瑞星卡卡安全论坛
sailordf - 2006-12-24 21:14:00
电脑不知道是中毒了，还是怎么了，我的电脑是XP的最近系统的一些图标全不见了，只留下一些图标箭头，还包括添加和删除程序里也不见了，程序开始菜单也没图标，发现C:\Documents and Settings\用户名\Local Settings\Temp下面多了好多东西，莫名其妙的东西，我重装系统试过了，把其他分区的东西该删除的也删除过了，还格式化全部硬盘了，系统刚装了一天又出现问题了，我郁闷啊，求求哪位大侠教教小弟怎么处理，谢谢
附件:
80957820061224210513.GIF
水树雨下 - 2006-12-24 21:15:00
mizuki.ys168.com下载System Repair Engineer扫个日志上来，一次贴不完分段贴，不要修改
sailordf - 2006-12-24 21:16:00
sailordf - 2006-12-24 21:18:00
sailordf - 2006-12-24 21:19:00
sailordf - 2006-12-24 21:20:00
鸟儿天上飞 - 2006-12-24 21:26:00
请下载SREng2（最新版） ，使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。
下载地址
http://www.kztechs.com/sreng/sreng2.zip
sailordf - 2006-12-24 21:30:00
第一部分日志
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<myMh2><C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE> [N/A]
<myZt2><C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><C:\PROGRA~1\svhost32.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"e:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"e:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<mhs2><C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe> [N/A]
<rxzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe> [N/A]
<wlzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
<zts2><C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<runeip><; C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<SiS Windows KeyHook><; C:\WINDOWS\system32\keyhook.exe> [Silicon Integrated Systems Corporation]
<SiSPower><; Rundll32.exe SiSPower.dll,ModeAgent> [Silicon Integrated Systems Corporation]
<SiSUSBRG><; C:\WINDOWS\SiSUSBrg.exe> [Silicon Integrated Systems Corp.]
<SMcfg><; smcfg.exe -s> []
<SoundMan><; SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<StormCodec_Helper><; "e:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<SunJavaUpdateSched><; C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp> [N/A]
sailordf - 2006-12-24 21:31:00
第二部分日志
==================================
启动文件夹
N/A
==================================
服务
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MSSQLSERVER / MSSQLSERVER]
<e:\PROGRA~1\MICROS~1\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[MSSQLServerADHelper / MSSQLServerADHelper]
<C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
[Rising Personal Firewall Service / RfwService]
<e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
<"e:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"e:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLSERVERAGENT / SQLSERVERAGENT]
<e:\PROGRA~1\MICROS~1\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[ExpScaner / ExpScaner]
<\??\e:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
<\??\e:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg]
<\??\e:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\e:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
<\??\e:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN]
<\??\e:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
<\??\e:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[Mtlmnt5 / Mtlmnt5]
<system32\DRIVERS\Mtlmnt5.sys><>
[Mtlstrm / Mtlstrm]
<system32\DRIVERS\Mtlstrm.sys><>
[npkcrypt / npkcrypt]
<\??\E:\Program Files\TM\TMDlls\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RecAgent / RecAgent]
<\SystemRoot\system32\DRIVERS\RecAgent.sys><>
[RsFwDrv / RsFwDrv]
<\??\e:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS]
<\??\e:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[SiS315 / SiS315]
<system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SiS AGP Filter / SISAGP]
<\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSkp / SiSkp]
<system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC]
<system32\DRIVERS\sisnic.sys><SiS Corporation>
[SmartLink AMR_PCI Driver / Slntamr]
<system32\DRIVERS\slntamr.sys><>
[SlNtHal / SlNtHal]
<system32\DRIVERS\Slnthal.sys><>
[SlWdmSup / SlWdmSup]
<system32\DRIVERS\SlWdmSup.sys><>
==================================
浏览器加载项
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <e:\Program Files\Thunder Network\Thunder\Thunder.exe, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.4.2_04]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll, JavaSoft / Sun Microsystems, Inc.>
[Java Plug-in 1.4.2_04]
{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll, JavaSoft / Sun Microsystems, Inc.>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<e:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<e:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
怀安LEDA電腦 - 2006-12-24 21:34:00
去下载个熊猫专杀和威金专杀吧。
kgwb - 2006-12-24 21:35:00
如果真的是瑞星杀毒和重装系统也不管用的话，那么可能问题就只可能是出在硬件上，请试着在与主板相关的一些个部件上检查一下如何？
sailordf - 2006-12-24 21:39:00
第四部分日志
==================================
正在运行的进程
[PID: 444][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 524][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 816][e:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 832][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 920][e:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 39]
[e:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[e:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[e:\Program Files\Rising\Rav\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[e:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[e:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[e:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[e:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[e:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[e:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
[e:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[e:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[e:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[e:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[e:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
[e:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[e:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[e:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[e:\Program Files\Rising\Rav\HookCont.dll] [Rising, 19, 0, 0, 0]
[e:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[e:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
[e:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[e:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[e:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
[e:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
[e:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 23]
[e:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[e:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
[e:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[e:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[e:\Program Files\Rising\Rav\ScanPack.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 18]
[e:\Program Files\Rising\Rav\RsVM.dll] [N/A, 19, 0, 0, 13]
[e:\Program Files\Rising\Rav\Uroutine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[e:\Program Files\Rising\Rav\Uscript.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[e:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[e:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[e:\Program Files\Rising\Rav\ScanNet.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 968][e:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 30]
[e:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
[e:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
[e:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 9]
[e:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[e:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
[e:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1272][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1468][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1500][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[e:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[e:\Program Files\ACDSee\picaview.dll] [ACD Systems, Ltd., 2, 0, 0, 78]
[e:\Program Files\ACDSee\PlugIns\IDE_ACDStd.apl] [ACD Systems, Ltd., 3,0,31,0]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
[PID: 1632][E:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[E:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[E:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[E:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[E:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
鸟儿天上飞 - 2006-12-24 21:39:00
你这日志不全 缺HOSTS以上的 都贴上来
sailordf - 2006-12-24 21:40:00
第五部分日志
[PID: 1640][E:\Program Files\Rising\Rfw\rfwmain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 56]
[E:\Program Files\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[E:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[E:\Program Files\Rising\Rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[E:\Program Files\Rising\Rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[E:\Program Files\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[PID: 1676][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[PID: 1244][E:\Program Files\TM\TMDlls\TM.exe] [N/A, N/A]
[E:\Program Files\TM\CoralAssist.DLL] [Coral Team, 4.5.0 build 20060515]
[E:\Program Files\TM\CoralQQ.DLL] [Coral Team, 4.5.4 Build 20061001]
[E:\Program Files\TM\ipsearcher.dll] [N/A, 1.0.0.4]
[E:\Program Files\TM\TMDlls\BasicCtrlDll.dll] [Tencent, 0, 3, 3, 9]
[E:\Program Files\TM\TMDlls\QQHelperDll.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQZip.dll] [tencent, 0, 3, 2, 4]
[E:\Program Files\TM\TMDlls\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\BaseUIClass.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[E:\Program Files\TM\TMDlls\QQAPI.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQRes.dll] [N/A, N/A]
[E:\Program Files\TM\TMDlls\LoginCtrl.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\npkcntc.dll] [INCA Internet Co., Ltd., 2005, 9, 1, 1]
[E:\Program Files\TM\TMDlls\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[E:\Program Files\TM\TMDlls\HostingMgr.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\WizardCtrl.dll] [Tencent, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQMainFrame.dll] [TENCENT, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\NewSkin.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\CQQApplication.dll] [N/A, N/A]
[E:\Program Files\TM\TMDlls\FrameBar.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\UserRelationWeight.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\CameraDll.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQGroupMng.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQAllInOne.dll] [N/A, N/A]
[E:\Program Files\TM\TMDlls\CommercesMng.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[E:\Program Files\TM\TMDlls\MiscCtrl.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\LongConnection.dll] [tencent, 0, 3, 3, 8]
[E:\Program Files\TM\TMDlls\QQSpace.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 0, 3, 0, 43]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 5, 0, 0]
[E:\安装文件\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[E:\Program Files\TM\TMDlls\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[E:\Program Files\TM\TMDlls\VqqModule.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[E:\Program Files\TM\TMDlls\RemoteHelp.dll] [, 1, 0, 0, 1]
[E:\Program Files\TM\TMDlls\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[E:\Program Files\TM\TMDlls\inplus.dll] [Tencent, 1.5.0.0]
[E:\Program Files\TM\TMDlls\ShareFiles.dll] [N/A, N/A]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[PID: 1956][C:\DOCUME~1\sailor\LOCALS~1\Temp\MjjiIs.exe] [N/A, N/A]
[PID: 852][C:\DOCUME~1\sailor\LOCALS~1\Temp\xnhuQD.exe] [N/A, N/A]
[PID: 1852][C:\DOCUME~1\sailor\LOCALS~1\Temp\esMOrT.exe] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\wlzs.dll] [N/A, N/A]
[PID: 372][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[PID: 1628][C:\DOCUME~1\sailor\LOCALS~1\Temp\KatWIR.exe] [N/A, N/A]
[PID: 1336][C:\DOCUME~1\sailor\LOCALS~1\Temp\xvYMql.exe] [N/A, N/A]
[PID: 860][C:\DOCUME~1\sailor\LOCALS~1\Temp\XtKJLD.exe] [N/A, N/A]
[PID: 1984][C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[PID: 940][C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[PID: 1432][C:\DOCUME~1\sailor\LOCALS~1\Temp\vJXWOj.exe] [N/A, N/A]
[PID: 412][C:\DOCUME~1\sailor\LOCALS~1\Temp\nfrBxX.exe] [N/A, N/A]
[PID: 492][C:\DOCUME~1\sailor\LOCALS~1\Temp\UVlppo.exe] [N/A, N/A]
[PID: 1584][C:\Program Files\CNNIC\Cdn\cdnup.exe] [CNNIC, 2, 5, 0, 6]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnuplib.dll] [CNNIC, 2, 5, 0, 5]
[C:\Program Files\CNNIC\Cdn\cdnprh.dll] [CNNIC, 2, 4, 0, 3]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[PID: 308][C:\WINDOWS\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[PID: 1264][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\CNNIC\Cdn\cdnuplib.dll] [CNNIC, 2, 5, 0, 5]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[e:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
[e:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 5, 0, 0]
[E:\安装文件\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[PID: 1248][C:\DOCUME~1\sailor\LOCALS~1\Temp\EhgfUx.exe] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\zts2.dll] [N/A, N/A]
[PID: 368][C:\DOCUME~1\sailor\LOCALS~1\Temp\ApUHYG.exe] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\mhs2.dll] [N/A, N/A]
[PID: 1492][C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\rxzs.dll] [N/A, N/A]
[PID: 1176][C:\DOCUME~1\sailor\LOCALS~1\Temp\PYRYAD.exe] [N/A, N/A]
[PID: 3184][C:\DOCUME~1\sailor\LOCALS~1\Temp\HNmDWh.exe] [N/A, N/A]
[PID: 3192][C:\DOCUME~1\sailor\LOCALS~1\Temp\CMxPUP.exe] [N/A, N/A]
[PID: 3200][C:\DOCUME~1\sailor\LOCALS~1\Temp\XUnHLt.exe] [N/A, N/A]
[PID: 3216][C:\DOCUME~1\sailor\LOCALS~1\Temp\shWZct.exe] [N/A, N/A]
[PID: 2004][C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe] [N/A, N/A]
[PID: 1552][C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe] [N/A, N/A]
[PID: 2416][C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe] [N/A, N/A]
[PID: 2260][C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2304][C:\Program Files\svhost32.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\g.dll] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[PID: 3544][C:\Documents and Settings\sailor\桌面\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll] [N/A, N/A]
[C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll] [N/A, N/A]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
sailordf - 2006-12-24 21:42:00
都帖完了‘鸟儿天上飞‘你分析一下，谢谢
鸟儿天上飞 - 2006-12-24 21:43:00
没有还少 HOSTS上面的全要
sailordf - 2006-12-24 21:46:00
2006-12-24,21:16:01
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
鸟儿天上飞 - 2006-12-24 21:48:00
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
要类似这样的资料 请不要修改
sailordf - 2006-12-24 21:50:00
就只有这么多了，还有最后有一个
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
鸟儿天上飞 - 2006-12-24 21:55:00
http://it.rising.com.cn/Channels/Service/2006-11/1163505486d38734.shtml下载这个杀毒 多杀几次 没有的话告诉我
sailordf - 2006-12-24 21:58:00
【回复“鸟儿天上飞”的帖子】好的
sailordf - 2006-12-24 22:06:00
【回复“sailordf”的帖子】C盘没发现病毒，其他盘有必要再杀吗，
鸟儿天上飞 - 2006-12-24 22:36:00
那用这个试一下http://forum.ikaka.com/topic.asp?board=28&artid=8235241
sailordf - 2006-12-24 22:38:00
怎么没人理我啊，电脑的进程快到60个了
skyshine - 2006-12-24 22:48:00
双击sreng，删除启动项目
<myMh2><C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE> [N/A]
<myZt2><C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE> [N/A]
<load><C:\PROGRA~1\svhost32.exe> [N/A]
mhs2><C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe> [N/A]
<rxzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe> [N/A]
<wlzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
<zts2><C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe> [N/A]
<{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp> [N/A]
重启后删除 使用KILLBOX删除以下文件：
C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\dllwm.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp
C:\DOCUME~1\sailor\LOCALS~1\Temp\MjjiIs.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xnhuQD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\esMOrT.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\wlzs.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\KatWIR.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xvYMql.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XtKJLD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\vJXWOj.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nfrBxX.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\UVlppo.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\EhgfUx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\ApUHYG.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mhs2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\zts2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\rxzs.dll
[C:\DOCUME~1\sailor\LOCALS~1\Temp\PYRYAD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\HNmDWh.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\CMxPUP.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XUnHLt.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\shWZct.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe
C:\Program Files\svhost32.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\g.dll
删除完毕之后，清理系统临时文件。
不仅如此，个人感觉你的服务项和驱动项有一些没有能扫描到的。
你按照上面的方法，清理之后，重新扫描日志发上来。
sailordf - 2006-12-24 22:51:00
好的，我试一试
鸟儿天上飞 - 2006-12-24 22:52:00
| 引用: |
【skyshine的贴子】双击sreng，删除启动项目
<myMh2><C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE> [N/A]
<myZt2><C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE> [N/A]
<load><C:\PROGRA~1\svhost32.exe> [N/A]
mhs2><C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe> [N/A]
<rxzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe> [N/A]
<wlzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
<zts2><C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe> [N/A]
<{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp> [N/A]
重启后删除 使用KILLBOX删除以下文件：
C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\dllwm.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp
C:\DOCUME~1\sailor\LOCALS~1\Temp\MjjiIs.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xnhuQD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\esMOrT.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\wlzs.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\KatWIR.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xvYMql.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XtKJLD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\vJXWOj.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nfrBxX.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\UVlppo.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\EhgfUx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\ApUHYG.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mhs2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\zts2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\rxzs.dll
[C:\DOCUME~1\sailor\LOCALS~1\Temp\PYRYAD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\HNmDWh.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\CMxPUP.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XUnHLt.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\shWZct.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe
C:\Program Files\svhost32.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\g.dll
删除完毕之后，清理系统临时文件。
不仅如此，个人感觉你的服务项和驱动项有一些没有能扫描到的。
你按照上面的方法，清理之后，重新扫描日志发上来。
……………… |
呵呵 没用的 他都说了 他重新做过系统 这是后感染的说明他别的盘有被感染的文件
看他的情况应该 微金 和熊猫的门大 删了C 没用
skyshine - 2006-12-24 23:09:00
| 引用: |
【鸟儿天上飞的贴子】| 引用: | 【skyshine的贴子】双击sreng，删除启动项目
<myMh2><C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE> [N/A]
<myZt2><C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE> [N/A]
<load><C:\PROGRA~1\svhost32.exe> [N/A]
mhs2><C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe> [N/A]
<rxzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe> [N/A]
<wlzs><C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
<zts2><C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe> [N/A]
<{729B6C61-BDC5-4C09-A1DE-A296BA0B89EC}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp> [N/A]
重启后删除 使用KILLBOX删除以下文件：
C:\DOCUME~1\sailor\LOCALS~1\Temp\Mhgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\dllwm.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.wmp
C:\DOCUME~1\sailor\LOCALS~1\Temp\MjjiIs.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xnhuQD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\esMOrT.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\wlzs.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\KatWIR.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xvYMql.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XtKJLD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mh2\iexpl0re.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Zt2\SVCH0ST.EXE
C:\DOCUME~1\sailor\LOCALS~1\Temp\Ztgx.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\vJXWOj.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nfrBxX.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\UVlppo.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\EhgfUx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\ApUHYG.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\mhs2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\zts2.dll
C:\DOCUME~1\sailor\LOCALS~1\Temp\xoZnxx.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\rxzs.dll
[C:\DOCUME~1\sailor\LOCALS~1\Temp\PYRYAD.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\HNmDWh.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\CMxPUP.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\XUnHLt.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\shWZct.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\KlPLSq.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\nwHfDA.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\uZcNbz.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\dpqIyl.exe
C:\Program Files\svhost32.exe
C:\DOCUME~1\sailor\LOCALS~1\Temp\g.dll
删除完毕之后，清理系统临时文件。
不仅如此，个人感觉你的服务项和驱动项有一些没有能扫描到的。
你按照上面的方法，清理之后，重新扫描日志发上来。
……………… |
呵呵 没用的 他都说了 他重新做过系统 这是后感染的说明他别的盘有被感染的文件
看他的情况应该 微金 和熊猫的门大 删了C 没用
……………… |
我不否认这些文件是威金造成的。
我之前说过了，他的系统中有些日志没有能扫描上来：
比如服务和驱动项。
这些操作，只是能帮助他解决目前的问题，要根本的解决，有一款杀软是必不可少的！
虽然这是瑞星论坛，可是我个人觉得，还是推荐他试下卡巴斯基！
至于威金专杀：我推荐农夫的“VKING杀虫剂”。可以去置顶的工具中查看。
sailordf - 2006-12-24 23:31:00
不行啊，我删除一个，出来两个，我刚把系统还原了，还是这样，1分钟之内全部上来了，又开始了，我觉得不是C盘这些文件的问题，想想其他办法！！
sailordf - 2006-12-24 23:33:00
VIKING杀虫剂我刚下载了，扫描不到，我的系统整个硬盘都格式化过，但是里面有一些重要的文件，我拷贝到移动硬盘里面了，后来又拷贝到电脑硬盘里面，这些文件我不能丢的，但是现在......我真的要哭了
© 2000 - 2026 Rising Corp. Ltd.