瑞星卡卡安全论坛

应该是威金病毒吧。可是我没有logo1_.exe文件，但是有1Sy.exe之类的。被我删除了。可是rundl132.exe反复出现。图标变糊了。一些程序根本打不开了。专杀试了也没用。急呀。。。附LOGO请高手帮我看看。谢谢了


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><C:\WINDOWS\rundl132.exe>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <SiSUSBRG><C:\WINDOWS\SiSUSBrg.exe>  [Silicon Integrated Systems Corp.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  []
    <avast!><C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe>  []
    <SoundMan><; SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\System32\userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
[Microsoft Office]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================
服务
[avast! iAVS4 Control Service / aswUpdSv]
  <"C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"><N/A>
[avast! Antivirus / avast! Antivirus]
  <"C:\Program Files\Alwil Software\Avast4\ashServ.exe"><N/A>
[avast! Mail Scanner / avast! Mail Scanner]
  <"C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service><ALWIL Software>
[avast! Web Scanner / avast! Web Scanner]
  <"C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service><ALWIL Software>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Remote Procedure Call (NPC) / Remotes]
  <><N/A>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[]
  {A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[NowStarter Control]
  {072039AB-2117-4ED5-A85F-9B9EB903E021} <C:\WINDOWS\DOWNLO~1\NOWSTA~1.OCX, (C) NOWCOM>
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[Filetran Control]
  {88734439-46D0-42C0-A13F-7E881EE550CF} <C:\PROGRA~1\bluesky\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINDOWS\System32\iuctl.dll, Microsoft Corporation>
[Qzone Media Tools]
  {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <C:\PROGRA~1\Tencent\QQ\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[MsnMessengerSetupDownloadControl Class]
  {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} <C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx, Microsoft Corporation>
[SiUpdaterCtrl Class]
  {BCA9A936-F557-408E-8301-D5B2B302EFD6} <C:\WINDOWS\Downloaded Program Files\iDanceUpdater1015.dll, www.idance.co.kr>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
  <C:\PROGRA~1\KUGOO2\KuGoo3DownX.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

正在运行的进程
[PID: 480][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 544][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 568][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 616][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 628][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 796][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 848][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 944][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 960][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1264][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1276][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX]  <N/A><N/A>
[PID: 1452][C:\WINDOWS\System32\conime.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1508][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3018>
[PID: 1540][C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe]  <N/A><5, 0, 0, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnOS.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\ashBase.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnB.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\aswCmnS.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\ashTask.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\aswAux.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\Aavm4h.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Base.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Lang.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\AavmRpch.dll]  <ALWIL Software><4, 7, 835, 0>
    [c:\program files\alwil software\avast4\ahruijs.dll]  <N/A><4, 7, 844, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\ashUInt.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\XT1922.dll]  <Codejock Software><1, 9, 4, 0>
    [c:\program files\alwil software\avast4\ahruimai.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruimes.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruins.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruiout.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruip2p.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruistd.dll]  <ALWIL Software><4, 7, 844, 0>
    [c:\program files\alwil software\avast4\ahruiws.dll]  <ALWIL Software><4, 7, 844, 0>
[PID: 1548][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>
[PID: 1580][C:\WINDOWS\VM_STI.EXE]  <VM.><4.2.610.4>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
[PID: 1748][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1788][C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe]  <N/A><N/A>
    [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll]  <ALWIL Software><4, 7, 824, 0>
[PID: 1804][C:\Program Files\Alwil Software\Avast4\ashServ.exe]  <N/A><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswAux.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswEngin.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswScan.dll]  <ALWIL Software><4, 7, 835, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\ashBase.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashTask.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswInteg.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Alwil Software\Avast4\aswIdle.dll]  <ALWIL Software><4, 6, 665, 0>
    [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Base.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\UNACEV2.DLL]  <N/A><N/A>
    [C:\Program Files\Alwil Software\Avast4\AhResJs.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResMai.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ahResMes.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResNS.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResOut.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ahResP2P.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResStd.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResWS.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashSSqlt.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>
[PID: 1884][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1920][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1136][C:\Program Files\Alwil Software\Avast4\ashWebSv.exe]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashBase.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashTask.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswAux.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Base.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\ashWsFtr.dll]  <ALWIL Software><4, 7, 835, 0>
    [C:\Program Files\Alwil Software\Avast4\aswScan.dll]  <ALWIL Software><4, 7, 835, 0>
    [C:\PROGRA~1\ALWILS~1\Avast4\AhResWs.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswEngin.dll]  <ALWIL Software><4, 7, 844, 0>
[PID: 1100][C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashUInt.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashBase.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnB.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\aswCmnS.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\XT1922.dll]  <Codejock Software><1, 9, 4, 0>
    [C:\Program Files\Alwil Software\Avast4\Aavm4h.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ashTask.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswAux.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Alwil Software\Avast4\AhResMai.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Base.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\aswEngin.dll]  <ALWIL Software><4, 7, 844, 0>
    [C:\Program Files\Alwil Software\Avast4\aswScan.dll]  <ALWIL Software><4, 7, 835, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\Lang.dll]  <ALWIL Software><4, 7, 824, 0>
    [C:\Program Files\Alwil Software\Avast4\ChineseS\langmai.dll]  <ALWIL Software><4, 7, 800, 0>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>
[PID: 3696][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2600.0000 (xpclient.010817-1148)>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX]  <N/A><N/A>
    [C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
    [C:\WINDOWS\System32\KIme.ime]  <金山软件公司><1, 0, 0, 1>
[PID: 3052][E:\软件程序\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll]  <ALWIL Software><4, 6, 763, 0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

到瑞星首页上下载威金的专杀看看是否管用。

55555没有用啊

对整个网络进行安全漏洞排查，可以登陆,http://www.pcav.cn/Soft/sdrj/rxsd/200606/183.html,免费下载瑞星杀毒软件2006网络版，使用其中的“增强型全网漏洞管理”功能进行全网扫描，排除安全隐患；个人用户应该使用瑞星杀毒软件2006版的“漏洞扫描”功能，给自己的电脑打上补丁，上网时应启用所有的实时监控功能，并使用个人防火墙。

不能下！不过还是谢谢！

着个病毒我也中了
但是我是通过下面的方法把问题解决了。
1。先看有那些应用程序被感染了（我的是迅雷，REALONE，压缩工具）
2。先在进程里面关掉rundl132.exe程序，然后用HijackThis.exe扫描，选中其中有rundl132.exe的选项选择FIX CHECKED。
3。然后打开IceSword.exe关闭里面的一个后门的程序
4。然后把C:\WINDOWS\rundl132.exe文件删除（有可能为迅雷，REALONE，压缩工具的图表）
5。删除全部被感染了的应用程序
6。打开注册表寻找rundl132，然后把有C:\WINDOWS\rundl132.exe的选项全部删除
7。重新启动
8。重复检查上面的1~~7要是没有的话把删除的相关的软件在重新安装下
9。重新启动检查上面的1~~7，要是没有问题的话问题就解决了

着是我的解决的方法，仅供参考，我已经把病毒的样本发送给瑞星了，等待官方的解决方案