中木马了,请问这样可以清除吗? ( 积分: 200 )

今天家里的电脑又中了<br>哎，散了吧

怎么回事,我结贴了呀<br>再结一次吧<br>随意分了

FREELIBRARY我没试过&nbsp;我自己写的一个键盘记录木马也是用DLL插入EXPLORER<br><br>以下是我的清除程序&nbsp;&nbsp;很粗糙&nbsp;希望有用吧<br><br>function&nbsp;KillTask(ExeFileName:&nbsp;string):&nbsp;Integer;<br>const<br>&nbsp;&nbsp;PROCESS_TERMINATE&nbsp;=&nbsp;$0001;<br>var<br>&nbsp;&nbsp;ContinueLoop:&nbsp;BOOL;<br>&nbsp;&nbsp;FSnapshotHandle:&nbsp;THandle;<br>&nbsp;&nbsp;FProcessEntry32:&nbsp;TProcessEntry32;<br>begin<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;FSnapshotHandle&nbsp;:=&nbsp;CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,&nbsp;0);<br>&nbsp;&nbsp;FProcessEntry32.dwSize&nbsp;:=&nbsp;SizeOf(FProcessEntry32);<br>&nbsp;&nbsp;ContinueLoop&nbsp;:=&nbsp;Process32First(FSnapshotHandle,&nbsp;FProcessEntry32);<br>while&nbsp;Integer(ContinueLoop)&nbsp;&lt;&gt;&nbsp;0&nbsp;do<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;((UpperCase(ExtractFileName(FProcessEntry32.szExeFile))&nbsp;=<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;UpperCase(ExeFileName))&nbsp;or&nbsp;(UpperCase(FProcessEntry32.szExeFile)&nbsp;=<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;UpperCase(ExeFileName)))&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;Integer(TerminateProcess(OpenProcess(PROCESS_TERMINATE,BOOL(0),FProcessEntry32.th32ProcessID),0));<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ContinueLoop&nbsp;:=&nbsp;Process32Next(FSnapshotHandle,&nbsp;FProcessEntry32);<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;CloseHandle(FSnapshotHandle);<br>end;<br><br>function&nbsp;WindowsDirectory:&nbsp;string;<br>&nbsp;&nbsp;var<br>&nbsp;&nbsp;&nbsp;&nbsp;WinDir:&nbsp;array&nbsp;[0..MAX_PATH]&nbsp;of&nbsp;char;<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;GetWindowsDirectory(WinDir,&nbsp;MAX_PATH);<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;WinDir;<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Result[Length(Result)]&nbsp;&lt;&gt;&nbsp;'/'&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;Result&nbsp;+&nbsp;'/';<br>end;<br><br><br>procedure&nbsp;TForm1.Button1Click(Sender:&nbsp;TObject);<br>begin<br>if&nbsp;fileExists(WindowsDirectory+'_ice_.exe')&nbsp;&nbsp;then<br>begin<br>RegDeleteKey(HKEY_LOCAL_MACHINE,&nbsp;'SOFTWARE/Microsoft/Active&nbsp;Setup/Installed&nbsp;Components/{D7BE2468-E024-79BC-0134-79ACE13578AC}');<br>if&nbsp;EnableDebugPrivilege&nbsp;then<br>KillTask('explorer.exe');<br>deletefile(WindowsDirectory+'_ice_.exe');<br>sleep(500);<br>deletefile(WindowsDirectory+'_ice_.dll');<br>sleep(1000);<br>application.messagebox(pchar('清除完成,请重新启动计算机'),&nbsp;'成功',&nbsp;mb_iconinformation);<br>//winexec('explorer.exe',sw_show);<br>end<br>else<br>application.messagebox(pchar('未发现木马'),&nbsp;'错误',&nbsp;mb_iconinformation);<br>end;

从上到下均分了

我已经结过一回贴子呀

结

这会结了