W32.Downadup.autorun病毒的清除

今天突然发现计算机有点异常，只要一打开Windows资源管理器左侧的文件夹，Explorer.exe就会崩溃，检查了一下发现中了W32.Downadup.autorun病毒。尽管机器安装了最新版本的瑞星杀毒软件，但是根本就检测不到该病毒。Symantec可以检测到，但是单位的涉密计算机就不允许安装国外的杀毒软件，只能用瑞星。在网上搜索了一下，在Symantec的网站上可以下载杀毒软件包。下回来运行了一下，可以把病毒删除了，下面是删除的日志文件：

Symantec W32.Downadup Removal Tool 1.1.0.5
process: svchost.exe, thread: 00000454 (terminated)
process: svchost.exe, thread: 00000B64 (terminated)
process: svchost.exe, thread: 00000BB0 (terminated)
process: svchost.exe, thread: 0000093C (terminated)
process: svchost.exe, thread: 00000BBC (terminated)
process: svchost.exe, thread: 00000BC0 (terminated)
process: svchost.exe, thread: 000000F0 (terminated)
process: svchost.exe (terminated)

G:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx: W32.Downadup.B (unrepairable) (deleted)

registry: HKLM\system\CurrentControlSet\Services\BITS: Start (value set to 0x00000003 (3))
registry: HKLM\system\CurrentControlSet\Services\ERSvc: Start (value set to 0x00000002 (2))
registry: HKLM\system\CurrentControlSet\Services\wscsvc: Start (value set to 0x00000002 (2))
registry: HKLM\system\CurrentControlSet\Services\wuauserv: Start (value set to 0x00000002 (2))

W32.Downadup has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 356394
The number of deleted threat files: 1
The number of threat processes terminated: 1
The number of threat threads terminated: 7
The number of registry entries fixed: 4

The tool initiated a system reboot.