...............又来了```````````````````` bbs.ikaka.com

TnayrbeboK - 2007-8-22 21:32:00

我算是无语了`

怎么我的电脑老是中病毒和木马啊~

请各位大侠帮帮解决.

这是瑞星监控出来的

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

附件: 9144552007822212154.jpg

TnayrbeboK - 2007-8-22 21:34:00

这是SRENG的图片

附件: 9144552007822212331.jpg

TnayrbeboK - 2007-8-22 21:35:00

接着`

附件: 9144552007822212436.jpg

TnayrbeboK - 2007-8-22 21:35:00

还有``

附件: 9144552007822212510.jpg

TnayrbeboK - 2007-8-22 21:36:00

这是SRENG扫的日志`

[CODE]

2007-08-22,21:06:15

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
<NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<runeip><"C:\Program Files\rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<nwiz><; nwiz.exe /install> [(Verified)Microsoft Windows XP Publisher]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [(Verified)"RealNetworks, Inc."]
<Super Rabbit SafeEdit><F:\实用软件\超级兔子\MagicSet\SRFC.EXE /Load> [Super Rabbit Soft]
<RAVHXMON><C:\Program Files\Internet Explorer\RAVHXMON.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><jzhpri.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{014A26F5-FBAD-4549-9CA1-C38210704BD1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins> []
<{8A65498A-7653-9801-1647-987114AB7F48}><C:\WINDOWS\System32\zxhpri.dll> []
<{859AFD5B-159F-ACD8-954C-ACD545FA6588}><C:\WINDOWS\System32\jzhpri.dll> []
<{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.0><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 5><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
<CRLUpdate><%SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl> [N/A]

==================================
启动文件夹
[QQ游戏启动加速程序]
<C:\Documents and Settings\mlcb\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> F:\实用软件\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

==================================
服务
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
<C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BS_I2cIo / BS_I2cIo][Running/System Start]
<\??\C:\WINDOWS\System32\drivers\BS_I2cIo.sys><BIOSTAR Group>
[C-Media WDM Audio Interface / cmuda][Running/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[IdeBusDr / IdeBusDr][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\IdeBusDr.sys><Intel Corporation>
[Intel(R) Ultra ATA Controller / IdeChnDr][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\IdeChnDr.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nVidia WDM Video Capture (universal) / nvcap][Running/Auto Start]
<System32\DRIVERS\nvcap.sys><NVIDIA Corporation>
[nVidia WDM TVTuner / nvTUNEP][Running/Auto Start]
<System32\DRIVERS\nvtunep.sys><NVIDIA Corporation>
[nVidia WDM TVAudio Crossbar / nvtvSND][Running/Auto Start]
<System32\DRIVERS\nvtvsnd.sys><NVIDIA Corporation>
[nVidia WDM A/V Crossbar / NVXBAR][Running/Auto Start]
<System32\DRIVERS\NVxbar.sys><NVIDIA Corporation>
[OrangeWare USB 2.0 Root Hub Support / ousb2hub][Running/Manual Start]
<System32\DRIVERS\ousb2hub.sys><OrangeWare Corporation>
[NEC PCI to USB Enhanced Host Controller / ousbehci][Running/Auto Start]
<System32\Drivers\ousbehci.sys><OrangeWare Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[npkcrypt / npkcrypt][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\npkycryp.sys><N/A>

==================================

TnayrbeboK - 2007-8-22 21:37:00

浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\实用软件\讯雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <F:\实用软件\讯雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\实用软件\讯雷\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\System32\LegitCheckControl.DLL, Microsoft Corporation>
[PhotoDraw Class]
{2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} <C:\WINDOWS\System32\QQPhotoDraw.dll, TENCENT>
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\实用软件\讯雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <F:\实用软件\讯雷\Components\InMedia\MediaAddin13.dll, Thunder Networking Technologies,LTD>
[Thunder DapPlayer]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <F:\实用软件\讯雷\Components\DownAndPlay\DapPlayer_Now.dll, ShenZhen Thunder Networking Technologies Ltd.>
[使用迅雷下载]
<F:\实用软件\讯雷\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<F:\实用软件\讯雷\Program\getallurl.htm, N/A>
[添加到QQ表情]
<F:\实用软件\腾讯QQ\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 436 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 492 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 516 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 572 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 728 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 808 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 888 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 936 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1304 / mlcb][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins] [N/A, ]
[C:\WINDOWS\winow.dll] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\RAVHXMON.DAT] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[PID: 1372 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\EBPMON2.DLL] [SEIKO EPSON CORPORATION, 2, 34, 0, 0]
[PID: 1516 / mlcb][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\winow.dll] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[PID: 1672 / SYSTEM][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 2, 3, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 26, 0, 0]
[PID: 1772 / SYSTEM][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.14.01.4351]
[PID: 1840 / LOCAL SERVICE][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1936 / mlcb][C:\Program Files\rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 4.0.0.18]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\winow.dll] [N/A, ]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[PID: 3780 / mlcb][C:\WINDOWS\System32\zxhins.exe] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[PID: 3412 / mlcb][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\WINDOWS\winow.dll] [N/A, ]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[PID: 3648 / mlcb][C:\WINDOWS\System32\jzhins.exe] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[PID: 3040 / mlcb][F:\实用软件\腾讯QQ\TIMPlatform.exe] [TENCENT, 7,0,365,1701]
[C:\Program Files\Internet Explorer\RAVHXMON.DAT] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\WINDOWS\winow.dll] [N/A, ]
[F:\实用软件\腾讯QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 2120 / mlcb][C:\Documents and Settings\mlcb\桌面\sreng.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\System32\zxhpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\RAVHXMON.DAT] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\Program Files\rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\System32\jzhpri.dll] [N/A, ]
[C:\WINDOWS\winow.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[E:\]
[AutoRun]
open=AutoRun.exe
shellexecute=AutoRun.exe
shell\打开(&O)\command=AutoRun.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 516, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1936, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3780, C:\WINDOWS\SYSTEM32\ZXHINS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3648, C:\WINDOWS\SYSTEM32\JZHINS.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

TnayrbeboK - 2007-8-22 21:38:00

对了

中这种病毒都已经中过好几次了.

能不能教我些主动防范的招啊``

谢了`

matongtoto - 2007-8-22 21:43:00

你把sreng的日志放到附件里

TnayrbeboK - 2007-8-22 21:45:00

那还不是一样吗?

算了``

这是`

附件: 9144552007822213438.txt

matongtoto - 2007-8-22 21:51:00

删除
c:\program files\common files\microsoft shared\msinfo\system16.ins
c:\program files\internet explorer\plugins\winsys64.sys
c:\program files\internet explorer\ravhxmon.dat
c:\windows\system32\jzhpri.dll
c:\windows\system32\zxhpri.dll
c:\windows\winow.dll
jzhpri.dll
c:\program files\internet explorer\ravhxmon.exe
%systemroot%\system32\updcrl.exe -e -u %systemroot%\system32\verisignpub1.crl
c:\windows\system32\npkycryp.sys

2.删除重启后使用SREng修复下面各项：

启动项目－－注册表之如下项删除：
[{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}] <C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys>
[{859AFD5B-159F-ACD8-954C-ACD545FA6588}] <C:\WINDOWS\System32\jzhpri.dll>
[{8A65498A-7653-9801-1647-987114AB7F48}] <C:\WINDOWS\System32\zxhpri.dll>
[{014A26F5-FBAD-4549-9CA1-C38210704BD1}] <C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins>
注意该项[AppInit_DLLs]修改：把<jzhpri.dll>修改为<>即清空
[RAVHXMON] <C:\Program Files\Internet Explorer\RAVHXMON.exe>
[CRLUpdate] <%SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl>

启动项目－－服务－－驱动程序之如下项删除：
[npkycryp / npkycryp] <\??\C:\WINDOWS\System32\npkycryp.sys>

超级游戏迷 - 2007-8-22 21:52:00

一、进入安全模式；
二、将C:\WINDOWS\System32目录下的zxhpri.dll、jzhpri.dll分别改名为1.DLL、2.DLL，重启电脑；
三、删除以下注册表值项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<RAVHXMON><C:\Program Files\Internet Explorer\RAVHXMON.exe> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{014A26F5-FBAD-4549-9CA1-C38210704BD1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins> []
<{8A65498A-7653-9801-1647-987114AB7F48}><C:\WINDOWS\System32\zxhpri.dll> []
<{859AFD5B-159F-ACD8-954C-ACD545FA6588}><C:\WINDOWS\System32\jzhpri.dll> []
<{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []

四，修改[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]<AppInit_DLLs>的数值数据为空（即删除jzhpri.dll这个字符串），编辑[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]<Userinit>这个值项的值为c:\windows\system32\userinit.exe,(包括逗号)。

五、删除以下文件：
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
C:\Program Files\Internet Explorer\RAVHXMON.exe
[C:\Program Files\Internet Explorer\RAVHXMON.DAT] [N/A, ]
[C:\WINDOWS\System32\jzhins.exe] [N/A, ]
[C:\WINDOWS\System32\1.dll] [N/A, ]
[C:\WINDOWS\System32\2.dll] [N/A, ]
[C:\WINDOWS\winow.dll] [N/A, ]
E:\Autorun.inf
E:\AutoRun.exe

六、卸载QQ，删除QQ安装目录及其下的所有文件，重装QQ；

七、安全模式下全盘杀毒。

注意：期间不可用任何方式访问E盘。

TnayrbeboK - 2007-8-22 22:22:00

啊~!

要重装QQ啊, 那聊天记录会不会丢失?

超级游戏迷 - 2007-8-22 22:25:00

引用:

【TnayrbeboK的贴子】啊~!

要重装QQ啊, 那聊天记录会不会丢失?

………………

可以备份到其他地方，不过我对用QQ不熟悉，你看着办吧。
PS：QQ信息有这么重要么？

matongtoto - 2007-8-22 22:28:00

不把QQ目录下的号码文件夹删了,聊天记录就还有

TnayrbeboK - 2007-8-23 9:36:00

只能这样试试了``

哎`我的QQ~~

TnayrbeboK - 2007-8-23 11:28:00

好像没弄好~出了点意外.

这是SRENG最新扫的日志

好像又有点麻烦

附件: 9144552007823111802.txt

天月来了 - 2007-8-23 13:17:00

愿意的话，可以试着卸载你原机里的瑞星杀毒软件。

然后安装现在的瑞星2008公测版。

如果能运行2008的瑞星，就可以到：主动防御设置》程序启动控制》添加里，一个一个将下面的文件，包括路径都复制到那个“浏览”的地址框里。

再确定添加规则为：启动者“*”，触发动作“拒绝”

再一路“确定”“应用”。

全部下面的文件都添加进规则里拒绝启动以后，重启电脑，删除下面的文件

C:\Program Files\NetMeeting\ravztmon.exe
C:\WINDOWS\System32\msyasd.dll
C:\Program Files\NetMeeting\ravztmon.dat
C:\WINDOWS\System32\msyasd.exe
C:\WINDOWS\System32\LYLoader.exe
C:\WINDOWS\System32\LYLoadbr.exe
C:\WINDOWS\System32\LYLeador.exe
C:\WINDOWS\System32\LYLoador.exe
C:\WINDOWS\System32\LYLoadar.exe
C:\WINDOWS\System32\LYLoadmr.exe
C:\WINDOWS\System32\LYLoadhr.exe
C:\WINDOWS\System32\LYLoadqr.exe

————————————————————————————————————————
删除完上面的文件以后，在扫日志的SRENG工具中的：启动项目》注册表》删除下面：
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ravztmon><C:\Program Files\NetMeeting\ravztmon.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]

————————————————————————————————————————
用扫日志的SRENG工具：启动项目》服务》驱动程序》修改下面启动类型为“Disabled”

驱动程序
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\npkycryp.sys><N/A>

找C:\WINDOWS\System32\npkycryp.sys这个文件，改名或删除。
——————————————————————————————
重启电脑，没异常就卸载2008瑞星，重装你自己原来的瑞星，并升级至最新版本，全盘杀毒。

TnayrbeboK - 2007-8-23 13:20:00

不是吧```要重装?

好麻烦,有没有简单点的?

TnayrbeboK - 2007-8-23 13:28:00

回 Leoooo

卡卡扫的日志:

瑞星卡卡电脑诊断日志 v1.30 (2007-8-23 13:11:27) 北京瑞星科技股份有限公司

注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;

+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
EPSONStatusAgent2
[AM] 1. c:\program files\common files\epson\ebapi\sagent2.exe
SEIKO EPSON CORPORATION
EPSON Printer Status Agent
.text,.rdata,.data,.rsrc,

msyasd
[A ] 2. c:\windows\system32\msyasd.exe
CODE,DATA,BSS,.idata,.tls,.rdata,.reloc,.rsrc,

NVSvc
[AM] 3. c:\windows\system32\nvsvc32.exe
NVIDIA Corporation
NVIDIA Driver Helper Service, Version 43.51
.text,.rdata,.data,.rsrc,

RfwProxySrv
[A ] 4. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,

RfwService
[A ] 5. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,

RsCCenter
[A ] 6. c:\program files\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,

RsRavMon
[A ] 7. c:\program files\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,

UMWdf
[AM] 8. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,

WmdmPmSN
[A ] 9. c:\windows\system32\mspmsnsv.dll
Microsoft Corporation
Microsoft Media Device Service Provider
.text,.data,.rsrc,.reloc,

+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
BaseTDI
[A ] 10. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,

BS_I2cIo
[A ] 11. c:\windows\system32\drivers\bs_i2cio.sys
BIOSTAR Group
I/O Interface driver file
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,

cmuda
[A ] 12. c:\windows\system32\drivers\cmuda.sys
C-Media Inc
C-Media Audio WDM Driver
.text,_LTEXT,_PTEXT,.data,.data1,_LDATA,_PDATA,PAGE,INIT,.rsrc,.reloc,

ExpScaner
[A ] 13. c:\program files\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookCont
[A ] 14. c:\program files\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookReg
[A ] 15. c:\program files\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookSys
[A ] 16. c:\program files\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,

HookUrl
[A ] 17. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,

IdeBusDr
[A ] 18. c:\windows\system32\drivers\idebusdr.sys
Intel Corporation
Intel Application Accelerator Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,

IdeChnDr
[A ] 19. c:\windows\system32\drivers\idechndr.sys
Intel Corporation
Intel Application Accelerator Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

mchInjDrv
[A ] 20. c:\windows\temp\mc21.tmp

MEMSCAN
[A ] 21. c:\program files\rising\rav\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

mProcRs
[A ] 22. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,

npkcrypt
[A ] 23. c:\windows\system32\npkcrypt.sys

npkycryp
[A ] 24. c:\windows\system32\npkycryp.sys

nv
[A ] 25. c:\windows\system32\drivers\nv4_mini.sys
NVIDIA Corporation
NVIDIA Compatible Windows 2000 Miniport Driver, Version 43.51
.text,_NVTEXT3,.rdata,.data,PAGE,PAGE,INIT,.rsrc,.reloc,

nvcap
[A ] 26. c:\windows\system32\drivers\nvcap.sys
NVIDIA Corporation
NVIDIA WDM Video Capture (universal)
.text,.rdata,.data,INIT,.rsrc,.reloc,

nvTUNEP
[A ] 27. c:\windows\system32\drivers\nvtunep.sys
NVIDIA Corporation
NVIDIA WDM TVTuner
.text,.rdata,.data,INIT,.rsrc,.reloc,

nvtvSND
[A ] 28. c:\windows\system32\drivers\nvtvsnd.sys
NVIDIA Corporation
NVIDIA WDM TV Sound
.text,.rdata,.data,INIT,.rsrc,.reloc,

NVXBAR
[A ] 29. c:\windows\system32\drivers\nvxbar.sys
NVIDIA Corporation
NVIDIA WDM A/V Crossbar
.text,.rdata,.data,INIT,.rsrc,.reloc,

ousb2hub
[A ] 30. c:\windows\system32\drivers\ousb2hub.sys
OrangeWare Corporation
USB 2.0 Hub Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,

ousbehci
[A ] 31. c:\windows\system32\drivers\ousbehci.sys
OrangeWare Corporation
USB 2.0 Enhanced Host Controller Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,

RsAntiSpyware
[A ] 32. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsFwDrv
[A ] 33. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,

RsNTGDI
[A ] 34. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,

RSPPSYS
[A ] 35. c:\program files\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,

Secdrv
[A ] 36. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,

Winflash
[A ] 37. c:\windows\system32\drivers\winflash.sys
Award Software Inc.
WinFlash
.text,.rdata,.data,INIT,.rsrc,.reloc,

+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 38. c:\windows\system32\kakatool.dll
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Toolbar
.text,.rdata,.data,MonitorS,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[AM] 39. f:\实用软件\讯雷\comdlls\tdatonce_now.dll
Thunder Networking Technologies,LTD
迅雷浏览器高级特性支持模块
.text,.rdata,.data,.rsrc,.reloc,

{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3}
[AM] 40. f:\实用软件\讯雷\comdlls\xunleibho_now.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
[AM] 41. c:\program files\adobe\acrobat 5.0\reader\activex\acroiehelper.ocx
AcroIEHelper Module
.text,.rdata,.data,.rsrc,.reloc,

+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 42. f:\实用软件\讯雷\thunder.exe
Thunder Networking Technologies,LTD
.text,.rdata,.data,.rsrc,

+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}
[A ] 43. c:\windows\system32\updcrl.exe
Microsoft Corporation
UPDCRL
.text,.data,.rsrc,

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Microsoft Outlook Custom Icon Handler
[A ] 44. c:\program files\microsoft office\office\olkfstub.dll
Microsoft Corporation
Microsoft Outlook Shell Hook for Start/Find
.text,.data,.rsrc,.reloc,

RISING
[A ] 45. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,

Auto Update Property Sheet Extension
[A ] 46. c:\windows\system32\wuaucpl.cpl
Microsoft Corporation
Automatic Updates Control Panel
.text,.data,.rsrc,.reloc,

WinRAR shell extension
[A ] 47. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,

Portable Media Devices
[A ] 48. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,

Portable Media Devices Menu
[A ] 48. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,

+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS
[A ] 49. c:\program files\messenger\msmsgs.exe
Microsoft Corporation
Messenger Client
.text,.data,.rsrc,

+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
runeip
[AM] 50. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

RavTask
[A ] 51. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,

RfwMain
[AM] 52. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

nwiz
[A ] 53. c:\windows\system32\nwiz.exe
NVIDIA Corporation
NVIDIA nView Wizard, Version 43.51
.text,.rdata,.data,.rsrc,

TkBellExe
[A ] 54. c:\program files\common files\real\update_ob\realsched.exe
RealNetworks, Inc.
RealNetworks Scheduler
.text,.rdata,.data,.rsrc,

Super Rabbit SafeEdit
[A ] 55. f:\实用软件\超级兔子\magicset\srfc.exe
Super Rabbit Soft
Super Rabbit Safe File Client
UPX0,UPX1,.rsrc,

ravztmon
[A ] 56. c:\program files\netmeeting\ravztmon.exe
VL橸谚?_Y??G,QV?褤瑒,

+ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MSDEG32
[A ] 57. c:\windows\system32\lyloader.exe
VL橸谚?_Y??G,QV?褤瑒,

TnayrbeboK - 2007-8-23 13:29:00

+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 58. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,

+ 映像劫持
+ HKCR\.bat
batfile\edit\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

batfile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.html
htmlfile\Edit\Command
[A ] 60. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 60. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

+ HKCR\.htm
htmlfile\Edit\Command
[A ] 60. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

htmlfile\Print\Command
[A ] 60. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,

+ HKCR\.log
txtfile\open\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

txtfile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

txtfile\printto\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.txt
txtfile\open\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

txtfile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

txtfile\printto\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.cmd
cmdfile\edit\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

cmdfile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.reg
regfile\edit\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

regfile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.vbs
vbsfile\Edit\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

vbsfile\Print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.js
jsfile\Edit\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

jsfile\Print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.ini
inifile\open\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

inifile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ HKCR\.inf
inffile\open\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

inffile\print\Command
[A ] 59. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,

+ 打印机监控
+ HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
EPSON V5 2KMonitor
[AM] 61. c:\windows\system32\ebpmon2.dll
SEIKO EPSON CORPORATION
EPSON Bidirectional Monitor
.text,.data,.rsrc,.reloc,

+ 其他自启动项目
+
Privilege.dat
[A ] 62. c:\privilege.dat
VL橸谚?_Y??G,QV?褤瑒,

+
Privilege.dat
[A ] 62. c:\privilege.dat
VL橸谚?_Y??G,QV?褤瑒,

+ 正在运行的进程
+ 000001b4(436) smss.exe

+ 000001ec(492) csrss.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 00000204(516) winlogon.exe
72C90000[00009000]
[ M] 64. c:\windows\system32\wdmaud.drv
Microsoft Corporation
WDM Audio driver mapper
.text,.data,.rsrc,.reloc,

72C80000[00008000]
[ M] 65. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 00000230(560) services.exe
10000000[0000F000]
[ M] 66. c:\windows\system32\lymangr.dll
.Upack,.rsrc,
入口点在最后一个节;

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 0000023c(572) lsass.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 000002dc(732) svchost.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 00000320(800) svchost.exe
01150000[00054000]
[ M] 67. c:\windows\system32\winhttp.dll
Microsoft Corporation
Windows HTTP Services
.text,.data,.rsrc,.reloc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 0000038c(908) svchost.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 000003b8(952) svchost.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 00000438(1080) explorer.exe
10000000[0001B000]
[ M] 68. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

72C90000[00009000]
[ M] 64. c:\windows\system32\wdmaud.drv
Microsoft Corporation
WDM Audio driver mapper
.text,.data,.rsrc,.reloc,

72C80000[00008000]
[ M] 65. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,

+ 0000055c(1372) spoolsv.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

50400000[00014000]
[AM] 61. c:\windows\system32\ebpmon2.dll
SEIKO EPSON CORPORATION
EPSON Bidirectional Monitor
.text,.data,.rsrc,.reloc,

+ 00000684(1668) SAgent2.exe
00400000[00019000]
[AM] 1. c:\program files\common files\epson\ebapi\sagent2.exe
SEIKO EPSON CORPORATION
EPSON Printer Status Agent
.text,.rdata,.data,.rsrc,

10000000[00025000]
[ M] 69. c:\windows\system32\ebapi2.dll
SEIKO EPSON CORPORATION
EBAPI for Consumer
.text,.rdata,.data,.rsrc,.reloc,

00D00000[0003F000]
[ M] 70. c:\program files\common files\epson\ebapi\ebplpt.dll
SEIKO EPSON CORPORATION
LPT Bidirectional Provier
.text,.rdata,.data,.idata,.rsrc,.reloc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 000006a4(1700) RfwMain.exe
00400000[00073000]
[AM] 52. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,

26600000[0007D000]
[ M] 71. c:\program files\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,

23700000[0001A000]
[ M] 72. c:\program files\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

10000000[0000F000]
[ M] 73. c:\program files\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,

23800000[0001A000]
[ M] 74. c:\program files\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,

23900000[00031000]
[ M] 75. c:\program files\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

01210000[0001B000]
[ M] 68. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

TnayrbeboK - 2007-8-23 13:31:00

+ 000006c4(1732) runiep.exe
00400000[00013000]
[AM] 50. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,

00BE0000[0001B000]
[ M] 68. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 000007b0(1968) nvsvc32.exe
00400000[00013000]
[AM] 3. c:\windows\system32\nvsvc32.exe
NVIDIA Corporation
NVIDIA Driver Helper Service, Version 43.51
.text,.rdata,.data,.rsrc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 000007b4(1972) iexplore.exe
59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

10000000[00024000]
[AM] 39. f:\实用软件\讯雷\comdlls\tdatonce_now.dll
Thunder Networking Technologies,LTD
迅雷浏览器高级特性支持模块
.text,.rdata,.data,.rsrc,.reloc,

00E80000[00044000]
[AM] 40. f:\实用软件\讯雷\comdlls\xunleibho_now.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,

22A30000[0000A000]
[ M] 76. f:\实用软件\讯雷\components\resworker\dsbho_01.dll
DsBho
.text,.rdata,.data,.rsrc,.reloc,

22A10000[0000D000]
[ M] 77. f:\实用软件\讯雷\components\resworker\dataprocessor_01.dll
Thunder Networking Technologies,LTD
DataProcessor
.text,.rdata,.data,.rsrc,.reloc,

01310000[00008000]
[AM] 41. c:\program files\adobe\acrobat 5.0\reader\activex\acroiehelper.ocx
AcroIEHelper Module
.text,.rdata,.data,.rsrc,.reloc,

02430000[00037000]
[ M] 78. c:\windows\system32\msyase.dll
Microsoft Corporation
DESWorker DLL
.text,.rdata,.data,.rsrc,.reloc,

01A10000[00019000]
[ M] 79. c:\program files\rising\rav\ravscrch.dll
Beijing Rising Technology Co., Ltd.
RavScrCh Module
.text,.rdata,.data,.rsrc,.reloc,

+ 000007ec(2028) wdfmgr.exe
01000000[0000C000]
[AM] 8. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,

59800000[0001D000]
[ M] 63. c:\windows\system32\msyasd.dll
CODE,DATA,BSS,.idata,.reloc,.rsrc,

+ 00000d88(3464) Ras.exe
00400000[0013F000]
[ M] 80. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,

10000000[000A3000]
[ M] 81. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,

01620000[0001B000]
[ M] 68. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,

对了卡卡扫出来个可疑文件 lymangr.dll

Leoooo - 2007-8-23 13:35:00

c:\windows\system32\msyasd.exe
c:\program files\netmeeting\ravztmon.exe
c:\windows\system32\lyloader.exe
c:\privilege.dat
c:\windows\system32\lymangr.dll
c:\windows\system32\msyasd.dll

上传给瑞星http://up.rising.com.cn/webmail/uploadnew.htm
然后删除这些文件.

大庆女人 - 2007-9-8 9:23:00

要不行试试卡巴斯基？

日不懂啊 - 2007-9-8 13:55:00

引用:

【TnayrbeboK的贴子】不是吧```要重装?

好麻烦,有没有简单点的?
………………

不重装也行，先把病毒搞了，按到天月大大的方法做
我补充一点
删除的文件中
[C:\WINDOWS\winow.dll] [N/A, ]
这个可以删除，但多了个
[C:\WINDOWS\winow.exe]也要删除

瑞星卡卡安全论坛