瑞星卡卡安全论坛

[C:\WINDOWS\system32\athcfg11.dll]  [Atheros, 4.1.2.25]
    [C:\WINDOWS\system32\athcfg11Res.dll]  [Atheros Communications, Inc., 4.1.2.25]
    [C:\WINDOWS\system32\athcfg11resloc.dll]  [TP-LINK TECHNOLOGIES CO., LTD., 4.1.2.25]
    [C:\WINDOWS\system32\AegisE5.dll]  [Meetinghouse Data Communications, 3, 0, 16, 0]
[PID: 1768][C:\Program Files\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]

[PID: 1872][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.2940]
[PID: 1952][C:\WINDOWS\system32\slserv.exe]  [ , 2.80.00(24Apr2000)]
[PID: 1980][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 296][c:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 66]
    [c:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 31]
    [c:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [c:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]

[c:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [c:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 1564][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 504][C:\WINDOWS\soundman.exe]  [Avance Logic, Inc., 5, 0, 0, 0]
[PID: 584][C:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]

[C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
[PID: 284][C:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]

[C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]

[PID: 720][C:\Program Files\TP-LINK\TWCU\TWCU.exe]  [TP-LINK TECHNOLOGIES CO., LTD, 4.1.2.25]
    [C:\WINDOWS\system32\wcapi.dll]  [Atheros, 4.1.2.25]
    [C:\WINDOWS\system32\athcfg11.dll]  [Atheros, 4.1.2.25]
    [C:\WINDOWS\system32\athcfg11Res.dll]  [Atheros Communications, Inc., 4.1.2.25]
    [C:\WINDOWS\system32\wgapi.dll]  [TP-LINK TECHNOLOGIES CO., LTD, 4.1.2.25]
    [C:\WINDOWS\system32\wgapiloc.dll]  [TP-LINK, 4.1.2.25]
    [C:\Program Files\TP-LINK\TWCU\TWCUloc.dll]  [TP-LINK TECHNOLOGIES CO., LTD., 4.1.2.25]
    [C:\Program Files\TP-LINK\TWCU\oemresloc.dll]  [TP-LINK TECHNOLOGIES CO., LTD., 4.1.2.25]

[PID: 1992][C:\WINDOWS\alga.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 2136][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2236][C:\WINDOWS\system32\iexp1ore.exe]  [N/A, N/A]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
[PID: 2844][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]

[PID: 1992][C:\WINDOWS\alga.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 2136][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2236][C:\WINDOWS\system32\iexp1ore.exe]  [N/A, N/A]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
[PID: 2844][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]

[PID: 2504][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 572][C:\Documents and Settings\George\桌面\sreng2_PConline\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\DOCUME~1\George\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]

.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

终于发完了,怎么每次只能发那么点啊
这个报告是我已经开机扫描杀毒过的.

呵呵  楼主真实在累坏了吧..辛苦了



重启按F８进入安全模式下
显示隐藏文件
删除：
C:\WINDOWS\system32\agtz.dll
C:\WINDOWS\system32\iexp1ore.exe
C:\WINDOWS\alga.exe
C:\WINDOWS\mhs2.exe
C:\WINDOWS\wls3.exe
C:\WINDOWS\LSASS.EXE
C:\WINDOWS\system32\twunk32.exe
C:\WINDOWS\system32\windhcp.ocx
清空:C:\DOCUME~1\George\LOCALS~1\Temp

运行SREng2,使用“启动项目”－－注册表－－删除
<SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<h8qjs719m><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<wsttrs><C:\WINDOWS\LSASS.EXE> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
<Load><; ?眝讱矑?翽蠲矑蟿矑?> [N/A]

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
，选择“删除服务”
点“设置”选择“否


C:\WINDOWS\system32\twunk32.exe参考:

http://forum.ikaka.com/topic.asp?board=28&artid=8237996

谢谢楼上高手，马上去试试。
可我不懂，我发现病毒杀不掉之后，就马上格掉了C盘，用GHOST备份重装了系统，为什么还是有这病毒呢？它不在C盘里？

建议LZ用置顶的威金和熊猫专杀洗一下机子！

不是让你参考这个了吗
C:\WINDOWS\system32\twunk32.exe参考:

http://forum.ikaka.com/topic.asp?board=28&artid=8237996

我照那帖子做了 可运行msconfig启动里还是有“。。粒。。粒。。”什么的一项啊？
还有我用sreng2的启动删除，没找到load这一项啊，没能删掉它。