如何清洗和去除Trojan.Win32.Obfuscated.gx、Trojan.Win32.agent.akk、Trojan.Zlob和等。

系統常數提示「關鍵系統錯誤!」 突然出現消息認為「您的瀏覽器由Trojan.Win32.Obfuscated.gx傳染。 您在其他案件需要立刻清洗它可以很快被碰撞的您的系統，! 點擊OK下載高技術antispyware保護軟件! (推薦)」。 流行音樂在網頁在Windows Explorer時任意地出現，例如，當打開URL使用IE，點擊在一個鏈接或點擊在一個文件項目。

如果用戶`傳染了』點擊好按鈕下載高技術antispyware去膜劑，一可執行以文件名字作為防禦者install.exe將被提供。 在旁邊， Google，雅虎! 并且窗口活查尋結果也許也被劫機點擊在鏈接在查尋結果將指揮用戶到不正確和引入歧途的網站而不是意欲的站點的地方。 壞所有，傳染報警信息也許也是出現於查尋結果頁。

Trojan.Win32.Obfuscated.gx (能也通認作為Trojan.Win32、Trojan.Win32.agent.akk、Trojan.Zlob、Trojan.Zlob-X.a、Trojan.Win32.LinkReplacer、Trojan.Win32.StarField、Trojan.Win32.Startpage.fq、Trojan.Agent、Trojan.Win32.Gorshok.a、Worm.Win32.Sober、Trojan.Vundo、Trojan.KillAV、Trojan.Win32.Patched、Trojan.Win32.CP4000、特洛伊人Win32/Qoologic，特洛伊人Win32.Murlo和其他未知的特洛伊人)單獨實質上不是病毒，反而是一個惡意把戲由新的凶惡anti-spyware節目例如IE防禦者或文件安全通過顯示一精讀用戶特洛伊人被列出以上成他們的掃描結果在假系統安全戒備，誤引和欺騙用戶入下載和隨後支付買凶惡antispyware節目簡單地去除他們在用戶』計算機種植的特洛伊人。

Trojan.Win32.Obfuscated.gx特洛伊人或malware能通過安裝請求安裝當演奏錄影時，成人通常滿意和性從P2P下載的明確錄影分享站點或洪流，例如臭名昭著的愛迪生・陳性相片醜聞的一臺假錄影編解碼器傳染計算機。

有各種各樣的方式安全地去除Trojan.Win32.Obfuscated.gx， Trojan.Win32、Trojan.Win32.agent.akk或者Trojan.Zlob。 多數新的抗病毒和anti-spyware節目更新與最新的署名應該能查出和刪除和電腦程式內的病毒。 如果您的反病毒程序不適當地做它的工作，這手工撤除指示從您的系統安全地和容易地清洗和去除Trojan.Win32.Obfuscated.gx蹤影。

1. 點擊 開始菜單 按鈕，然後點擊 控制板 選擇，在然後雙擊 增加或去除節目 像或 卸載節目 鏈接。
2. 位於 Trojan.Win32.Obfuscated.gx (或它的相關不同的名字)和雙擊對卸載特洛伊人的此。 跟隨逐步在屏幕指示完成特洛伊人的卸載。 If the Trojan.Win32.Obfuscated.gx is not found as one of the uninstallation item, step to step 5.
3. Restart the computer when prompted.
4. System will continue uninstalling the Trojan. When uninstallation completed, exit “Add or Remove Programs” and “Control Panel” or “Programs and Features” folder.
5. Close all programs, especially Internet Explorer and Windows Explorer.
6. Run Registry Editor (regedit.exe), and then search and delete all of the following infected entries in registry:

   7d4b39e4cab018496e2fe9bf9c3234b2
   69c9be662f7f284aae171adeb136cb24
   1bc5752bd72f44f004d9f061dd7f9e00
   bcf3a381bbe26d9c1ec24bac8b18f567
   8266c79a434aed795a5f3f7abb0aff0d
   696ce23305a35bb118afc42d58845791
   2982068d063848ddb0b8029750411a84
   fe6e6a62a572e84e9eaee12eb3ee8a2b
   1057a2dcd13130963be0a51c41dc4d1c
   396955766b2e512bc3545a24bc485dbe
   5f9523529ce2cac480acbda2b8bf4e1e
   7df5417b22988d88e8080a44392ade95
   cbdc7b3033e82c2065a1b48061b2ca01
   6d3c4dbecf4aaf1ae826a0a7edde5951
   e05997f932f826f0271cf32d00bbd3be
   c18c3b4771120703624baaf835feecd8
   9ceecf911241c9890541167edf53739f
   40613dee6ad5fec910606c25b25262fd
   3ba096caa45ab117721e725079cc53a1
   bb5be1c92c299a1c6bcfe67655b0a0c7
   9a9f57899a28547b04fc2da3700c95cf
   7a329404de21925daacbbbee093ff6dc

7. Open Task Manager (taskmgr.exe) and terminate any Trojan.Win32.Obfuscated.gx (or its variant) process.
8. Find and locate the path to the following Trojan infected files. Unregister these DLLs with command below at command prompt, and then rename the infected DLL files as BADFILE1.DLL, BADFILE2.DLL, BADFILE3.DLL and so on:

   Command to unregister DLL (Run the command in the folder which contain the DLL by using “cd” to change directory):

   regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister listed below)

   Trojan infect DLLs:

   mlljh.dll
   ibpmxtbv.dll
   ljjhedc.dll
   cabvie.dll
   windivx.dll
   ddayv.dll
   vkcxxfvi.dll
   ssqpo.dll
   stream32a.dll
   vipextqtr.dll
   ecxwp.dll
   gebca.dll
   ddcdedd.dll
   advpac.dll
   tdlRMS.dll
   lcxmehhg.dll
   hdbxuqje.dll
   mljge.dll
   ddcbyvt.dll
   advrepkon.dll
   ddccd.dll
   sgqddvym.dll
   pofwjina.dll
   bkfgnqhm.dll
   orkbobob.dll
   tuvttrr.dll
   cpwvehup.dll
   enhtb.dll

   Note: If you unable to delete or rename the files, try to restart computer in and boot in safe mode to try again.

9. Go to C:\Program Files\ folder and delete the “IE Defender” folder, if found.

   Note: If you unable to rename the files, try to restart computer in and boot in safe mode to try again.

10. Restart computer.
11. If no problem exists, delete all “BADFILE*.DLL” which renamed from infected DLLs.
12. If IE homepage has been changed or hijacked, go to Start -> Control Panel -> Internet Options, click on the General tab, and then click Use Default under Home Page. Type in the new desired default homepage, then click Apply or OK button. Open a new web browser to check that IE displays the desired default homepage.
13. To remove Trojan.Win32.Obfuscated.gx or its variant icons from the Desktop, simply delete them or drag and drop thems to the Recycle Bin.

Trojan.Win32.Obfuscated.gx is now completely removed and cleaned from the system. If you prefer a more automated way to delete the virus, use SmithfraudFix or follow guide below to use FixIEDef that specifically removes AntiSpyPro, Files Secure, and IEDefender and thus eliminates the “Fake Alerts” generated by Trojan-Downloader.Win32.Delf. FixIEDef also removes Trojan-Downloader.Win32.Delf from the system.

1. Download FixIEDef.exe by ShadowPuterDude to the Desktop.

   Note that FixIEDef.exe must be saved to desktop or it may not work properly.

2. Double-click FixIEDef on desktop.

   

3. Click OK.

   

4. Click Scan! to start scanning the system for trace of Trojan.Win32.Obfuscated.gx and related Trojans.

   

5. Click OK.

   

6. Wait for the scanning process to finish. Both file system and registry will be scanned.

   
   

   Note that FixIEDef will kill all copies of Internet Explorer and Explorer that are running, during removal of malicious files. The icons and Start Menu on your Desktop will not be visible while FixIEDef is removing malicious files. This is necessary to remove parts of the infection that would otherwise not be removed.

7. Click Exit once FixIEDef displays the “All Finished” message.

   

8. All FixIEDef log will be posted on the desktop. Review the content of the log if needed.

If you’re using HijackThis, there is also a how-to guide to get rid of “IE Defender” or “Files Secure” with HijackThis at Lavasoft Support forum.

IMPORTANT: You're reading a machine translated page which is provided "as is" without warranty. Unlike human translation, machine translation does not understand the grammar, semantics, syntax, idioms of natural language, thus often produce inaccurate and low quality text which is misleading and incomprehensible. Thus, please refer to original English article whenever possible.

MDL blog postings now continue at Tip and Trick, and readers are welcome to join My Digital Life Forums.

Related Articles

• Don’t Get Infected by Trojan.Zlob When Browsing Edison Chen Sex Scandal Photo
• Beware of Spyware While Browsing Edison Chen’s Sex Scandal Photos
• Remove or Hide Windows Live Messenger Tabs
• Recover and Reclaim ‘Lost’ Disk Space After Installing Windows Vista Service Pack 1 (SP1)
• How to Recover a Soaked Cell Phone
• Windows Defender Review by Spyware Confidential
• Download RED (Remove Empty Directories) for Windows PC
• Remove Ads from Windows Live Messenger with A-Patch and Customize Messenger Options and Visualisation
• Unable to Clean Install Windows Vista with Upgrade Edition Product Key
• Remove USB Devices with USB Disk Ejector 1.1.2 with a Single Mouse Click (Excerpt)

This entry was posted on Saturday, February 16th, 2008 at 10:21 pm and is filed under Security. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.