灰鸽子真的杀不掉吗~ bbs.ikaka.com

O五重海O - 2006-7-20 10:59:00

昨天晚上感觉电脑有点不正常~~
赶紧开开瑞星~~
还没扫几个文件就查到毒~~
原来是灰鸽子(早闻其名`米中过)~~
心想~~
啊呀~!~~一场虚惊~~
没想到~~
那该死的病毒~~
可能是侵入了所有运行中的进程~~
包括瑞星的进程~~
瑞星也真够傻的~~
清除的时候把自己的进程也关掉了~~
反复这样好几次~~
根本就没法继续杀~~~
没办法了~~
以前什么毒都能轻松搞定~~
顶多是手动过一遍~~
这回连文件`进程之类的线索都找不到~~
最后实在米办法~
在安全模式运行用瑞星~
终于可以继续杀了~`
但是重启进到普通模式复查的时候~~
还是扫到毒~~
而且和刚开始一样~
瑞星把自己关掉~~~
我这是已经火的不行~~
但是毒还得杀啊~~~
有上网找到瑞星的灰鸽子专杀工具~~
杀完重启再进系统~~
再复查~~
欧买嘎~~!~~@~~~~
他还在~~~~~~~~~~!~~!`
事实已经说明~~
这个病毒瑞星根本杀不掉~~~
大家赶紧帮我想想其他的办法~~~
现在电脑还在中毒状态~~
后门大开~~~`
那边一引爆~我这边就炸啊~~~~
拜托各位~~

灰鸽子 [Backdoor.Gpigeon.srt] [Backdoor.Gpigeon.ziy] [Backdoor.Gpigeon.faw]
还有个不知道什么名字的 [Trojan.DL.Likebug] [Binder.Likebug]
这个不知道名字的有单独进程like.bug.exe(进程被我手动消灭)~~
也有隐藏文件~~

O五重海O - 2006-7-20 11:00:00

下面的日志是在安全模式下查杀时候的~
--------------------------------------
病毒名称处理结果发现日期路径文件病毒来源
Backdoor.Gpigeon.srt清除成功2006-07-20 07:56IEXPLORE.EXE>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 07:57IEXPLORE.EXE>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 07:57explorer.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 07:57Rav.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15Explorer.EXE>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15E_S4I3W1.EXE>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15VM_STI.EXE>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15realsched.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15RavTask.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15ctfmon.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.srt清除成功2006-07-20 08:15Ravmon.exe>>C:\WINDOWS\RUNDLL32Key.DLL本机
Backdoor.Gpigeon.ziy删除成功2006-07-20 08:26C:\WINDOWS\TempRUNDLL320.DLL本机
Backdoor.Gpigeon.ziy删除成功2006-07-20 08:27C:\WINDOWSRUNDLL32.DLL本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:28C:\WINDOWSRUNDLL32HIDE.DLL本机
Trojan.DL.Likebug删除成功2006-07-20 08:30C:\Documents and Settings\aa\桌面like.bug.exe本机
Trojan.DL.Likebug删除成功2006-07-20 08:31C:\Documents and Settings\aalike.bug.exe本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:40C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP0A0000002.DLL本机
Trojan.DL.Likebug删除成功2006-07-20 08:40C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000016.exe本机
Trojan.DL.Likebug删除成功2006-07-20 08:40C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000032.exe本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:40C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000033.DLL本机
Backdoor.Gpigeon.ziy删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000137.DLL本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000139.DLL本机
Backdoor.Gpigeon.ziy删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000156.DLL本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000162.DLL本机
Backdoor.Gpigeon.ziy删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000169.DLL本机
Backdoor.Gpigeon.faw删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000172.DLL本机
Trojan.DL.Likebug删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000173.exe本机
Trojan.DL.Likebug删除成功2006-07-20 08:41C:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000174.exe本机
Binder.Likebug清除成功2006-07-20 08:41D:\Program Files\ACDSee(已安装)acdassoc.exe本机
Binder.Likebug清除成功2006-07-20 08:41D:\Program Files\ACDSee(已安装)ACDSee.exe本机
Binder.Likebug清除成功2006-07-20 08:41D:\Program Files\ACDSee(已安装)uninstall.exe本机
Binder.Likebug清除成功2006-07-20 08:41D:\联众btesetup.exe本机
Binder.Likebug清除成功2006-07-20 08:42D:\联众GLHistoryExe.exe本机
Binder.Likebug清除成功2006-07-20 08:42D:\winrar解压\winrarUninstall.exe本机
Binder.Likebug清除成功2006-07-20 08:42D:\名人软件START_CD.exe本机
Binder.Likebug清除成功2006-07-20 08:42D:\名人软件\setupSetup.exe本机
Binder.Likebug清除成功2006-07-20 08:42D:\名人软件autorun.exe本机
Binder.Likebug清除成功2006-07-20 08:43D:\yulo\系统增强\dix9dxsetup.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\AdbeRdrAdbeRdr70_chs_full.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\AdbeRdr\reader\Reader\Updateracroaum.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\AdbeRdr\reader\ReaderAcroRd32.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\AdbeRdr\reader\ReaderAcroRd32Info.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\BT\安装bitcomet_setup.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\共享\安装eMule-0.46b-VeryCD0715Install.exe本机
Binder.Likebug清除成功2006-07-20 08:45D:\yulo\共享\eMuleUninstall.exe本机
Binder.Likebug清除成功2006-07-20 08:46D:\yulo\RealPlayer\安装RealPlayer10-5GOLD_skycn.exe本机
Binder.Likebug清除成功2006-07-20 08:46D:\yulo\RealPlayer\real\Setupsetup.exe本机
Binder.Likebug清除成功2006-07-20 08:46D:\yulo\蚂蚁TV\安装TvantsSetup.EXE本机
Binder.Likebug清除成功2006-07-20 08:46D:\yulo\QQLive\安装QQLive3.1.FormalSP1.exe本机
Binder.Likebug清除成功2006-07-20 08:47D:\yulo\QQLive\QQliveTVLoge.exe本机
Binder.Likebug清除成功2006-07-20 08:47D:\yulo\QQLive\QQliveuninstall.exe本机
Binder.Likebug清除成功2006-07-20 08:48D:\yulo\天下贰\天下贰2测\directxDXSETUP.exe本机
Binder.Likebug清除成功2006-07-20 08:48D:UCSetup_2005IIBeta2.exe本机
Binder.Likebug清除成功2006-07-20 08:48D:dddsetup.exe本机
Binder.Likebug清除成功2006-07-20 08:49D:acdc31sr1.exe本机
Binder.Likebug清除成功2006-07-20 08:49D:\ougishi4字\毛笔书法生成软件 ougishi 4.00 Lite beta 简体中文版Setup.exe本机
Binder.Likebug清除成功2006-07-20 08:49D:QQGame2006Beta1_setup.EXE本机
Binder.Likebug清除成功2006-07-20 08:51D:\暴风播放器\安装StormCodec6.04.08.exe本机
Binder.Likebug清除成功2006-07-20 08:51D:\暴风播放器\暴风影视StormSet.exe本机
Binder.Likebug清除成功2006-07-20 08:51D:\暴风播放器\暴风影视GSpot.exe本机
Binder.Likebug清除成功2006-07-20 08:51D:\windows优化大师\安装\WomSetup731WomSetup.exe本机
Binder.Likebug清除成功2006-07-20 08:51D:\紫光拼音输入法\安装Setup.Exe本机
Binder.Likebug清除成功2006-07-20 08:51D:\MSN\安装INSTALL_MSN_MESSENGER_9X.EXE本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000176.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000177.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000178.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000179.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000180.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000181.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000182.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000183.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000184.exe本机
Binder.Likebug清除成功2006-07-20 08:52D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000185.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000186.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000187.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000188.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000189.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000190.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000191.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000192.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000193.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000194.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000195.EXE本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000196.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000197.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000198.exe本机
Binder.Likebug清除成功2006-07-20 08:53D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000199.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000200.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000201.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000202.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000203.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000204.EXE本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000205.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000206.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000207.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000208.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000209.exe本机
Binder.Likebug清除成功2006-07-20 08:54D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000210.exe本机
Binder.Likebug清除成功2006-07-20 08:55D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000211.Exe本机
Binder.Likebug清除成功2006-07-20 08:55D:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000212.EXE本机
Binder.Likebug清除成功2006-07-20 08:55D:\Ougishi字uninstall.exe本机
Binder.Likebug清除成功2006-07-20 08:57E:\System Volume Information\_restore{E22F68EE-9389-44D5-ADBD-674B611369E5}\RP1A0000214.exe本机
Binder.Likebug清除成功2006-07-20 08:57E:RealPlayer10GOLD_cn.exe本机
Trojan.DL.Likebug删除成功2006-07-20 08:58F:like.bug.exe本机
Binder.Likebug删除成功2006-07-20 08:58F:jx2Setup103.exe本机

O五重海O - 2006-7-20 11:14:00

谁能帮帮我啊~~~

独孤豪侠 - 2006-7-20 11:19:00

鸽子完全可以杀,不过要手动杀....
http://forum.ikaka.com/topic.asp?board=28&artid=6979213 下载四楼的SRENG扫描工具扫一份日志上来.

O五重海O - 2006-7-20 12:31:00

2006-07-20,12:13:21

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

============================
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<EPSON ME 1><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P10 "EPSON ME 1" /O6 "USB001" /M "ME 1"> [SEIKO EPSON CORPORATION]
<BigDogPath><C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera> []
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe> [Tencent]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [Microsoft Corporation]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<RavTask><"C:\Program Files\瑞星\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Corel Reminder><; > []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<dddclient><; > []
<Gtwatch><; C:\WINDOWS\gtwatch.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "C:\Program Files\Messenger\Msmsgs.exe" /background> [Microsoft Corporation]
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<Torjan Program><; > []
<WinampAgent><; C:\Program Files\Winamp\winampa.exe> []

==================================
启动文件夹
[Watch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Watch.lnk><N>
[EPSON Online Register]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Online Register.lnk><N>

==================================
服务
[DuDu Accelerator / DuDuProsvc]
<><N/A>
[Rising Process Communication Center / RsCCenter]
<><N/A>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\瑞星\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[RUNDLL32_Alerter / RUNDLL32_Alerter]
<C:\WINDOWS\RUNDLL32.COM><N/A>

O五重海O - 2006-7-20 12:31:00

==================================
浏览器加载项
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[EpsonToolBandKicker Class]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} <C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll, SEIKO EPSON CORPORATION>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[EPSON Web-To-Page]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} <C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll, SEIKO EPSON CORPORATION>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[SLAProbe Control]
{7A97B026-F3BB-49F6-BEAC-75021AD45B4E} <C:\WINDOWS\DOWNLO~1\SLAProbe.ocx, AKAZAM Communications>
[Filetran Control]
{88734439-46D0-42C0-A13F-7E881EE550CF} <C:\PROGRA~1\Bluesky\BLUESK~1\filetran.ocx, Bluesky Studio(http://www.bluesky.cn)>
[KSHScan Control]
{ACFE8232-03C5-4AEC-AF5E-42B806724096} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KSHScan.ocx, kingsoft>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <, N/A>
[assist]
{1B0E7716-898E-48CC-9690-4E338E8DE1D3} <C:\PROGRA~1\3721\Assist\assist.dll, >
[KLeakScan Control]
{1FFFA3E9-A615-41FA-972D-7DB61F23AE90} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KLKScan.ocx, kingsoft>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[BlueskyVideo Control]
{2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <C:\PROGRA~1\Bluesky\BLUESK~1\v2.ocx, 蓝天工作室(http://www.bluesky.cn)>
[HtmlDlgSafeHelper Class]
{3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[SLAProbe Control]
{7A97B026-F3BB-49F6-BEAC-75021AD45B4E} <C:\WINDOWS\DOWNLO~1\SLAProbe.ocx, AKAZAM Communications>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Blueskyvoice Control]
{991481A7-4669-4E15-8C24-100404E1F5CB} <C:\PROGRA~1\Bluesky\BLUESK~1\BLUESK~2.OCX, 蓝天工作室(http://www.bluesky.cn)>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[KSHScan Control]
{ACFE8232-03C5-4AEC-AF5E-42B806724096} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KSHScan.ocx, kingsoft>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[上网助手]
{BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[Kingsoft DUBA OnlineScan]
{C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} <C:\WINDOWS\system32\kingsoft\ONLINE~1\kavclean.ocx, kingsoft>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__MPEG Moniker Class]
{CD3AFA89-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[EpsonToolBandKicker Class]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} <C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll, SEIKO EPSON CORPORATION>
[EPSON Web-To-Page]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} <C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll, SEIKO EPSON CORPORATION>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

O五重海O - 2006-7-20 12:32:00

==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 492][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 516][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 560][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 572][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 720][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 764][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 840][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 888][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 960][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1144][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\EBPMON24.DLL] <SEIKO EPSON CORPORATION><5, 3, 0, 0>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1368][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll] <SEIKO EPSON CORPORATION><1, 0, 0, 0>
[C:\Program Files\TENCENT\Adplus\SSAddr.dll] <Tencent><4, 1, 7, 72>
[PID: 1492][C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE] <SEIKO EPSON CORPORATION><3.00>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[PID: 1500][C:\WINDOWS\VM_STI.EXE] <BIGDOG><4, 2, 610, 4>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1536][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3292>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[PID: 1672][C:\Program Files\瑞星\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\瑞星\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\瑞星\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\瑞星\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\瑞星\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1684][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1704][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1784][C:\WINDOWS\twain_32\B12U12K\WATCH.exe] <Common Group><2, 3, 2, 7>
[C:\WINDOWS\twain_32\B12U12K\P9Spi.dll] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1824][C:\Program Files\瑞星\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 30>
[C:\Program Files\瑞星\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[C:\Program Files\瑞星\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\瑞星\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\瑞星\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\瑞星\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\瑞星\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\瑞星\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[PID: 276][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 1484][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[PID: 1592][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 2148][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 2444][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\Program Files\TENCENT\Adplus\SSAddr.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll] <SEIKO EPSON CORPORATION><1, 0, 0, 0>
[C:\Program Files\瑞星\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\system32\JPWB.IME] <常诚研制><4.00.950>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 2932][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\Program Files\TENCENT\Adplus\SSAddr.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll] <SEIKO EPSON CORPORATION><1, 0, 0, 0>
[C:\Program Files\瑞星\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[PID: 2220][C:\Program Files\瑞星\新建文件夹\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] <Tencent><4, 1, 7, 72>
[C:\WINDOWS\RUNDLL32Key.DLL] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

O五重海O - 2006-7-20 12:33:00

已经把日志发上来了~~
帮我看看怎么解决~~
谢谢了~~

独孤豪侠 - 2006-7-20 12:37:00

[DuDu Accelerator / DuDuProsvc]
<><N/A>
[Rising Process Communication Center / RsCCenter]
<><N/A>
1.开始-运行输入regedit,打开注册表编辑器，定位到HKEY_LOCAL_MACHINE\ SYSTEM \ CURRENTCONTROLSET \ SERVICES分支，删除左栏中的服务名"DuDu Accelerator或 DuDuProsvc"和"Rising Process Communication Center 或RsCCenter"

[RUNDLL32_Alerter / RUNDLL32_Alerter]
<C:\WINDOWS\RUNDLL32.COM><N/A>

1.开始-运行输入regedit,打开注册表编辑器，定位到HKEY_LOCAL_MACHINE\ SYSTEM \ CURRENTCONTROLSET \ SERVICES分支，删除左栏中的病毒服务名RUNDLL32_Alerter
2.重启系统，在“文件夹选项”的“查看”面板中勾选“显示系统文件”、“显示所有的文件和文件夹”两项，点击“确定”按钮。然后在%windows%下寻找病毒文件名C:\WINDOWS\RUNDLL32.COM C:\WINDOWS\RUNDLL32Key.DLL C:\WINDOWS\RUNDLL32.DLL C:\WINDOWS\RUNDLL32_hook.DLL 能找到的全部删除.

O五重海O - 2006-7-20 12:55:00

【回复“独孤豪侠”的帖子】
1.开始-运行输入regedit,打开注册表编辑器，定位到HKEY_LOCAL_MACHINE\ SYSTEM \ CURRENTCONTROLSET \ SERVICES分支，删除左栏中的病毒服务名RUNDLL32_Alerter

RUNDLL32_Alerter 这项好象找不到~

不言放弃 - 2006-7-20 13:01:00

【回复“O五重海O”的帖子】
http://www.syssafety.com/
下载安装SSM(支持中文)

在SSM中添加规则
禁止如下文件加载：
C:\WINDOWS\RUNDLL32.COM
C:\WINDOWS\RUNDLL32HIDE.DLL
C:\WINDOWS\RUNDLL32Key.DLL
C:\WINDOWS\RUNDLL32.dll(若存在的话)
C:\WINDOWS\RUNDLL32_hook.dll(若存在的话)

并将SSM设置为“自动加载”

重启机器

开始－－控制面板－－性能和维护－－管理工具－－服务
禁用RUNDLL32_Alerter服务

开始－－运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除RUNDLL32_Alerter文件夹

然后删除
C:\WINDOWS\RUNDLL32.COM
C:\WINDOWS\RUNDLL32HIDE.DLL
C:\WINDOWS\RUNDLL32Key.DLL
C:\WINDOWS\RUNDLL32.dll(若存在的话)
C:\WINDOWS\RUNDLL32_hook.dll(若存在的话)

提示：
SSM的使用方法参考http://forum.ikaka.com/topic.asp?board=28&artid=7990675

O五重海O - 2006-7-20 14:30:00

【回复“独孤豪侠”的帖子】
【回复“不言放弃”的帖子】

问题已经解决~~
谢谢各位帮忙了~~
以后要多向你们学习哦~~
谢谢谢谢~~!``!@

不言放弃 - 2006-7-20 14:31:00

引用:

【O五重海O的贴子】【回复“独孤豪侠”的帖子】
【回复“不言放弃”的帖子】

问题已经解决~~
谢谢各位帮忙了~~
以后要多向你们学习哦~~
谢谢谢谢~~!``!@
...........................

是用SSM解决的吗？

O五重海O - 2006-7-20 14:37:00

【回复“不言放弃”的帖子】
不是哦~`
用的最原始的方法~~
改注册表~`!`删文件~!~
呵呵~~

不言放弃 - 2006-7-20 14:59:00

引用:

【O五重海O的贴子】【回复“不言放弃”的帖子】
不是哦~`
用的最原始的方法~~
改注册表~`!`删文件~!~
呵呵~~

...........................

晕晕

[PID: 492][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 516][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 560][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>
[PID: 572][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\RUNDLL32HIDE.DLL] <N/A><N/A>

C:\WINDOWS\RUNDLL32HIDE.DLL已经插入到了如下四个核心系统进程中
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe

竟然用一般的方法也能搞定
怀疑中
真是不敢相信

mopery - 2006-7-20 15:09:00

文件删了没...
没删给我...

不言放弃 - 2006-7-20 15:29:00

引用:

【O五重海O的贴子】【回复“不言放弃”的帖子】
不是哦~`
用的最原始的方法~~
改注册表~`!`删文件~!~
呵呵~~

...........................

楼主还在不在啊

独孤豪侠 - 2006-7-20 15:36:00

呵呵...用最原始的方法搞定是先进的病毒....哈哈.....

mopery - 2006-7-20 15:38:00

我上星期也杀了只这样的..普通的方法..

我郁闷..楼主样本吖..又丢了个样本..

独孤豪侠 - 2006-7-20 15:42:00

下次偶注意......

瑞星卡卡安全论坛