【求助】Trojan.Agent.dur怎么杀阿？（在线等待） bbs.ikaka.com

小猪东东 - 2006-8-24 8:04:00

各位大侠帮忙拉，我昨晚用在线查毒查出许多Trojan.Agent.dur，而我的电脑上装的瑞星是05升级到06版的，病毒库是2006.8.23号，查不出任何病毒来，怎么回事阿？怎么杀毒阿？

附件: 696630200682475900.JPG

小猪东东 - 2006-8-24 8:05:00

电脑上杀毒的图片

附件: 696630200682475743.JPG

小猪东东 - 2006-8-24 8:41:00

哪位大哥来帮忙阿？

westbeck - 2006-8-24 8:42:00

病毒路径...
进安全模式扫一次看看...

小猪东东 - 2006-8-24 8:43:00

病毒基本都在c:\windwos\
安全模式好像近不去了;-(

westbeck - 2006-8-24 8:55:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

小猪东东 - 2006-8-24 9:00:00

2006-08-24,08:50:36

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [Microsoft Corporation]
<UIHost><"\Program Files\Logonui\Royale.exe"> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<helper.dll><; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
<mircosoftwinsows><; mirsoftwinsows.exe> []

==================================
启动文件夹
服务
[Autodesk Licensing Service / Autodesk Licensing Service]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IHiu Class]
{616E0E15-E4E4-4f8d-8212-0BC61A4ACBE4} <C:\WINDOWS\System32\COOLBHO.dll, >
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[AcroIEToolbarHelper Class]
{AE7CD045-E861-484f-8273-0445EE161910} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[T2BHO Class]
{B1D147E7-873E-4909-8127-695D9BB78728} <C:\WINDOWS\Downloaded Program Files\barhelp24.0.dll, HDT, Inc.>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Adobe PDF]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[SetupAct Class]
{3A289F34-B61E-4E9B-BD55-738EC858BB53} <C:\WINDOWS\System32\kingsoft\SetupActiveX\SetupActiveX.dll, kingsoft Corporation>
[天下搜索]
{56A7DC70-E102-4408-A34A-AE06FEF01586} <, N/A>
[UTPKES Control]
{94BE7FE8-CF75-4FD3-8A41-9D5FE7135511} <C:\WINDOWS\DOWNLO~1\UTPKES.ocx, 广州科友科技股份有限公司>
[GLWebAvt Control]
{C14D003A-DA41-4FEE-8204-62A94EAA29D1} <C:\WINDOWS\DOWNLO~1\GLWebAvt.ocx, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
<, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<, N/A>
[添加到QQ表情]
<, N/A>
[用QQ彩信发送该图片]
<, N/A>

==================================

小猪东东 - 2006-8-24 9:01:00

正在运行的进程
[PID: 368][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 424][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 448][\??\C:\WINDOWS\SYSTEM32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 492][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 504][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 668][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 732][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 812][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 884][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 916][C:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[C:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[C:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[C:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[C:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[C:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[C:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 14>
[C:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[C:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[C:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[C:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 1068][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS\System32\adimon.dll] <Autodesk, Inc.><3,0,14,176>
[C:\WINDOWS\system32\heidi3.dll] <Autodesk, Inc.><3,0,14,176>
[C:\WINDOWS\System32\AdobePDF.dll] <Adobe Systems Incorporated.><6.0.000>
[C:\Program Files\Adobe\Acrobat 6.0\Distillr\AdistRes.CHS] <N/A><N/A>
[C:\WINDOWS\system32\E_SL2602.DLL] <SEIKO EPSON CORPORATION><1, 3, 0, 0>
[PID: 1168][C:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1432][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.13.10.3140>
[PID: 1784][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.1.63.0>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.1.63.0>
[C:\WINDOWS\System32\mp3infp.dll] <win32lab.com><2.44.3.0>
[C:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll] <Adobe Systems Inc.><1.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.chs] <Adobe Systems Inc.><1.0.0.2003051500>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500>
[PID: 1964][C:\Program Files\Rising\Rfw\rfwmain.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
[C:\Program Files\Rising\Rfw\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[C:\Program Files\Rising\Rfw\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rfw\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1980][c:\program files\rising\rfw\rfwsrv.exe] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[c:\program files\rising\rfw\RfwRule.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[c:\program files\rising\rfw\rfwlog.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[c:\program files\rising\rfw\Rfwdrv.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[c:\program files\rising\rfw\MonDrv.dll] <rs><1, 0, 0, 4>
[c:\program files\rising\rfw\ProcLib.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[c:\program files\rising\rfw\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[PID: 316][C:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 332][C:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 32>
[C:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
[C:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[C:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 348][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1600][C:\Program Files\AutoCAD R14\acad.exe] <Autodesk, Inc.><S.0.79.0>
[C:\Program Files\AutoCAD R14\acfirst.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\SH31W32.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\uclib32.dll] <Autodesk Inc.><1, 0, 1, 6>
[C:\Program Files\AutoCAD R14\dswhip.dll] <Autodesk, Inc.><I3.0>
[C:\WINDOWS\System32\heidi3.dll] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\dlint3.dll] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\ACW32S32.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\libacge.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\Adctrls.dll] <><1, 0, 0, 1>
[C:\Program Files\AutoCAD R14\acadres.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\acadbtn.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\drv\plsys.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\oleaprot.arx] <N/A><N/A>
[C:\PROGRA~1\AUTOCA~1\acadapp.arx] <N/A><N/A>
[C:\PROGRA~1\AUTOCA~1\acmted.arx] <Autodesk><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad1.arx] <><2, 6, 0, 1>
[C:\WINDOWS\System32\Tssd14S.dll] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad2.arx] <北京探索者软件技术有限公司><2002, 2003, 8, 22>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad3.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad4.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad5.arx] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad6.arx] <北京探索者软件技术有限公司><14, 2003, 9, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad7.arx] <><2002, 2004, 2, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad8.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad9.arx] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad10.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad11.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad12.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad13.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TSSD.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\gdi3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\lfb3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\rblast3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\WINDOWS\System32\gdifont3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\PROGRA~1\AUTOCA~1\match.arx] <N/A><N/A>

小猪东东 - 2006-8-24 9:03:00

[PID: 360][C:\Program Files\AutoCAD R14\acad.exe] <Autodesk, Inc.><S.0.79.0>
[C:\Program Files\AutoCAD R14\acfirst.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\SH31W32.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\uclib32.dll] <Autodesk Inc.><1, 0, 1, 6>
[C:\Program Files\AutoCAD R14\dswhip.dll] <Autodesk, Inc.><I3.0>
[C:\WINDOWS\System32\heidi3.dll] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\dlint3.dll] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\ACW32S32.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\libacge.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\Adctrls.dll] <><1, 0, 0, 1>
[C:\Program Files\AutoCAD R14\acadres.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\acadbtn.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\drv\plsys.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\oleaprot.arx] <N/A><N/A>
[C:\PROGRA~1\AUTOCA~1\acadapp.arx] <N/A><N/A>
[C:\PROGRA~1\AUTOCA~1\acmted.arx] <Autodesk><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad1.arx] <><2, 6, 0, 1>
[C:\WINDOWS\System32\Tssd14S.dll] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad2.arx] <北京探索者软件技术有限公司><2002, 2003, 8, 22>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad3.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad4.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad5.arx] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad6.arx] <北京探索者软件技术有限公司><14, 2003, 9, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad7.arx] <><2002, 2004, 2, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad8.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad9.arx] <N/A><N/A>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad10.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad11.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad12.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TssdCad13.arx] <><1, 0, 0, 1>
[C:\Program Files\TszCAD\Tssd14S\sys\TSSD.dll] <N/A><N/A>
[C:\Program Files\AutoCAD R14\gdi3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\lfb3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\Program Files\AutoCAD R14\rblast3.hdi] <Autodesk, Inc.><3,0,14,176>
[C:\WINDOWS\System32\gdifont3.hdi] <Autodesk, Inc.><3,0,14,176>
[PID: 772][C:\Program Files\MwIE\MwIE.exe] <><3, 8, 0, 0>
[C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.1.63.0>
[C:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\WINDOWS\System32\cspyii.ime] <中文之星><1, 0, 0, 1>
[PID: 1304][C:\Documents and Settings\zhang\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

westbeck - 2006-8-24 9:21:00

运行System Repair Engineer，使用“系统修复，文件关联"来修复所有文件关联
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项
<mircosoftwinsows><; mirsoftwinsows.exe>
运行System Repair Engineer，使用“系统修复，浏览器加载项”来删除以下选项
[IHiu Class]
{616E0E15-E4E4-4f8d-8212-0BC61A4ACBE4} <C:\WINDOWS\System32\COOLBHO.dll, >
显示隐藏文件删除:
mirsoftwinsows.exe
C:\WINDOWS\System32\COOLBHO.dll

小猪东东 - 2006-8-24 9:34:00

非常感谢,有几点不明白

运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项
<mircosoftwinsows><; mirsoftwinsows.exe>
里面没有阿,

显示隐藏文件删除:
mirsoftwinsows.exe
C:\WINDOWS\System32\COOLBHO.dll
指什么?

附件: 696630200682492657.JPG

westbeck - 2006-8-24 9:39:00

显示隐藏文件删除:
mirsoftwinsows.exe
C:\WINDOWS\System32\COOLBHO.dll
指的是让你去删除这两个文件...

westbeck - 2006-8-24 9:41:00

运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项
<mircosoftwinsows><; mirsoftwinsows.exe>
里面没有阿,
这样吧,开始-运行输入regedit,打开注册表编辑器，搜一下mirsoftwinsows,把找到的都删除

小猪东东 - 2006-8-24 14:05:00

非常感谢，删掉两个文件阿，重新用瑞星杀毒就查出病毒来了

附件: 6966302006824135717.JPG

小猪东东 - 2006-8-24 14:07:00

重启后，再用在线查毒，发现已经没有病毒了

附件: 6966302006824135923.JPG

【火影】我爱罗 - 2006-8-24 14:19:00

瑞星卡卡安全论坛