瑞星卡卡安全论坛

中毒了,还禁用杀软,高手帮我看看
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <svcshare><C:\WINDOWS\system32\drivers\spoclsv.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <load><C:\WINDOWS\uninstall\rundl132.exe>  [N/A]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Intel Corporation]
    <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Intel Corporation]
    <psojva><C:\WINDOWS\system32\dsbjrn.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Corporation]
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system2.sys>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Corporation]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Corporation]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Corporation]

==================================

启动文件夹
N/A

==================================
服务
[ASP.NET State Service / aspnet_state]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[User Profile Hive Cleanup / UPHClean]
  <C:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>
[Windows Media Connect (WMC) / WmcCds]
  <c:\program files\windows media connect\mswmccds.exe><Microsoft Corporation>
[Windows Media Connect (WMC) 帮助程序 / WmcCdsLs]
  <C:\Program Files\Windows Media Connect\mswmcls.exe><Microsoft Corporation>

==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS]
  <system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[FXDRV / FXDRV]
  <\??\G:\Fxdrv.sys><N/A>
[ialm / ialm]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[TCP/IP Protocol Driver / Tcpip]
  <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}]
  <system32\drivers\ialmsbw.sys><Intel Corporation>

==================================
浏览器加载项
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 432][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 488][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 512][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 712][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 800][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 844][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 904][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1192][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1428][C:\Program Files\UPHClean\uphclean.exe]  [Microsoft Corporation, 1.5.5.21]
[PID: 1200][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
    [E:\应用程序\上网助手\ske\contmenu.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dsbjrn.dll]  [N/A, N/A]
[PID: 472][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.10]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
[PID: 1564][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
[PID: 1536][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
[PID: 1028][C:\WINDOWS\system32\drivers\spoclsv.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\dsbjrn.dll]  [N/A, N/A]
[PID: 572][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
    [C:\WINDOWS\system32\macromed\flash\Flash.ocx]  [Macromedia, Inc., 7,0,19,0]
    [C:\WINDOWS\system32\dsbjrn.dll]  [N/A, N/A]
[PID: 632][C:\WINDOWS\system32\dsbjrn.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\dsbjrn.dll]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]
[PID: 248][C:\WINDOWS\Documents and Settings\All Users\dwonload\temp.exe]  [N/A, N/A]
[PID: 988][C:\DOCUME~1\ADMINI~3.WOR\LOCALS~1\Temp\sreng2.zip 的临时目录 1\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\system32\dsbjrn.dll]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\system2.sys]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[E:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe

==================================
HOSTS 文件
127.0.0.1      localhost

怎么都没人帮帮我呀

运行System Repair Engineer 启动项目，注册表，删除
load><C:\WINDOWS\uninstall\rundl132.exe> [N/
<psojva><C:\WINDOWS\system32\dsbjrn.exe> [N/A]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system2.sys> [N/A]
删除
C:\WINDOWS\uninstall\rundl132.exe
C:\WINDOWS\system32\dsbjrn.exe
C:\Program Files\Internet Explorer\PLUGINS\system2.sys
右健打开各个分区删除
setup.exe

注册表怎么打开呀,还有要删除的
能详细点说吗

....

附件: 79532220061216132125.JPG

load><C:\WINDOWS\uninstall\rundl132.exe> [N/
<psojva><C:\WINDOWS\system32\dsbjrn.exe> [N/A]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system2.sys> [N/A]
这些的目录能详细点吗

C:\Program Files\Internet Explorer\PLUGINS\目录下可能还有与system2.sys文件名相同后缀不同的隐藏文件一起删了
每个盘符下autorun也要删掉

引用:

【水树雨下的贴子】右健打开各个分区删除 setup.exe ………………

不删除autorun.inf?就删除病毒文件 后遗症怎么解决 

佩服

哦明白了,我真笨,谢谢各位了

还要删除什么afkp4e7 能详细说吗

.....

附件: 79532220061216132714.JPG

他是让你气的忘了

运行你扫日志的软件删除，删除setup.exe的同时删除autorun文件，注意是隐藏文件

失误，刚才连运行System Repair Engineer删除那句都没写上，后来马上补的

我给你说详细一点
进入安全模式
打开SRE  进入启动项目  在启动中删除
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<svcshare><C:\WINDOWS\system32\drivers\spoclsv.exe> [N/A]
<psojva><C:\WINDOWS\system32\dsbjrn.exe> [N/A]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system2.sys> [N/A]
这四项
并且打开隐藏文件 找到
C:\WINDOWS\uninstall\rundl132.exe
C:\WINDOWS\system32\drivers\spoclsv.exe
C:\WINDOWS\system32\dsbjrn.exe
C:\Program Files\Internet Explorer\PLUGINS\system2.sys
C:\WINDOWS\system32\dsbjrn.dll
C:\WINDOWS\Documents and Settings\All Users\dwonload\temp.exe
这六个文件删除
如果有文件删除不了
重新启动计算机 用冰刃找到文件  强制删除
注意路径  慎用冰刃  否则会导致系统出错
删除后重新启动

团结稳定

引用:

【afkp4e7的贴子】C:\Program Files\Internet Explorer\PLUGINS\目录下可能还有与system2.sys文件名相同后缀不同的隐藏文件一起删了 每个盘符下autorun也要删掉 ………………

真的不懂呀
一步一步来嘛
这台机子我重装好几遍了
病毒还是存在
我也没法子呀
麻烦你了

C:\WINDOWS\system32\drivers\spoclsv.exe他中熊猫了啊

完 了d盘exe文件 挂了

昨天我发现的那个瑞星还不能识别
搂主 去查d盘的exe吧 保证一堆小熊猫

哈哈 没有中过  不知道是熊猫  看来那个详细的杀毒方法也没有用了 哈哈

水树兄  都没有注意这个启动项  佩服至极

直接上专杀，瑞星的不行就找个农夫版的，上边的删不删吧

搂主要在局域网内记得去查下其他的机器是不是 也有

我昨天见 的是350k和置顶的不同
不知搂主的是哪个版本的

现在瑞星可以识别这个病毒了

我的瑞星识别  熊猫变种M  等等我去找个旧电脑试验一下

我现在就是一堆的熊猫
谁有办法帮我把这毒杀了呀
拜托了

人都去哪了

运行SREng2,使用“启动项目”－－注册表－－删除
C:\WINDOWS\system32\drivers\spoclsv.exe
C:\WINDOWS\uninstall\rundl132.exe
C:\WINDOWS\system32\dsbjrn.exe

重启按F８进入安全模式下
显示隐藏文件
删除：
C:\WINDOWS\system32\drivers\spoclsv.exe
C:\WINDOWS\uninstall\rundl132.exe
C:\WINDOWS\system32\dsbjrn.exe
C:\Program Files\Internet Explorer\PLUGINS\system2.sys
C:\WINDOWS\system32\dsbjrn.dll
C:\WINDOWS\Documents and Settings\All Users\dwonload\temp.exe


右键打开,不要双击,删除每个盘的根目录隐藏文件
Autorun.inf
setup.exe