请帮帮忙! bbs.ikaka.com

sin1881 - 2006-4-28 1:06:00

卡巴斯基杀了"Trojan-proxy.win32.delf.ax.后.下次重新开机又会检测到病毒.为什么会这样杀不完呢?

请帮我!

轩辕小聪 - 2006-4-28 1:11:00

病毒文件名称与具体路径？

sin1881 - 2006-4-28 1:57:00

c:windows\system 32\twain.dll
c\document and settings\administraor\local settings\temporary internet files\content.IE5\ctufkuj\twain(1)dll.
这是报告里显示的,好像 c:windows\system32.. 这个带的病毒杀不了.

请帮我一下.谢谢!

轩辕小聪 - 2006-4-28 1:59:00

试试安全模式下断网查杀或手工删除。
后面的那一个，清空IE临时文件。

sin1881 - 2006-4-28 2:01:00

2006-04-28,01:57:51

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<DrvMon.exe><C:\WINDOWS\system32\DrvMon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<eMuleAutoStart><; d:\Program Files\eMule\eMule.exe -AutoStart>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVPersonal50><C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<XFILTER><"D:\Program Files\Filseclab\xfilter\xfilter.exe" -a>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Rspoolsz><C:\WINDOWS\system32\spoolsz.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RealTray><; c:\Program Files\Ringz Studio\Storm Codec\mplayerc.exe SYSTEMBOOTHIDEPLAYER>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<xBarUpdate><; C:\Program Files\xBar\xBarUpdate.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
[费尔消息服务]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\费尔消息服务.lnk><N>
[迅雷4]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\迅雷4.lnk><N>

==================================
服务
[kavsvc / kavsvc]
<C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe><Kaspersky Lab>
[Tong备份服务 / TongBackupSrv]
<C:\WINDOWS\system32\TongBackupSrv.exe><N/A>
[用友通 / UFNet]
<C:\WINDOWS\system32\ServerNT.exe><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[CMoveCatchPic Object]
{0CF098A0-CBAC-4EFB-8451-3AFC201C7222} <C:\Program Files\xBar\xBarHelper.dll, SeekLong Technologies, Inc.>
[MsHelp Class]
{33C3992F-1963-49BE-88D7-974C8EE564B5} <C:\WINDOWS\system32\MsHelper.dll, Microsofts>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Router Layer]
{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} <C:\WINDOWS\System32\aclayer.dll, N/A>
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation>
[EmoWebInstallerCtl Class]
{7FC751A9-492D-41B1-9F8D-D2C8809D8907} <C:\WINDOWS\Downloaded Program Files\EmoWebInstaller.dll, MotinOne Inc.>
[BuddyInvite Control]
{973BA7A6-FFF1-11D8-892B-009008A5E8D8} <C:\WINDOWS\BUDDYI~1.OCX, >
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CMoveCatchPic Object]
{0CF098A0-CBAC-4EFB-8451-3AFC201C7222} <C:\Program Files\xBar\xBarHelper.dll, SeekLong Technologies, Inc.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[MsHelp Class]
{33C3992F-1963-49BE-88D7-974C8EE564B5} <C:\WINDOWS\system32\MsHelper.dll, Microsofts>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Router Layer]
{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} <C:\WINDOWS\System32\aclayer.dll, N/A>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[IETimeBehaviorFactory Class]
{A4639D29-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[IEAnimBehaviorFactory Class]
{A4639D2F-774E-11D3-A490-00C04F6843FB} <C:\PROGRA~1\COMMON~1\MICROS~1\MSORUN\MSORUN.DLL, Microsoft Corporation>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[IERPCtl Class]
{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5} <c:\Program Files\Ringz Studio\Storm Codec\rpplugins\ierpplug.dll, RealNetworks, Inc.>
[!搜一搜(&S)]
<res://C:\PROGRA~1\YiSou\yisou.dll/232, N/A>
[&使用迅雷下载]
<D:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Program Files\Thunder Network\Thunder\getAllurl.htm, N/A>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
<D:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[发送到手机]
<C:\Program Files\xBar\xBar.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[豪杰超级解霸V8实时播放]
<d:\Herosoft\HeroV8\MPURLGET.HTM, N/A>

sin1881 - 2006-4-28 2:01:00

正在运行的进程
[PID: 468][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 532][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 556][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 600][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 612][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 756][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 816][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 900][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 960][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 1016][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 1212][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp.050610-1527)>
[PID: 1436][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A>
[PID: 1664][D:\Program Files\Filseclab\xfilter\xfilter.exe] <费尔安全实验室><3.0>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.156.342>
[PID: 1672][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208>
[PID: 1688][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1736][C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe] <Microsoft Corporation><2000.080.0194.00>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 1800][C:\Program Files\Common Files\Filseclab\FilMsg.exe] <费尔安全实验室><3, 1, 0, 927>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 1984][C:\WINDOWS\system32\TongBackupSrv.exe] <N/A><N/A>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 528][C:\WINDOWS\system32\ServerNT.exe] <N/A><N/A>
[C:\WINDOWS\system32\UMiscNT.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\SecuComm.dll] <N/A><N/A>
[C:\WINDOWS\system32\UfZf5.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\M80SGV.dll] <><8, 2, 0, 0>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 1860][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[PID: 2000][D:\金山词霸2005\XDICT.EXE] <Kingsoft Co, Ltd.><8, 5, 0, 0>
[D:\金山词霸2005\DicMngr.dll] <Kingsoft><1, 0, 0, 0>
[D:\金山词霸2005\doshow.dll] <N/A><N/A>
[D:\金山词霸2005\ITextOut.dll] <Kingsoft><1, 1, 0, 0>
[D:\金山词霸2005\KPic10.dll] <N/A><N/A>
[D:\金山词霸2005\ijl11.dll] <Intel Corporation><1.1.2>
[D:\金山词霸2005\NormGrab.DLL] <Kingsoft Co, Ltd.><6, 0, 0, 0>
[D:\金山词霸2005\toTTSEngine50.dll] <Kingsoft Corporation><1, 0, 0, 1>
[D:\金山词霸2005\xfile.dll] <N/A><N/A>
[D:\金山词霸2005\DBCore10.dll] <Kingsoft Corp.><1, 0, 0, 0>
[D:\金山词霸2005\XdictGrb.dll] <Kingsoft Co, Ltd.><8, 5, 0, 0>
[PID: 3240][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[C:\Program Files\xBar\xBarHelper.dll] <SeekLong Technologies, Inc.><1.0.0.6>
[D:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.156.342>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] <Kaspersky Lab><1.0.156.3>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.0.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] <Kaspersky Lab><5.0.156.0>
[C:\WINDOWS\system32\JPWB.IME] <长江软件工作室><4.00.950>
[PID: 3864][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\xunleibho_v4.dll] <><4, 3, 2, 29>
[C:\Program Files\xBar\xBarHelper.dll] <SeekLong Technologies, Inc.><1.0.0.6>
[D:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A>
[C:\WINDOWS\system32\mfc313u.dll] <N/A><N/A>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.156.342>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] <Kaspersky Lab><1.0.156.3>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.0.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] <Kaspersky Lab><5.0.156.0>
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[C:\WINDOWS\system32\JPWB.IME] <长江软件工作室><4.00.950>
[PID: 3828][D:\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] <Filseclab Corporation><3, 0, 0, 3644>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
d:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
MSAFD Tcpip [UDP/IP]
d:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
MSAFD Tcpip [RAW/IP]
d:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
RSVP UDP Service Provider
d:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)
RSVP TCP Service Provider
d:\Program Files\Filseclab\xfilter\XFILTER.DLL(Filseclab Corporation, Filseclab Personal Firewall)

==================================

sin1881 - 2006-4-28 2:03:00

安全模式下什么意思啊

轩辕小聪 - 2006-4-28 2:13:00

晕倒……
重启电脑按住F8（可以不停地按）直到出现登陆选项，选“安全模式”或“SAFE MODE”即可进入安全模式。安全模式下仅有比较基本的系统进程在开机时运行，所以可以比较容易地删除病毒（汗，这应该是很基本的）。进入安全模式后再运行卡巴斯基扫描杀毒（这个应该懂吧）。或是自己找到那个文件并删除之。
【小常识】
若文件找不到或无法删除文件
打开我的电脑
在工具栏中点击－－工具－－文件夹选项－－查看
勾选“显示所有文件及文件夹”
同时把“隐藏受保护的操作系统文件（推荐）”前的勾去掉
然后再进行查找一下

或利用KILLBOX来删除
KILLBOX下载：
http://forum.ikaka.com/topic.asp?board=28&artid=6979213

或利用费尔木马强力清除助手来删除
费尔木马强力清除助手使用参考：
http://www.xfilt.com/tech/trojan-horse.htm

从日志上看：
卸载C:\Program Files\xBar\并删除整个文件夹；
删除C:\WINDOWS\System32\aclayer.dll。
并在注册表找到并删除与以上两项相应的项目。

要睡了，中午再来看，祝楼主好运。

轩辕小聪 - 2006-4-28 2:17:00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Rspoolsz><C:\WINDOWS\system32\spoolsz.exe>
这一项也有问题。建议：
在注册表中删除这一项，找到并删除C:\WINDOWS\system32\spoolsz.exe文件。

sin1881 - 2006-4-28 2:22:00

谢谢!

不言放弃 - 2006-4-28 8:12:00

【回复“sin1881”的帖子】
进入注册表
删除如下几项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Rspoolsz><C:\WINDOWS\system32\spoolsz.exe>

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<xBarUpdate><; C:\Program Files\xBar\xBarUpdate.exe>

[CMoveCatchPic Object]
{0CF098A0-CBAC-4EFB-8451-3AFC201C7222} <C:\Program Files\xBar\xBarHelper.dll, SeekLong Technologies, Inc.>

[MsHelp Class]
{33C3992F-1963-49BE-88D7-974C8EE564B5} <C:\WINDOWS\system32\MsHelper.dll, Microsofts>

[Router Layer]
{5EB7CB50-E375-4718-B4C0-9AD12EFA2F84} <C:\WINDOWS\System32\aclayer.dll, N/A>

[EmoWebInstallerCtl Class]
{7FC751A9-492D-41B1-9F8D-D2C8809D8907} <C:\WINDOWS\Downloaded Program Files\EmoWebInstaller.dll, MotinOne Inc.>

[!搜一搜(&S)]
<res://C:\PROGRA~1\YiSou\yisou.dll/232, N/A>

[发送到手机]
<C:\Program Files\xBar\xBar.htm, N/A>

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

卸载
C:\Program Files\xBar\
C:\Program Files\YiSou\

＝＝＝＝＝＝＝＝＝＝＝＝＝

安全模式下删除
C:\Program Files\xBar\
C:\Program Files\YiSou\
C:\WINDOWS\system32\mfc313u.dll
C:\WINDOWS\system32\spoolsz.exe
C:\WINDOWS\system32\MsHelper.dll
C:\WINDOWS\System32\aclayer.dll
C:\WINDOWS\System32\aclayer.exe
C:\WINDOWS\Downloaded Program Files\EmoWebInstaller.dll

sin1881 - 2006-4-28 12:25:00

我删不掉XBAR啊,在盘里直接删不掉,是我操作错了吗,安全模式是什么啊

瑞星卡卡安全论坛