斑竹这两个到底是什么病毒啊？Logo1_.EXE和rundl132.exe bbs.ikaka.com

終生學習 - 2006-9-10 16:58:00

病毒文件在C\WINDOWS下，每次出现都会把瑞星监控消失掉，不是任何时候都出现，是一打开大程序或者打开ACDSEE就会出现，而且两个病毒文件的图标会变，假如我打开游戏，图标就变成我打开那个游戏的图标，假如我打开ACDSS，那么图标就变成ACDSEE的图标，，我已经手动将两个文件删除，但是只要一运行一些程序就会出来，

附件: 3506222006910165132.JPG

deadmanzj - 2006-9-10 17:01:00

把那个样本发给偶，压缩加密123，发送到gudugd@yahoo.com.cn，第一个是威金，中了没救，全盘格掉重装

我无邪 - 2006-9-10 17:03:00

都是病毒
Logo1_.exe的专杀
http://forum.ikaka.com/topic.asp?board=28&artid=8098930
http://it.rising.com.cn/service/technology/RavVikiing.htm
用这个专杀到安全模式下查杀一次。
完后重启
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

終生學習 - 2006-9-10 17:04:00

而且只要Logo1_.EXE和rundl132.exe 的出现,那么又会生成其它文件到其他地方

附件: 3506222006910165635.jpg

終生學習 - 2006-9-10 17:09:00

........虽然是能杀得掉,但是那两个文件还是杀不了,,而且还在C\WINDOWS下生成COMMAND文件夹里面再声称RUNDLL32.EXE文件,还有一个在在C\WINDOWS下生成1SY.EXE,,其他SY.EXE都能杀掉,这个1SY.EXE和COMMAND下的RUNDLL32.EXE瑞星都检查不到,杀不到,,,
而且还发现在"病毒隔离"里看到的那几个文件,瑞星是能杀得到,但是病毒警告不停的弹出来,直到瑞星监控挺不住消失为止

附件: 3506222006910170112.jpg

deadmanzj - 2006-9-10 17:10:00

是威金，把样本发给我好吗？压缩加密123，发送到gudugd@yahoo.com.cn

終生學習 - 2006-9-10 17:24:00

哦还有三个现象就是昨天到现在我与另外一台电脑都动不动就断线,重启路油和MODEM才能继续上网.
另外一个现在就是 :只要出现那两个文件,那么还会在每个盘符和每个文件夹下生成_desktop.INI隐藏文件,弄的要清理很难清理
第三个还会在生成C:\WINDOWS\Intel\rundll32.exe

終生學習 - 2006-9-10 17:26:00

引用:

【deadmanzj的贴子】是威金，把样本发给我好吗？压缩加密123，发送到gudugd@yahoo.com.cn
………………

两个文件我手动删除了,,等再出现再发给你

終生學習 - 2006-9-10 17:32:00

2006-09-10,17:20:54

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<msnappau><"C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\msnappau.exe"> [Microsoft Corporation]
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<HDDGMon><C:\program files\YuanZhi\Recovery Genius\WinNT\HDDGMon.exe> []
<RavTask><"d:\Program Files\Rising\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<Tray><C:\WINDOWS\command\rundll32.exe> []
<zt><C:\WINDOWS\Intel\rundll32.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"d:\Program Files\Rising\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB391231M.LOG> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys> []

==================================
启动文件夹
[INTERNAT]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\INTERNAT.lnk><N>

==================================

終生學習 - 2006-9-10 17:32:00

服务
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"d:\Program Files\Rising\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"d:\Program Files\Rising\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><N/A>
[VMware Authorization Service / VMAuthdService]
<D:\Program Files\VMware Workstation\vmware-authd.exe><VMware, Inc.>
[VMware DHCP Service / VMnetDHCP]
<C:\WINDOWS\System32\vmnetdhcp.exe><VMware, Inc.>
[VMware Virtual Mount Manager Extended / vmount2]
<C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe><VMware, Inc.>
[VMware NAT Service / VMware NAT Service]
<C:\WINDOWS\System32\vmnat.exe><VMware, Inc.>

==================================
浏览器加载项
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <D:\game\浩方对战平台\GameClient.exe, >
[超级解霸10 Beta]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <d:\Program Files\超级解霸10\STHSDVD.EXE, herosoft>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\OFFICE~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\flashget.exe, >
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[MSN 工具栏]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[使用网际快车下载]
<D:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\Program Files\FlashGet\jc_all.htm, N/A>
[使用超级解霸播放]
<d:\Program Files\超级解霸10\MPURLGET.HTM, N/A>
[在Foxmail中添加该RSS频道/频道组]
<res://C:\WINDOWS\System32\fmrsslink.dll/201, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\OFFICE~1\OFFICE11\EXCEL.EXE/3000, N/A>
[用比特精灵下载(&B)]
<D:\Program Files\BitSpirit\bsurl.htm, N/A>

終生學習 - 2006-9-10 17:34:00

==================================
正在运行的进程
[PID: 480][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 536][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 608][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 620][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 780][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 832][d:\Program Files\Rising\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 860][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 956][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1112][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1152][d:\Program Files\Rising\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
[d:\Program Files\Rising\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[d:\Program Files\Rising\RsCommX.dll] <rising><18, 0, 0, 1>
[d:\Program Files\Rising\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[d:\Program Files\Rising\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Program Files\Rising\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Program Files\Rising\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[d:\Program Files\Rising\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[d:\Program Files\Rising\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[d:\Program Files\Rising\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[d:\Program Files\Rising\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[d:\Program Files\Rising\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[d:\Program Files\Rising\HookWeb.dll] <rising><18, 0, 0, 2>
[d:\Program Files\Rising\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[d:\Program Files\Rising\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Program Files\Rising\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[d:\Program Files\Rising\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[d:\Program Files\Rising\SpamEng.dll] <N/A><18, 0, 0, 6>
[d:\Program Files\Rising\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[d:\Program Files\Rising\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
[d:\Program Files\Rising\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Program Files\Rising\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Program Files\Rising\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[d:\Program Files\Rising\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
[d:\Program Files\Rising\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[d:\Program Files\Rising\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[d:\Program Files\Rising\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[d:\Program Files\Rising\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Program Files\Rising\ExtFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[d:\Program Files\Rising\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[d:\Program Files\Rising\RsStore.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[d:\Program Files\Rising\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1340][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1556][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[D:\PROGRA~1\FlashGet\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[d:\Program Files\Rising\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\System32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL] <Adobe Systems, Incorporated><7.0>
[d:\Program Files\UltraEdit-32\ue32ctmn.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\WINABCX.IME] <PKUETI><5.22.216>
[PID: 1676][d:\Program Files\Rising\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[d:\Program Files\Rising\RsCommX.dll] <rising><18, 0, 0, 1>
[d:\Program Files\Rising\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1856][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.5216>
[PID: 220][C:\program files\YuanZhi\Recovery Genius\WinNT\HDDGMon.exe] <><5, 0, 0, 350>
[C:\program files\YuanZhi\Recovery Genius\WinNT\SimCom.dll] <N/A><N/A>
[C:\program files\YuanZhi\Recovery Genius\WinNT\chkID.dll] <N/A><N/A>
[C:\program files\YuanZhi\Recovery Genius\WinNT\HMRes.dll] <><5, 0, 0, 350>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 228][D:\Program Files\Rising\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[D:\Program Files\Rising\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Program Files\Rising\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[PID: 328][C:\Program Files\MSN Messenger\MsnMsgr.Exe] <Microsoft Corporation><8.0.0792.00>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[PID: 432][C:\WINDOWS\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 1132][D:\Program Files\Winamp\Winamp.exe] <Nullsoft><2.81>
[D:\Program Files\Winamp\Plugins\IN_CDDA.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\IN_MIDI.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\read_file.dll] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\IN_MOD.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\IN_MP3.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\in_vorbis.dll] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\IN_WAVE.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\IN_WM.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\OUT_DISK.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\OUT_DS.DLL] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\out_wave.dll] <N/A><N/A>
[D:\Program Files\Winamp\Plugins\OUT_WM.DLL] <N/A><N/A>
[C:\WINDOWS\System32\tssoft32.acm] <DSP GROUP, INC.><1.01>
[C:\WINDOWS\System32\tsd32.dll] <N/A><N/A>
[C:\WINDOWS\System32\sl_anet.acm] <Sipro Lab Telecom Inc.><3.02>
[C:\WINDOWS\System32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>

終生學習 - 2006-9-10 17:34:00

[PID: 3152][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 2292][C:\WINDOWS\System32\taskmgr.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 1936][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 3084][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll] <Microsoft Corporation><01.01.2607.0>
[C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\mtbres.dll] <Microsoft Corporation><01.01.2607.0>
[D:\PROGRA~1\FlashGet\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\WINDOWS\System32\WINABCX.IME] <PKUETI><5.22.216>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[C:\Documents and Settings\Administrator\桌面\VirusKiller.scr] <Beijing Rising Tech. Co., Ltd.><1, 0, 0, 1>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 2752][C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\msnappau.exe] <Microsoft Corporation><01.02.0002.1001>
[C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\au_util.dll] <Microsoft Corporation><01.02.0002.1001>
[C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\TBDwnMgr.dll] <Microsoft Corporation><01.02.0002.1001>
[PID: 3880][D:\Program Files\Rising\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[D:\Program Files\Rising\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[D:\Program Files\Rising\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[D:\Program Files\Rising\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Program Files\Rising\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Program Files\Rising\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Program Files\Rising\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Program Files\Rising\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>
[PID: 2084][D:\资料\软件\系统工具\sreng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. ["d:\网页三剑客\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

waterblue - 2006-9-12 14:55:00

我们单位都中了这个病毒，他感染硬盘上全部的EXE文件，只有装卡巴的没中。

怎么办啊？

该s的木马啊 - 2006-9-12 15:04:00

很不幸，我也中这两个，，瑞星监控打不开。。。。

waterblue - 2006-9-13 18:26:00

Mcafee 4850病毒库已经可以查杀，清除这个病毒了，我今天修复了600多个exe文件。Mcafee不愧是杀软大厂，大家快去试试。

songsong123 - 2006-9-15 19:01:00

Mcafee 4850病毒库已经可以查杀，清除这个病毒了，我今天修复了600多个exe文件。Mcafee不愧是杀软大厂，大家快去试试。什么地方有下载啊??

終生學習 - 2006-9-15 19:05:00

引用:

【songsong123的贴子】Mcafee 4850病毒库已经可以查杀，清除这个病毒了，我今天修复了600多个exe文件。Mcafee不愧是杀软大厂，大家快去试试。什么地方有下载啊??
………………

哇都什么时候拉，还回帖，，病毒早就清除完了

瑞星卡卡安全论坛