我又来了【我的电脑中毒，瑞星装不上了，请帮忙】有图，日志—

纯飞 - 2006-12-28 18:19:00

前天——————
“我今天一开机，瑞星就帮我杀出了Rootkit.Agent.nu，可是杀不掉，每次瑞星都提示我杀毒成功，可是每次我用瑞星再杀一遍的时候又有了，而且它的文件不能删，会自动复制回来，卡卡上网助手也帮我找到N个流氓软件，说还有一个需要重启后杀掉，我就重启了……
恐怖的事情也发生了，在屏幕出现“欢迎使用”字幕之前赫然出现了特别大的，用许多%组成的“瑞星杀毒”四个大字，下面还有升及日期之类的，好恐怖啊，然后，在进入系统了，瑞星的所有监控就禁用了！！！！！”
然后一个高手帮助我，可能是我操作有问题，机器完了，只能重装了，昨天从做了2次系统，系统还是有问题，有很多网页开不了。
今天————————
我重做了系统后装瑞星，防火墙很顺利，可是瑞星我第一次下来安装的时候，提示我文件已改变，我重新下了一次安装时候发现下面的情况：

附件: 25100920061228181946.jpg

纯飞 - 2006-12-28 18:31:00

病毒看来还在啊，现在我把日志贴上来，一直等，等大家的帮忙，谢谢了~~~
[CODE]

2006-12-28,17:57:27

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\ASSIST~1\yclickon.dll> [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Basetdi / Basetdi][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[HookUrl / HookUrl][Stopped/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<D:\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Tencent\QQ\SendMMS.htm, N/A>

纯飞 - 2006-12-28 18:31:00

==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 496][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 520][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4113]
[PID: 564][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 576][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 728][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[PID: 756][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 812][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 880][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 952][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1388][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4113]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2496]
[PID: 1472][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1604][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5142]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5142]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5142]
[PID: 1612][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.30]
[PID: 1620][C:\WINDOWS\system32\CTFMON.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 932][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1980][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[PID: 1100][D:\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 370]
[D:\Tencent\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Tencent\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Tencent\QQ\QQMainFrame.dll] [N/A, N/A]
[D:\Tencent\QQ\CQQApplication.dll] [N/A, N/A]
[D:\Tencent\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[D:\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\GroupLive.dll] [N/A, N/A]
[D:\Tencent\QQ\QQSysMsgMng.dll] [N/A, N/A]
[D:\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\QQPlugin.dll] [N/A, N/A]
[D:\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Tencent\QQ\ShareFiles.dll] [N/A, N/A]
[D:\Tencent\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\Tencent\QQ\QRingMng.dll] [N/A, N/A]
[D:\Tencent\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Tencent\QQ\VPortal.dll] [, 1, 0, 0, 4]
[D:\Tencent\QQ\QQAllInOne.dll] [N/A, N/A]
[D:\Tencent\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\Tencent\QQ\QQCustomFace.dll] [N/A, N/A]
[D:\Tencent\QQ\QQAvatar.dll] [N/A, N/A]
[D:\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[D:\Tencent\QQ\QQSceneMng.dll] [N/A, N/A]
[D:\Tencent\QQ\BQQApplication.dll] [N/A, N/A]
[D:\Tencent\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 240]
[D:\Tencent\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Tencent\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 2, 23]
[PID: 1380][D:\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[D:\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 172][D:\Tencent\QQ\QQexternal.exe] [, 1, 0, 0, 1]
[D:\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 370]
[D:\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 568][C:\Program Files\Rising\Rfw\rfwmain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 56]
[C:\Program Files\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[C:\Program Files\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[C:\Program Files\Rising\Rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 1648][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 30]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 9]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
[c:\program files\rising\rfw\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[PID: 396][C:\WINDOWS\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2900][C:\Documents and Settings\Admin\桌面\Upgrade.exe] [Beijing Rising Technology Co., Ltd., 19.3.0.0]
[PID: 3132][C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\Upgrade.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 3]
[C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\Upgrade.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
[PID: 2756][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3456][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 424][C:\Documents and Settings\Admin\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

红夜鬼1 - 2006-12-28 18:33:00

C:\DOCUME~1\Admin\LOCALS~1\Temp\到安全模式下清空

纯飞 - 2006-12-28 19:21:00

我找不到这个文件夹啊，说的详细点，可以吗？

纯飞 - 2006-12-28 20:23:00

不行啊，我的机子现在安全模式下是2个用户名，里面什么也没有，正常启动里的有，但是删不掉

纯飞 - 2006-12-28 20:31:00

怎么没人里啊，说话啊

纯飞 - 2006-12-28 20:34:00

自己顶

纯飞 - 2006-12-28 20:58:00

帮忙啊

鸟儿天上飞 - 2006-12-28 21:01:00

C:\DOCUME~1\Admin\LOCALS~1\Temp 代表
C:\Documents and Settings\Admin\Local Settings\Temp
显示隐藏文件找

skyshine - 2006-12-28 21:10:00

日志没有问题，建议在控制面板鼠标设置里调整一下相关设置试试看。如果问题还不能解决，请用下面的工具扫描一下病毒。
用Dr.Web CureIT扫瞄一次你的电脑
a) 下载 Dr.Web CureIT:ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe并保存到桌面
b) 运行 cureit.exe ,会提示你做一次Express Scan(快速扫瞄),扫瞄一次你的记忆体,如果找到已感染的档案,会提示你进行杀毒(Cure)
c) Express Scan完成后,按 Select drives ,再按右手面的三角形/箭头开始扫瞄
d) 当扫瞄过程中找到已感染的档案,按 Yes to All 去清除/移动档案
e) 扫瞄完成后,如果找到已感染的档案,按中间第一个正方形(有红Tick)的制,再按下面个正方形(由上开始数,第2个)的制,选 Move incurable

baohe - 2006-12-28 21:34:00

【回复“纯飞”的帖子】
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\ASSIST~1\yclickon.dll> [N/A]——————删除这个加载项。重启。显示隐藏文件。删除：C:\PROGRA~1\Yahoo!\ASSIST~1\yclickon.dll

————————
[PID: 2900][C:\Documents and Settings\Admin\桌面\Upgrade.exe] [Beijing Rising Technology Co., Ltd., 19.3.0.0]
[PID: 3132][C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\Upgrade.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 3]
[C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\DOCUME~1\Admin\LOCALS~1\Temp\RavTmp\Upgrade.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
结束这些进程。
删除C:\Documents and Settings\Admin\桌面\Upgrade.exe。
清空C:\DOCUME~1\Admin\LOCALS~1\Temp文件夹。
重新安装瑞星杀软。

鸟儿天上飞 - 2006-12-28 21:49:00

大叔楼主老笨滴说你告诉他怎么显示隐藏文件吧,,

纯飞 - 2006-12-28 21:51:00

晕，我看不明白~~~，人已经都走了，我打开了，可是找不到这个健值啊，要怎么才能找到，我看不明白~~~

鸟儿天上飞 - 2006-12-28 21:54:00

不告诉你了吗把墙删了清空那文件夹先装杀软在装墙

纯飞 - 2006-12-28 21:56:00

嘿嘿，不好意思
隐藏文件我会显示，可是他说的其他的我不会啊，不过我知道进启动项用regedit,后面找的也对啊，可是就是看不到

鸟儿天上飞 - 2006-12-28 22:01:00

运行SRENG--启动项目--注册表找到
<{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\ASSIST~1\yclickon.dll> 删除
然后:CTRL+ALT+DEL 调出任务管理器结束
Upgrade.exe(有几个结束几个..)
Upgrade.dll
删除:
删除C:\Documents and Settings\Admin\桌面\Upgrade.exe
清空C:\C:\Documents and\Admin\Local Settings\Temp文件夹
重新安装瑞星杀软。

纯飞 - 2006-12-28 22:08:00

SRENG运行不了啊

魔域乖乖 - 2006-12-28 22:17:00

哇~~强~~重装都不得~~是不是你系统安装碟也有毒啊~~你在重装时你有没有吧其它盘都格啦~~格啦这样才干净~~

纯飞 - 2006-12-28 22:37:00

引用:

【魔域乖乖的贴子】哇~~强~~重装都不得~~是不是你系统安装碟也有毒啊~~你在重装时你有没有吧其它盘都格啦~~格啦这样才干净~~
………………

竟说没用的！！！！

纯飞 - 2006-12-29 11:46:00

有人在吗，进来哦

纯飞 - 2006-12-29 20:53:00

有人在吗？我必须要全部格系统吗

纯飞 - 2006-12-29 21:39:00

把硬盘全格掉吗？我的安全模式下现在有两个用户，我真的烦死了，要怎么半啊，机子很多网页也开不了

纯飞 - 2006-12-29 21:45:00

是不是我的东西改变了，所以键值也变了，是不是我要重新扫秒一下日志

琪乐无琼 - 2007-1-15 1:25:00

想请问楼主，这样的问题解决了吗？我遇到的问题和你一样哦。今天刚刚重新安装了系统，我的瑞星是老版本了，今天全部重新升级后，防火墙不费事的就安装好了，到了这个杀毒软件安装时，出现的问题和楼主一样哦，怪郁闷的，请教各位大侠，给点指教吧！那注册表的问题我可是不敢随意修改的，请诸位解释详细点哦。先谢谢了！

附件: 819984200711512211.jpg

瑞星卡卡安全论坛