jgliyfrtdus - 2007-7-28 8:25:00
昨天新做了系统,全部都是重新格的,就弄完了瑞星杀毒防火墙,下了个QQ和PPLIVE网络电视,今天早上上来瑞星就提示有病毒,紧跟着所有磁盘都打不开了,大侠们帮帮忙啊!谢谢了,在线等!对了,双击磁盘瑞星监控的小伞马上变成红的了!
病毒名Trojan.PSW.Win32.WoWar.sp
文件名c:\windows\system32\1.dat>>upack0.34
这个是新杀出来的病毒!我反复杀好几次了!
又来了
文件名c:\windows\system32\1.exe>>upack0.39
病毒名Trojan.PSW.Win32.OnlineGames.dpq
病毒名Trojan.PSW.Win32.OnlineGames.dpv
文件名c:\windows\system32\2.dat>>upack0.34
病毒名Trojan.PSW.Win32.OnlineGames.dpq
文件名c:\windows\system32\4.exe>>upack0.39
病毒名Trojan.PSW.Win32.OnlineGames.dki
文件名c:\windows\system32\4.dat>>upack0.34
病毒名Trojan.PSW.Win32.OnlineGames.dpq
文件名c:\windows\system32\7.exe>>upack0.39
病毒名Trojan.PSW.Win32.QQPass.qjb
文件名C:\WINDOWS\system32\nwizhx2.dll
一共29个病毒!我没全粘贴上来 不过全是Trojan.PSW开头的!
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
jgliyfrtdus - 2007-7-28 8:37:00
瑞星卡卡电脑诊断日志 v1.30 (2006-9-30 12:3:38) 北京瑞星科技股份有限公司
注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
RfwProxySrv
[A ] 1. d:\rising\rfw\rfwproxy.exe
RfwService
[A ] 2. d:\rising\rfw\rfwsrv.exe
RsCCenter
[A ] 3. d:\rising\rav\ccenter.exe
RsRavMon
[A ] 4. d:\rising\rav\ravmond.exe
UMWdf
[AM] 5. c:\windows\system32\wdfmgr.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 6. c:\windows\system32\drivers\alcxwdm.sys
BaseTDI
[A ] 7. c:\windows\system32\drivers\basetdi.sys
cda1000
[A ] 8. c:\windows\system32\drivers\cda1000.sys
ExpScaner
[A ] 9. d:\rising\rav\expscan.sys
HookCont
[A ] 10. d:\rising\rav\hookcont.sys
HookReg
[A ] 11. d:\rising\rav\hookreg.sys
HookSys
[A ] 12. d:\rising\rav\hooksys.sys
HookUrl
[A ] 13. d:\rising\rfw\hookurl.sys
MEMSCAN
[A ] 14. d:\rising\rav\memscan.sys
mProcRs
[A ] 15. d:\rising\rfw\mprocrs.sys
RsAntiSpyware
[A ] 16. c:\windows\system32\drivers\rsboot.sys
RsFwDrv
[A ] 17. d:\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 18. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 19. d:\rising\rav\rsppsys.sys
Secdrv
[A ] 20. c:\windows\system32\drivers\secdrv.sys
VIAIDEXP
[A ] 21. c:\windows\system32\drivers\viaidexp.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 22. c:\windows\system32\kakatool.dll
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 23. c:\windows\system32\hticons.dll
Portable Media Devices
[A ] 24. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 24. c:\windows\system32\audiodev.dll
RISING
[AM] 25. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{252D2432-37A2-324F-2A54-21BF5CF2F1A2}
[AM] 26. c:\windows\system32\jhapri.dll
{559AFD5B-159F-ACD8-954C-ACD545FA6585}
[AM] 27. c:\windows\system32\jzepri.dll
{54123FF1-8371-9834-9021-184518451FA5}
[AM] 28. c:\windows\system32\qjepri.dll
{26368135-64FA-BC34-DA32-DCF4FD431C92}
[AM] 29. c:\windows\system32\qhbpri.dll
{5A65498A-7653-9801-1647-987114AB7F45}
[AM] 30. c:\windows\system32\zxepri.dll
{713AF41A-21B1-131B-1BFC-D2A90DF4A2B7}
[AM] 31. c:\windows\system32\xyfpri.dll
{B1351752-5628-1547-FFAB-BADC13512AFB}
[AM] 32. c:\windows\system32\ztkpri.dll
{425AB2F3-234A-7469-2F43-E341713ABFA4}
[AM] 33. c:\windows\system32\wgdpri.dll
{1182C1EB-375C-573D-1F5E-234552345211}
[AM] 34. c:\windows\system32\wldpri.dll
+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
bgswitch
[A ] 35. c:\windows\system32\bgswitch.exe
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SoundMan
[AM] 36. c:\windows\soundman.exe
RfwMain
[AM] 37. d:\rising\rfw\rfwmain.exe
runeip
[A ] 38. c:\program files\rising\antispyware\runiep.exe
RavTask
[A ] 39. d:\rising\rav\ravtask.exe
crsss
[A ] 40. c:\windows\system32\niu.exe
Microsoft Autorun3
[A ] 41. c:\windows\system32\nwizhx2.exe
AVPSrv
[A ] 42. c:\windows\avpsrv.exe
TIMHost
[A ] 43. c:\windows\timhost.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 44. d:\rising\rav\ravstub.exe
KKDelay
[A ] 45. c:\program files\rising\antispyware\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 46. c:\windows\system32\bsmain.exe
[A ] 47. c:\windows\system32\kknative.exe
+ 程序初始化和已知动态连接库
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
[AM] 33. c:\windows\system32\wgdpri.dll
+ 其他自启动项目
+ c:\autorun.inf
open
[A ] 48. c:\niu.exe
shell\open\Command
[A ] 48. c:\niu.exe
shell\explore\Command
[A ] 48. c:\niu.exe
+ d:\autorun.inf
open
[A ] 49. d:\niu.exe
shell\open\Command
[A ] 49. d:\niu.exe
shell\explore\Command
[A ] 49. d:\niu.exe
+ e:\autorun.inf
open
[A ] 50. e:\niu.exe
shell\open\Command
[A ] 50. e:\niu.exe
shell\explore\Command
[A ] 50. e:\niu.exe
+ f:\autorun.inf
open
[A ] 51. f:\niu.exe
shell\open\Command
[A ] 51. f:\niu.exe
shell\explore\Command
[A ] 51. f:\niu.exe
+ g:\autorun.inf
open
[A ] 52. g:\niu.exe
shell\open\Command
[A ] 52. g:\niu.exe
shell\explore\Command
[A ] 52. g:\niu.exe
+ 正在运行的进程
+ 0000015c(348) ctfmon.exe
003D0000[0000A000]
[AM] 29. c:\windows\system32\qhbpri.dll
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
15000000[00010000]
[ M] 54. c:\windows\system32\8.dat
00AD0000[00010000]
[ M] 55. c:\windows\system32\7.dat
00AE0000[00010000]
[ M] 56. c:\windows\system32\4.dat
00AF0000[00010000]
[ M] 57. c:\windows\system32\2.dat
00B00000[00011000]
[ M] 58. c:\windows\system32\1.dat
+ 000001a4(420) smss.exe
+ 000001e0(480) csrss.exe
+ 000001f8(504) winlogon.exe
004D0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv
+ 00000228(552) services.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 00000234(564) lsass.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 00000268(616) alg.exe
+ 000002c8(712) svchost.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 000002f4(756) svchost.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 00000354(852) svchost.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 000003c4(964) svchost.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 000003e8(1000) svchost.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 00000418(1048) Ras.exe
00400000[0013F000]
[ M] 60. c:\program files\rising\antispyware\ras.exe
003D0000[0000A000]
[AM] 34. c:\windows\system32\wldpri.dll
10020000[00011000]
[ M] 61. c:\windows\system32\windhcp.ocx
15000000[00010000]
[ M] 54. c:\windows\system32\8.dat
01270000[00010000]
[ M] 55. c:\windows\system32\7.dat
01280000[00010000]
[ M] 56. c:\windows\system32\4.dat
01290000[00010000]
[ M] 57. c:\windows\system32\2.dat
012A0000[00011000]
[ M] 58. c:\windows\system32\1.dat
01310000[000A3000]
[ M] 62. c:\program files\rising\antispyware\rasgui.dll
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
01C30000[00009000]
[ M] 63. c:\windows\system32\timhost.dll
01C40000[00009000]
[ M] 64. c:\windows\system32\avpsrv.dll
01C50000[0000A000]
[AM] 33. c:\windows\system32\wgdpri.dll
jgliyfrtdus - 2007-7-28 8:38:00
01C60000[0000B000]
[AM] 32. c:\windows\system32\ztkpri.dll
01C70000[00012000]
[AM] 31. c:\windows\system32\xyfpri.dll
01C90000[0000A000]
[AM] 30. c:\windows\system32\zxepri.dll
01CA0000[0000A000]
[AM] 29. c:\windows\system32\qhbpri.dll
01CB0000[0000A000]
[AM] 28. c:\windows\system32\qjepri.dll
01CC0000[0000A000]
[AM] 26. c:\windows\system32\jhapri.dll
01CD0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
02C20000[0002F000]
[ M] 65. c:\program files\rising\antispyware\engine.dll
01E50000[00012000]
[ M] 66. c:\program files\rising\antispyware\zip.dll
+ 000004dc(1244) Explorer.EXE
003D0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
00DE0000[0000A000]
[AM] 26. c:\windows\system32\jhapri.dll
00DF0000[0000A000]
[AM] 28. c:\windows\system32\qjepri.dll
00E00000[0000A000]
[AM] 29. c:\windows\system32\qhbpri.dll
00E10000[0000A000]
[AM] 30. c:\windows\system32\zxepri.dll
00FB0000[00012000]
[AM] 31. c:\windows\system32\xyfpri.dll
00FD0000[0000B000]
[AM] 32. c:\windows\system32\ztkpri.dll
00FE0000[0000A000]
[AM] 33. c:\windows\system32\wgdpri.dll
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv
23700000[0001A000]
[ M] 67. d:\rising\rav\rscommon.dll
15000000[00011000]
[ M] 58. c:\windows\system32\1.dat
01FD0000[00010000]
[ M] 57. c:\windows\system32\2.dat
01FF0000[00010000]
[ M] 56. c:\windows\system32\4.dat
01AB0000[00010000]
[ M] 55. c:\windows\system32\7.dat
01B00000[00010000]
[ M] 54. c:\windows\system32\8.dat
01AA0000[00005000]
[ M] 68. c:\windows\system32\nwizhx2.dll
01520000[0000A000]
[AM] 34. c:\windows\system32\wldpri.dll
02590000[0001B000]
[AM] 25. c:\windows\system32\ravext.dll
02920000[00009000]
[ M] 64. c:\windows\system32\avpsrv.dll
02B60000[00009000]
[ M] 63. c:\windows\system32\timhost.dll
+ 00000584(1412) spoolsv.exe
003C0000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
+ 000005d8(1496) RavStub.exe
00400000[00018000]
[AM] 44. d:\rising\rav\ravstub.exe
10000000[0001B000]
[ M] 69. d:\rising\rav\rscommx.dll
23700000[0001A000]
[ M] 67. d:\rising\rav\rscommon.dll
+ 00000620(1568) wdfmgr.exe
01000000[0000C000]
[AM] 5. c:\windows\system32\wdfmgr.exe
00560000[0000A000]
[AM] 33. c:\windows\system32\wgdpri.dll
+ 0000068c(1676) RfwMain.exe
00400000[00073000]
[AM] 37. d:\rising\rfw\rfwmain.exe
26600000[0007D000]
[ M] 70. d:\rising\rfw\rsguilib.dll
23700000[0001A000]
[ M] 71. d:\rising\rfw\rscommon.dll
10000000[0000F000]
[ M] 72. d:\rising\rfw\rfwctrl.dll
23800000[0001A000]
[ M] 73. d:\rising\rfw\rsxml.dll
23900000[00031000]
[ M] 74. d:\rising\rfw\pngdll.dll
01110000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
015B0000[0000A000]
[AM] 33. c:\windows\system32\wgdpri.dll
016A0000[0000B000]
[AM] 32. c:\windows\system32\ztkpri.dll
016B0000[00012000]
[AM] 31. c:\windows\system32\xyfpri.dll
016D0000[0000A000]
[AM] 30. c:\windows\system32\zxepri.dll
016E0000[0000A000]
[AM] 29. c:\windows\system32\qhbpri.dll
016F0000[0000A000]
[AM] 28. c:\windows\system32\qjepri.dll
01700000[0000A000]
[AM] 26. c:\windows\system32\jhapri.dll
01710000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
15000000[00010000]
[ M] 54. c:\windows\system32\8.dat
015F0000[00010000]
[ M] 55. c:\windows\system32\7.dat
01600000[00010000]
[ M] 56. c:\windows\system32\4.dat
01610000[00010000]
[ M] 57. c:\windows\system32\2.dat
01720000[00011000]
[ M] 58. c:\windows\system32\1.dat
018D0000[0000A000]
[AM] 34. c:\windows\system32\wldpri.dll
01750000[00009000]
[ M] 63. c:\windows\system32\timhost.dll
018C0000[00009000]
[ M] 64. c:\windows\system32\avpsrv.dll
+ 000006a8(1704) conime.exe
10020000[00011000]
[ M] 61. c:\windows\system32\windhcp.ocx
15000000[00010000]
[ M] 56. c:\windows\system32\4.dat
00A80000[00010000]
[ M] 57. c:\windows\system32\2.dat
00FA0000[00011000]
[ M] 58. c:\windows\system32\1.dat
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
01090000[00010000]
[ M] 54. c:\windows\system32\8.dat
010A0000[00010000]
[ M] 55. c:\windows\system32\7.dat
+ 000007f4(2036) SOUNDMAN.EXE
00400000[0000D000]
[AM] 36. c:\windows\soundman.exe
72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
+ 00000c60(3168) IEXPLORE.EXE
003D0000[0000B000]
[AM] 32. c:\windows\system32\ztkpri.dll
10020000[00011000]
[ M] 61. c:\windows\system32\windhcp.ocx
15000000[00010000]
[ M] 54. c:\windows\system32\8.dat
00EB0000[00010000]
[ M] 55. c:\windows\system32\7.dat
10000000[0001B000]
[ M] 53. c:\program files\rising\antispyware\ieprot.dll
02310000[0000A000]
[AM] 33. c:\windows\system32\wgdpri.dll
02320000[00012000]
[AM] 31. c:\windows\system32\xyfpri.dll
02340000[0000A000]
[AM] 30. c:\windows\system32\zxepri.dll
02350000[0000A000]
[AM] 29. c:\windows\system32\qhbpri.dll
02360000[0000A000]
[AM] 28. c:\windows\system32\qjepri.dll
02370000[0000A000]
[AM] 26. c:\windows\system32\jhapri.dll
02380000[0000A000]
[AM] 27. c:\windows\system32\jzepri.dll
029C0000[00019000]
[ M] 75. d:\rising\rav\ravscrch.dll
72C80000[00008000]
[ M] 59. c:\windows\system32\msacm32.drv
01E40000[0000A000]
[AM] 34. c:\windows\system32\wldpri.dll
01E60000[00010000]
[ M] 56. c:\windows\system32\4.dat
01E70000[00010000]
[ M] 57. c:\windows\system32\2.dat
01E80000[00011000]
[ M] 58. c:\windows\system32\1.dat
01E30000[00009000]
[ M] 63. c:\windows\system32\timhost.dll
01E50000[00009000]
[ M] 64. c:\windows\system32\avpsrv.dll
30000000[00222000]
[ M] 76. c:\windows\system32\macromed\flash\flash8.ocx
jgliyfrtdus - 2007-7-28 9:14:00
文件夹里隐藏着 niu.exe 这个东西,还有个文档 内容是[AutoRun]
open=niu.exe
shell\open=打开(&O)
shell\open\Command=niu.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=niu.exe
脚本小孩 - 2007-8-28 2:59:00
不会是AUTO病毒吧,建议你下个Autoguard全面杀一次,该软件很好使哦专杀AUTO的
小贝＆壳儿 - 2007-8-28 12:21:00
我的瑞新杀毒软件没用了，只能查毒，杀不了啊，哪位帮帮我啊？
© 2000 - 2026 Rising Corp. Ltd.