瑞星卡卡安全论坛

瑞星扫描正常，但进入安全模式会蓝屏，瑞星已升级到最新但无法扫描到病毒，用EWIDO扫描后发现系统有500多个文件感染了Trojan.OnLineGames.owx 这个病毒，提示清除成功，但重起后依然出现病毒，网络游戏帐号被盗。下面是EWIDO的扫描报告，谢谢高手指点，重装系统都没用了

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


附件: 1028133200832300828.txt

ewido anti-spyware - 扫描报告
---------------------------------------------------------

+ 创建时间:22:06:21 2008-3-22

+ 扫描结果:

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PEXK7YI9\o[1].js -> Downloader.IstBar.az : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp195.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1D7.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1DB.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1DD.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1DF.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1E1.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1E3.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1E7.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1E9.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1EB.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1ED.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1EF.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1F1.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1F3.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1F5.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1F7.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1F9.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1FB.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1FD.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp1FF.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp201.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp203.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp205.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp207.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp209.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp20B.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp20D.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp20F.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp211.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp213.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp215.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp217.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp219.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp21B.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp21D.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp21F.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp221.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp223.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp225.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp227.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp229.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp22B.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp22D.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp22F.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp231.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp233.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp235.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp237.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp23A.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp23C.tmp -> Trojan.OnLineGames.owx : 已清除并备份(已隔离).
C:\Documents and Settings\Administrator\Local Settings\Temp\tmp23E.tm

楼主清空一下临时文件夹和IE缓存！再用卡卡助手查杀一下！

下载 System Repair Engineer，
http://download.kztechs.com/files/sreng2.zip
1 解压缩sreng2.zip
2 运行SREngPS.EXE
3 智能扫描=》扫描=》保存报告
4 把报告保存后以附件的形式发上来，注意把报告文件的扩展名改成“.txt”


清理临时文件夹:
打开我的电脑-工具-文件夹选项-查看-显示隐藏文件-隐藏受保护的系统文件(勾去掉)-确定
重起进入安全模式(开机不停的按F8,选择安全模式启动) 清空临时文件夹：
C:\Documents and Settings\用户名\Local Settings\Temporary Internet Files
C:\Documents and Settings\用户名\Local Settings\Temp

SREng可修复安全模式

【回复“ansyn”的帖子】
用IceSword强制删除下面这个目录下的所有文件：
C:\Documents and Settings\Administrator\Local Settings\Temp\