RootKit.Cell.a/Trojan.PSW.ZhengTu.xx/Trojan.PSW.Lineage.ys bbs.ikaka.com

EKZUC - 2006-12-25 8:16:00

RootKit.Cell.a
开机后提示病毒,点删除后瑞星显示忽略.
重新启动后依然存在.

Trojan.PSW.ZhengTu.xx
Trojan.PSW.Lineage.ys
开机约5分钟后提示,点删除瑞星其实已删.
重新启动后又冒出来了.

以下是日志,大大们帮帮我..

HijackThis_zww汉化版扫描日志 V1.99.1
保存于 8:00:10, 日期 2006-12-25
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\iTouch\iTouch.exe
C:\Program Files\MouseWare\system\em_exec.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\丁雯\LOCALS~1\Temp\rxzs.exe
C:\Program Files\Rising\Rav\RavMon.exe
D:\Tencent\TT\TTraveler.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\丁雯\桌面\HijackThis1[1].99.1\HijackThis1991zww.exe

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: QQCycloneHelper - {00000000-12C9-4305-82F9-43058F20E8D2} - D:\Tencent\QQDownload\QQIEHelper01.dll
O2 - BHO: 搜搜地址栏搜索 - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet 0.80\tools\BitCometBHO.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [zBrowser Launcher] C:\Program Files\iTouch\iTouch.exe
O4 - 启动项HKLM\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - 启动项HKLM\\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [rxzs] C:\DOCUME~1\丁雯\LOCALS~1\Temp\rxzs.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [myZt1] C:\DOCUME~1\丁雯\LOCALS~1\Temp\Zt1\SVCH0ST.EXE
O4 - HKCU\..\Run: [myWl2] C:\DOCUME~1\丁雯\LOCALS~1\Temp\Wl2\lexplore.exe
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - d:\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [TBH] 中文搜搜
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DFD24C9-BB50-419C-BF2A-864346FF781F}: NameServer = 218.85.157.99 202.101.98.55
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

鸟儿天上飞 - 2006-12-25 8:18:00

下载SREng2（最新版），使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。

下载地址
http://www.kztechs.com/sreng/sreng2.zip

EKZUC - 2006-12-25 8:26:00

[CODE]

2006-12-25,08:13:26

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<msnmsgr><"C:\Program Files\MSN Messenger\msnmsgr.exe" /background> [(Verified)Microsoft Corporation]
<myZt1><C:\DOCUME~1\丁雯\LOCALS~1\Temp\Zt1\SVCH0ST.EXE> [N/A]
<myWl2><C:\DOCUME~1\丁雯\LOCALS~1\Temp\Wl2\lexplore.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<zBrowser Launcher><C:\Program Files\iTouch\iTouch.exe> [Logitech Inc.]
<Logitech Utility><Logi_MwX.Exe> [(Verified)Logitech Inc.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<BigDogPath><C:\WINDOWS\VM_STI.EXE USB PC Camera 301P> [N/A]
<stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe> [Tencent]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [(Verified)RealNetworks, Inc.]
<rxzs><C:\DOCUME~1\丁雯\LOCALS~1\Temp\rxzs.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<NiceMSoft><C:\WINDOWS\system32\retemp.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{06A48AD9-FF57-4E73-937B-B493E72F4226}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\WinInfo.rxk> [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Driver Helper Service / NVSvc][Stopped/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

==================================
驱动程序
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
<system32\drivers\ALCXSENS.SYS><Sensaura Ltd>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\G:\4代万能主板\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWBS2 / HSFHWBS2][Running/Manual Start]
<system32\DRIVERS\HSFBS2S2.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP][Running/Manual Start]
<system32\DRIVERS\HSFDPSP2.sys><Conexant Systems, Inc.>
[IPHOOK / IPHOOK][Stopped/Auto Start]
<\??\C:\Program Files\rising\rfw\2000\iphook.sys><N/A>
[iTouch Keyboard Filter / itchfltr][Running/Manual Start]
<system32\DRIVERS\itchfltr.sys><Logitech, Inc.>
[Logitech HID/USB Mouse Filter Driver / LHidFlt2][Running/Manual Start]
<system32\DRIVERS\LHidFlt2.Sys><Logitech, Inc.>
[Logitech USB Receiver device driver / LHidUsb][Running/Manual Start]
<System32\Drivers\LHidUsb.Sys><Logitech, Inc.>
[Logitech Mouse Class Filter Driver / LMouFlt2][Running/Manual Start]
<system32\DRIVERS\LMouFlt2.Sys><Logitech, Inc.>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[New0 / New0][Running/Auto Start]
<\??\C:\WINDOWS\system32\new.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\d:\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[TDIHOOK / TDIHOOK][Stopped/System Start]
<\??\C:\Program Files\rising\rfw\2000\tdihook.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSFCXTS2.sys><Conexant Systems, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[USB PC Camera 301P / ZSMC301b][Running/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>

EKZUC - 2006-12-25 8:27:00

==================================
浏览器加载项
[QQCycloneHelper Class]
{00000000-12C9-4305-82F9-43058F20E8D2} <D:\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\BitComet 0.80\tools\BitCometBHO.dll, BitComet>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Tencent\QQ\QQIEHelper.dll, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Tencent\QQ\QQIEHelper.dll, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[QQCycloneHelper Class]
{00000000-12C9-4305-82F9-43058F20E8D2} <D:\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\Adplus\SSAddr.dll, Tencent>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\BitComet 0.80\tools\BitCometBHO.dll, BitComet>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Tencent\QQ\QQIEHelper.dll, N/A>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\淘宝网\淘宝旺旺\WangWangX3.dll, 淘宝（中国）软件有限公司>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<D:\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Tencent\QQ\SendMMS.htm, N/A>

EKZUC - 2006-12-25 8:29:00

==================================
正在运行的进程
[PID: 456][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 512][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 536][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 592][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 800][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 868][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 884][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 948][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1012][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 39]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\rfwctrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\HookWeb.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\HookCont.dll] [Rising, 19, 0, 0, 0]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 23]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[C:\Program Files\Rising\Rav\ScanPack.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 18]
[C:\Program Files\Rising\Rav\RsVM.dll] [N/A, 19, 0, 0, 13]
[C:\Program Files\Rising\Rav\Uroutine.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
[C:\Program Files\Rising\Rav\ScanNet.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\Uscript.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[C:\Program Files\Rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]

EKZUC - 2006-12-25 8:29:00

[PID: 1092][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 30]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 9]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 1288][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1380][C:\Program Files\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1644][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\WinInfo.rxk] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[D:\Tencent\RTXC\RTXShl.dll] [Tencent, 1, 0, 0, 1]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1680][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 56]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[PID: 1720][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[PID: 724][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2004][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.09]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[PID: 292][C:\Program Files\iTouch\iTouch.exe] [Logitech Inc., 2.16.271]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\iTouch\iTouchrc.dll] [Logitech Inc., 2.16.271]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\iTouch\kbdhook.dll] [Logitech Inc., 2.16.271]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[PID: 328][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 364][C:\Program Files\MouseWare\system\em_exec.exe] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\system\EVENTEX.dll] [Logitech Inc., 9.75.302]
[C:\WINDOWS\system32\COMNCTR.dll] [Logitech Inc., 9.75.302]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\system\ccresrce.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\system\GlbResLt.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\devices.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\system\ccstmglb.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\system\ccustom.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\system\ccmsghk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[PID: 988][C:\WINDOWS\VM_STI.EXE] [VM., 4.2.610.4]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\system32\VM31bPrp.Ax] [VM, 4.2.711.31]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[PID: 404][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[PID: 556][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3760]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[PID: 504][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[PID: 584][C:\DOCUME~1\丁雯\LOCALS~1\Temp\rxzs.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 3104][C:\Program Files\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[PID: 3208][D:\Tencent\TT\TTraveler.exe] [腾讯公司, 3.1.0.261]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[D:\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] [腾讯公司, 1, 1, 0, 5]
[D:\Tencent\TT\Plugins\TWeather\TWeather.dll] [, 1, 0, 0, 3]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[D:\Tencent\TT\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
[C:\Program Files\iTouch\kbdhook.dll] [Logitech Inc., 2.16.271]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3504][D:\Tencent\TT\TCPlus.exe] [腾讯公司, 1, 0, 0, 5]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[D:\Tencent\TT\QQDownload.dll] [Tencent Technology (Shenzhen) Company Limited, 1, 0, 101, 28]
[D:\Tencent\TT\TNProxy.dll] [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 60]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[PID: 3352][C:\Documents and Settings\丁雯\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\MouseWare\System\LgWndHk.dll] [Logitech Inc., 9.75.302]
[C:\Program Files\iTouch\iTchHk.dll] [Logitech Inc., 1.0.0]
[C:\Program Files\Common Files\Logitech\Scrolling\LgMsgHk.dll] [Logitech Inc., 1.0.0]

EKZUC - 2006-12-25 8:30:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

EKZUC - 2006-12-25 8:30:00

日志的量还真大额...麻烦各位大大了..

EKZUC - 2006-12-25 10:52:00

沉到好下面噢....顶下下,大大们帮我看看吧..

水树雨下 - 2006-12-25 10:58:00

运行System Repair Engineer 启动项目，注册表删除
<myZt1><C:\DOCUME~1\丁雯\LOCALS~1\Temp\Zt1\SVCH0ST.EXE> [N/A]
<myWl2><C:\DOCUME~1\丁雯\LOCALS~1\Temp\Wl2\lexplore.exe> [N/A]
rxzs><C:\DOCUME~1\丁雯\LOCALS~1\Temp\rxzs.exe> [N/A]
启动项目，服务,win32服务应用程序，勾选隐藏微软服务后删除
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
重启后我的电脑，工具，文件夹选项，查看，显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉删除
windhcp.ocx
这个文件夹所有文件C:\DOCUME~1\丁雯\LOCALS~1\Temp
这个没见过，你看看是什么
C:\WINDOWS\system32\retemp.exe

EKZUC - 2006-12-25 11:00:00

感谢9楼滴水树雨下,我先按你的方法弄一下.

EKZUC - 2006-12-25 11:12:00

windhcp.ocx
这个文件删不掉,会提示拒绝访问.

C:\WINDOWS\system32\retemp.exe
这个...我是电脑白痴级的...别说没见过了..就算见过也不知道是什么...

还有个问题是要删除C:\DOCUME~1\丁雯\LOCALS~1\Temp这个里面的所有东西吗?

水树雨下 - 2006-12-25 11:14:00

没重启吧？Temp里边的全删

EKZUC - 2006-12-25 11:15:00

重新启动过了噢,删不了.
还是会有发现病毒的提示.

EKZUC - 2006-12-25 11:16:00

C:\DOCUME~1\丁雯\LOCALS~1\Temp 里的
Perflib_Perfdata_3c8.dat
Perflib_Perfdata_688.dat
这两个文件删不了,提示是正在被使用.

水树雨下 - 2006-12-25 11:18:00

根据上边的提示删除那个服务，安全模式下删除windhcp.ocx

EKZUC - 2006-12-25 11:25:00

[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
这个删了好几次,也重新启动了好几次..都删不了.
第一次我还以为我点了"是",后面2次都很确定点了"否"还是删不了..我换去安全模式试一下.

EKZUC - 2006-12-25 12:18:00

好倒霉..写了一大堆一个验证码不正确就都没了..

过程如下.

1.删除服务[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

2.重新启动

3.进入安全模式

4.删除C:\WINDOWS\system32\windhcp.ocx

5.进入C:\DOCUME~1\丁雯\LOCALS~1\Temp发现其中并没有文件存在.(已选择显示隐藏文件以及受保护系统文件的选项)

6.重新启动

7.进入正常模式

8.运行System Repair Engineer,发现服务[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>又出现了.

9.C:\WINDOWS\system32\windhcp.ocx文件也再次出现...

10.C:\DOCUME~1\丁雯\LOCALS~1\Temp文件夹内还是有Perflib_Perfdata_3c8.dat和Perflib_Perfdata_688.dat两个文件,无法删除.

大大救救我吧...

EKZUC - 2006-12-25 12:55:00

我有罪....
忘记说了...丁雯只是这台电脑其中的一个用户.
刚才看了一下http://forum.ikaka.com/topic.asp?board=28&artid=8238940这个帖子,是否可以按照里面的步骤操作呢?

瑞星卡卡安全论坛