瑞星卡卡安全论坛

郁闷啊,电脑现在开机就跳有病毒,随后防火墙杀毒都被关了,关了之后是还能打开,下面是扫描日志,哪位大虾帮忙看看,解决解决


[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


附件: 847276200791800940.txt

自己顶

找到下面的文件复制到桌面，用RAR压缩发到enao@people.com.cn 麻烦你了
C:\WINDOWS.0\system32\rsjzbpm.dll
C:\WINDOWS.0\system32\raqjapi.dll
C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys
C:\WINDOWS.0\system32\ztavpw0.dll
C:\WINDOWS.0\system32\rsmyapm.dll
C:\WINDOWS.0\system32\GMSY.dll
egomoo.exe(搜索下)

删除注册表项目
<{798977F1-34FC-4DDD-AF6D-1B5C196B4EB4}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System6.ins>  []
    <{22FAACDE-34DA-CCD4-AB4D-DA34485A3422}><C:\WINDOWS.0\system32\rsjzbpm.dll>  []
    <{14783410-4F90-34A0-7820-3230ACD05F41}><C:\WINDOWS.0\system32\raqjapi.dll>  []
    <{1960356A-458E-DE24-BD50-268F589A56A1}><>  [N/A]
    <{CEB1B6B3-348D-4E5F-A1D6-E7B3952579D6}><C:\WINDOWS.0\system32\ztavpw0.dll>  []
    <{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS.0\system32\rsmyapm.dll>  [N/A]
    <{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys>  []
<7531><C:\WINDOWS.0\system32\GMSY.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FuckJacks.exe]
    <IFEO[FuckJacks.exe]><egomoo.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe]
    <IFEO[Logo1_.exe]><egomoo.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSO.exe]
    <IFEO[OSO.exe]><egomoo.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundl132.exe]
    <IFEO[rundl132.exe]><egomoo.exe>  [N/A]

安全模式下删除
C:\WINDOWS.0\system32\rsjzbpm.dll
C:\WINDOWS.0\system32\raqjapi.dll
C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys
C:\WINDOWS.0\system32\ztavpw0.dll
C:\WINDOWS.0\system32\rsmyapm.dll
C:\WINDOWS.0\system32\GMSY.dll
egomoo.exe(搜索下)

删除不掉的文件尝试用XDelBox1.5一次性删除
(enao.ys168.com 下载)
打开XDelBox1.3==>在 文件路径 填上文件具体路径==>点 添加==>勾选上 抑制再生==>选中 列表中的文件 点 右键(若要一次性删除多个文件，可以按住键盘的Ctrl,进行多选)==>选择 立刻重启执行删除

编辑<AppInit_DLLs>内容为空 即删除<rsjzbpm.dll>

偶这就去搞,终于有人理了555

删除注册表项目
<{798977F1-34FC-4DDD-AF6D-1B5C196B4EB4}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System6.ins> []
<{22FAACDE-34DA-CCD4-AB4D-DA34485A3422}><C:\WINDOWS.0\system32\rsjzbpm.dll> []
<{14783410-4F90-34A0-7820-3230ACD05F41}><C:\WINDOWS.0\system32\raqjapi.dll> []
<{1960356A-458E-DE24-BD50-268F589A56A1}><> [N/A]
<{CEB1B6B3-348D-4E5F-A1D6-E7B3952579D6}><C:\WINDOWS.0\system32\ztavpw0.dll> []
<{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS.0\system32\rsmyapm.dll> [N/A]
<{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
<7531><C:\WINDOWS.0\system32\GMSY.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FuckJacks.exe]
<IFEO[FuckJacks.exe]><egomoo.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe]
<IFEO[Logo1_.exe]><egomoo.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OSO.exe]
<IFEO[OSO.exe]><egomoo.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundl132.exe]
<IFEO[rundl132.exe]><egomoo.exe> [N/A]
这些去哪删啊55555555

安全模式进不去55555每次选择就又跳会选择项了