TGFC Lifestyle - Powered by Discuz! Board

标题: 关于win7+security [打印本页]

作者: bingsui2131 时间: 2011-4-19 10:22 标题: 关于win7+security

posted by wap, platform: Nokia (E5)

昨天上网突然弹出win7+security说是发现威胁禁止我上网，除非购买完整版。。。关也关不掉。。。现在网也不能上了。有办法关掉这个软件么？

作者: GioGio 时间: 2011-4-19 14:10

什么security？MSE？

作者: bingsui2131 时间: 2011-4-19 17:42

posted by wap, platform: Nokia (E5)

win7+security+2011,可能是我nod32过期了，它就趁需而入。

作者: GioGio 时间: 2011-4-19 18:06

哦。。。我知道了，那个伪装成杀毒软件的东西。
google了一下：
1.关闭进程：
pw.exe
MSASCui.exe
2.删注册表：
HKEY_CURRENT_USER\Software\Classes\pezfile
HKEY_CLASSES_ROOT\pezfile
HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CURRENT_USER\Software\Classes\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CLASSES_ROOT\.exe\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_CLASSES_ROOT\pezfile\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "%1" %*
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command "(Default)" = "%UserProfile%\Local Settings\Application Data\pw.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "AntiVirusOverride" = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center "FirewallOverride" = "1"
3.删文件：
%UserProfile%\Local Settings\Application Data\pw.exe
%UserProfile%\Local Settings\Application Data\MSASCui.exe
%UserProfile%\AppData\Local\pw.exe
%UserProfile%\AppData\Local\MSASCui.exe

作者: GioGio 时间: 2011-4-19 18:09

google上很多地方都提到用一个叫Spyware Doctor的软件可以自动清理。我没用过，仅供参考。

作者: bingsui2131 时间: 2011-4-19 19:56 标题: 回复 5# 的帖子

是骗钱的吧。。。。一直让付款。我把nod续费了。能干掉他么？不能我再手动

欢迎光临 TGFC Lifestyle (http://bbs.tgfcer.com/)