帮忙看下给个解决方法(在线等)论坛么人了？？ bbs.ikaka.com

挥不去的病毒 - 2007-3-2 13:48:00

[CODE]

2007-03-02,13:33:15

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<g3kl><C:\WINDOWS\servicer.exe> [N/A]
<mdb2jl2g><C:\WINDOWS\c0nima.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A]
<InternetEx><C:\WINDOWS\system\inetinf.exe> [N/A]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<Internet><C:\WINDOWS\system\svchosi.exe> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<ShStatEXE><"C:\Program Files\ePOPlice\SHSTAT.EXE" /STANDALONE> [(Verified)McAfee, Inc.]
<McAfeeUpdaterUI><"C:\Program Files\Common Framework\UdaterUI.exe" /StartedFromRunKey> [(Verified)McAfee, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<internet><C:\WINDOWS\system\taskmgr.exe /scan> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Corporation]

挥不去的病毒 - 2007-3-2 13:50:00

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework Service / McAfeeFramework][Running/Auto Start]
<"C:\Program Files\Common Framework\FrameworkService.exe" /ServiceStart><McAfee, Inc.>
[McAfee McShield / McShield][Running/Auto Start]
<"C:\Program Files\ePOPlice\Mcshield.exe"><McAfee, Inc.>
[McAfee Task Manager / McTaskManager][Running/Auto Start]
<"C:\Program Files\ePOPlice\VsTskMgr.exe"><McAfee, Inc.>

==================================
驱动程序
[AliIde / AliIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[McAfee Inc. / mfeapfk][Running/Manual Start]
<system32\drivers\mfeapfk.sys><McAfee, Inc.>
[McAfee Inc. / mfeavfk][Running/Manual Start]
<system32\drivers\mfeavfk.sys><McAfee, Inc.>
[McAfee Inc. / mfebopk][Running/Manual Start]
<system32\drivers\mfebopk.sys><McAfee, Inc.>
[McAfee Inc. / mfehidk][Running/Manual Start]
<system32\drivers\mfehidk.sys><McAfee, Inc.>
[VSCore mferkdk / mferkdk][Running/System Start]
<\??\C:\Program Files\ePOPlice\mferkdk.sys><McAfee, Inc.>
[McAfee Inc. / mfetdik][Running/System Start]
<system32\drivers\mfetdik.sys><McAfee, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[Flash 9b]
{492B8F66-B8CF-4F7A-B0EE-B7383B92F5BA} <C:\WINDOWS\system\IceHBO.dll, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Update Class]
{9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINDOWS\system32\iuctl.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>

挥不去的病毒 - 2007-3-2 13:51:00

=================================
正在运行的进程
[PID: 376][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 432][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 456][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 500][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 512][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 644][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 708][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 848][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 880][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 892][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1028][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1056][C:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1184][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1208][C:\Program Files\Common Framework\FrameworkService.exe] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\nailog.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naXML71.dll] [N/A, N/A]
[C:\Program Files\Common Framework\NaiSign.DLL] [N/A, N/A]
[C:\WINDOWS\system32\epoPGPSDK.dll] [PGP Corporation, 3.5.3]
[C:\Program Files\Common Framework\naCmnLib71.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\applib.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\0409\AgentRes.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\Logging.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\InternetManager.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naInet.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\UserSpace.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\SecureFrameworkFactory.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\Management.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\cmalib.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naPolicyManager.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\ScriptSubSys.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\UpdateSubSys.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\Scheduler.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\TCSubSys.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\GenEvtInf.dll] [McAfee, Inc., 3.6.0.453]
[PID: 1292][C:\Program Files\ePOPlice\Mcshield.exe] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\LockDown.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mytilus.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mytilus2.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\RES0402\McShield.dll] [McAfee, Inc., VSCORE.13.3.1.100]
[C:\Program Files\ePOPlice\FTL.Dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\naiann.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\VsEvntUI.dll] [N/A, N/A]
[C:\Program Files\ePOPlice\NAEvent.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\shutil.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\wmain.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\Common Framework\GenEvtInf.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\SecureFrameworkFactory.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\ePOPlice\scriptsv.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mfebopa.dll] [McAfee, Inc., SYSCORE.13.3.0.116.x86]
[C:\Program Files\ePOPlice\mfehida.dll] [McAfee, Inc., SYSCORE.13.3.0.116.x86]
[C:\Program Files\ePOPlice\mfeapfa.dll] [McAfee, Inc., SYSCORE.13.3.0.116.x86]
[C:\Program Files\ePOPlice\mfeavfa.dll] [McAfee, Inc., SYSCORE.13.3.0.116.x86]
[C:\Program Files\Common Files\McAfee\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]

挥不去的病毒 - 2007-3-2 13:51:00

[PID: 1320][C:\Program Files\ePOPlice\VsTskMgr.exe] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\LockDown.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mytilus2.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mytilus.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\shutil.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\wmain.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\condl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\RES0402\McShield.dll] [McAfee, Inc., VSCORE.13.3.1.100]
[C:\Program Files\ePOPlice\MIDUtil.Dll] [McAfee, Inc., 8.5.0.148]
[C:\Program Files\ePOPlice\BBCpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\coptcpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\EmCfgCpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\nvpcpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\ftcfg.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\OASCpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\QuarCpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\vsodscpl.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\VsEvntUI.dll] [N/A, N/A]
[C:\Program Files\ePOPlice\NAEvent.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\ftl.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\vsupdcpl.dll] [McAfee, Inc., 8.5.0.781]
[PID: 1408][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1404][C:\Program Files\Common Framework\naPrdMgr.exe] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\NaiSign.DLL] [N/A, N/A]
[C:\WINDOWS\system32\epoPGPSDK.dll] [PGP Corporation, 3.5.3]
[C:\Program Files\Common Framework\naXML71.dll] [N/A, N/A]
[C:\Program Files\Common Framework\nailog.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naCmnLib71.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\applib.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\0409\AgentRes.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\ePOPlice\VsPlugin.dll] [McAfee, Inc., 8.5.0.781]
[PID: 1448][C:\WINDOWS\system32\Dfssvc.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1756][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\Program Files\Common Framework\JrMac.dll] [McAfee, Inc., 1.0.0.125]
[C:\Program Files\ePOPlice\shext.dll] [McAfee, Inc., 8.5.0.781]
[PID: 1812][C:\WINDOWS\system\taskmgr.exe] [N/A, N/A]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 1856][C:\WINDOWS\system\inetinf.exe] [N/A, N/A]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 1900][C:\WINDOWS\system\svchosi.exe] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[PID: 1908][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.1622]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]

挥不去的病毒 - 2007-3-2 13:52:00

[PID: 1932][C:\Program Files\ePOPlice\SHSTAT.EXE] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\LockDown.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\ftcfg.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\mytilus2.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\mytilus.dll] [McAfee, Inc., VSCORE.13.3.1.100.x86]
[C:\Program Files\ePOPlice\wmain.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\shutil.dll] [McAfee, Inc., 8.5.0.781]
[C:\Program Files\ePOPlice\RES0402\McShield.dll] [McAfee, Inc., VSCORE.13.3.1.100]
[C:\Program Files\ePOPlice\Graphics.dll] [McAfee, Inc., 8.5.0.781]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]
[PID: 1948][C:\Program Files\Common Framework\UdaterUI.exe] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\nailog.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naCmnLib71.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\naXML71.dll] [N/A, N/A]
[C:\Program Files\Common Framework\NaiSign.DLL] [N/A, N/A]
[C:\WINDOWS\system32\epoPGPSDK.dll] [PGP Corporation, 3.5.3]
[C:\Program Files\Common Framework\applib.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\cmalib.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\0409\UpdRes.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\0409\AgentRes.dll] [McAfee, Inc., 3.6.0.453]
[C:\Program Files\Common Framework\SecureFrameworkFactory.dll] [McAfee, Inc., 3.6.0.453]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]
[PID: 1956][C:\SysWsj\svchost.exe] [N/A, N/A]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[PID: 1968][C:\SysDayN\svchost.exe] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 1992][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 2000][C:\Program Files\Common Framework\McTray.exe] [McAfee, Inc., 1.0.0.125]
[C:\Program Files\Common Framework\JrMac.dll] [McAfee, Inc., 1.0.0.125]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 188][C:\WINDOWS\servicer.exe] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]
[PID: 252][C:\WINDOWS\c0nime.exe] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[PID: 1836][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[PID: 2568][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 2996][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 3024][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3640][C:\Documents and Settings\Administrator\Local Settings\Temp\sreng2.zip 的临时目录 2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\SysWsj\Ghook.dll] [N/A, N/A]
[C:\SysDayN\Ghook.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\Qqzos.dll] [N/A, N/A]

挥不去的病毒 - 2007-3-2 13:52:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[D:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[F:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe
[G:\]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\打开(&O)\command=setup.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

挥不去的病毒 - 2007-3-2 14:11:00

顶顶

挥不去的病毒 - 2007-3-2 14:25:00

没人懂吗?

ppdog - 2007-3-2 14:51:00

重启至安全模式：

删除：
启动项：
<g3kl><C:\WINDOWS\servicer.exe> [N/A]
<mdb2jl2g><C:\WINDOWS\c0nima.exe> [N/A]
<InternetEx><C:\WINDOWS\system\inetinf.exe> [N/A]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<Internet><C:\WINDOWS\system\svchosi.exe> [N/A]

删除文件：
C:\WINDOWS\servicer.exe
C:\WINDOWS\c0nima.exe
C:\WINDOWS\system\inetinf.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe]
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\system\svchosi.exe
C:\WINDOWS\system32\Gjzos.dll
C:\WINDOWS\system32\Qqzos.dll
每个盘符下的setup.exe和antorun.inf文件
文件夹：C:\SysDayN\和C:\SysWsj\

还有，请贴全日志

newcenturymoon - 2007-3-2 15:03:00

安全模式下(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统)
打开sreng （就是你扫日志的软件）启动项目注册表删除如下项目 (如果有哪项你认识或者确认不是病毒请不要删除)
<g3kl><C:\WINDOWS\servicer.exe> [N/A]
<mdb2jl2g><C:\WINDOWS\c0nima.exe> [N/A]
<InternetEx><C:\WINDOWS\system\inetinf.exe> [N/A]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.exe> [N/A]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
<Internet><C:\WINDOWS\system\svchosi.exe> [N/A]
<internet><C:\WINDOWS\system\taskmgr.exe /scan> [N/A]

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

DE91E301 / DE91E301
Updater Server / Updater Server

在“启动项目”-“服务”-“驱动程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

把下面的代码拷入记事本中然后另存为1.reg文件
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

双击1.reg把这个注册表项导入

双击我的电脑－工具－文件夹选项－查看－显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉。
右击打开C: D: F: G: 删除autorun.inf然后删除
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\Gjzos.dll
C:\WINDOWS\system32\Qqzos.dll
C:\WINDOWS\servicer.exe
C:\WINDOWS\c0nima.exe
C:\WINDOWS\system\inetinf.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp下面所有文件
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\system\svchosi.exe
C:\WINDOWS\system\taskmgr.exe

瑞星卡卡安全论坛