请高手来帮忙中了remove spyware bbs.ikaka.com

天上那朵云 - 2006-9-30 19:38:00

电脑桌面上莫名其妙多了个remove spyware的图标，而且不停的弹出外国的网页来，上网查了好多用了网上介绍的很多软件都不行，还是不停的弹网页，求高手告诉我到底怎么杀呀，我弄了一天了头都大了，谢谢了，偶是菜鸟，麻烦说的明白点，谢谢

秋日里的蓝天 - 2006-9-30 19:40:00

请下载SREng2 ，使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。

下载地址
http://free5.ys168.com/?ufwihgu168

天上那朵云 - 2006-9-30 19:45:00

谢谢，我去试试

天上那朵云 - 2006-9-30 19:50:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [Yahoo! China]
<yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo! China]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<_{AEB6717E-7E19-11d0-97EE-00C04FD91972}><> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
<WinlogonNotify: policies><C:\WINDOWS\system32\fp8m03l1e.dll> []
[]
<C:><; > []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<HControl><; ; C:\WINDOWS\ATK0100\HControl.exe> []
<Hsfpwcfg.exe><; ; C:\WINDOWS\Hsfpwcfg.exe> [Conexant Systems , Inc.]
<IMJPMIG8.1><; ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; ??粒?粒粒粒??粒?粒???粒澴矚> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Messager.exe><; ; C:\Program Files\Tencent\QQ\Messenger.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; ; "C:\Program Files\Messenger\msmsgs.exe" /background> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSPY2002><; ; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<NvCplDaemon><; ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<NWEReboot><; ; > []
<PHIME2002A><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<SoundMan><; ; SOUNDMAN.EXE> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SpyEmergency><; "C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX01.629\Spy Emergency\SpyEmergency.exe"> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Spyware Stormer><; E:\新建文件夹 (3)\Spyware Stormer\SpywareStorme> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit IEPro><; ; E:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SvcManager><; ; c:\windows\system32\iexploer4.exe> []
<xy><; ; C:\WINDOWS\Download\svhost32.exe> []

天上那朵云 - 2006-9-30 19:51:00

启动文件夹
服务
[QoS Service / BNESS]
<C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL,Export 1087><N/A>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<E:\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[KSD2Service / KSD2Service]
<C:\WINDOWS\system32\SVCH0ST.exe><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

天上那朵云 - 2006-9-30 19:51:00

浏览器加载项
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\PROGRA~1\SUPERR~1\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\PROGRA~1\SUPERR~1\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[TencentVmpCtl Class]
{D9819BD5-422B-4281-8523-726466ED692B} <C:\Program Files\Tencent\Viewpoint Media Player\AxMetaStream.dll, Viewpoint Corporation>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[&使用迅雷下载]
<D:\新建文件夹\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\新建文件夹\Program\GetAllUrl.htm, N/A>

天上那朵云 - 2006-9-30 19:52:00

正在运行的进程
[PID: 1756][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.7330>
[C:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.7330>
[C:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.10045>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[E:\ewido anti-spyware 4.0\context.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 1848][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] <yahoo! china><3, 0, 1, 1001>
[PID: 1620][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[PID: 568][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll] <yahoo! china><3, 1, 4, 1062>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ysearch.dll] <Yahoo! China><3, 0, 5, 1005>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasnoad.dll] <yahoo! china><3, 0, 2, 1004>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yzsNetProto.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] <Yahoo! China><3, 0, 4, 1006>
[C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yaswiper.dll] <Yahoo! China><3, 0, 2, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasiesec.dll] <Yahoo! China><3, 0, 3, 1003>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YSETTI~1.DLL] <yahoo! china><3, 0, 5, 1010>
[C:\Program Files\Yahoo!\Assistant\Assist\ymailp.dll] <Yahoo! China><3.0.0.1006>
[c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] <Yahoo! China><3, 0, 1, 1002>
[C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll] <Yahoo! China><3, 0, 3, 1005>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yoptimum.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll] <Yahoo! China><3, 0, 7, 1010>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yxpstyle.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\WINDOWS\system32\WBJJU.IME] <北京六合源软件技术有限公司><2, 8, 0, 0>
[C:\WINDOWS\system32\WbCodeU.dll] <N/A><2, 8, 0, 0>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yprockg.dll] <Yahoo! China><3, 0, 0, 1000>
[PID: 1936][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe] <Yahoo! China><3, 0, 2, 1003>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yAssecblk.dll] <Yahoo! China><3, 0, 3, 1005>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo! China><3, 0, 0, 1001>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo! China><3, 0, 0, 1000>
[PID: 1596][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[PID: 540][E:\新建文件夹\WinRAR.exe] <N/A><N/A>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[PID: 476][C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.936\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [C:\WINDOWS\hh.exe %1]
.HLP Error. [C:\WINDOWS\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF Error. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

秋日里的蓝天 - 2006-9-30 19:57:00

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务KSD2Service ，选择“删除服务”
点“设置”选择“否”

运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
><C:\WINDOWS\system32\fp8m03l1e.dll
; C:\Program Files\Tencent\QQ\Messenger.exe
C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX01.629\Spy Emergency\SpyEmergency.exe
c:\windows\system32\iexploer4.exe> []
<xy><; ; C:\WINDOWS\Download\svhost32.exe>
注册表编辑---删除><; ??粒?粒粒粒??粒?粒???粒澴矚> []
显示隐藏文件
删除
<C:\WINDOWS\system32\fp8m03l1e.dll
C:\Program Files\Tencent\QQ\Messenger.exe
C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX01.629\Spy Emergency\SpyEmergency.exe
c:\windows\system32\iexploer4.exe
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL
C:\WINDOWS\system32\SVCH0ST.exe

运行SREng2,使用：系统修复－－文件关联－－全选－－修复

天上那朵云 - 2006-9-30 20:19:00

按你说的做了重新启动电脑还是弹出网页来，而且开机时候弹出找不到??粒?粒粒粒??粒?粒???粒澴矚>

天上那朵云 - 2006-9-30 20:20:00

怎么办呀，痛苦

秋日里的蓝天 - 2006-9-30 20:33:00

再扫描上来

天上那朵云 - 2006-9-30 20:37:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
<Super Rabbit IEPro><; ; E:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><; ; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [Yahoo! China]
<yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo! China]
<HControl><; ; C:\WINDOWS\ATK0100\HControl.exe> []
<Hsfpwcfg.exe><; ; C:\WINDOWS\Hsfpwcfg.exe> [Conexant Systems , Inc.]
<IMJPMIG8.1><; ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<MSPY2002><; ; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> []
<NWEReboot><; ; > []
<PHIME2002A><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<SoundMan><; ; SOUNDMAN.EXE> []
<Spyware Stormer><; E:\新建文件夹 (3)\Spyware Stormer\SpywareStorme> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
<WinlogonNotify: policies><C:\WINDOWS\system32\m4820eloehqc0.dll> []

天上那朵云 - 2006-9-30 20:37:00

启动文件夹
服务
[QoS Service / BNESS]
<C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL,Export 1087><N/A>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<E:\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[KSD2Service / KSD2Service]
<C:\WINDOWS\system32\SVCH0ST.exe><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\PROGRA~1\SUPERR~1\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll, yahoo! china>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\PROGRA~1\SUPERR~1\MAGICSET\haokanbar.dll, Xiang Feng Technology>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <C:\Program Files\Yahoo!\Assistant\yaLive.dll, yahoo! china>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[TencentVmpCtl Class]
{D9819BD5-422B-4281-8523-726466ED692B} <C:\Program Files\Tencent\Viewpoint Media Player\AxMetaStream.dll, Viewpoint Corporation>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[&使用迅雷下载]
<D:\新建文件夹\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\新建文件夹\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<D:\新建文件夹 (3)\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\新建文件夹 (3)\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\新建文件夹 (3)\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\新建文件夹 (3)\SendMMS.htm, N/A>

天上那朵云 - 2006-9-30 20:38:00

正在运行的进程
[PID: 1728][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\meftedit.dll] <N/A><N/A>
[C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.7330>
[C:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.7330>
[C:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.10045>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[PID: 1516][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1900][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll] <yahoo! china><3, 1, 4, 1062>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ysearch.dll] <Yahoo! China><3, 0, 5, 1005>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasnoad.dll] <yahoo! china><3, 0, 2, 1004>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yzsNetProto.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] <Yahoo! China><3, 0, 4, 1006>
[C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yaswiper.dll] <Yahoo! China><3, 0, 2, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasiesec.dll] <Yahoo! China><3, 0, 3, 1003>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YSETTI~1.DLL] <yahoo! china><3, 0, 5, 1010>
[C:\Program Files\Yahoo!\Assistant\Assist\ymailp.dll] <Yahoo! China><3.0.0.1006>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\WINDOWS\system32\WBJJU.IME] <北京六合源软件技术有限公司><2, 8, 0, 0>
[C:\WINDOWS\system32\WbCodeU.dll] <N/A><2, 8, 0, 0>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] <Yahoo! China><3, 0, 1, 1002>
[C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll] <Yahoo! China><3, 0, 3, 1005>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yoptimum.dll] <Yahoo! China><3, 0, 0, 1000>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrepair.dll] <Yahoo! China><3, 0, 7, 1010>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yxpstyle.dll] <Yahoo! China><3, 0, 0, 1000>
[PID: 1932][C:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll] <yahoo! china><3, 4, 0, 1091>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] <Yahoo! China><3, 0, 1, 1010>
[C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] <yahoo! china><3, 0, 1, 1001>
[PID: 812][D:\新建文件夹\Program\Thunder5.exe] <Thunder Networking Technologies,LTD><5.4.0.226>
[D:\新建文件夹\Program\UpdateDownload.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 8>
[D:\新建文件夹\Program\download_interface.dll] <Thunder Networking Technologies,LTD><2, 0, 0, 1>
[D:\新建文件夹\Program\stlport_vc646.dll] <STLport Consulting, Inc.><4.6.2003.1031>
[D:\新建文件夹\Program\log4cplus.dll] <><1, 0, 2, 1>
[D:\新建文件夹\Program\asyn_dns.dll] <N/A><N/A>
[D:\新建文件夹\Program\msgmanage.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 15>
[D:\新建文件夹\Program\historyinfo_manage.dll] <Thunder Networking Technologies,LTD><5, 2, 0, 148>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[D:\新建文件夹\Program\RegisterDll.dll] <Thunder Networking Technologies,LTD><2, 1, 0, 18>
[D:\新建文件夹\Program\FloatBar.dll] <Thunder Networking Technologies,LTD><1, 0, 0, 2>
[D:\新建文件夹\Components\InMedia\iEmbedShell.dll] <　><1, 0, 0, 11>
[D:\新建文件夹\Components\InMedia\iEmbed04.dll] <　><2, 3, 0, 37>
[D:\新建文件夹\Components\P4PClient\P4PClient.dll] <Thunder Networking Technologies,LTD><1, 0, 4, 10>
[D:\新建文件夹\Program\iTargetAd.dll] <Thunder Networking Technologies,LTD><1, 0, 1, 59>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 256][C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.625\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>
[PID: 408][C:\WINDOWS\system32\NOTEPAD.EXE] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <Yahoo! China><3, 0, 2, 1020>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll] <Yahoo! China><3, 1, 2, 1018>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

秋日里的蓝天 - 2006-9-30 21:03:00

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务KSD2Service ，选择“删除服务”
点“设置”选择“否”

运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
C:\WINDOWS\system32\m4820eloehqc0.dll
C:\WINDOWS\system32\SVCH0ST.exe

天上那朵云 - 2006-9-30 21:14:00

没有找到这个啊C:\WINDOWS\system32\SVCH0ST.exe

天上那朵云 - 2006-9-30 21:15:00

C:\WINDOWS\system32\m4820eloehqc0.dll
这个一刷新还是有

秋日里的蓝天 - 2006-9-30 21:20:00

C:\WINDOWS\system32\Ravdm.exe
http://forum.ikaka.com/topic.asp?board=28&artid=8156736

把上面的修复后,再删除哪个文件

还有异常,在扫描上来

メingΘ花开 - 2006-11-23 11:29:00

我也中了.系统启动栏出现一红叉叉,老提示:
Your computer is infected!或者Your computer is in Danger!
用卡卡上网安全助手(3.0.0.7)看到启动中SvcManager可疑,但怎么也删不掉,删了马上就出现...

瑞星卡卡安全论坛