求救,瑞星杀不了的病毒 bbs.ikaka.com

elincome - 2006-6-23 19:42:00

电脑下午中毒了,两个小时里,瑞星监控发现删除了20几个这种Trojan.DL.Agent.jer;,可是无法彻底清除,我的杀毒软件已经升级到18.32.42了,还是不行,现在怎么办呀?瑞星监控删除的文件是在C:\WINDOWS\SYSTEM\VIPTRAY.EXE
请高手帮帮忙啊

elincome - 2006-6-24 13:39:00

难道没有人知道这个病毒吗?
救命啊

我无邪 - 2006-6-24 13:49:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

elincome - 2006-6-24 13:56:00

谢谢,马上行动

elincome - 2006-6-24 13:58:00

注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<visit><C:\WINDOWS\system32\visit.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<CameraFixer><C:\WINDOWS\CameraFixer.exe> []
<tsnpstd3><C:\WINDOWS\tsnpstd3.exe> []
<snpstd3><C:\WINDOWS\vsnpstd3.exe> []
<EmServer><> []
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> []
<WinFaxAppPortStarter><wfxsnt40.exe> [Microsoft Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<SchedulingAgent><mstask.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><userinit.exe,> [Microsoft Corporation]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsHook.dll> [北京三七二一科技有限公司]
<{A213B520-C6C2-11d0-AF9D-008029E1027E}><f:\Program Files\Symantec\WinFax\WfxSeh32.Dll> [Symantec Corporation]

==================================

elincome - 2006-6-24 14:00:00

启动文件夹
[Controller]
<C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Controller.LNK><N>
[IE-BAR]
<C:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\IE-BAR.lnk><N>

==================================
服务
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[P4P Service / P4P Service]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[VIPTray / VIPTray]
<2 - 系统找不到指定的文件。
><N/A>
[WinFax PRO / wfxsvc]
<C:\WINDOWS\system32\WFXSVC.EXE><Symantec Corporation>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[CPub Object]
{0CA51D02-7739-43EA-8D9A-1E8AD4327B03} <F:\P4P\sodaie.dll, N/A>
[BrowserHelper Class]
{2D99E8F4-56B7-457B-9A92-61B5D247D263} <C:\WINDOWS\system32\WinDefendor.dll, TODO: <公司名>>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, N/A>
[VnetCookie Class]
{4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, N/A>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Progra~1\Baidu\bar\BaiDuBar.dll, Baidu.com, Inc.>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <F:\FLASHG~1.65\jccatch.dll, Amaze Soft>
[上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsHook.dll, 北京三七二一科技有限公司>
[TtuNtsob Class]
{EDC7DCCB-EAC9-BAE9-76B6-1DBD84735079} <C:\WINDOWS\DOWNLO~1\yeemtoq.dll, N/A>
[WMHlprObj Class]
{F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, N/A>
[免费精彩视频超流畅在线观看]
{022C4009-5283-4365-97BF-144054B40E2E} <http://itv.mop.com, N/A>
[企业管理软件网站]
{37E91B47-F40A-11D1-B792-444553540000} <http://www.wenysoft.com, N/A>
[Yahoo 1G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[@shdoclc.dll,-866@2052,相关站点]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\FLASHG~1.65\fgiebar.dll, Amaze Soft>

elincome - 2006-6-24 14:00:00

上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Progra~1\Baidu\bar\BaiDuBar.dll, Baidu.com, Inc.>
[MSN]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll, N/A>
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[VnetAnprIns Class]
{74447F9C-5691-4A9A-8BE4-564092E40B03} <C:\WINDOWS\Downloaded Program Files\anprins.dll, 中国电信股份有限公司>
[Cdmcco Class]
{938527D1-CDB7-4147-998A-B20FCA5CC976} <C:\WINDOWS\Downloaded Program Files\dmcc2.dll, >
[Qzone Media Tools]
{A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <e:\PROGRA~1\Tencent\qq\QZone\QZONEM~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[IcbcSslCacheCleanerCtrl Class]
{E9707834-5BF7-4CFF-A639-398427DE1991} <C:\WINDOWS\Downloaded Program Files\IcbcSslCacheCleaner.dll, 中国工商银行>
[VqqSpeedDlProxy Class]
{F138084D-84D7-48CD-BEA8-04772457516E} <C:\WINDOWS\vqqsdl.dll, Tencent>
[AcPreview 控件]
{F281A59C-7B65-11D3-8617-0010830243BD} <C:\WINDOWS\DOWNLO~1\ACPREV~1.OCX, Autodesk>
[pCastPanel Class]
{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <C:\WINDOWS\Downloaded Program Files\pCastCtl.dll, >
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v4.dll, >
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CPub Object]
{0CA51D02-7739-43EA-8D9A-1E8AD4327B03} <F:\P4P\sodaie.dll, N/A>
[EWA Control]
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\COMMON~1\Synacast\SynaLive\SYNACA~1.OCX, Synacast>
[EtCell Control]
{20423C49-2276-43D5-BC6D-53829C41AEAD} <C:\WINDOWS\system32\EtCell.ocx, 济南昂利万软件有限公司>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DownLoad Class]
{276BF72D-CA22-4237-9BCF-593B4E490DE9} <C:\WINDOWS\Downloaded Program Files\AliTalk_WebUpdate.dll, >
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[BrowserHelper Class]
{2D99E8F4-56B7-457B-9A92-61B5D247D263} <C:\WINDOWS\system32\WinDefendor.dll, TODO: <公司名>>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, N/A>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[EPUImageControl Class]
{4C39376E-FA9D-4349-BACC-D305C1750EF3} <C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll, eBay, Inc.>
[VnetCookie Class]
{4E83D567-4697-4F7B-B1F0-A513B01DB89A} <c:\PROGRA~1\chinanet\VNETTR~1.DLL, >
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[天下搜索]
{56A7DC70-E102-4408-A34A-AE06FEF01586} <, N/A>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Microsoft 外壳 UI 帮助程序]
{64AB4BB7-111E-11D1-8F79-00C04FC2FBE1} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
[VnetAnprIns Class]
{74447F9C-5691-4A9A-8BE4-564092E40B03} <C:\WINDOWS\Downloaded Program Files\anprins.dll, 中国电信股份有限公司>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\Progra~1\Baidu\bar\BaiDuBar.dll, Baidu.com, Inc.>
[AutoLive]
{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\system32\SUBMIT~1.DLL, >
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <F:\FLASHG~1.65\jccatch.dll, Amaze Soft>
[Tool Class]
{A7F05EE4-0426-454F-8013-C41E3596E9E9} <C:\Progra~1\Baidu\bar\BaiDuBar.dll, Baidu.com, Inc.>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\Progra~1\Baidu\bar\BaiDuBar.dll, Baidu.com, Inc.>
[]
{B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[3721]
{B83FC273-3522-4CC6-92EC-75CC86678DA4} <C:\WINDOWS\Downloaded Program Files\CONFLICT.6\CnsMin.dll, 北京三七二一科技有限公司>
[上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[MSN]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll, N/A>
[OWSBrowserUI Class]
{BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~3\Office\OWS.DLL, N/A>
[OWSMiscApis Class]
{BDEADE44-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~3\Office\OWS.DLL, N/A>
[OWSDiscussionServers Class]
{BDEADE4E-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~3\Office\OWS.DLL, N/A>
[AUDIO__MID Moniker Class]
{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsHook.dll, 北京三七二一科技有限公司>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[Microsoft Agent Control 2.0]
{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} <C:\WINDOWS\msagent\agentctl.dll, Microsoft Corporation>
[Microsoft DirectAnimation Path]
{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6} <C:\WINDOWS\system32\daxctle.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\FLASHG~1.65\fgiebar.dll, Amaze Soft>
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[TtuNtsob Class]
{EDC7DCCB-EAC9-BAE9-76B6-1DBD84735079} <C:\WINDOWS\DOWNLO~1\yeemtoq.dll, N/A>
[VqqSpeedDlProxy Class]
{F138084D-84D7-48CD-BEA8-04772457516E} <C:\WINDOWS\vqqsdl.dll, Tencent>
[WMHlprObj Class]
{F5824EFB-728A-4726-A5A5-85A68B20EDC3} <C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, N/A>
[]
{FB7199AB-79BF-11D2-8D94-0000F875C541} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[pCastPanel Class]
{FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} <C:\WINDOWS\Downloaded Program Files\pCastCtl.dll, >
[ >> 彩信发送 <<]
<res://C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm, N/A>
[DailyPim: 保存当前网页]
<, N/A>
[DailyPim: 保存当前链接]
<, N/A>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<F:\FlashGet1.65\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<F:\FlashGet1.65\jc_all.htm, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[百度-搜索MP3]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM, N/A>
[百度-搜索图片]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM, N/A>
[百度-搜索新闻]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM, N/A>
[百度-搜索歌词]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM, N/A>
[百度-搜索网页]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM, N/A>
[百度-搜索贴吧]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM, N/A>
[百度-词典搜索]
<res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM, N/A>
[豪杰超级解霸V8实时播放]
<, N/A>

baohe - 2006-6-24 14:02:00

【回复“elincome”的帖子】
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<visit><C:\WINDOWS\system32\visit.exe> []
中招了吧

elincome - 2006-6-24 14:03:00

正在运行的进程
[PID: 540][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 604][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 628][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 672][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 684][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 856][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 920][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1016][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1036][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1076][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1128][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1268][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 3>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 28>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\Program Files\Rising\Rav\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1536][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[f:\Program Files\Symantec\WinFax\WfxSeh32.Dll] <Symantec Corporation><9.02.98.1128>
[C:\PROGRA~1\3721\Assist\asnoad.dll] <><1, 0, 0, 9>
[C:\Progra~1\Baidu\bar\BaiDuBar.dll] <Baidu.com, Inc.><2, 0, 2, 60>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\PROGRA~1\3721\assist\repair.dll] <北京三七二一科技有限公司><1, 0, 2, 4>
[C:\PROGRA~1\3721\assist\asfsks.dll] <3721.com><2, 1, 1, 87>
[C:\PROGRA~1\3721\assist\optimum.dll] <N/A><N/A>
[c:\progra~1\3721\assist\adfilter.dll] < ><1, 0, 1, 6>
[C:\PROGRA~1\3721\assist\XPStyle.dll] <N/A><N/A>
[C:\PROGRA~1\3721\Assist\assecblk.dll] <3721><1, 0, 0, 9>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[E:\Program Files\Tencent\qq\qdshm.dll] <><1, 0, 1, 2>
[C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx] <Macromedia, Inc.><8,0,24,0>
[C:\PROGRA~1\3721\Assist\asbar.dll] <3721><1, 0, 1, 1001>
[C:\PROGRA~1\3721\Assist\ieaUI.dll] <yahoo!china><1, 0, 1, 1005>
[C:\PROGRA~1\3721\Assist\TbWrap.dll] <3721><1, 0, 0, 2>
[C:\PROGRA~1\3721\Assist\aswiper.dll] <3721><1, 0, 1, 1001>
[C:\PROGRA~1\3721\Assist\asiesec.dll] <yahoo><1, 0, 0, 9>
[C:\WINDOWS\system32\WinDefendor.dll] <TODO: <公司名>><1.0.0.2>
[PID: 1644][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[C:\WINDOWS\system32\dtmon.dll] <Data Techniques, Inc.><3.00.00>
[C:\WINDOWS\system32\WFXMNT40.DLL] <Microsoft Corporation><7.00 (Build 019)>

elincome - 2006-6-24 14:04:00

[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\WFXPNT40.DLL] <N/A><N/A>
[PID: 1736][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1976][d:\PROGRA~1\MICROS~2\MSSQL$~1\binn\sqlservr.exe] <Microsoft Corporation><2000.080.0194.00>
[PID: 208][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe] <Sohu.com Inc.><2, 0, 0, 17>
[C:\Program Files\Sogou PXP\vodsvr.dll] <Sohu.com Inc.><1, 1, 0, 4>
[C:\Program Files\Sogou PXP\PluginClient.dll] <Sohu.com Inc.><1, 0, 0, 22>
[PID: 408][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 568][C:\WINDOWS\system32\Rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMinEx.dll] <国风因特软件(北京)有限公司><1, 0, 3, 1>
[PID: 888][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1056][C:\WINDOWS\system32\WFXSVC.EXE] <Symantec Corporation><9.02.98.1128>
[PID: 1436][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1504][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 99>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1528][C:\WINDOWS\CameraFixer.exe] <><1, 0, 0, 2>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2080][C:\WINDOWS\vsnpstd3.exe] <><1, 0, 2, 2>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2156][C:\WINDOWS\system32\wfxsnt40.exe] <Microsoft Corporation><7.00 (Build 019)>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2244][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3510>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2324][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2336][C:\WINDOWS\system32\visit.exe] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 2628][C:\WINDOWS\system32\rundll32.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Progra~1\IE-BAR\Cast\dmipn.dll] <千橡互联><2, 2, 1, 0>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[C:\Progra~1\IE-BAR\Cast\dmshell.dll] <千橡互联><2, 2, 1, 0>
[C:\Progra~1\IE-BAR\Cast\221~1.0\dmplayer.dll] <千橡互联><2, 2, 1, 0>
[PID: 2724][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 424][E:\TT\TTraveler.exe] <深圳市腾讯计算机系统有限公司><2, 0, 14, 196>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsHook.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[E:\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[E:\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx] <Macromedia, Inc.><8,0,24,0>
[PID: 592][C:\WINDOWS\system32\ntvdm.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 1316][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] <Microsoft Corporation><2000.080.0194.00>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>
[PID: 4024][C:\Documents and Settings\jsg.BDOA-E70DE09C55\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\DOWNLO~1\CONFLICT.6\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 1>

==================================
文件关联
.TXT Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [C:\WINDOWS\hh.exe %1]
.HLP Error. [C:\WINDOWS\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. []
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

elincome - 2006-6-24 14:05:00

【回复“baohe”的帖子】
:(现在怎么办呀?拜托帮帮忙哦

我无邪 - 2006-6-24 14:08:00

运行System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常
进入控制面版的添加删除程序中卸载IE-BAR
运行System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务VIPTray，选择“删除服务”点“设置”选择“否”
ALT+CTRL+DELETE调出任务管理器,终止visit.exe的进程
关闭所有浏览窗口以及一些不必要的程序
运行System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项。
C:\WINDOWS\system32\WinDefendor.dll
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\visit.exe
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\Program Files\IE-BAR
C:\WINDOWS\system32\visit.exe
C:\WINDOWS\system32\WinDefendor.dll

baohe - 2006-6-24 14:09:00

引用:

【elincome的贴子】【回复“baohe”的帖子】
:(现在怎么办呀?拜托帮帮忙哦
...........................

显示隐藏文件。
找到C:\WINDOWS\system32\visit.exe，打包（解压密码用virus），发到：baohelin@yahoo.com.cn

elincome - 2006-6-24 14:15:00

不是压缩吗?怎么还要用解压密码啊?

elincome - 2006-6-24 14:20:00

【回复“baohe”的帖子】我已经发送邮件了,麻烦你看看哦,谢谢!

轩辕小聪 - 2006-6-24 14:30:00

楼主之前所说的那个病毒文件的注册表服务项已经没了：
[VIPTray / VIPTray]
<2 - 系统找不到指定的文件。
><N/A>
汗，这个早就发现过了，也有人上报过了，瑞星居然等到现在才反应过来。

但是C:\WINDOWS\system32\visit.exe就非常可疑。

elincome - 2006-6-24 14:35:00

是呀,我查询不到VIPTray这个文件
在运行服务里面有这个,不过无法禁用.

elincome - 2006-6-24 16:16:00

【回复“我无邪”的帖子】System Repair Engineer这个要在哪里运行?要下载吗?

wyatt - 2006-6-24 16:40:00

我昨晚也中了这个病毒，每5分钟瑞星跳出来提示一次“删除成功”。以前曾有人提供方法如下：
《trojan.dl.agent.jer是windows下的木马病毒
昨晚整了一个晚上终于搞定了，光瑞星是刹不掉的。在网上下了vk2005反木马专家V2.8和木马刹客进入安全模式分别刹了一遍居然刹了二十多个木马。用瑞星全盘刹了一遍没发现病毒，重启电脑一切正常，再也不会弹出提示发现病毒。》
可我试了一遍还是没有效果。还请瑞星的工程师速提供解决方案。

elincome - 2006-6-24 16:44:00

引用:

【wyatt的贴子】我昨晚也中了这个病毒，每5分钟瑞星跳出来提示一次“删除成功”。以前曾有人提供方法如下：
《trojan.dl.agent.jer是windows下的木马病毒
昨晚整了一个晚上终于搞定了，光瑞星是刹不掉的。在网上下了vk2005反木马专家V2.8和木马刹客进入安全模式分别刹了一遍居然刹了二十多个木马。用瑞星全盘刹了一遍没发现病毒，重启电脑一切正常，再也不会弹出提示发现病毒。》
可我试了一遍还是没有效果。还请瑞星的工程师速提供解决方案。
...........................

为什么这么多人中相同的病毒,却没能解决呀?

wyatt - 2006-6-24 16:58:00

建议elincome进行病毒上报：http://up.rising.com.cn/webmail/uploadnew.htm，辛苦了。

elincome - 2006-6-24 17:09:00

我昨天就已经上报了,还没解决.

elincome - 2006-6-25 10:11:00

还没解决啊,越来越严重了.

白天黑云 - 2006-6-25 10:55:00

我教你,qq48593229

我无邪 - 2006-6-25 11:28:00

楼主你按以下的方法去做，没有理由不行的。
运行System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常
进入控制面版的添加删除程序中卸载IE-BAR
运行System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务VIPTray，选择“删除服务”点“设置”选择“否”
ALT+CTRL+DELETE调出任务管理器,终止visit.exe的进程
关闭所有浏览窗口以及一些不必要的程序
运行System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项。
C:\WINDOWS\system32\WinDefendor.dll
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项。
C:\WINDOWS\system32\visit.exe
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\Program Files\IE-BAR
C:\WINDOWS\system32\visit.exe
C:\WINDOWS\system32\WinDefendor.dll

soood - 2006-6-25 13:35:00

24楼说的对。楼主清完后，右键单击“我的电脑－属性－硬件－设备管理器－查看－显示隐藏的驱动程序”，如果其中有带红色“！”的，卸载！

我无邪 - 2006-6-25 13:37:00

楼主的太武断，据我所知，有些正常的也会显示为红色的。

soood - 2006-6-25 13:50:00

这类的鼠标点上去，系统会提示不存在，或不能运行。由于正常清况下卸载不净，才能见到！

瑞星卡卡安全论坛