【求助】在线急等！！急死我了：木马病毒，杀了还有，附SREngLOG.log bbs.ikaka.com

pxzx1119 - 2006-10-10 13:27:00

症状：
1、不断弹出2个网页（附图1、2）；
2、有时瑞星监控被强行关闭、输入法不可用；
3、瑞星监控杀掉好多（附图3），在安全模式彻底查杀后重启还有

急死我了！下午还有重要邮件要发，哪位高手帮个忙。
在线急等！！

附SREngLOG.log

附件: 64723920061010131923.JPG

pxzx1119 - 2006-10-10 13:28:00

图2

附件: 64723920061010132005.JPG

pxzx1119 - 2006-10-10 13:28:00

图3

附件: 64723920061010132029.JPG

pxzx1119 - 2006-10-10 13:31:00

附SREngLOG.log

2006-10-10,12:50:38

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<DesktopSprite><; D:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe> [SnowFox Studio.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Intel Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<RfwMain><"d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<bacstray><; BacsTray.exe> [Broadcom Corporation]
<DrvLsnr><; C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe> [adi]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<MSPY2002><; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<Smapp><; C:\Program Files\Analog Devices\SoundMAX\SMTray.exe> [Analog Devices, Inc.]
<YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [N/A]
<xy><C:\WINDOWS\Download\svhost32.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FB1}><C:\WINDOWS\system32\cnscheck100.dll> [N/A]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62F1A}><C:\WINDOWS\system32\Cnscheck010.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[mms-up / mms-up]
<C:\DOCUME~1\pxzx01\LOCALS~1\Temp\mms.exe -R><N/A>
[Rising Proxy Service / RfwProxySrv]
<d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
<d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Workstatioc / Workstatioc]
<C:\WINDOWS\SCVHOST.EXE><N/A>

==================================

pxzx1119 - 2006-10-10 13:32:00

驱动程序
[aeaudio / aeaudio]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k]
<System32\DRIVERS\b57xp32.sys><Broadcom Corporation>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Broadcom Advanced Server Program Driver / Blfp]
<System32\DRIVERS\baspxp32.sys><Broadcom Corporation>
[ExpScaner / ExpScaner]
<\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
<\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HOOKTDI1 / HOOKTDI1]
<\??\d:\Program Files\rising\rfw\tdihook.sys><N/A>
[HookUrl / HookUrl]
<\??\d:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IPHOOK / IPHOOK]
<\??\d:\Program Files\rising\rfw\iphook.sys><N/A>
[MEMSCAN / MEMSCAN]
<\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[New0 / New0]
<\??\C:\WINDOWS\System32\new.sys><N/A>
[npkcrypt / npkcrypt]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsFwDrv / RsFwDrv]
<\??\d:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[smwdm / smwdm]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf]
<system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd]
<system32\DRIVERS\wudfrd.sys><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}]
<system32\drivers\ialmkchw.sys><Intel Corporation>

==================================
浏览器加载项
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\System32\msjava.dll, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Java Plug-in 1.4.1_07]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <d:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll, JavaSoft / Sun Microsystems, Inc.>
[Java Plug-in 1.4.1_07]
{CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} <d:\Program Files\Java\j2re1.4.1_07\bin\npjpi141_07.dll, JavaSoft / Sun Microsystems, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\System32\msjava.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <d:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[卡卡上网安全助手]
{AFF6E516-CBE5-4F8A-9C2F-38A68013E766} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Adobe Acrobat Control for ActiveX]
{CA8A9780-280D-11CF-A24D-444553540000} <D:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx, Adobe Systems Incorporated>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\System32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[&使用迅雷下载]
<d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

pxzx1119 - 2006-10-10 13:33:00

正在运行的进程
[PID: 384][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 544][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 736][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 748][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 892][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 956][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 996][d:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 1024][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 1076][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1200][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1220][D:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35]
[D:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[D:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11]
[d:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[d:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[d:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]

pxzx1119 - 2006-10-10 13:35:00

[D:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[D:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[D:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[D:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[d:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[d:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34]
[d:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[d:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[d:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[d:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27]
[d:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 17]
[d:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[d:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[d:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[d:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[d:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[d:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[d:\Program Files\Rising\Rav\posttrtx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1296][d:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 32]
[d:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[d:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[d:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[d:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[d:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 1404][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\HPBMMON.DLL] [Hewlett-Packard, 10.00.16]
[C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00]
[C:\WINDOWS\system32\HPBHealr.dll] [N/A, N/A]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINDOWS\system32\Imf32.dll] [Zenographics, Inc., 5, 60, 1204, 0]
[C:\WINDOWS\system32\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\system32\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[PID: 1560][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[PID: 1648][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 1784][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[PID: 1876][D:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 360][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 412][d:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 51]
[d:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[d:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[d:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 540][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\System32\igfxhk.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,2104]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 608][D:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[D:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 628][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 1548][D:\dzh\internet\hypwise.exe] [大智慧, 1, 0, 0, 1]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[PID: 3708][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 3988][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 4076][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 308][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 2060][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 3640][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 3232][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]

pxzx1119 - 2006-10-10 13:36:00

[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 816][C:\DOCUME~1\pxzx01\LOCALS~1\Temp\mhh.exe] [N/A, N/A]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[PID: 3084][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 4044][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 2556][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[d:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 1840][D:\下载\soft\杀毒\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\cnscheck100.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.3]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
50.0.191.1ha_srv1

==================================
我的妈呀，总算发完了！！

不言放弃 - 2006-10-10 14:09:00

【回复“pxzx1119”的帖子】
修复
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<xy><C:\WINDOWS\Download\svhost32.exe> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FB1}><C:\WINDOWS\system32\cnscheck100.dll> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62F1A}><C:\WINDOWS\system32\Cnscheck010.dll> [N/A]

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

开始－－控制面板－－性能和维护－－管理工具－－服务
禁用如下服务：
[mms-up / mms-up]
[Workstatioc / Workstatioc]

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

开始－－运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除如下文件夹：
mms-up文件夹
Workstatioc文件夹

依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Enum\Root\](X代表1,2,3,4....)
删除如下文件夹：
LEGACY_mms-up文件夹
LEGACY_Workstatioc文件夹

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

http://www.xfocus.net/tools/200605/1161.html
下载后打开IceSword
在工具栏中点击－－文件－－设置
勾选“禁止进线程创建”
然后结束如下进程：
d:\Program Files\Rising\Rav\CCenter.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\dzh\internet\hypwise.exe
C:\Program Files\Internet Explorer\iexplore.exe

用IceSword删除
C:\WINDOWS\system32\cnscheck100.dll
C:\WINDOWS\system32\Cnscheck010.dll
C:\WINDOWS\system32\xydll.dll

在IceSword主界面点击左窗口中的“SSDT”按纽
用IceSword删除C:\WINDOWS\System32\new.sys

删除完毕
把IceSword的“禁止进线程创建”前的勾去掉

附注：
使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178

＝＝＝＝＝＝＝＝＝＝

清空HOSTS文件

＝＝＝＝＝＝＝＝＝＝

开始－－运行
输入regedit
确定
进入注册表
依次搜索“前两个图片中的网址”
找到后全部删除

＝＝＝＝＝＝＝＝＝＝＝

删除
C:\WINDOWS\SCVHOST.EXE
以及C:\DOCUME~1\pxzx01\LOCALS~1\Temp\下的所有文件及文件夹

若能找到如下文件
同样删除之
C:\WINDOWS\SCVHOST.dll
C:\WINDOWS\SCVHOSTkey.dll
C:\WINDOWS\SCVHOST_hook.dll

＝＝＝＝＝＝＝＝＝＝

提示：
若正常模式下无法解决
建议进入安全模式下操作

pxzx1119 - 2006-10-10 15:04:00

在工具栏中点击－－文件－－设置
勾选“禁止进线程创建”
然后结束如下进程：
d:\Program Files\Rising\Rav\CCenter.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\dzh\internet\hypwise.exe
C:\Program Files\Internet Explorer\iexplore.exe

该操作是否为了防止以后木马对它们的更改？

pxzx1119 - 2006-10-10 15:11:00

删除完毕是否还要
把IceSword的“禁止进线程创建”前的勾去掉

不言放弃 - 2006-10-10 15:18:00

引用:

【pxzx1119的贴子】在工具栏中点击－－文件－－设置
勾选“禁止进线程创建”
然后结束如下进程：
d:\Program Files\Rising\Rav\CCenter.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\dzh\internet\hypwise.exe
C:\Program Files\Internet Explorer\iexplore.exe

该操作是否为了防止以后木马对它们的更改？
………………

不是防止以后
是因为DLL木马已经插入到如上进程中
若不禁止如上进程的话
DLL木马是不能删除的

是否已经明白？

不言放弃 - 2006-10-10 15:20:00

引用:

【pxzx1119的贴子】删除完毕是否还要
把IceSword的“禁止进线程创建”前的勾去掉

………………

在正常情况下
“禁止进线程创建”前的方框中是不能打勾的

当使用完毕IceSword后
必须把IceSword的“禁止进线程创建”前的勾去掉

pxzx1119 - 2006-10-10 15:34:00

彻底明白了——万分感谢！

pxzx1119 - 2006-10-10 16:21:00

引用:

【不言放弃的贴子】【回复“pxzx1119”的帖子】
修复
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<xy><C:\WINDOWS\Download\svhost32.exe> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FB1}><C:\WINDOWS\system32\cnscheck100.dll> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62F1A}><C:\WINDOWS\system32\Cnscheck010.dll> [N/A]

＝＝＝＝＝＝＝＝＝＝＝＝＝＝
………………

请问在哪里修复呀？
我真的很“菜”！

猪知山 - 2006-10-10 16:29:00

就是删除的意思

不言放弃 - 2006-10-10 16:32:00

引用:

请问在哪里修复呀？
我真的很“菜”！

………………

参考
http://forum.ikaka.com/topic.asp?board=67&artid=8125594

techie3000 - 2006-10-10 16:34:00

与毒斗其乐无穷!

轩辕小聪 - 2006-10-10 16:46:00

不言

那两个dll很菜的，没有注册表守护，删了注册表，重启后就可以干掉了，可以不用IceSword出手。不过遇上“刘麻子”的话就不那么简单了。

deadmanzj - 2006-10-10 16:52:00

不言，昨天就出现。。嘿嘿招呼一下前辈

pxzx1119 - 2006-10-10 17:34:00

引用:

【不言放弃的贴子】【回复“pxzx1119”的帖子】
修复
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<xy><C:\WINDOWS\Download\svhost32.exe> [N/A]此处没有找到，（安全模式下，下同）

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62FB1}><C:\WINDOWS\system32\cnscheck100.dll> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{9A0CFC58-5A6F-41ba-9FFE-4320F4F62F1A}><C:\WINDOWS\system32\Cnscheck010.dll> [N/A]

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

开始－－控制面板－－性能和维护－－管理工具－－服务
禁用如下服务：
[mms-up / mms-up]
[Workstatioc / Workstatioc]

＝＝＝＝＝＝＝＝＝＝＝＝＝＝

开始－－运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除如下文件夹：
mms-up文件夹
Workstatioc文件夹

依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Enum\Root\](X代表1,2,3,4....)
删除如下文件夹：
LEGACY_mms-up文件夹
LEGACY_Workstatioc文件夹此处无法删除
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

http://www.xfocus.net/tools/200605/1161.html
下载后打开IceSword
在工具栏中点击－－文件－－设置
勾选“禁止进线程创建”
然后结束如下进程：
d:\Program Files\Rising\Rav\CCenter.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\hkcmd.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\dzh\internet\hypwise.exe
C:\Program Files\Internet Explorer\iexplore.exe

用IceSword删除
C:\WINDOWS\system32\cnscheck100.dll
C:\WINDOWS\system32\Cnscheck010.dll
C:\WINDOWS\system32\xydll.dll

在IceSword主界面点击左窗口中的“SSDT”按纽
用IceSword删除C:\WINDOWS\System32\new.sys此处找不到
删除完毕
把IceSword的“禁止进线程创建”前的勾去掉

附注：
使用IceSword杀毒的一些基本操作
http://forum.ikaka.com/topic.asp?board=28&artid=7168178

＝＝＝＝＝＝＝＝＝＝

清空HOSTS文件

＝＝＝＝＝＝＝＝＝＝

开始－－运行
输入regedit
确定
进入注册表
依次搜索“前两个图片中的网址”此处搜索不到
找到后全部删除

＝＝＝＝＝＝＝＝＝＝＝

删除
C:\WINDOWS\SCVHOST.EXE
以及C:\DOCUME~1\pxzx01\LOCALS~1\Temp\下的所有文件及文件夹

若能找到如下文件
同样删除之
C:\WINDOWS\SCVHOST.dll
C:\WINDOWS\SCVHOSTkey.dll
C:\WINDOWS\SCVHOST_hook.dll

＝＝＝＝＝＝＝＝＝＝

提示：
若正常模式下无法解决
建议进入安全模式下操作
………………

另外：操作完后用3721反间谍专家完全扫描出3个可以项目：附图

附件: 64723920061010172634.JPG

pxzx1119 - 2006-10-10 17:35:00

2

附件: 64723920061010172741.JPG

枫枫神话 - 2006-10-10 17:44:00

学习哈

pxzx1119 - 2006-10-11 8:54:00

引用:

【轩辕小聪的贴子】不言
那两个dll很菜的，没有注册表守护，删了注册表，重启后就可以干掉了，可以不用IceSword出手。不过遇上“刘麻子”的话就不那么简单了。
………………

“刘麻子”是什么东东？

不言放弃 - 2006-10-11 12:30:00

引用:

【pxzx1119的贴子】

“刘麻子”是什么东东？
………………

刘麻子是盗号木马

pxzx1119 - 2006-10-11 15:59:00

20楼所列没删除、没找到的今天全部揪出来了！爽啊！
再次感谢“不言放弃 ”，帮我解决问题，又长了见识～

还有一疑问：我打了所有漏洞补丁，安装有瑞星杀软、防火墙，下载东西先杀毒——木马是怎么进来的呢？

不言放弃 - 2006-10-11 16:03:00

引用:

【pxzx1119的贴子】20楼所列没删除、没找到的今天全部揪出来了！爽啊！
再次感谢“不言放弃 ”，帮我解决问题，又长了见识～

还有一疑问：我打了所有漏洞补丁，安装有瑞星杀软、防火墙，下载东西先杀毒——木马是怎么进来的呢？
………………

给系统打补丁是必需的
杀软与防火墙是辅助的
养成良好的上网习惯才是最重要的

现在是否已经明白？

＝＝＝＝＝＝＝

另外在注册表中无法删除某个系统服务文件夹
请这样操作：
在该文件夹上右击－－权限－－“允许”完全控制
然后再删除试试

不知是不是这样操作的？

pxzx1119 - 2006-10-11 16:12:00

引用:

【不言放弃的贴子】

另外在注册表中无法删除某个系统服务文件夹
请这样操作：
在该文件夹上右击－－权限－－“允许”完全控制
然后再删除试试

不知是不是这样操作的？
………………

我是在ICESWORD里删除的——嘿嘿^_^

不言放弃 - 2006-10-11 16:24:00

引用:

【pxzx1119的贴子】
我是在ICESWORD里删除的——嘿嘿^_^
………………

呵呵
不错啊

ICESWORD是有这个能力

瑞星卡卡安全论坛