LYLOADER.EXE LYMANGR.DLL MSDEG32.DLL病毒解决方案

LYLOADER.EXE LYMANGR.DLL MSDEG32.DLL病毒解决方案
 

技术分析
==========

木马运行后释放另一个exe到临时目录，并将其运行：
%temp%/LYLOADER.EXE
释放两个dll文件注入进程：
%temp%/LYMANGR.DLL
%temp%/MSDEG32.DLL

同事复制到系统目录下：
%system%/LYLOADER.EXE
%system%/LYMANGR.DLL
%system%/MSDEG32.DLL

创建启动项：

[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer/Run]
"MSDEG32"="LYLoader.exe"
"MSDWG32"="LYLoadbr.exe"
"MSDCG32      "="LYLeador.exe"
"MSOG32"="LYLoador.exe"
"MSDSG32"="LYLoadar.exe"
"MSDMG32"="LYLoadmr.exe"
"MSDHG32"="LYLoadhr.exe"
"MSDQG32"="LYLoadqr.exe"

清除步骤
==========

1. 删除启动项(开始菜单－运行－输入“regedit”依次打开以下项,然后删除即可)：

[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer/Run]
"MSDEG32"="LYLoader.exe"
"MSDWG32"="LYLoadbr.exe"
"MSDCG32      "="LYLeador.exe"
"MSDOG32"="LYLoador.exe"
"MSDSG32"="LYLoadar.exe"
"MSDMG32"="LYLoadmr

exe"
"MSDHG32"="LYLoadhr.exe"
"MSDQG32"="LYLoadqr.exe"
2. 重新启动计算机

3. 删除文件(如遇提示无法删除文件，到down.45it.com下载费尔木马强制删除器工具进行强制删除)：
%temp%/LYLOADER.EXE
%temp%/LYMANGR.DLL
%temp%/MSDEG32.DLL
%system%/LYLOADER.EXE
%system%/LYMANGR.DLL
%system%/MSDEG32.DLL