紧急求助我已经没有办法了 bbs.ikaka.com

sealwbc - 2007-1-5 19:21:00

周三那天用别人还我的U盘复制文件.插入后进行过查毒,没有问题.几分钟后,机器所有进程被关,右下状态栏一一被关.瑞星无法开启.CRTL+ALT+DIE打开后进程管理立即被关.可以运行其他程序但启动较慢

重装几次后依然如此,且安装瑞星时,每次启动便被关.使用在先杀毒该页面立即无响应.所有分区双击无法打开,右键文字变成英文(如自动播放变为AUTO).进程无法打开

用系统盘将硬盘重新分区格式化重装后症状依然如此,下载最新卡卡助手(旧的不能更新)
后查到为 [SOUNDMAN].
百度查找方法后发现橙色八月可以删除.下载后查出病毒为内存下的 SPOCLSV.EXE,其他分区DEF SYSTEM VOLUME INFORMATIONS/_RESTORE....A000780\781\782
杀完后可以启动进程管理,可以安装杀毒软件.
为安全起见再次重装,安装杀瑞星后,生级到 1月4日,对所有硬盘查毒显示无毒.但当我双击其他分区又变成以前的样子了.
橙色八月检查后,结果和上次一样.但杀完后,系统依然没有好转,再杀时橙八初始化失败.

本人电脑知识有限,望高手帮忙.个人觉得此病毒已经不是7 8月时候的样子了应该已经变种.
如需手动方法请将方法详细化,本人电脑略懂皮毛.
希望瑞星重视该问题,为何使用当天最新的瑞星无法查出,被病毒攻击后无法启动.请尽快给我解决方法.并推出补丁,和查杀工具.

rund1132 - 2007-1-5 19:24:00

先把每个盘里根目录的AUTORUN.INF和对应的EXE文件DEL，然后下个SRENG上日志文件

sealwbc - 2007-1-5 19:42:00

以下是我用橙八查杀好后的扫描记录
不用不行啊 TXT都打不开

刚又多了一大堆木马可能是它引起的

不敢点其他分区盘,一点可能又中了.
WINDOWS下格式话会说该程序正在被使用无法删除

sealwbc - 2007-1-6 1:30:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<myZt3><C:\DOCUME~1\1\LOCALS~1\Temp\zt3\SVCHQST.EXE> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\Userinit.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]

sealwbc - 2007-1-6 1:30:00

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[ATK Keyboard Service / ATKKeyboardService][Running/Auto Start]
<C:\WINDOWS\ATKKBService.exe><ASUSTeK COMPUTER INC.>
[Forceware Web Interface / ForcewareWebInterface][Running/Auto Start]
<"C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice><Apache Software Foundation>
[ForceWare IP service / nSvcIp][Running/Auto Start]
<C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe><N/A>
[ForceWare user log service / nSvcLog][Running/Auto Start]
<C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe><N/A>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

sealwbc - 2007-1-6 1:31:00

驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Enhanced Display Driver Helper Service / asuskbnt][Running/System Start]
<system32\drivers\atkkbnt.sys><ASUSTeK COMPUTER INC.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[EIO / EIO][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\EIO.sys><ASUSTeK Computer Inc.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[nvatabus / nvatabus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nvatabus.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[NVIDIA nForce AGP Bus Filter / nv_agp][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>

sealwbc - 2007-1-6 1:32:00

==================================
浏览器加载项
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 384][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 620][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 644][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4116]
[PID: 688][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 856][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 876][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 944][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1052][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1296][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1340][c:\program files\rising\rfw\rfwsrv.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 32]
[c:\program files\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
[c:\program files\rising\rfw\rfwlog.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
[c:\program files\rising\rfw\Rfwdrv.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
[c:\program files\rising\rfw\MonDrv.dll] [rs, 1, 0, 0, 4]
[c:\program files\rising\rfw\ProcLib.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[PID: 1696][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1960][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5155]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5155]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5155]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5155]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 2024][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 144][C:\DOCUME~1\1\LOCALS~1\Temp\zt3\SVCHQST.EXE] [N/A, N/A]
[C:\DOCUME~1\1\LOCALS~1\Temp\gLZt.dll] [N/A, N/A]
[PID: 476][C:\WINDOWS\ATKKBService.exe] [ASUSTeK COMPUTER INC., 1, 0, 0, 0]

sealwbc - 2007-1-6 1:32:00

[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 520][C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] [N/A, N/A]
[PID: 580][C:\NVIDIA\NetworkAccessManager\bin\nSvcIp.exe] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common_firewall.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\NMI.dll] [NVIDIA Corporation, 1, 0, 2, 0]
[C:\NVIDIA\NetworkAccessManager\bin\SpecialCase.dll] [N/A, N/A]
[PID: 616][C:\NVIDIA\NetworkAccessManager\bin\nSvcLog.exe] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\bin\nv_common.dll] [N/A, N/A]
[PID: 1204][C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapr.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libaprutil.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libapriconv.dll] [Apache Software Foundation, 0.0.0.0]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\libhttpd.dll] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_access.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_actions.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_alias.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_asis.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_autoindex.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_cgi.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_dir.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_env.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_expires.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_headers.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_imap.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_include.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_isapi.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_log_config.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_mime.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_negotiation.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_rewrite.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_setenvif.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\modules\mod_ssl.so] [Apache Software Foundation, 2.0.47]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\SSLEAY32.dll] [N/A, N/A]
[C:\NVIDIA\NetworkAccessManager\Apache Group\Apache2\bin\LIBEAY32.dll] [N/A, N/A]

sealwbc - 2007-1-6 1:33:00

[PID: 3216][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 51]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1820][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1788][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 4224][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 4216][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 4708][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 5236][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[PID: 5440][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3164][C:\Program Files\Rising\Rav\RavMon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 940][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 3584][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3836][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 4100][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 4452][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 5848][D:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]

sealwbc - 2007-1-6 1:33:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[E:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[H:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

龙在天宵 - 2007-1-6 17:10:00

运行SREng2,使用“启动项目”－－注册表－－删除
<myZt3><C:\DOCUME~1\1\LOCALS~1\Temp\zt3\SVCHQST.EXE> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
Windows DHCP Service
，选择“删除服务”
点“设置”选择“否”
重启按F８进入安全模式下
显示隐藏文件
删除：[]
C:\WINDOWS\system32/windhcp.ocx
C:\DOCUME~1\1\LOCALS~1\Temp\zt3\SVCHQST.EXE> [N/A]
C:\WINDOWS\system32\twunk32.exe> [N/A]

右键打开,不要双击,删除每个盘的根目录隐藏文件
Autorun.inf
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[E:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
[H:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe

先干掉这些,再重新贴日志请高手处理

瑞星卡卡安全论坛