瑞星卡卡安全论坛

大家小心啦！这病毒好厉害，谁能救救苦命的我啊!

一开机就杀到（因我开了防火墙的开机扫描功能）

杀了后连我的打字软件也没啦。55555

上网查（搜）过，说是WINDOWS下得PE病毒，但我还没找到一个好的全面地杀毒方法

求助高高手们啊。。小弟谢谢，感恩啊。。5555

病毒详细路径： Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj


天天杀..日志如下:2006-09-28 13:22:24, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-28 13:06:50, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-28 12:51:40, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-28 12:08:26, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-28 11:37:00, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-27 09:19:14, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-27 00:43:22, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-26 21:04:06, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-26 11:00:39, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-26 10:35:06, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-25 17:19:49, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-25 15:09:44, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-25 09:55:22, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-25 08:21:00, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-24 17:50:37, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-23 20:08:00, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-23 11:45:27, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-23 00:43:24, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-20 12:07:25, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-19 14:17:31, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-15 23:32:41, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-13 19:39:30, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-11 13:33:43, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-11 08:30:05, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-11 00:49:28, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-10 15:33:39, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-10 13:29:03, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj
2006-09-10 00:31:43, Explorer.EXE>>C:\WINNT\NeroC.DLL ->Backdoor.Gpigeon.2006.oj

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

【这是杀了那毒之后的扫描】

引用:

2006-09-29,17:55:29 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能 以下内容被选中：     所有的启动项目（包括注册表、启动文件夹、服务等）     浏览器加载项     正在运行的进程（包括进程模块信息）     文件关联 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]     <TuneUp MemOptimizer><"C:\Program Files\TuneUp Utilities 2004\MemOptimizer.exe" autostart>  [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]     <load><>  [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]     <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]     <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]     <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]     <nwiz><nwiz.exe /install>  [NVIDIA Corporation]     <NvCplDaemon><RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]     <shell><Explorer.exe>  [Microsoft Corporation]     <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]     <AppInit_DLLs><>  [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]     <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.] ================================== 启动文件夹 服务 [Logical Disk Manager Administrative Service / dmadmin]   <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.> [Logical Servers Web / Logical Servers Web]   <C:\WINNT\svshost.exe><N/A> [NeroFilterCheck / NeroFilterCheck]   <C:\WINNT\NeroCheck><N/A> [NVIDIA Display Driver Service / NVSvc]   <C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation> [Rising Proxy  Service / RfwProxySrv]   <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService]   <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter]   <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon]   <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 浏览器加载项 [ThunderIEHelper Class]   {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v4.dll, > [MonitorURL Class]   {08A312BB-5409-49FC-9347-54BB7D069AC6} <, N/A> [Thunder Browser Helper]   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\2k\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD> [MMBHO Class]   {8B7F22CB-5075-48D7-8B8C-85B55869D8C0} <, N/A> [ALiBaBar_Helper]   {CE439C63-384A-747A-A357-23D96B5D652B} <C:\PROGRA~1\ALiBaBar\ALiBaBar.dll, Alfred, C. S. Li> [CAdBlocker Object]   {E24AD748-155E-4254-B674-4EDF86E7E1DF} <, N/A> [Windows ToyClass]   {E3DB85B5-C559-4894-B474-42E89FAA1EFD} <, N/A> [启动迅雷]   {0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\2k\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD> [Web Shutter]   {0713E8D2-850A-101B-AFC0-4210102A8DA7} <D:\2k\Program Files\M.A.B Software\Web Shutter\WShutter.exe, M.A.B Software> [CAdBlockToolExt Object]   {2E071ADC-ADF8-4b4b-8ACB-EDC49E6D45A2} <, N/A> [信息检索(&R)]   {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\2k\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [@shdoclc.dll,-866]   {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ]   {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\2k\Program Files\QQ.EXE, N/A> [QQ]   {c95fe080-8f5d-11d2-a20b-00aa003c157b}? <D:\2k\Program Files\QQ.EXE, N/A> [@msdxmLC.dll,-1@2052,电台(&R)]   {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation> [金山快译(&K)]   {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <D:\2k\Program Files\Kingsoft\FastAIT 2006\IEBand.dll, 金山软件股份有限公司> [ALiBaBar]   {0A1375E1-56C2-11D6-8E45-8933A0FB5235} <C:\PROGRA~1\ALiBaBar\ALiBaBar.dll, Alfred, C. S. Li> [卡卡上网安全助手]   {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINNT\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.> [&Web Shutter]   {5B48A820-5C79-42AF-ABF6-0035A2392A4B} <D:\2k\PROGRA~1\MA0816~1.BSO\WEBSHU~1\Hsiebar.dll, N/A> [WUWebControl Class]   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation> [Shockwave Flash Object]   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [&使用迅雷下载]   <D:\2k\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接]   <D:\2k\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [上传到QQ网络硬盘]   <D:\2k\Program Files\Tencent\qq\AddToNetDisk.htm, N/A> [保存全部网页 到图片...]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/saveimage, N/A> [保存全部网页 到网文任我存]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/brwsall, N/A> [保存所选文字 到网文任我存]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/txtstart, N/A> [保存所选文字(接上页) 到网文任我存]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/txtcontinue, N/A> [保存所选网页 到网文任我存]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/brwstart, N/A> [保存所选网页(接上页) 到网文任我存]   <res://D:\2k\Program Files\M.A.B Software\Web Shutter\brwstart.dll/brwcontinue, N/A> [剪贴板文字:  简 > 繁]   <res://C:\Program Files\ALiBaBar\ALiBaBar.dll/RT_HTML/ClipToTrad, N/A> [剪贴板文字:  繁 > 简]   <res://C:\Program Files\ALiBaBar\ALiBaBar.dll/RT_HTML/ClipToSim, N/A> [导出到 Microsoft Office Excel(&X)]   <res://D:\2k\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ自定义面板]   <D:\2k\Program Files\Tencent\qq\AddPanel.htm, N/A> [添加到QQ表情]   <D:\2k\Program Files\Tencent\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片]   <D:\2k\Program Files\Tencent\qq\SendMMS.htm, N/A> [用比特精灵下载(&B)]   <D:\2k\Program Files\BitSpirit\bsurl.htm, N/A> [网页:  [简体] 显示]   <res://C:\Program Files\ALiBaBar\ALiBaBar.dll/RT_HTML/PageToSim, N/A> [网页:  [繁体] 显示]   <res://C:\Program Files\ALiBaBar\ALiBaBar.dll/RT_HTML/PageToTrad, N/A> ………………

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 184][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 212][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.7035>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.7011>
[PID: 392][c:\program files\rising\rfw\rfwsrv.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 33>
    [c:\program files\rising\rfw\RfwRule.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
    [c:\program files\rising\rfw\rfwlog.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
    [c:\program files\rising\rfw\Rfwdrv.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
    [c:\program files\rising\rfw\MonDrv.dll]  <rs><1, 0, 0, 4>
    [c:\program files\rising\rfw\ProcLib.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
    [c:\program files\rising\rfw\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[PID: 404][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 480][C:\Program Files\Rising\Rav\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 540][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 572][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 732][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\svshost.DLL]  <N/A><N/A>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\xunleibho_v4.dll]  <><4, 3, 2, 29>
    [D:\2k\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [C:\PROGRA~1\ALiBaBar\ALiBaBar.dll]  <Alfred, C. S. Li><5.1.0.0>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [C:\WINNT\NeroCheck]  <N/A><N/A>
[PID: 776][C:\WINNT\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5303>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 808][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 836][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6972>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 856][C:\WINNT\System32\tcpsvcs.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 916][C:\WINNT\System32\snmp.exe]  <Microsoft Corporation><5.00.2195.6605>
[PID: 996][C:\WINNT\system32\stisvc.exe]  <Microsoft Corporation><5.00.2195.6656>
[PID: 1024][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 1044][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 1056][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 328][C:\WINNT\System32\inetsrv\inetinfo.exe]  <Microsoft Corporation><5.00.0984>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 1236][C:\WINNT\system32\ctfmon.exe]  <Microsoft Corporation><1.00.2409.34 built by: Lab06_N>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 1484][c:\program files\rising\rfw\RfwMain.exe]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 52>
    [c:\program files\rising\rfw\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
    [c:\program files\rising\rfw\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [c:\program files\rising\rfw\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 1408][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>

[PID: 1368][C:\Program Files\TuneUp Utilities 2004\MemOptimizer.exe]  <TuneUp Software GmbH><1.0.0.143>
    [C:\Program Files\TuneUp Utilities 2004\rtl60.bpl]  <Borland Software Corporation><6.0.6.241>
    [C:\Program Files\TuneUp Utilities 2004\vcl60.bpl]  <Borland Software Corporation><6.0.6.240>
    [C:\Program Files\TuneUp Utilities 2004\MainControls.bpl]  <TuneUp Software GmbH><1.0.0.315>
    [C:\Program Files\TuneUp Utilities 2004\GR32_D6.bpl]  <><1.0.0.67>
    [C:\Program Files\TuneUp Utilities 2004\DEC.bpl]  <><1.0.0.178>
    [C:\Program Files\TuneUp Utilities 2004\vcljpg60.bpl]  <Borland Software Corporation><6.0.6.163>
    [C:\Program Files\TuneUp Utilities 2004\Html.bpl]  <><1.0.0.266>
    [C:\Program Files\TuneUp Utilities 2004\AppInitialization.bpl]  <TuneUp Software GmbH><4.0.0.92>
    [C:\Program Files\TuneUp Utilities 2004\VisControls.bpl]  <TuneUp Software GmbH><1.0.0.290>
    [C:\Program Files\TuneUp Utilities 2004\SysControls.bpl]  <TuneUp Software GmbH><1.0.0.204>
    [C:\Program Files\TuneUp Utilities 2004\Indicators.bpl]  <><1.0.0.202>
    [C:\Program Files\TuneUp Utilities 2004\ThemeManager.bpl]  <><1.0.0.198>
    [C:\Program Files\TuneUp Utilities 2004\ehs_d6.bpl]  <><1.0.0.185>
    [C:\Program Files\TuneUp Utilities 2004\CommonForms.bpl]  <><1.0.0.511>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 1488][C:\WINNT\explorer.exe]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\TuneUp Utilities 2004\sdshelex.dll]  <TuneUp Software GmbH><1.0.0.145>
    [C:\Program Files\TuneUp Utilities 2004\rtl60.bpl]  <Borland Software Corporation><6.0.6.241>
    [C:\Program Files\TuneUp Utilities 2004\vcl60.bpl]  <Borland Software Corporation><6.0.6.240>
    [C:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\7-Zip\7-zip.dll]  <N/A><N/A>
    [C:\WINNT\system32\xunleibho_v4.dll]  <><4, 3, 2, 29>
    [D:\2k\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  <Thunder Networking Technologies,LTD><5, 0, 0, 2>
    [C:\PROGRA~1\ALiBaBar\ALiBaBar.dll]  <Alfred, C. S. Li><5.1.0.0>
[PID: 1556][D:\2k\Program Files\Maxthon\Max.exe]  <Maxthon International Ltd.><1, 5, 3, 18>
    [D:\2k\Program Files\Maxthon\maxzlib.dll]  < ><1, 0, 0, 2>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
    [D:\2k\Program Files\Maxthon\Services\RealTime\real_time.dll]  <><1, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
[PID: 956][C:\Program Files\Rising\Rav\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [C:\Program Files\Rising\Rav\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [C:\Program Files\Rising\Rav\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\Rav\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\HookWeb.dll]  <rising><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [C:\Program Files\Rising\Rav\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [C:\Program Files\Rising\Rav\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 27>
    [C:\Program Files\Rising\Rav\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 17>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[PID: 320][C:\Program Files\Rising\Rav\RAVMON.EXE]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 780][C:\Program Files\Rising\Rav\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 2088][C:\Program Files\Rising\Rav\RsAgent.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
[PID: 2192][C:\WINNT\msagent\AgentSvr.exe]  <Microsoft Corporation><2.00.0.3422>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
[PID: 628][C:\Documents and Settings\huang\桌面\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\svshostKey.DLL]  <N/A><N/A>
    [C:\WINNT\system32\wshcon32.dll]  <><4, 1, 0, 0>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

C:\WINNT\svshost.exe

找到 QQ289039676 传给我

sreng删除服务
Logical Servers Web

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Logical Servers Web,NeroFilterCheck，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）

请到http://forum.ikaka.com/topic.asp?board=67&artid=5188931，下载，LSPFix.exe，WinsockXPFix这两个软件
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行LSPFix.exe
删除
wshcon32.dll
附说明一份
LSPFix.exe这个软件主要用来辅助修复HijackThis扫描发现的O10项。
使用时，请关闭所有IE界面和文件夹界面后运行LSPFix，运行后，把要修复的那一个O10项从左边转到右边，点“Finish”即可。（不过这之前，需要在“I know what I`m doing”前面打勾。）
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINNT\svshost.exe
C:\WINNT\NeroCheck
C:\WINNT\svshostKey.DLL
C:\WINNT\svshost.DLL
C:\WINNT\system32\wshcon32.dll
修复后重启，如果无法上网，请运行WinsockXPFix，让它修复一下。
回到正常模式，请再扫日志粘上来。
如果总是无法修复
看以下的帖子
解决Winsock LSP“浏览器劫持”的一些方法
http://forum.ikaka.com/topic.asp?board=67&artid=8162074

我也中啦！！而且杀不掉，又不知道自己怎么手动删掉

【回复“fishball”的帖子】
学一下楼主，自己立个帖子，扫个日志粘上来。

谢谢!谢谢!感恩啊!!!【我无邪】好厉害啦!!
按您的方法其它删了.
[C:\WINNT\system32\wshcon32.dll 删不掉,然后用您的第二个方法,
先重命名它,再删,就OK啦!!
看来我也要多多学习,研究病毒这个坏蛋才行.呵呵!