【求助】Trojan.PSW.QQPass.pxx 杀不掉,有日志! bbs.ikaka.com

sonic0005 - 2006-10-4 1:22:00

我按照至顶贴的方法下了内个工具可是还是没用,高手帮帮我啊!

sonic0005 - 2006-10-4 10:05:00

快帮帮我啊...

爬围墙上青天 - 2006-10-4 10:15:00

这是个盗QQ的病毒，并不可怕，你肯定北被安装了木马了

爬围墙上青天 - 2006-10-4 10:16:00

病毒分类 WINDOWS下的PE病毒病毒名称 Trojan.PSW.QQPass.pxx
别名病毒长度
依赖系统传播途径
行为类型感染
病毒发作瑞星版本号
18.43.02 属于橙色八月病毒

这些病毒包括“传奇终结者（Trojan.PSW.LMir）”、“QQ通行证（Trojan.PSW.QQPass）”以及“密西木马（Trojan.PSW.Misc）”等病毒的最新变种。瑞星已发布今年首次橙色（二级）安全警报，提醒广大用户警惕此类病毒。

针对此类病毒，可用简单的三个方法对它们进行识别：

第一招

打开“我的电脑”，选择菜单“工具”-》“文件夹选项”，点击“查看”，取消“隐藏受保护的操作系统文件”前的对勾，并在“隐藏文件和文件夹”项中选择“显示所有文件和文件夹”，同时取消掉“隐藏已知文件类型的扩展名”前的对勾，然后点击“确定”。

进入C:\windows\system32目录下（Windows2000系统为C:\WINNT目录），若发现有名为“command”、“dxdiaq.com”、“finder.com”、“MSCONFIG.COM”、“regedit.com”以及“rundll32.com”等文件生成，则说明是中了“密西木马（Trojan.PSW.Misc）”或其变种病毒。

第二招

点击“开始”按钮，选择“运行”，输入“regedit”并确定，启动注册表编辑器。打开“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows”项，在右边的窗口中查找AppInit_DLLs。若其值为“KB（中间六位数字）M.LOG”，如“KB896588M.LOG”、“KB235780M.LOG”、“KB75976M.LOG”等，则说明是中了新的“传奇终结者（Trojan.PSW.LMir）”及其变种病毒。

第三招

同时按下键盘CTRL+ALT+DEL键，或右键点击任务栏，选择“任务管理器”。单击“进程”标签。如果找到名为“SVOHOST.EXE”的进程，则说明已感染了“QQ通行证（Trojan.PSW.QQPass）”病毒或其变种

爬围墙上青天 - 2006-10-4 10:16:00

在这期间请不要开QQ或游戏

sonic0005 - 2006-10-4 11:19:00

....怎么杀呀!!

sonic0005 - 2006-10-4 11:49:00

帮帮我...

sonic0005 - 2006-10-4 12:31:00

没有人啊...

sonic0005 - 2006-10-4 14:28:00

哎呀...

AC1899 - 2006-10-4 15:03:00

用SRENG扫个日志上来，请其他高手指点

sonic0005 - 2006-10-4 17:55:00

2006-10-04,17:37:44

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><D:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<NvCplDaemon><RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<桌面图标文字自动透明><d:\Program Files\Wom\WinMem.exe XP> [N/A]
<RfwMain><"D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<DAEMON Tools-2052><"D:\Program Files\D-Tools\daemon.exe" -lang 2052> [DAEMON'S HOME]
<IMSCMig><D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<BigDogPath><D:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera> [N/A]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<TkBellExe><"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Corporation]
<Userinit><D:\WINDOWS\system32\Userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><D:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{8A238B14-A6FF-11E0-9A84-00C04FD8DBD8}><D:\WINDOWS\system32\sysldr.dll> [N/A]
<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yclickon.dll> [YAHOO Corporation Limited]
<{E568441B-9EF3-49F8-9A67-4141AC41ADD4}><D:\PROGRA~1\Yahoo!\ASSIST~1\assist\ypatch.dll> [N/A]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><D:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll> [Anti-Malware Development a.s.]

==================================
启动文件夹
[腾讯QQ]
<D:\Documents and Settings\YinTsang\「开始」菜单\程序\启动\腾讯QQ.lnk --> E:\OICQ\QQ.exe [TENCENT]><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
<"D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[C-DillaSrv / C-DillaSrv]
<D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE><C-Dilla Ltd>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<D:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
<D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[onServer / nServer]
<D:\WINDOWS\system.dll><N/A>
[NVIDIA Display Driver Service / NVSvc]
<D:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv]
<d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
<D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Network IPSEC Connections / WalALET]
<D:\WINDOWS\SYSTEM32\RUNDLL32.EXE D:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>

==================================
驱动程序
[General Purpose USB Driver (adildr.sys) / ADILOADER]
<System32\Drivers\adildr.sys><N/A>
[USB ADSL WAN Adapter / adiusbaw]
<system32\DRIVERS\adiusbaw.sys><N/A>
[aeaudio / aeaudio]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[C-Dilla / C-Dilla]
<\??\D:\WINDOWS\system32\drivers\CDANT.SYS><Macrovision>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
<\??\D:\Program Files\ewido anti-spyware 4.0\guard.sys><N/A>
[ExpScaner / ExpScaner]
<\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HookCont / HookCont]
<\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\D:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[kmsinput / kmsinput]
<\??\D:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN]
<\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt]
<\??\E:\OICQ\npkcrypt.sys><N/A>
[npkycryp / npkycryp]
<\??\E:\OICQ\npkycryp.sys><N/A>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[QuakeDRV / QuakeDRV]
<\SystemRoot\system32\DRIVERS\quakedrv.sys><N/A>
[RsFwDrv / RsFwDrv]
<\??\D:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[smwdm / smwdm]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[VIA AGP Filter / viaagp1]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[ViaIde / ViaIde]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

sonic0005 - 2006-10-4 17:58:00

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <D:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <D:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, yahoo! china>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[MSN Shell 4]
{0713E8D2-850A-101B-AFC0-4210102A8DA7} <D:\Program Files\MSNShell\Bin\MSNShell.exe, N/A>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方对战平台\gameclient.exe, 上海浩方在线信息技术有限公司>
[视频聊天]
{6924091F-CD97-41E1-B1D4-D9079409D413} <http://www.liantang.net, N/A>
[寻论网--中学作业解答]
{6924091F-CD97-41E1-B1D4-D9079409D423} <http://www.xunlun.com, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\OICQ\QQ.EXE, TENCENT>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, yahoo! china>
[IMCv1 Control]
{6924091F-CD97-41E1-B1D4-D9079409D413} <D:\PROGRA~1\LtUcx\1003\c0.dll, 北京莲塘软件技术有限公司 Liantang Software Tech. Inc. (http://www.lotuspond.com.cn)>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <D:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <D:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <D:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Yahoo!Photo]
{33BBE430-0E42-4F12-B075-8D21ACB10DCB} <D:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, yahoo! china>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <E:\OICQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Yahoo!Live]
{57421194-58FB-49AE-9B4F-FD48869B9AD4} <D:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll, N/A>
[DragSearch BHO]
{62EED7C6-9F02-42F9-B634-98E2899E147B} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <D:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[IMCv1 Control]
{6924091F-CD97-41E1-B1D4-D9079409D413} <D:\PROGRA~1\LtUcx\1003\c0.dll, 北京莲塘软件技术有限公司 Liantang Software Tech. Inc. (http://www.lotuspond.com.cn)>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <D:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[ltmenu Class]
{78C21EFD-53BA-406C-AF1A-33A38ABD3958} <D:\Program Files\LtUcx\1002\c0.dll, 北京莲塘软件技术有限公司>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <D:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <D:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SPlayerCtrl Class]
{B0CE7123-982E-4A0C-A0D6-E4F32B9BAEDF} <D:\PROGRA~1\sina\STVPLA~1\STVPLA~1.DLL, 北京新浪信息技术有限公司>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <D:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <D:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <D:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <D:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Windows Live Sign-in Control]
{D2517915-48CE-4286-970F-921E881B8C5C} <D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[&使用迅雷下载]
<D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<E:\OICQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
<D:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
<E:\OICQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\OICQ\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
<res://D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
<E:\OICQ\SendMMS.htm, N/A>
[设为 Messenger Live 头像]
<D:\Program Files\MSNShell\BIN\SetMSNDP.htm, N/A>
[雅虎搜索]
<res://D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll/246, N/A>

sonic0005 - 2006-10-4 18:01:00

==================================
正在运行的进程
[PID: 580][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 648][\??\D:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 672][\??\D:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 716][D:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 728][D:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 892][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 984][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1076][D:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 1096][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1136][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1288][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1312][D:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35]
[D:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[D:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11]
[D:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[D:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[D:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[D:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[D:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[D:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[D:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[D:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[D:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34]
[D:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[D:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27]
[D:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[D:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[D:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[D:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[D:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[D:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[PID: 1460][d:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 30]
[d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 12]
[d:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[d:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[d:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[d:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[PID: 1524][D:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[D:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8265]
[D:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8265]
[D:\WINDOWS\system32\nvshell.dll] [N/A, N/A]
[D:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[D:\PROGRA~1\Yahoo!\ASSIST~1\assist\yclickon.dll] [YAHOO Corporation Limited, 3, 0, 0, 1001]
[D:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] [Yahoo! China, 3, 0, 4, 1006]
[D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] [yahoo! china, 3, 1, 6, 1066]
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] [N/A, N/A]
[PID: 1704][D:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1936][d:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 48]

sonic0005 - 2006-10-4 18:01:00

[d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 2008][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[D:\Program Files\Common Files\Microsoft Shared\MSInfo\MSINFO16.DLL] [N/A, N/A]
[PID: 260][D:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[PID: 252][D:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[D:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[PID: 364][D:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1912][D:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE] [C-Dilla Ltd, 3.25.010]
[PID: 1620][D:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8265]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1300][D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[PID: 1384][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 220][D:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 2220][D:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 2724][D:\Program Files\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33]
[D:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[D:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 3576][D:\Program Files\PPLive\PPLive.exe] [, 1, 0, 0, 1]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[D:\Program Files\PPLive\PPH.dll] [N/A, N/A]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\common.dll] [, 1, 0, 0, 1]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\SYNACA~1.OCX] [Synacast, 1, 3, 20, 0]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\SYNACA~2.OCX] [, 1, 0, 0, 0]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\FWUpnp.dll] [N/A, N/A]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\kom.dll] [Synacast Corp., 1, 1, 9, 2]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\EROC.DLL] [Synacast Corp., 1, 1, 9, 4]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\TEN.DLL] [Synacast, 1, 1, 0, 8]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\GAL.DLL] [Synacast, 1, 1, 0, 9]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\MUL.DLL] [Synacast, 1, 1, 0, 8]
[D:\PROGRA~1\COMMON~1\Synacast\SynaLive\PP\MIR.DLL] [Synacast Corp., 1, 2, 0, 8]
[D:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0]
[D:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[D:\WINDOWS\system32\ffdshow.ax] [N/A, 1.0.2.1997]
[PID: 3252][D:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[D:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] [Yahoo! China, 3, 0, 4, 1006]
[D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] [yahoo! china, 3, 1, 6, 1066]
[D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] [N/A, N/A]
[D:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0]
[PID: 1640][D:\Documents and Settings\YinTsang\My Documents\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[D:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]

sonic0005 - 2006-10-4 18:01:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. []
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

sonic0005 - 2006-10-4 18:36:00

日志都发上来了,高手帮帮我吧...

sjadys - 2006-10-4 19:00:00

确实杀不鸟杀了又来而且阻拦瑞星
没办法我只好明天让同事把我的硬盘全格拉
我今天用专杀杀了还有杀不鸟把瑞星升成最新版竟然差不出毒
昏死中............
各位大虾们快快想想办法啊最好不要让我把我的机子全格 55555555555555

sonic0005 - 2006-10-4 19:02:00

朋友你也中了...
哎,这病毒真操蛋...

sjadys - 2006-10-4 19:06:00

没办法这个鸟毒是谁造的啊狂晕真TM牛啊
唉大虾们在干吗啊

sonic0005 - 2006-10-4 19:47:00

是啊...快帮帮我们....

sonic0005 - 2006-10-4 21:28:00

....帮帮我吧,还杀不掉呢!

K一荒漠孤狼一K - 2006-10-4 21:35:00

哎！！！！！我是什么办法都用干净了，就是没有办法，就连瑞星网站都没有办法，我们又有什么办法？？？有办法瑞星早用了，我的账号不知道被盗多少会了

sonic0005 - 2006-10-4 22:43:00

还是没有人帮忙!!

sonic0005 - 2006-10-5 1:27:00

哎呀...

arlenlc - 2006-10-5 2:46:00

[onServer / nServer]
<D:\WINDOWS\system.dll><N/A>
这个，注意一下，干掉它

sonic0005 - 2006-10-5 9:37:00

帮帮我...

sonic0005 - 2006-10-5 11:09:00

我在等啊....

老粗在前进 - 2006-10-5 11:13:00

呵呵你又来了那你顶吧有办法也通知我一下啊

sonic0005 - 2006-10-5 11:16:00

哎...不来不行啊...高手还没来啊!
我就操制造这个病毒的人了!

sonic0005 - 2006-10-5 11:24:00

帮帮我昂...

瑞星卡卡安全论坛