【急救】『不要无视我』→密碼小賊太猖狂。。。。怎么沉这么快...顶死我了 bbs.ikaka.com

錵Ζǐ - 2006-9-1 8:45:00

HijackThis_zww汉化版扫描日志 V1.99.1
保存于 8:36:06, 日期 2006-9-1
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Starsoftcomm\StarCenter\alert.exe
C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe
E:\工具软件\涂鸦\bin\jusched.exe
C:\Program Files\KV2005\KVMonXP.kxp
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\KV2005\KVSrvXP.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\KV2005\TrojDie.kxp
C:\Program Files\KV2005\KRegEx.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Starsoftcomm\StarCenter\AutoUpd.EXE
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\explorer.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\72y.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\WINDOWS\system32\DllHost.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\KV2005\KvXP.kxp
C:\Program Files\Internet Explorer\iexplore.exe
E:\硬件工具\HijackThis1991\HijackThis1991zww.exe

O1 - Hosts: 218.89.137.70 qqgm.com
O1 - Hosts: 218.89.137.70 www.qqgm.com
O1 - Hosts: 218.89.137.70 chinawg.net
O1 - Hosts: 218.89.137.70 www.chinawg.net
O1 - Hosts: 218.89.137.70 bbs.chinawg.net
O1 - Hosts: 218.89.137.70 ad.chinawg.net
O1 - Hosts: 218.89.137.70 91530.com
O1 - Hosts: 218.89.137.70 www.91530.com
O1 - Hosts: 218.89.137.70 177g.com
O1 - Hosts: 218.89.137.70 www.177g.com
O1 - Hosts: 218.89.137.70 177g.net
O1 - Hosts: 218.89.137.70 www.177g.net
O1 - Hosts: 218.89.137.70 www.paodian.com
O1 - Hosts: 218.89.137.70 www.guacq.com
O1 - Hosts: 218.89.137.70 cq.30ok.com
O1 - Hosts: 218.89.137.70 555china.com
O1 - Hosts: 218.89.137.70 www.555china.com
O1 - Hosts: 218.89.137.70 love.555china.com
O1 - Hosts: 218.89.137.70 xxlink.net
O1 - Hosts: 218.89.137.70 www.xxlink.net
O1 - Hosts: 218.89.137.70 36161.com
O1 - Hosts: 218.89.137.70 www.36161.com
O1 - Hosts: 218.89.137.70 37ww.net
O1 - Hosts: 218.89.137.70 www.37ww.net
O1 - Hosts: 218.89.137.70 sf52.net
O1 - Hosts: 218.89.137.70 www.sf52.net
O1 - Hosts: 218.89.137.70 dv96.com
O1 - Hosts: 218.89.137.70 www.dv96.com
O1 - Hosts: 218.89.137.70 878g.com
O1 - Hosts: 218.89.137.70 www.878g.com
O1 - Hosts: 218.89.137.70 kan4f.com
O1 - Hosts: 218.89.137.70 www.kan4f.com
O1 - Hosts: 218.89.137.70 8a6.net
O1 - Hosts: 218.89.137.70 www.8a6.net
O1 - Hosts: 218.89.137.70 gcq365.com
O1 - Hosts: 218.89.137.70 www.gcq365.com
O1 - Hosts: 218.89.137.70 cq.gcq365.com
O1 - Hosts: 218.89.137.70 tt45.cn
O1 - Hosts: 218.89.137.70 www.tt45.cn
O1 - Hosts: 218.89.137.70 h28.com
O1 - Hosts: 218.89.137.70 www.h28.com
O1 - Hosts: 218.89.137.70 mir.h28.com
O1 - Hosts: 218.89.137.70 okgua.com
O1 - Hosts: 218.89.137.70 www.okgua.com
O1 - Hosts: 218.89.137.70 ucpk.com
O1 - Hosts: 218.89.137.70 www.ucpk.com
O1 - Hosts: 218.89.137.70 8sf.org
O1 - Hosts: 218.89.137.70 www.8sf.org
O1 - Hosts: 218.89.137.70 666.8sf.org
O1 - Hosts: 218.89.137.70 y27.com
O1 - Hosts: 218.89.137.70 www.y27.com
O1 - Hosts: 218.89.137.70 pao.y27.com
O1 - Hosts: 218.89.137.70 paogame.net
O1 - Hosts: 218.89.137.70 paogame.com
O1 - Hosts: 218.89.137.70 www.paogame.net
O1 - Hosts: 218.89.137.70 www.paogame.com
O1 - Hosts: 218.89.137.70 waigua8.com
O1 - Hosts: 218.89.137.70 www.waigua8.com
O1 - Hosts: 218.89.137.70 waigua8.net
O1 - Hosts: 218.89.137.70 www.waigua8.net
O1 - Hosts: 218.89.137.70 99945.com
O1 - Hosts: 218.89.137.70 www.99945.com
O1 - Hosts: 218.89.137.70 fxin2008.com
O1 - Hosts: 218.89.137.70 www.fxin2008.com
O1 - Hosts: 218.89.137.70 51vip.net
O1 - Hosts: 218.89.137.70 www.51vip.net
O1 - Hosts: 218.89.137.70 wg.51vip.net
O1 - Hosts: 218.89.137.70 hahawg.net
O1 - Hosts: 218.89.137.70 www.hahawg.net
O1 - Hosts: 218.89.137.70 6657.com
O1 - Hosts: 218.89.137.70 www.6657.com
O1 - Hosts: 218.89.137.70 5qw.com
O1 - Hosts: 218.89.137.70 www.5qw.com
O1 - Hosts: 218.89.137.70 kekewg.com
O1 - Hosts: 218.89.137.70 www.kekewg.com
O1 - Hosts: 218.89.137.70 27pk.com
O1 - Hosts: 218.89.137.70 27pk.net
O1 - Hosts: 218.89.137.70 www.27pk.com
O1 - Hosts: 218.89.137.70 www.27pk.net
O1 - Hosts: 218.89.137.70 92sf.net
O1 - Hosts: 218.89.137.70 92sf.com
O1 - Hosts: 218.89.137.70 www.92sf.net
O1 - Hosts: 218.89.137.70 www.92sf.com
O1 - Hosts: 218.89.137.70 3333sf.com
O1 - Hosts: 218.89.137.70 www.3333sf.com
O1 - Hosts: 218.89.137.70 cssf999.com
O1 - Hosts: 218.89.137.70 cssf999.net
O1 - Hosts: 218.89.137.70 www.cssf999.com
O1 - Hosts: 218.89.137.70 www.cssf999.net
O1 - Hosts: 218.89.137.70 wg2046.com
O1 - Hosts: 218.89.137.70 www.wg2046.com
O1 - Hosts: 218.89.137.70 sf123.com
O1 - Hosts: 218.89.137.70 wwww.sf123.com
O1 - Hosts: 218.89.137.70 guaji.sf123.com
O1 - Hosts: 218.89.137.70 sf123.com
O1 - Hosts: 218.89.137.70 sf123.net
O1 - Hosts: 218.89.137.70 www.sf123.com
O1 - Hosts: 218.89.137.70 www.sf123.net
O1 - Hosts: 218.89.137.70 58cqsf.com
O1 - Hosts: 218.89.137.70 www.58cqsf.com
O1 - Hosts: 218.89.137.70 78cq.com
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\KV2005\KvShell_1.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll
O3 - IE工具栏增项: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2005\KvShell_1.dll
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - 启动项HKLM\\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - 启动项HKLM\\Run: [Alert] C:\Program Files\Starsoftcomm\StarCenter\alert.exe
O4 - 启动项HKLM\\Run: [StarCenter] C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe
O4 - 启动项HKLM\\Run: [AutoUpd] C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] E:\工具软件\涂鸦\bin\jusched.exe
O4 - 启动项HKLM\\Run: [KvMonXP] "C:\Program Files\KV2005\KVMonXP.kxp" /auto
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [KvXP] "C:\Program Files\KV2005\KvXP.kxp" /ScanBoot /ScanSys
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\kvwspxp.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://samowest.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146048350173
O16 - DPF: {74447F9C-5691-4A9A-8BE4-564092E40B03} (VnetAnprIns Class) - http://plugin.vnet.cn/VnetPluginIns.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{DDA4EA79-679A-4A2E-BBD1-286956C72787}: NameServer = 218.2.135.1 221.228.255.1
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - NT 服务: KVSrvXP - JiangMin New Tech Ltd. - C:\PROGRA~1\KV2005\KVSrvXP.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

附件: 71110020069183756.jpg

錵Ζǐ - 2006-9-1 8:50:00

這個毒中了有段日子了
應該是針對密碼的武漢男生
用江民更新后打開全部監視殺都說沒有病毒
（以前還查到過1次，沒有清除掉，後來就沒查到過了）
於是就養到了現在
沒料到天天上我扣扣就算了錢花光了
沒什麽好干了巴
居然把我的扣扣秀也扒光
真實太有職業道德了
1偷到底！

如果有高手可以幫忙
不勝感激

錵Ζǐ - 2006-9-1 9:01:00

上去上去！~

錵Ζǐ - 2006-9-1 9:11:00

上去上去

錵Ζǐ - 2006-9-1 9:19:00

[C:\Program Files\Tencent\QQ\QQZip.dll] <tencent><0, 3, 2, 4>
[C:\Program Files\Tencent\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\Tencent\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[C:\Program Files\Tencent\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 6, 60>
[C:\Program Files\Tencent\QQ\QQSettingCtrl.dll] <><1, 0, 0, 1>
[PID: 1880][C:\WINDOWS\system32\DllHost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\KV2005\FrogAgent.dll] <JiangMin Ltd.><9.0.0.500>
[C:\Program Files\KV2005\UpdateX.dll] <JiangMin Ltd.><8, 0, 0, 0>
[C:\Program Files\KV2005\FrogAgentPS.dll] <JiangMin Ltd.><9.0.0.500>
[PID: 2200][C:\WINDOWS\system32\drwtsn32.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 3028][C:\WINDOWS\system32\drwtsn32.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\Program Files\KV2005\KvXP.kxp] <Jiangmin Co.Ltd><9, 0, 5, 1205>
[C:\Program Files\KV2005\UpdateX.dll] <JiangMin Ltd.><8, 0, 0, 0>
[C:\Program Files\KV2005\FrogAgentPS.dll] <JiangMin Ltd.><9.0.0.500>
[C:\Program Files\KV2005\APIImpl.dll] <JiangMin Ltd.><9.0.0.500>
[C:\Program Files\KV2005\PProtect.dll] <北京江民新科技术公司><1.0.121>
[C:\Program Files\KV2005\KvXpUw.dll] <jiangmin software><9, 0, 5, 922>
[C:\Program Files\KV2005\KVEnhO.dll] <JiangMin New Tech Ltd.><9, 0, 5, 507>
[C:\Program Files\KV2005\lang\Kvxp0804_1.lng] <N/A><N/A>
[C:\Program Files\KV2005\GUIExt.dll] <JiangMin Ltd.><9.0.0.501>
[C:\Program Files\KV2005\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\WINDOWS\system32\WINABCX.IME] <PKUETI><5.22.216>
[C:\Program Files\KV2005\VirusUpload.dll] <N/A><2, 0, 0, 0>
[C:\Program Files\KV2005\KVWPSet.dll] <N/A><9, 0, 0, 505>
[C:\Program Files\KV2005\KVEnhD.dll] <JiangMin Ltd.><9, 1, 5, 423>
[C:\Program Files\KV2005\KVEnhC.DLL] <JiangMin Ltd.><9, 1, 5, 603>
[C:\Program Files\KV2005\KVEnhS.dll] <JiangMin New Tech Ltd.><9, 0, 5, 607>
[C:\Program Files\KV2005\KVEnhJ.dll] <JiangMin New Tech. Ltd.><9, 1, 5, 508>
[C:\Program Files\KV2005\KVExtLZH.dll] <N/A><N/A>
[C:\Program Files\KV2005\KVExtCab.dll] <JiangMin New Tech. Ltd.><9, 0, 5, 621>
[C:\Program Files\KV2005\KVExtEml.dll] <JiangMin New Tech. Ltd.><9, 0, 0, 503>
[C:\Program Files\KV2005\KvExtRar.dll] <JiangMin Ltd.><9, 1, 0, 804>
[C:\Program Files\KV2005\KvExtZip.dll] <JiangMin Ltd.><9, 0, 5, 420>
[C:\Program Files\KV2005\KVExtZ.dll] <Jiangmin New Tech.><9.1.0.503>
[C:\Program Files\KV2005\KVExtGz.dll] <Jiangmin New Tech.><9, 0, 5, 420>
[C:\Program Files\KV2005\KVExtTar.dll] <Jiangmin New Tech.><9, 0, 5, 420>
[C:\Program Files\KV2005\KVEnhK.dll] <JiangMin Ltd.><9, 1, 5, 507>
[PID: 3484][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\WINABCX.IME] <PKUETI><5.22.216>
[C:\Program Files\KV2005\KvShell_1.dll] <JiangMin Lmt><9, 0, 5, 1205>
[C:\Program Files\KV2005\UpdateX.dll] <JiangMin Ltd.><8, 0, 0, 0>
[C:\Program Files\KV2005\lang\Kvxp0804_1.lng] <N/A><N/A>
[C:\Program Files\KV2005\APIImpl.dll] <JiangMin Ltd.><9.0.0.500>
[C:\Program Files\KV2005\GUIExt.dll] <JiangMin Ltd.><9.0.0.501>
[C:\Program Files\KV2005\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1>
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] <><1, 0, 0, 169>
[C:\WINDOWS\system32\KvWspXp.dll] <JiangMin Ltd.><9, 0, 5, 324>
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx] <Macromedia, Inc.><8,5,0,133>
[C:\WINDOWS\system32\JPWB.IME] <常诚研制><4.00.950>
[C:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin] <N/A><N/A>
[C:\WINDOWS\system32\WINABCX.IME] <PKUETI><5.22.216>
[C:\WINDOWS\system32\KvWspXp.dll] <JiangMin Ltd.><9, 0, 5, 324>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\LUALIB.DLL] <Tecgraf, PUC-Rio><5.0.00>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\LUA.DLL] <Tecgraf, PUC-Rio><5.0.00>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SHELLD~1.{00\translib.dll] <N/A><N/A>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\6657.dll] <N/A><N/A>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_4\krnln.fne] <><1, 0, 0, 1>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\E_4\dp1.fne] <N/A><N/A>
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] <><1, 0, 0, 169>
[PID: 2156][E:\硬件工具\HijackThis1991\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\system32\WINABCX.IME] <PKUETI><5.22.216>
[C:\WINDOWS\system32\KvWspXp.dll] <JiangMin Ltd.><9, 0, 5, 324>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

有毒必问 - 2006-9-1 9:32:00

在安全模式下
删除
E:\工具软件\涂鸦\bin\jusched.exe
C:\WINDOWS\system32\DllHost.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\72y.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin

取消启动
O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] E:\工具软件\涂鸦\bin\jusched.exe

有毒必问 - 2006-9-1 9:33:00

好像还不是很准确,我想这样应该K不掉,但试一下吧

錵Ζǐ - 2006-9-1 9:38:00

恩！~~！

錵Ζǐ - 2006-9-1 9:39:00

怎么取消启动啊~~~

錵Ζǐ - 2006-9-1 9:39:00

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\72y.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\shell.dll.{00021401-0000-0000-C000-000000000046}\superman.bin

这是我的外挂~

影子110 - 2006-9-1 9:58:00

关闭IE,
清空临时文件夹~
IE》属性》删除文件（包括脱机文件）》确定
修复所有的01项~

另,有人说外挂也就像病毒一样~~~(你能确保自己的这个就不是?除非这个外挂程序是你自己写的~)

再一个,能找到以前查到的那个病毒的文件名和路径吗?到杀软的历史记录里看看~

錵Ζǐ - 2006-9-1 10:12:00

后来又杀了太多次了
找不到以前那个毒的资料了

以前去删过它删不动

外挂带来的毒是有可能的

我想杀掉这毒

外挂留下~

錵Ζǐ - 2006-9-1 10:13:00

现在查毒也查不出
就算杀掉了我又怎么知道~
难道等QQ还会不会给人上吗

mopery - 2006-9-1 10:25:00

杀软都没装...

清空
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\

修复所有01项..

錵Ζǐ - 2006-9-1 10:46:00

好烦噢谁来我家给我弄啊~！~！

錵Ζǐ - 2006-9-1 10:49:00

ADMINI~1
里面没有 →LOCALS~1\Temp\

影子110 - 2006-9-1 10:59:00

ADMINI~1就是你现在登陆的用户名~

錵Ζǐ - 2006-9-1 11:04:00

windows”=“%SystemDir%\winscok.exe

.winscok.exe运行后，会调用install.dll，设置2个系统挂钩函数。用户只需在资源管理器中点击了鼠标左键，挂钩函数即被激活，以EXPLORER.EXE的身份调用winscok.dll。而病毒主程序winscok.exe此时结束运行。
怪不得我看你的日志就找不到头。。

錵Ζǐ - 2006-9-1 11:08:00

这是以前查到没清掉的东东

我的临时文件夹不知道去哪了

附件: 711100200691110009.jpg

影子110 - 2006-9-1 17:56:00

打开我的电脑》工具》文件夹选项》查看》显示所有文件，不隐藏受保护的操作系统文件》确定

需要显示所有文件才能看到

瑞星卡卡安全论坛