中了host.exe这个病毒,我该怎么办?
发布网友
发布时间：2022-04-23 18:37
共2个回答
热心网友
时间：2023-07-12 04:12
temp2进程(如果人物管理器中没有，则跳过这一步);然后依次进入:"工具-文件夹选项-查看"，去掉"隐藏受保护系统文件"和选取"显示所有文件"前面的钩;电机右键选择"打开"进入所有硬盘盘符，删掉:
autorun.inf copy.exe host.exe ,进入C:\windows ,删掉
xcopy.exe和svchost.exe ，不要担心，这两个不是系统文件，而是病毒----真正的文件在system32里面。
进入C:\windows\system32 ,删除temp1.exe和temp2.exe; 在注册表中"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\Current Version\Windows"，删除Load字符串值，或打开清空里面的内容"C:\Windows\svchost.exe" 。这样就解决问题了，最后重新启动电脑。
热心网友
时间：2023-07-12 04:12
if exist c:\autorun.inf attrib c:\autorun.inf -a -r -s -h
if exist d:\autorun.inf attrib d:\autorun.inf -a -r -s -h
if exist e:\autorun.inf attrib e:\autorun.inf -a -r -s -h
if exist f:\autorun.inf attrib f:\autorun.inf -a -r -s -h
if exist g:\autorun.inf attrib g:\autorun.inf -a -r -s -h
if exist h:\autorun.inf attrib h:\autorun.inf -a -r -s -h
if exist i:\autorun.inf attrib i:\autorun.inf -a -r -s -h
if exist c:\copy.exe attrib c:\copy.exe -a -r -s -h
if exist d:\copy.exe attrib d:\copy.exe -a -r -s -h
if exist e:\copy.exe attrib e:\copy.exe -a -r -s -h
if exist f:\copy.exe attrib f:\copy.exe -a -r -s -h
if exist g:\copy.exe attrib g:\copy.exe -a -r -s -h
if exist h:\copy.exe attrib h:\copy.exe -a -r -s -h
if exist i:\copy.exe attrib i:\copy.exe -a -r -s -h
if exist c:\host.exe attrib c:\host.exe -a -r -s -h
if exist d:\host.exe attrib d:\host.exe -a -r -s -h
if exist e:\host.exe attrib e:\host.exe -a -r -s -h
if exist f:\host.exe attrib f:\host.exe -a -r -s -h
if exist g:\host.exe attrib g:\host.exe -a -r -s -h
if exist h:\host.exe attrib h:\host.exe -a -r -s -h
if exist i:\host.exe attrib i:\host.exe -a -r -s -h
if exist %systemroot%\system32\temp1.exe attrib %systemroot%\system32\temp1.exe -a -r -s -h
if exist %systemroot%\system32\temp2.exe attrib %systemroot%\system32\temp2.exe -a -r -s -h
if exist %systemroot%\xcopy.exe attrib %systemroot%\xcopy.exe -a -r -s -h
if exist %systemroot%\system32\svshost.exe attrib %systemroot%\system32\svshost.exe -a -r -s -h
f exist c:\copy.exe del c:\copy.exe
if exist d:\copy.exe del d:\copy.exe
if exist e:\copy.exe del e:\copy.exe
if exist f:\copy.exe del f:\copy.exe
if exist g:\copy.exe del g:\copy.exe
if exist h:\copy.exe del h:\copy.exe
if exist i:\copy.exe del i:\copy.exe
if exist c:\host.exe del c:\host.exe
if exist d:\host.exe del d:\host.exe
if exist e:\host.exe del e:\host.exe
if exist f:\host.exe del f:\host.exe
if exist g:\host.exe del g:\host.exe
if exist h:\host.exe del h:\host.exe
if exist i:\host.exe del i:\host.exe
if exist c:\autorun.inf del c:\autorun.inf
if exist d:\autorun.inf del d:\autorun.inf
if exist e:\autorun.inf del e:\autorun.inf
if exist f:\autorun.inf del f:\autorun.inf
if exist g:\autorun.inf del g:\autorun.inf
if exist h:\autorun.inf del h:\autorun.inf
if exist i:\autorun.inf del i:\autorun.inf
if exist %systemroot%\system32\temp1.exe del /f /s /q %systemroot%\system32\temp1.exe
if exist %systemroot%\system32\temp2.exe del /f /s /q %systemroot%\system32\temp2.exe
if exist %systemroot%\xcopy.exe del %systemroot%\xcopy.exe
if exist %systemroot%\svshost.exe del %systemroot%\svshost.exe
把上面的东西保存在del的文本文件里，把扩展名改成bat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="@shell32.dll,-30499"
"Type"="group"
"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
00
"HelpID"="shell.hlp#51131"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"
把上面的东西保存成hidden.reg
然后运行就好了
其实上面的那个人是对的
