Aaa00.sys,Worm.Agent.ez.34304清除

Worm.Agent.ez.34304是一个蠕虫盗号者。会在磁盘中释放出文件，会修改注册表，会创建盗号系统服务。

在磁盘中释放出以下文件:
C:\WINDOWS\System32\WinNt32.dll
C:\WINDOWS\System32\drivers\Aaa00.sys

在注册表中创建了以下信息:
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32"
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Aaa00.sys"
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\Aaa00.sys"
"HKLM\System\CurrentControlSet\Services\Aaa00"

在注册表中设置了以下信息:
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "DLLName" "WinNt32.dll"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "StartShell" "WLEventStartShell"
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "Impersonate" ""
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinNt32" "Asynchronous" ""
"HKLM\System\CurrentControlSet\Services\Aaa00" "ImagePath" "C:\WINDOWS\System32\drivers\Aaa00.sys"
"HKLM\System\CurrentControlSet\Services\Aaa00" "DisplayName" ""

病毒会连接作者指定的网址:
http://www.g****e.com/search?q=free video
域名:"www.g****e.com" 端口:80 (TCP)
www.g****e.com/search?q=free

在系统中创建了以下服务:
服务名: "Aaa00 (NULL)"
映像路径: "C:\WINDOWS\System32\drivers\Aaa00.sys"

推荐安装金山毒霸正版的杀毒软件进行全面监控，防范日益增多的病毒