瑞星卡卡安全论坛

Trojan.DL.Agent.bdl
着是什么病毒啊
瑞星能彻底清除吗 ,这个病毒今天已经杀了13个了
告诉我该怎么做啊

病毒路径和文件名

Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\System Volume Information\_restore{953639C2-F3D0-4A9B-A034-D81EC1D0215C}\RP3A0008879.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll
Trojan.DL.Agent.bdlD:\Downloadscmqqbeta3v144a.zip>>cmqqbeta3v144a.exe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.dll

是这个吗

附件: 70117120061216193540.BMP

来帮我看看啊

着是我的日志


Logfile of HijackThis v1.99.1
Scan saved at 18:53:08, on 2006-12-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\RavMonD.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\Program Files\Rising\Rfw\rfwmain.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\忽忽\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://account.qq.com/qqedit.cab
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - E:\KUGOO\KuGoo3\InExtend\KuGoo3DownXControl.ocx
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Nwcle_lawksw - NVIDIA Corporation - (no file)
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

帮我想想办法啊
是要这个路径吗
好多病毒 都是同一个
D:\Downloads\cmqqbeta3v144a.zip>>cmqqbeta3v144a.e
xe>>$TEMP\00cmqq00.exe>>$SYSDIR\drivers\soundmix.d
ll 着是其中的一个路径

关闭D盘的系统还原,重启,打开D盘的系统还原
重启按F８进入安全模式下
显示隐藏文件
删除：
D:\Downloads\cmqqbeta3v144a.zip
D:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe

怎么关闭系统还原啊
我电脑 没按还原卡啊

晕
我的电脑>右键>属性>系统还原

每在安全模式下删除
D:\Downloads\cmqqbeta3v144a.zip
D:\跑跑卡顶车\waigua\cmqqbeta3v144acmqqbeta3v144a.exe
这个可以吗

不可以 那样可能杀不干净 还有红夜鬼C:\WINDOWS\System32\svchost.exe
  这个  路径的System32怎么S大写 就算系统不区分大小写也不应该是这样啊

我刚在安全模式下杀毒了
在D盘的Recycled杀出一个
我电脑C D E F盘全是关闭
没打开过,这样我能彻底杀除了吗

来帮我看看啊
我这样能彻底杀掉吗

怎么没人来看啊
我现在都不敢上QQ和玩游戏
快来帮帮我啊

引用:

【简简单单23的贴子】不可以 那样可能杀不干净 还有红夜鬼C:\WINDOWS\System32\svchost.exe   这个  路径的System32怎么S大写 就算系统不区分大小写也不应该是这样啊 ………………

别误导，这个正常

那我这样能彻底杀除了吗

告诉我啊
我那样杀彻底了吗