我最恨开机关我瑞星的病毒，今天...有日志，吐血中。。救命。。 bbs.ikaka.com

救命啊救命啊 - 2007-3-30 9:39:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<b><C:\DOCUME~1\kjf\LOCALS~1\Temp\Servere.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<runeip><C:\Program Files\Rising\KakaToolBar\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<cmdbcs><C:\WINDOWS\cmdbcs.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Corporation]
<Userinit><userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk> [N/A]
<{DC7035B1-E435-4A65-9546-059796785F52}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cmdmant]
<WinlogonNotify: cmdmant><msgcom.dll> [N/A]

==================================
启动文件夹
N/A

救命啊救命啊 - 2007-3-30 9:39:00

服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[DHCP SEC Server / DHCPSEC][Running/Auto Start]
<C:\Windows\system32\OVBJQWCJ.EXE><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[msndns / msndns][Stopped/Auto Start]
<C:\WINDOWS\msn.exe><N/A>
[PPRich Server / PPRich][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k ppsvcs-->C:\Program Files\PPGou Soft\PPRich\PPRich.dll><www.pprich.com>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows SystemDown / WindowsDown][Stopped/Auto Start]
<C:\WINDOWS\system32\servet.exe><N/A>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Lenovo USB Still Image driver / BrScnUsb][Running/Manual Start]
<System32\Drivers\BrScnUsb.sys><Brother Industries Ltd.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[InCD File System / InCDFs][Stopped/Disabled]
<system32\drivers\InCDFs.sys><N/A>

救命啊救命啊 - 2007-3-30 9:40:00

服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[DHCP SEC Server / DHCPSEC][Running/Auto Start]
<C:\Windows\system32\OVBJQWCJ.EXE><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[msndns / msndns][Stopped/Auto Start]
<C:\WINDOWS\msn.exe><N/A>
[PPRich Server / PPRich][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k ppsvcs-->C:\Program Files\PPGou Soft\PPRich\PPRich.dll><www.pprich.com>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows SystemDown / WindowsDown][Stopped/Auto Start]
<C:\WINDOWS\system32\servet.exe><N/A>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Lenovo USB Still Image driver / BrScnUsb][Running/Manual Start]
<System32\Drivers\BrScnUsb.sys><Brother Industries Ltd.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[InCD File System / InCDFs][Stopped/Disabled]
<system32\drivers\InCDFs.sys><N/A>

救命啊救命啊 - 2007-3-30 9:40:00

[InCDPass / InCDPass][Stopped/System Start]
<system32\drivers\InCDPass.sys><N/A>
[InCD Reader / InCDRm][Stopped/System Start]
<system32\drivers\InCDRm.sys><N/A>
[IsDrv118 / IsDrv118][Running/System Start]
<\SystemRoot\System32\Drivers\IsDrv118.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\F:\1qq2\npkcrypt.sys><INCA Internet Co., Ltd.>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303][Stopped/Manual Start]
<System32\Drivers\usbVM303.sys><Vimicro Corporation>
[junzhang / junzhang][Stopped/]
<2 - 系统找不到指定的文件。
><N/A>

救命啊救命啊 - 2007-3-30 9:41:00

浏览器加载项
[Thunder Browser Helper]
{0005A87C-D626-4B3A-84F9-1D9571695F55} <F:\迅雷\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <F:\1qq2\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DeskbarBHO]
{A8B28872-3324-4CD2-8AA3-7D555C872D96} <C:\Program Files\Deskbar\deskbar.dll, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\1qq2\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\1qq2\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <D:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Thunder Browser Helper]
{0005A87C-D626-4B3A-84F9-1D9571695F55} <F:\迅雷\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[Yahoo! Toolbar Helper]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} <, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <D:\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <F:\1qq2\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[DeskbarBHO]
{A8B28872-3324-4CD2-8AA3-7D555C872D96} <C:\Program Files\Deskbar\deskbar.dll, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[OfficeObj Class]
{D2BD7935-05FC-11D2-9059-00C04FD7A1BD} <, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[BoBo P2P多媒体网络点播/广播/直播系统 V3]
{EC0978ED-24E3-403C-AB7A-060E388553E6} <C:\WINDOWS\system32\BOBO_A~1.OCX, 广州易播信息科技有限公司>
[Yahoo! Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} <, N/A>
[IEDown Class]
{F917534D-535B-416B-8E8F-0C04756C31A8} <C:\WINDOWS\system32\GLIEDown2.dll, 联众公司>
[&使用迅雷下载]
<F:\迅雷\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<F:\迅雷\Program\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<F:\1qq2\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<F:\1qq2\AddPanel.htm, N/A>
[添加到QQ表情]
<F:\1qq2\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<F:\1qq2\SendMMS.htm, N/A>

救命啊救命啊 - 2007-3-30 9:41:00

正在运行的进程
[PID: 584][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 676][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\msgcom.dll] [N/A, N/A]
[PID: 748][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 900][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[PID: 920][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 996][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1100][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1140][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1280][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1508][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[PID: 1560][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, N/A]
[C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll] [Nero AG, 2, 0, 0, 8]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1736][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\E_FLMAAP.DLL] [SEIKO EPSON CORPORATION, 5, 7, 0, 0]
[PID: 2012][C:\Windows\system32\OVBJQWCJ.EXE] [N/A, N/A]
[PID: 440][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\ppgou soft\pprich\pprich.dll] [www.pprich.com, 2.0.0.8]
[PID: 536][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\CJSTI.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[C:\WINDOWS\twain_32\A686\CJ01LLD.dll] [, 1, 0, 0, 2]
[C:\WINDOWS\system32\BrWia04b.dll] [Brother Industries, Ltd., 3.0.6.0 built by: WinDDK]
[C:\WINDOWS\twain_32\A686\UniScan.dll] [, 1, 0, 0, 3]
[C:\WINDOWS\system32\BrUSi04b.dll] [Brother Industries, Ltd., 1, 0, 0, 1]
[PID: 1528][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 2312][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2468][C:\Program Files\Rising\KakaToolBar\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\KakaToolBar\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[PID: 2528][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[PID: 2680][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[PID: 2952][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3360][C:\WINDOWS\system32\2.exe] [N/A, N/A]
[PID: 2432][F:\Photoshop 7.0\Photoshop.exe] [Adobe Systems, Incorporated, 7.0.1]
[F:\Photoshop 7.0\ACE.dll] [Adobe Systems Incorporated, 2.02.05]
[F:\Photoshop 7.0\AGM.dll] [Adobe Systems Incorporated, 4.08.18]
[F:\Photoshop 7.0\BIB.dll] [Adobe Systems Incorporated, 1.1.8]
[F:\Photoshop 7.0\CoolType.dll] [Adobe Systems Incorporated, 4.10.20]
[F:\Photoshop 7.0\asn.er.dll] [N/A, N/A]
[F:\Photoshop 7.0\Photoshop.dll] [Adobe Systems, Incorporated, 7.0.1]
[F:\Photoshop 7.0\PSViews.dll] [Adobe Systems, Incorporated, 7.0.1]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FUICAAP.DLL] [SEIKO EPSON CORP., 0. 3. 40, 33]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FMAIAAP.DLL] [SEIKO EPSON Corporation, 0. 3. 1. 24]
[F:\Photoshop 7.0\Plug-Ins\Adobe Photoshop Only\Extensions\FastCore.8BX] [Adobe Systems, Incorporated, 7.0.1]
[F:\Photoshop 7.0\PLUGIN.dll] [Adobe Systems, Incorporated, 7.0]
[F:\Photoshop 7.0\Plug-Ins\Adobe Photoshop Only\Extensions\MMXCore.8BX] [Adobe Systems, Incorporated, 7.0.1]
[F:\Photoshop 7.0\Required\ADMPlugin.apl] [Adobe Systems Incorporated, 2.84ps79 07.15.2002-10:05:00h]
[F:\Photoshop 7.0\Required\PNGIcons.apl] [Adobe Systems Incorporated, 1.21x7 2001.12.14-1602h.21s]
[F:\Photoshop 7.0\Required\ASDataStream.apl] [Adobe Systems Incorporated, 1.02x7 02.02.15-01:45:06h]
[F:\Photoshop 7.0\Plug-Ins\Parser\PDF 图像导入.8BI] [Adobe Systems, Incorporated, 7.0.1]
[F:\Photoshop 7.0\PDFL50.dll] [Adobe Systems Incorporated, 5.0.000]
[F:\Photoshop 7.0\OPP.dll] [Adobe Systems Incorporated, 1.02.01]
[C:\WINDOWS\system32\BrWia04b.dll] [Brother Industries, Ltd., 3.0.6.0 built by: WinDDK]
[C:\WINDOWS\system32\ATMLIB.dll] [Adobe Systems, 5.1 Build 226]
[C:\Program Files\Common Files\Adobe\Workflow\ARM.dll] [Adobe Systems, Incorporated, 2.8.3.3]
[C:\Program Files\Common Files\Adobe\Web\AdobeWeb.dll] [Adobe Systems, Incorporated, 2.8.3.3]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, N/A]
[PID: 3732][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 3, 0]
[F:\迅雷\ComDlls\XunLeiBHO_006.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
[C:\WINDOWS\system32\xunleibho_v8.dll] [, 4, 5, 1, 33]
[F:\1qq2\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 2204][F:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGCQSJ2.dll] [N/A, N/A]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, N/A]

救命啊救命啊 - 2007-3-30 10:49:00

怎么没人帮忙啊，一开机瑞星就发现病毒，位置是：widnows\system32\1.exe，然后接着还会出现7、8个病毒。

一个人战斗 - 2007-3-30 10:58:00

正规网站这个样木马不可能中的!

在安全模式下删除以下病毒文件.

1.exe 2.exe 3.exe 4.exe病毒，在C:\Documents and Settings\用户名\Local Settings\Temp文件夹里
C:\Program Files\Microsoft 文件svhost32.exe
C:\WINDOWS\command 文件rundll32.exe
c:\windows\qq.exe
服务
windows 格式 hack*.com.cn.ini名字不清楚了
windows updata 格式 c:\windows\qq.exe
两个服务用第三放软件删除
msconfig启动项svhost32 C:\Program Files\Microsoft\svhost32.exe
rundll32 C:\WINDOWS\command\rundll32.dll

可以的加载项HLM\SOFTWARE\microsoft\windows nt\currentversion\policies\explorer\run
checkfaultkenel----c:\windows\system32\mswdm.exe

然后用防火墙软件禁止c:\windows\explorer.exe防问网络.即可防止再次下载此木马.

以木马下载文件有:

C:\Documents and Settings\adminstrator\Local Settings\Temp\dns.exe
C:\Documents and Settings\adminstrator\Local Settings\Temp\1.exe
C:\Documents and Settings\adminstrator\Local Settings\Temp\2.exe
C:\Documents and Settings\adminstrator\Local Settings\Temp\3.exe
C:\Documents and Settings\adminstrator\Local Settings\Temp\4.exe
C:\Documents and Settings\adminstrator\Local Settings\Temp\js.dll
C:\Program Files\Microsoft\svhost32.exe
C:\Program Files\command\svhost32.exe
C:\windows\command\rundll32.exec:\windows\qq.exe
C:\Program Files\svhost32.exe

瑞星卡卡安全论坛