诺顿查出W32.Arpiframe病毒删不了怎么办 无限重启抗不住叻``帮帮忙!
发布网友
发布时间：2022-09-25 17:56
共4个回答
热心网友
时间：2023-09-19 19:45
不知道你的机子有没有DOS通道，如果有的话就尝试在DOS下DEL 删除那个病毒文件。若没有DOS通道，重装系统
附：W32.Arpiframe病毒分析
Writeup By: Elia Florio
Discovered: June 12, 2007
Updated: June 13, 2007 2:11:12 AM
Type: Worm
Infection Length: 737.2380 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
CVE References: CVE-2006-0003, CVE-2007-1215
Once executed, the worm drops the following files:
* %System%\wuclmi.exe (a hacktool)
* %System%\sevices.exe (a copy of wuclmi.exe)
* %System%\wincfg.exe (WinPCap libraries installer)
* %System%\capinstall.exe (a copy of wincfg.exe)
Next, the worm runs the file %System%\capinstall.exe in the background to install WinPCap libraries on the compromised computer. The installer will create some of the
following clean files:
* %System%\daemon_mgm.exe
* %System%\NetMonInstaller.exe
* %System%\npf_mgm.exe
* %System%\rpcapd.exe
* %System%\wpcap.dll
* %System%\Packet.dll
* %System%\pthreadVC.dll
* %System%\WanPacket.dll
* %System%\drivers\npf.sys
The worm waits until installation is finished and then it deletes the file %System%\capinstall.exe.
The worm then gathers the local subnet address, such as 192.168.1.x, and runs an ARP-poisoning attack on the local network to infect other computers. The attack uses WinPCap
libraries to inject the following malicious IFRAME code into HTTP traffic of the local network:
[http://]1234.89111.cn/woya[REMOVED]
The malicious IFRAME will be injected in Web pages viewed by other computers connected to the same local network. The IFRAME forces those computers to download the following
exploits for Internet Explorer:
* [http://]www.if56.cn/ad.[REMOVED] (Microsoft Windows Graphics Rendering Engine GDI Local Privilege Escalation Vulnerability (BID 23273))
* [http://]1234.89111.cn/[REMOVED] (Microsoft MDAC RDS.Dataspace ActiveX Control Remote Code Execution Vulnerability (BID 17462))
The exploits may download a copy of the worm or some additional malware.
It has been reported that W32.Arpiframe installs a copy of W32.Drom downloaded from the following URLs:
* [http://]down.if56.cn/abc[REMOVED]
* [http://]down.if56.cn/avp[REMOVED]
一旦运行，这个蠕虫释放以下文件：
* %System%\wuclmi.exe 黑客工具
* %System%\sevices.exe wuclmi.exe的拷贝
* %System%\wincfg.exe Winpcap运行库安装程序
* %System%\capinstall.exe Wincfg的拷贝
接下来，这个蠕虫在后台运行%System%\capinstall.exe，在受感染的系统上，安装Winpcap运行库。安装程序将创建以下的一些干净文件：
* %System%\daemon_mgm.exe
* %System%\NetMonInstaller.exe
* %System%\npf_mgm.exe
* %System%\rpcapd.exe
* %System%\wpcap.dll
* %System%\Packet.dll
* %System%\pthreadVC.dll
* %System%\WanPacket.dll
* %System%\drivers\npf.sys
这个蠕虫等待直到安装完成，然后它删除%System%\capinstall.exe这个文件
然后这个蠕虫收集本地子网地址，例如192.168.1.x，在本地网络上运行ARP欺骗攻击影响其他计算机。这个攻击使用Winpcap库对本地网络的HTTP数据包里注入以下有毒的IFRAME代码。
[http://]1234.89111.cn/woya[REMOVED]
这个恶意代码将注入链接在同一个局域网中的其他电脑浏览的WEB页，这个IFRAME强迫那些电脑下载以下Internet Explorer的漏洞利用代码。
* [http://]www.if56.cn/ad.[REMOVED] (Microsoft Windows Graphics Rendering Engine GDI Local Privilege Escalation Vulnerability (BID 23273))
* [http://]1234.89111.cn/[REMOVED] (Microsoft MDAC RDS.Dataspace ActiveX Control Remote Code Execution Vulnerability (BID 17462))
这个漏洞将下载下载这个蠕虫的COPY或者一些其他病毒
有反馈，它是W32.Drom下载者从以下地址下载的一个拷贝。
* [http://]down.if56.cn/abc[REMOVED]
* [http://]down.if56.cn/avp[REMOVED]
热心网友
时间：2023-09-19 19:46
2.换种杀毒软件查杀
热心网友
时间：2023-09-19 19:46
防病毒软件一定要用正版的。
热心网友
时间：2023-09-19 19:47
