今天看了中军网，结果又被感染了，防火墙和雨伞都不行了，斑竹看看应该怎么杀啊？

2006-10-27,23:43:43

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
    <Yahoo! Pager><; "E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet>  [(Verified)Yahoo! Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <BigDogPath><; C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  [N/A]
    <CM-SmWizard><; C:\WINDOWS\System\SmWizard.exe>  [C-Media Electronics Inc.]
    <Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd>  [N/A]
    <HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Intel Corporation]
    <IgfxTray><; C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Intel Corporation]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{A15AA297-2978-7829-915A-89891A29785A}><C:\Program Files\Common Files\SYSTEM\A1582799.dll>  [N/A]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><>  [N/A]
==================================
启动文件夹
[589279]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\589279.exe -->  [N/A]><N>
[589279]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\589279.exe -->  [N/A]><N>

==================================
服务
[Canon Camera Access Library 8 / CCALib8]
  <C:\Program Files\Canon\CAL\CALMAIN.exe><Canon Inc.>
[Windows Client / ClientWeb]
  <C:\WINDOWS\System_Root.exe><N/A>
[Gray_Pigeon_Server1.23 / GrayPigeonServer1.23]
  <C:\WINDOWS\ddddd.exe><N/A>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy  Service / RfwProxySrv]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

驱动程序
[Rising TDI Base Driver / BaseTDI]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[C-Media WDM Audio Interface / cmuda]
  <system32\drivers\cmuda.sys><C-Media Inc>
[ExpScaner / ExpScaner]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HSFHWBS2 / HSFHWBS2]
  <system32\DRIVERS\HSFBS2S2.sys><Conexant Systems, Inc.>
[HSF_DP / HSF_DP]
  <system32\DRIVERS\HSFDPSP2.sys><Conexant Systems, Inc.>
[ialm / ialm]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[mdmxsdk / mdmxsdk]
  <system32\DRIVERS\mdmxsdk.sys><Conexant>
[MEMSCAN / MEMSCAN]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[PNP06698 / PNP06698]
  <\SystemRoot\system32\Drivers\pnp06545.sys><Anti Driver>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[SVKP / SVKP]
  <\??\C:\WINDOWS\system32\SVKP.sys><AntiCracking>
[winachsf / winachsf]
  <system32\DRIVERS\HSFCXTS2.sys><Conexant Systems, Inc.>
[World Standard Teletext Codec / WSTCODEC]
==================================
浏览器加载项
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[启动迅雷]
  {0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[PowerList Control]
  {20C2C286-BDE8-441B-B73D-AFA22D914DA5} <C:\WINDOWS\DOWNLO~1\POWERL~1.OCX, PPStream.com>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v13.dll, N/A>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <E:\adobe\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[PowerList Control]
  {20C2C286-BDE8-441B-B73D-AFA22D914DA5} <C:\WINDOWS\DOWNLO~1\POWERL~1.OCX, PPStream.com>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[PowerPlayer Control]
  {5EC7C511-CD0F-42E6-830C-1BD9882F3458} <C:\WINDOWS\DOWNLO~1\POWERP~1.DLL, PPStream Inc.>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[RMGetLicense Class]
  {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[MessengerChecker Class]
  {DA4F543C-C8A9-4E88-9A79-548CBB46F18F} <E:\Program Files\Yahoo!\Messenger\YPagerChecker.dll, TODO: <Company name>>
[Messenger Class]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
  <E:\Tencent\qq\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <E:\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\Tencent\qq\SendMMS.htm, N/A>
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 504][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 528][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 572][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 584][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 792][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 852][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 896][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1076][c:\program files\rising\rfw\rfwproxy.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 14]
    [c:\program files\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
    [c:\program files\rising\rfw\MonMid.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 2]
[PID: 1196][c:\program files\rising\rfw\rfwsrv.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 33]
    [c:\program files\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 13]
    [c:\program files\rising\rfw\rfwlog.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 6]
    [c:\program files\rising\rfw\Rfwdrv.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 21]
    [c:\program files\rising\rfw\MonDrv.dll]  [rs, 1, 0, 0, 4]
    [c:\program files\rising\rfw\ProcLib.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 9]
[PID: 1256][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [E:\adobe\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1416][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1512][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
[PID: 1620][c:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
    [c:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
    [c:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [c:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
[PID: 1764][C:\Program Files\Rising\Rav\RavMon.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33]
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
[PID: 2036][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 356][C:\Program Files\Canon\CAL\CALMAIN.exe]  [Canon Inc., 8, 1, 0, 14]
[PID: 1140][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2216][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 2936][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
    [D:\rising\sreng2\SREng\SREng.com]  [Smallfrogs Studio, 2.2.6.605]
    [C:\Program Files\Common Files\SYSTEM\A1582799.dll]  [N/A, N/A]
    [D:\rising\sreng2\SREng\Plugins\SRECXTMG.SRE]  [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 www1.tmdqq.net
127.0.0.1 www3.57185.com
127.0.0.1 www.im123.net
127.0.0.1 www.isplay.net
9.9.9.9 skypetools.tom.com
9.9.9.9 download.3721.com
9.9.9.9 assistant.3721.com
9.9.9.9 iebar.t2t2.com
9.9.9.9 www.94lm.com
9.9.9.9 365tan.com
9.9.9.9 www.duduw.com
9.9.9.9 duduw.com
9.9.9.9 alexa.com
9.9.9.9 www.alexa.com
9.9.9.9 data.alexa.com
9.9.9.9 client.alexa.com
9.9.9.9 log.alexa.com
9.9.9.9 redirect.alexa.com
9.9.9.9 cgi.alexa.com
9.9.9.9 www.cool-pic.com
9.9.9.9 www.511ku.com
9.9.9.9 www.511q.com
9.9.9.9 www.fvip.cn
9.9.9.9 17rm.com
9.9.9.9 www.mv23.com
9.9.9.9 www.911y.com
9.9.9.9 www.kanhaha.com
9.9.9.9 168.tu9.cn
9.9.9.9 liao8.top22.cn
9.9.9.9 top22.cn
9.9.9.9 tu9.cn
9.9.9.9 liao8.tu9.cn
9.9.9.9 www.haha9999.com
9.9.9.9 haha9999.com
9.9.9.9 www.mmm168.com
9.9.9.9 www.rm78.com
9.9.9.9 rm78.com
9.9.9.9 v.511.cc
9.9.9.9 www.kvip.cn
9.9.9.9 www.10uu.com
9.9.9.9 168.8799.com
9.9.9.9 www.movieon.net
9.9.9.9 www.18mei.com
9.9.9.9 vod.xp99.net
9.9.9.9 vcd.58so.com
9.9.9.9 www.movie78.com
9.9.9.9 www.103h.com
9.9.9.9 www.kan8dy.com
9.9.9.9 www.yk88.com
9.9.9.9 www.qq500.cn
9.9.9.9 www.921mn.com
9.9.9.9 www.38mtv.com
9.9.9.9 www.591mn.com
9.9.9.9 liao2.sees8.com
9.9.9.9 www.66pp.net
9.9.9.9 www.581mm.com
9.9.9.9 www.cl258.com
9.9.9.9 www.sedy8.com
9.9.9.9 www.531kdy.com
9.9.9.9 www.ku90.com
9.9.9.9 www.47028.com
9.9.9.9 client.jogo.cn
9.9.9.9 vod.mmm168.com
9.9.9.9 www.521lan.com
9.9.9.9 www.dy87.com
9.9.9.9 www.55p5.com
9.9.9.9 liao.kkddd.com
9.9.9.9 www.ddkkk.com
9.9.9.9 www.setu8.com
9.9.9.9 www.mfvo.com
9.9.9.9 vod.soucn.net
9.9.9.9 vod.88997.com
9.9.9.9 www.777dy.com
9.9.9.9 pi.51.net
9.9.9.9 liao8.ip33.cn
9.9.9.9 2liao8.ip33.cn
9.9.9.9 www.kku98.com
9.9.9.9 wwv.86565.com
9.9.9.9 wwv.vbdy.com
9.9.9.9 00565.com
9.9.9.9 www.88588cc.com
9.9.9.9 www.bb90dy.com
9.9.9.9 www.0011222.com
9.9.9.9 www.5k8dy.com
9.9.9.9 www.0730dy.com
9.9.9.9 www.5111dy.com
9.9.9.9 www.999ko.com
9.9.9.9 www.gongzhusms.com
9.9.9.9 www.cc911.com
9.9.9.9 www.rongtv.com
9.9.9.9 www.8000ys.com
9.9.9.9 www.9myy.com
9.9.9.9 www.920dy.net
9.9.9.9 www.gying.com
9.9.9.9 www.irdex.com
9.9.9.9 count.zhaodl.com

昨天实在太困了，日志今天才发上来，不好意思啊前辈！！！！！谁能帮我看看啊～～～～～～～

安全模式下
打开sreng启动项 注册表 删除
<{A15AA297-2978-7829-915A-89891A29785A}><C:\Program Files\Common Files\SYSTEM\A1582799.dll> [N/A]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><> [N/A]
删除如下文件
C:\Program Files\Common Files\SYSTEM\A1582799.dll

C:\WINDOWS\System_Root.exe
C:\WINDOWS\ddddd.exe
然后用记事本打开C:\WINDOWS\system32\drivers\etc\hosts
只剩一个127.0.0.1 localhost 其他都删除

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{A15AA297-2978-7829-915A-89891A29785A}><C:\Program Files\Common Files\SYSTEM\A1582799.dll> [N/A]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><> [N/A]
==================================
启动文件夹
[589279]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\589279.exe --> [N/A]><N>
[589279]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\589279.exe --> [N/A]><N>


安全模式下修复上面的项~
并删除其相关文件,如找不到,可搜索下~或显示所有文件后再找~
打开 我的电脑》工具》文件夹选项》查看》显示所有文件，不隐藏受保护的操作系统文件》确定


对于下面这两个服务~楼主可以如下操作试试~(安全模式下~)
Windows Client / ClientWeb]
<C:\WINDOWS\System_Root.exe><N/A>
[Gray_Pigeon_Server1.23 / GrayPigeonServer1.23]
<C:\WINDOWS\ddddd.exe><N/A>

在SREng中>启动项目>服务>win32服务应用程序>隐藏微软>找到[Windows Client / ClientWeb]和[Gray_Pigeon_Server1.23 / GrayPigeonServer1.23]这两个服务>点修改启动类型>,将它的启动类型改为disabled或manual start>修改.>重启系统>进安全模式>删除这两个服务(在这个工具中)>删除和它相关的文件.

6楼前辈我照你的方法
1、启动文件夹  589279.exe怎样修复？我将它删除，刚刚删掉立即又出现了；
2、对于下面这两个服务~楼主可以如下操作试试~(安全模式下~)
  Windows Client / ClientWeb]
  <C:\WINDOWS\System_Root.exe><N/A>
  [Gray_Pigeon_Server1.23 / GrayPigeonServer1.23]
  <C:\WINDOWS\ddddd.exe><N/A>


  点击删除，就会出现“操作被取消”的对话框


不知要彻底删掉要怎么做才行啊？？？？？斑竹帮帮忙吧～～～～～～SOS

点击删除，就会出现“操作被取消”的对话框
点取消

点击删除，就会出现“操作被取消”的对话框
点取消