〖求助〗mswdm.exe的问题，论坛里的专题贴无效啊 bbs.ikaka.com

芢歲釺歲 - 2006-9-15 22:09:00

如题

按照贴子上的做了
可还是不管用

mswdm.exe依然存在

请问怎么回事啊？我一步一步的按照论坛里的贴做的，可还是没把删除，急啊

baohe - 2006-9-15 22:15:00

【回复“芢歲釺歲”的帖子】
是木马文件不能删除？还是你自己没动手删除？
请说清楚。

芢歲釺歲 - 2006-9-16 3:51:00

木马文件我只知道还在我电脑里

手动删除
但是到最后没效果

懂的人也麻烦帮帮忙啊
我要郁闷死了

Greysign - 2006-9-16 6:48:00

你不会也是删除MSWMDM.dll吧..这个可是系统文件.删了会回来的...
很多人都和我反映找不到mswdm.exe.
其实有那么难吗.他不就系统加隐藏属性= =|||仔细照我说的那样做肯定能删.
假如删除以后还有.只能说你经常使用的或经常上的网带有这个病毒

芢歲釺歲 - 2006-9-16 7:16:00

晕``谁能帮忙想想问题出在哪里啊？

注册表里的LOAD已经完全删除（应该删了，WINDOWS里没）
启动里的那个9也完全删除（应该删了，SREng启动里已经没了）
QQ完全卸了！
也重起了，隐藏文件显示之类的也都设置了。

为什么最后回收站里没病毒文件啊？

拜托。。。。急啊

baohe - 2006-9-16 8:39:00

引用:

【芢歲釺歲的贴子】晕``谁能帮忙想想问题出在哪里啊？

注册表里的LOAD已经完全删除（应该删了，WINDOWS里没）
启动里的那个9也完全删除（应该删了，SREng启动里已经没了）
QQ完全卸了！
也重起了，隐藏文件显示之类的也都设置了。

为什么最后回收站里没病毒文件啊？

拜托。。。。急啊

………………

你动手删除那些文件了没？
删除的结果如何？
删了，但删不掉？
另：你是按照那个帖子的方法做的？给出那个帖子的地址。
把问题说清楚。

芢歲釺歲 - 2006-9-16 11:40:00

斑竹啊

我是完全按照这个贴子做的

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=7

能帮忙想想问题出在哪里吗？

芢歲釺歲 - 2006-9-16 13:04:00

。。。。我要哭了

本来电脑好好，居然在我最信任的2个网站中毒了

从头爱你 - 2006-9-16 13:26:00

引用:

【芢歲釺歲的贴子】。。。。我要哭了

本来电脑好好，居然在我最信任的2个网站中毒了
………………

芢歲釺歲 - 2006-9-16 19:30:00

2006-09-16,19:17:01

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]

<MSMSGS><; ; "C:\Program Files\Messenger\msmsgs.exe" /background> []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]

<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]

<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [Microsoft Corporation]

<RavTask><"G:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]

<HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe> [Intel Corporation]

<IgfxTray><; C:\WINDOWS\system32\igfxtray.exe> [Intel Corporation]

<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]

<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]

<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> []

<QuickTime Update Completion 0><; "C:\WINDOWS\system32\QuickTime\QuickTimeUpdateHelper.exe" -uninstallwithapps -destfullpath "d:\program files\QuickTimeUpdater.exe" -sourcefullpath "d:\program files\TempUpdater.exe" -atboottime "QuickTime Update Completion 0"> []

<TotalRecorderScheduler><; ; ; "D:\Music\TotRecSched.exe"> [High Criteria inc.]

<UnlockerAssistant><; ; "D:\Program Files\Unlocker\UnlockerAssistant.exe"> []

<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

<shell><Explorer.exe> [Microsoft Corporation]

<Userinit><C:\WINDOWS\system32\Userinit.exe> [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

<AppInit_DLLs><> []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

<UIHost><LogonUI.EXE> [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]

<WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll> [System Safety Limited]

芢歲釺歲 - 2006-9-16 19:31:00

服务
[Rising Process Communication Center / RsCCenter]

<"G:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]

<"G:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[StarWind iSCSI Service / StarWindService]

<D:\Program Files\120%\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>
[Ulead Burning Helper / UleadBurningHelper]

<C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe><Ulead Systems, Inc.>

芢歲釺歲 - 2006-9-16 19:32:00

浏览器加载项
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <G:\qq\QQ.EXE, TENCENT>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology>
[MoxtvUploadX Control]
{30348281-949B-4E9F-8A99-44EC423EB66D} <C:\WINDOWS\DOWNLO~1\MOXUPL~1.OCX, >
[photo_uploader Control]
{A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[IeCatch5 Class]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[MoxtvUploadX Control]
{30348281-949B-4E9F-8A99-44EC423EB66D} <C:\WINDOWS\DOWNLO~1\MOXUPL~1.OCX, >
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[AdPutHelper.AdHelper]
{631EDC67-F035-49BA-B8BC-983B474E9BB4} <C:\WINDOWS\system32\AdPutHelper.dll, chuangya>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet>
[photo_uploader Control]
{A984ED9F-E8DA-44E5-BC18-C14B9ABEF79D} <C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[BHelper Class]
{F2E37336-BFDB-409B-8D0E-6F013C438B20} <C:\WINDOWS\761o6bc0.dll, N/A>
[上传到QQ网络硬盘]
<G:\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<D:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<D:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<G:\qq\AddPanel.htm, N/A>
[添加到QQ表情]
<G:\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<G:\qq\SendMMS.htm, N/A>
[用比特精灵下载(&B)]
<G:\BitSpirit\bsurl.htm, N/A>

芢歲釺歲 - 2006-9-16 19:33:00

正在运行的进程
[PID: 508][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 568][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 592][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\SSMWinlogonEx.dll] <System Safety Limited><2.2.0.583>
[PID: 640][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 652][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 804][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 848][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 916][G:\Program Files\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 932][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 972][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1096][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1176][G:\Program Files\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
[G:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Program Files\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[G:\Program Files\Rising\Rav\HOOKSYS.dll] <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
[G:\Program Files\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
[G:\Program Files\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[G:\Program Files\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[G:\Program Files\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[G:\Program Files\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[G:\Program Files\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[G:\Program Files\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Program Files\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[G:\Program Files\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[G:\Program Files\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[G:\Program Files\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
[G:\Program Files\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
[G:\Program Files\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Program Files\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Program Files\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[G:\Program Files\Rising\Rav\RSUnpack.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
[G:\Program Files\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[G:\Program Files\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[G:\Program Files\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
[G:\Program Files\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Program Files\Rising\Rav\ExtOLE.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[G:\Program Files\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1288][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\PROGRA~1\FLASHGET\jccatch.dll] <FlashGet><1, 1, 5, 0>
[G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[PID: 1496][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.27>
[PID: 1516][G:\Program Files\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[PID: 1540][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1652][G:\Program Files\Rising\Rav\Ravmon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
[G:\Program Files\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
[G:\Program Files\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[G:\Program Files\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[G:\Program Files\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Program Files\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1668][C:\Program Files\河南铁通宽带拨号软件\HNMainUI.exe] <N/A><2, 3, 0, 1>
[C:\Program Files\河南铁通宽带拨号软件\HNKernel.dll] <HelloNet><2.2.0.1>
[C:\Program Files\河南铁通宽带拨号软件\HNUtils.dll] <N/A><2, 2, 0, 1>
[C:\Program Files\河南铁通宽带拨号软件\HNRes_0804.dll] <N/A><2, 2, 0, 1>
[C:\Program Files\河南铁通宽带拨号软件\plugins\Diagnose.dll] <HelloNet><2.2.0.1>
[PID: 1752][G:\Program Files\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[G:\Program Files\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[G:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 264][D:\Program Files\120%\Alcohol 120\StarWind\StarWindService.exe] <Rocket Division Software><2.6.1 Build 0x20050401>
[PID: 420][C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe] <Ulead Systems, Inc.><1, 0, 0, 4>
[PID: 496][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1104][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2384][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[D:\Program Files\MagicSet\haokanbar.dll] <Xiang Feng Technology><2, 2, 0, 1612>
[D:\PROGRA~1\FLASHGET\jccatch.dll] <FlashGet><1, 1, 5, 0>
[G:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 3672][D:\PROGRA~1\FLASHGET\flashget.exe] <FlashGet.com><1, 7, 2, 0>
[PID: 2836][C:\Program Files\Windows Media Player\wmplayer.exe] <Microsoft Corporation><10.00.00.3802>
[G:\Program Files\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\system32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\WINDOWS\system32\ffdshow.ax] <N/A><1, 0, 0, 1>
[PID: 3560][G:\Program Files\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

芢歲釺歲 - 2006-9-16 19:34:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

轩辕小聪 - 2006-9-16 19:35:00

引用:

你的意思是：
注册表里的LOAD已经完全删除（应该删了，WINDOWS里没）
启动里的那个9也完全删除（应该删了，SREng启动里已经没了）
QQ完全卸了！
也重起了，隐藏文件显示之类的也都设置了。
然后你就期待着这样回收站就会自动出现那个文件？！
如果这样想就错了，做完了这些，文件要你自己去删到回收站，而不是说它自己就跑到回收站了。

baohe - 2006-9-16 20:23:00

引用:

【芢歲釺歲的贴子】斑竹啊

我是完全按照这个贴子做的

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=7

能帮忙想想问题出在哪里吗？

………………

你的问题是“mswdm.exe”如何查杀。

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=1————这个帖子是讲“ Ravdm.exe的查杀”

蛮拧！！

baohe - 2006-9-16 20:32:00

【回复“芢歲釺歲”的帖子】
你可以看看这个帖子：
http://forum.ikaka.com/topic.asp?board=28&artid=8154055

轩辕小聪 - 2006-9-16 20:34:00

引用:

【baohe的贴子】

你的问题是“mswdm.exe”如何查杀。

http://forum.ikaka.com/topic.asp?board=28&artid=8156736&page=1————这个帖子是讲“ Ravdm.exe的查杀”

蛮拧！！
………………

没想到楼主会搞错成这种地步，所以没有注意这个链接。我汗了。

瑞星卡卡安全论坛