desktoplayer.exe病毒及d:\w7rtm\base\wcp\sil\merged\ntu\ntsystem.cpp的解决方案

1 前言

该病毒，使用360普通杀毒杀不出来，而且会伴随以下问题：

a.电脑蓝屏问题[多图]

b.fsc/scannow CbS.log d:\w7rtm\base\wcp\sil\merged\ntu\ntsystem.cpp

CBS.log

POQ  ends.

-- ::, Info CSI 000000e6 [SR] Verify complete

-- ::, Info CSI 000000e7 [SR] Verifying  (0x0000000000000064) components

-- ::, Info CSI 000000e8 [SR] Beginning Verify and Repair transaction

-- ::, Error CSI 000000e9 (F) STATUS_OBJECT_NAME_NOT_FOUND ## from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation), handle = {provider=NULL, handle=}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES), oa = @0x238c7e0->OBJECT_ATTRIBUTES {s:; rd:NULL; on:[]"\??\C:\Windows\WinSxS\amd64_atiilhag.inf.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_07d1a0ddfebc8ffd"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x238c7c0, as = (null), fa = , sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = , disp = Invalid)

[gle=0xd0000034]

-- ::, Error CSI 000000ea@//:::48.749 (F) d:\w7rtm\base\wcp\sil\merged\ntu\ntsystem.cpp(): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)

[gle=0x80004005]

-- ::, Error CSI 000000eb (F) STATUS_OBJECT_NAME_NOT_FOUND ## from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingDirectory(...)[gle=0xd0000034]

-- ::, Error CSI 000000ec (F) STATUS_OBJECT_NAME_NOT_FOUND ## from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingDirectory(flags = , da = (SYNCHRONIZE), oa = @0x238d0d8->SIL_OBJECT_ATTRIBUTES {s:; on:"amd64_atiilhag.inf.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_07d1a0ddfebc8ffd"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), dir = NULL, disp = Invalid)

[gle=0xd0000034]

2 解决方案

2.1 解决1.a的问题

使用360系统急救箱中强力模式

2.2 解决1.b问题

//使用第一条命令

DISM.exe /Online /Cleanup-image /Scanhealth

DISM.exe /Online /Cleanup-image /Restorehealth[4]

重新扫描结果如下：

　

3  参考资料

1.https://bbs.kafan.cn/thread-1608705-1-1.html

2.https://zhidao.baidu.com/question/2057069465664257947.html（Ramnit感染型蠕虫病毒专杀工具，由赛门铁克安全中心发布）

3.360系统急救箱（采用有效清除）

4.dism RestoreHealth 和 CheckHealth选项时提示错误：87