ws2_64.dll引起的无法上网（PWSteal.Trojan Trojan.Redfall）

3. Ending the Taskmon64.exe process
To end the Trojan process, follow the steps for your version of Windows:

1. Press Ctrl+Alt+Delete once.
2. Scroll through the list of programs and look for Taskmon64.exe.
3. If you find the file, click it, and then click End Task.

1. Press Ctrl+Alt+Delete once.
2. Click Task Manager.
3. Click the Processes tab.
4. Double-click the Image Name column header to alphabetically sort the processes.
5. Scroll through the list and look for Taskmon64.exe.
6. If you find the file, click it, and then click End Process.
7. Exit the Task Manager.
   

4. Scanning for and deleting the infected files

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   • For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
   • For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
2. Run a full system scan.
3. If any files are detected as infected with Trojan.Redfall, Trojan.KillAV, or PWSteal.Trojan, click Delete.

5. Reversing the changes made to the registry

CAUTION:

• Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
• The reversal of the changes that Trojan.Redfall made is an exacting task that requires great care. Be sure to follow these instructions explicitly. Read them in their entirety and ensure that you understand them before you begin this procedure.

1. Click Start, and then click Run. (The Run dialog box appears.)
   
2. Type regedit
   
   Then click OK. (The Registry Editor opens.)
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries
   
   
4. Click on the first subkey. It will be named 000000000001.
   
5. In the right pane, double-click the name PackedCatalogItem. An "Edit Binary Value" dialog appears. If the text on the right-hand side of this window contains the string "ws2_64.dll" (an example is shown in the picture below), then Trojan.Redfall has changed this value, and therefore must be restored. Close the dialog by clicking Cancel, and then proceed to the next step.
   
   
   
   
   
6. To restore the value, perform steps i - xii.
   
   1. Navigate to the key:
      
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Winsock
      
      
   2. In the right pane, double-click on the name:
      
      1001
      
      A window entitled "Edit String" will appear. An example of the window is shown in the picture below.
      
      
      
      
      
   3. Carefully count the number of characters in the string listed. In this example, the string is 31 characters long, but your system may vary. Write this information down, as you will need it in step 9.
      
   4. Write down the Value data, or Highlight and copy it, and then paste it into Notepad for future reference.
      
      

      ---

      Note: You can copy the original value data, but when it comes time to replace the changed data, you will be unable to paste it in. You will need to type the value in by hand, so be sure to copy it some place for reference, or write it down exactly as it appears, using proper case, like capitalization.

      ---

      
      
   5. Click Cancel.
      
   6. Navigate to the key:
      
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries
      
      and click on the subkey 000000000001.
      
      
   7. In the right pane, double-click the name PackedCatalogItem. An "Edit Binary Value" dialog appears.
      
   8. In the Value data box, place the cursor immediately to the left of the first character in the block of text, to the right of the box, as shown in the picture below:
      
      
      
      
      
   9. Using the character count from step 3, delete that number of characters from the beginning of the text displayed in the Value data box. The easiest way to do this is to put the cursor at the beginning of the text values, and then hit the delete key the correct number of times.
      
   10. With the cursor at the beginning of the text area (where it should still be after the previous step), type the value you copied in step 4 exactly as it appeared.
       
       
   11. After entering the correct value, scroll to the bottom of the Value data. It should look exactly like the picture below. If it does not, you have deleted or typed in the wrong number of characters. In this case, click Cancel and return to step 1. If the box appears exactly as shown in the picture below, click OK.
       
       
       
       
       
   12. You have now finished restoring the value of one subkey. To complete the removal, you must repeat steps C through F for each subkey under the key:
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries
       
       
       Note: Each subkey that Trojan.Redfall has changed will have a corresponding value under the key:
       
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Winsock
       
       where the original data is stored.
       
       
       For example, the key:
       
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
       
       has the corresponding value 1002 in the key:
       
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Winsock
       
       and the key:
       
       HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
       
       has the corresponding value 1003, and so forth.
       
       
7. Once you have examined the PackedCatalogItem values for each subkey under:
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries
   
   and restored those values that Trojan.Redfall modified, delete the key:
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2\Winsock.
   
   
8. Exit the Registry Editor.
   
9. Restart the computer.