瑞星卡卡安全论坛

所中的不知道是什么病毒．．因为病毒把全部杀毒程序都自动关闭．．打不开．．连瑞星的在线杀毒打开都自动关闭．．附件中是SRENG日志请大虾们帮忙．．万分感谢！！

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 1.7; TencentTraveler ; .NET CLR 1.1.4322; Seekmo 10.0.341.0)


附件: 10148262008217122522.txt

补充１点．．．电脑进不了安全模式　进入就蓝屏死机．．呵呵

断开网络1.建议使用XDelBox删除以下文件(XDelBox1.6下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择勾上抑制再生，从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

c:\windows\system32\msplrct.dll
c:\windows\system32\fswgp.dll
c:\windows\system32\avwghmn.dll
c:\windows\system32\z86cbkjb.dll
c:\program files\ocins\idnsvr.exe
c:\program files\ocins\idnsvr.dll
c:\windows\system32\rundllforour.exe
c:\windows\system32\wbem\rehuj.dll
c:\program files\common files\microsoft shared\urxktvf.exe
c:\windows\system32\mstask.exe
c:\program files\common files\system\vjptebu.exe
c:\windows\system32\fswgp.dll
c:\windows\system32\rundllforour.exe
c:\windows\system32\wbem\rehuj.dll
c:\windows\system32\drivers\0bf3.sys
c:\windows\system32\drivers\9na4.sys
c:\windows\system32\drivers\aahefeah.sys
c:\windows\system32\drivers\acbdgdea.sys
c:\windows\system32\drivers\yfaeht78.sys
c:\windows\system32\drivers\xprotector.sys
c:\windows\system32\drivers\vkatw.sys
c:\windows\system32\a 31164.sys
c:\windows\system32\drivers\qaqdcw05.sys
c:\windows\system32\fat32.sys
c:\windows\system32\drivers\ntgdt.sys
c:\windows\system32\drivers\nmpkg.sys
c:\windows\system32\new.sys
c:\windows\\systemroot\system32\drivers\ndndognh.sys
c:\windows\system32\drivers\mxdispdr.sys
c:\windows\system32\drivers\ibceiaec.sys
c:\windows\system32\drivers\ffdaeahg.sys
c:\windows\system32\drivers\cxw2yrj.sys
c:\windows\system32\drivers\bgejegfa.sys
c:\windows\system32\drivers\atmpstub.sys
c:\windows\system32\drivers\idnaux.sys
c:\windows\system32\drivers\cnprov.sys
c:\program files\internet explorer\iexplore32.dat
c:\program files\internet explorer\iexplore32.sys
c:\program files\internet explorer\iexplore32.win
c:\progra~1\ocins\ieaux.dll
c:\aqgwumn.exe
d:\aqgwumn.exe
e:\aqgwumn.exe
f:\aqgwumn.exe
g:\aqgwumn.exe
c:\autorun.inf
d:\autorun.inf
e:\autorun.inf
f:\autorun.inf
g:\autorun.inf

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[aqgwumn]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[SchedulingAgent]    <; mstask.exe>
[mdxrbqt]    <C:\Program Files\Common Files\System\vjptebu.exe>
[jrefcgte]    <; D;]XJOEPXT]tztufn43]Svoemm43/fyf!#D;]XJOEPXT]tztufn43]deoqsi/emm#-Tubsu>
[IdnSvr]    <C:\Program Files\OCINS\idnsvr.exe>
[IFEO[360rpt.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[360Safe.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[360tray.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[adam.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[AgentSvr.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[AppSvc32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[ArSwp.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[AST.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[autoruns.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[AvastU3.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[avconsol.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[avgrssvc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[AvMonitor.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[avp.com]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[avp.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[CCenter.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[ccSvcHst.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[EGHOST.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[FileDsty.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[FTCleanerShell.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[FYFireWall.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[ghost.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[HijackThis.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[IceSword.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[iparmo.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Iparmor.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[irsetup.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[isPwdSvc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[kabaload.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KASMain.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KASTask.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAV32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAVDX.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAVPF.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAVPFW.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAVSetup.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KAVStart.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KISLnchr.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KMailMon.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KMFilter.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KPFW32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KPFW32X.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KPfwSvc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KRegEx.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KRepair.com]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KsLoader.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVCenter.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KvDetect.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KvfwMcl.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVMonXP.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVMonXP_1.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[kvol.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[kvolself.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KvReport.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVScan.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVSrvXP.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KVStub.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[kvupload.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[kvwsc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KvXP.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KvXP_1.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KWatch.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KWatch9x.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[KWatchX.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[loaddll.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[MagicSet.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[mcconsol.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[mmqczj.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[mmsk.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Navapsvc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Navapw32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[nod32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[nod32krn.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[nod32kui.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[NPFMntor.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[PFW.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[PFWLiveUpdate.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[QHSET.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[QQDoctor.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[QQKav.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[QQSC.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Ras.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Rav.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RavMon.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RavMonD.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RavStub.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RavTask.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RegClean.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[rfwcfg.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[rfwmain.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[rfwsrv.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[RsAgent.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Rsaupd.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[rstrui.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[runiep.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[safelive.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[scan32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[shcfg32.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[SmartUp.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[SREng.EXE]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[symlcsvc.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[SysSafe.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[TrojanDetector.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[Trojanwall.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[TrojDie.kxp]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UIHost.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UmxAgent.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UmxAttachment.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UmxCfg.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UmxFwHlp.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UmxPol.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[upiea.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[UpLive.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[USBCleaner.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[vsstat.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[webscanx.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[WoptiClean.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>
[IFEO[zjb.exe]]    <C:\Program Files\Common Files\Microsoft Shared\urxktvf.exe>

启动项目 －－ 服务 －－ Win32服务应用程序之如下项禁用：
[Office Backup Engine / Patterns]    <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\fswgp.dll>
[Distributed Application Client / SHipING]    <C:\WINDOWS\SYSTEM32\RUNDLLFOROUR.EXE C:\WINDOWS\SYSTEM32\WBEM\REHUJ.DLL,DllRegisterServer 1087>

    启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[0bf3 / 0bf3]    <\??\C:\WINDOWS\system32\drivers\0bf3.sys>
[9na / 9na4]    <\SystemRoot\System32\DRIVERS\9na4.sys>
[aahefeah / aahefeah]    <\SystemRoot\system32\drivers\aahefeah.sys>
[acbdgdea / acbdgdea]    <\SystemRoot\system32\drivers\acbdgdea.sys>
[yfaeht7 / yfaeht78]    <\SystemRoot\System32\DRIVERS\yfaeht78.sys>
[XPROTECTOR / XPROTECTOR]    <\??\C:\WINDOWS\system32\drivers\Xprotector.sys>
[vkat / vkatw]    <\SystemRoot\System32\DRIVERS\vkatw.sys>
[R0A / R0A]    <\??\C:\WINDOWS\system32\a 31164.sys>
[qaqdcw0 / qaqdcw05]    <\SystemRoot\System32\DRIVERS\qaqdcw05.sys>
[PciHardDisk / PciHardDisk]    <\??\C:\WINDOWS\system32\fat32.sys>
[NTGDT / NTGDT]    <\??\C:\WINDOWS\system32\Drivers\NTGDT.SYS>
[nmpkg / nmpkg]    <\??\C:\WINDOWS\system32\drivers\nmpkg.sys>
[New0 / New0]    <\??\C:\WINDOWS\system32\new.sys>
[ndndognh / ndndognh]    <\SystemRoot\\SystemRoot\System32\drivers\ndndognh.sys>
[mxdispdr / mxdispdr]    <\??\C:\WINDOWS\system32\drivers\mxdispdr.sys>
[ibceiaec / ibceiaec]    <\SystemRoot\system32\drivers\ibceiaec.sys>
[ffdaeahg / ffdaeahg]    <\SystemRoot\system32\drivers\ffdaeahg.sys>
[cxw2yr / cxw2yrj]    <\SystemRoot\System32\DRIVERS\cxw2yrj.sys>
[bgejegfa / bgejegfa]    <\SystemRoot\system32\drivers\bgejegfa.sys>
[atmpstub / atmpstub]    <\??\C:\WINDOWS\system32\drivers\atmpstub.sys>
[idnaux / idnaux]    <system32\drivers\idnaux.sys>
[cnprov / cnprov]    <\SystemRoot\system32\drivers\cnprov.sys>

    系统修复－－　浏览器加载项之如下项删除：
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Dat>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.Sys>
[]    <C:\Program Files\Internet Explorer\IEXPLORE32.win>
[&Google]    <>
[WebThunder Class]    <>
[IEAux Class]    <C:\PROGRA~1\OCINS\ieaux.dll>

    系统修复－－ HOSTS文件－－重置

安全模式打不开可以用金山的AV终结者专杀修复