s -h -a %%x:\autorun.inf >nul 2>nul

del %%x:\autorun.inf /q /f >nul 2>nul

if not exist %%x:\AUTORUN.INF md %%x:\AUTORUN.INF >nul 2>nul

attrib +r +s +h %%x:\AUTORUN.INF >nul 2>nul

echo %T%> %%x:\AUTORUN.INF\README.TXT

cls)

rem 病毒感染用的檔案刪除完成

echo.

rem 關閉正在使用病毒檔的程式(工作列會消失一陣子)

start /wait taskkill /f /im explorer.exe

start /wait taskkill /f /im wuauclt.exe

echo.

rem 刪除登錄檔中KAVO病毒的起動值

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "jvsoft" /f >nul 2>nul

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "tasoft" /f >nul 2>nul

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "kava" /f >nul 2>nul

reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "tava" /f >nul 2>nul

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "tasa" /f >nul 2>nul

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "mnsa" /f >nul 2>nul

echo.

rem 將被鎖定的隱藏檢視功能開啟(登錄檔)

reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" /v "CheckedValue" /t REG_DWORD /d 00000001 /f >nul 2>nul

reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 00000001 /f >nul 2>nul

reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 00000001 /f >nul 2>nul

reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks" /v "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" >nul 2>nul

rem 已修復無法開啟檢視隱藏檔的功能，有需要請到資料夾中的資料夾選項去開啟檢視隱藏的功能，不需要就別開

echo.

rem 刪除kavo的病毒主程式及建立防毒用的資料夾

echo.

for %%z in (

J3EWRO.EXE

JWEDSFDO0.DLL

KAVO.EXE

KAVO0.DLL

KAVO1.DLL

KAVO2.DLL

TAVO.EXE

TAVO0.DLL

JVVO.EXE

JVVO0.DLL

KXVO.EXE

KXVO0.DLL

KXVO1.DLL

) do (

attrib -s -h -r "%windir%\system32\%%z" >nul 2>nul

echo.

echo.

del "%windir%\system32\%%z" >nul 2>nul

if not exist "%windir%\system32\%%z" md "%windir%\system32\%%z" >nul 2>nul

attrib +s +h +r "%windir%\system32\%%z"

echo %T% > "%windir%\system32\%%z\README.TXT")

cls

Step 2.存在C:底下(del.bat)
Step 3.用cmd模式執行del.bat,如此即可將其刪除
資料來源:http://tw.myblog.yahoo.com/jw!ljyxR6.BFU.mrG8YGw--/article?mid=107&prev=668&next=7