HijackThis_zww汉化版扫描日志 V1.99.1
保存于      11:22:05, 日期 2007-1-18
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\mhs2.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\iexpiore.exe
C:\WINDOWS\wls3.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe
C:\WINDOWS\system32\expiorer.exe
C:\WINDOWS\system32\lexplore.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Rising\Rav\Rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\pyb\LOCALS~1\Temp\Rar$EX00.391\HijackThis1991zww.exe

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [mhs2] C:\WINDOWS\mhs2.exe
O4 - 启动项HKLM\\Run: [zts2] C:\DOCUME~1\pyb\LOCALS~1\Temp\services.exe
O4 - 启动项HKLM\\Run: [wlzs] C:\DOCUME~1\pyb\LOCALS~1\Temp\conime.exe
O4 - 启动项HKLM\\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [8dks] C:\WINDOWS\iexpiore.exe
O4 - 启动项HKLM\\Run: [wls3] C:\WINDOWS\wls3.exe
O4 - 启动项HKLM\\Run: [mytsf] C:\DOCUME~1\pyb\LOCALS~1\Temp\csrss.exe
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [myRx3] C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe
O4 - HKCU\..\Run: [SyztMy] C:\WINDOWS\system32\expiorer.exe
O4 - HKCU\..\Run: [SywlMy] C:\WINDOWS\system32\lexplore.exe
O4 - HKCU\..\Run: [SyrxMy] C:\WINDOWS\system32\iexp1ore.exe
O4 - HKCU\..\Run: [Vagaa] "D:\应用软件\最新版本V2.6.4.3\CX\Vagaa\vagaa.exe" -tray
O8 - IE右键菜单中的新增项目: &V使用Vagaa哇嘎下载 - D:\应用软件\最新版本V2.6.4.3\CX\Vagaa\Data\vg.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\应用软件\迅雷5\迅雷5程序\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\应用软件\迅雷5\迅雷5程序\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - E:\QQ下载\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - E:\QQ下载\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\QQ下载\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - E:\QQ下载\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ下载\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\QQ下载\QQ\QQ.EXE
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [TBH] 中文搜搜
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

到哪里发贴的呀?

磁盘文件：
C:\WINDOWS\mhs2.exe  //如果确定不是你安装的，就删除。
C:\WINDOWS\iexpiore.exe  //如果确定不是你安装的，就删除。
C:\WINDOWS\wls3.exe      //如果确定不是你安装的，就删除。
C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe //如果确定不是你安装的，就删除。
注表项：
O4 - 启动项HKLM\\Run: [mhs2] C:\WINDOWS\mhs2.exe  //如果确定不是你安装的，就删除。
O4 - 启动项HKLM\\Run: [8dks] C:\WINDOWS\iexpiore.exe  //如果确定不是你安装的，就删除。
O4 - 启动项HKLM\\Run: [wls3] C:\WINDOWS\wls3.exe  //如果确定不是你安装的，就删除。
O4 - HKCU\..\Run: [SyrxMy] C:\WINDOWS\system32\iexp1ore.exe //如果确定不是你安装的，就删除。
O4 - HKCU\..\Run: [myRx3] C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe //如果确定不是你安装的，就删除。

下面这几个注册表项，和系统的进程重名，如果你确定不是你安装的就册除。
O4 - 启动项HKLM\\Run: [mytsf] C:\DOCUME~1\pyb\LOCALS~1\Temp\csrss.exe
O4 - 启动项HKLM\\Run: [zts2] C:\DOCUME~1\pyb\LOCALS~1\Temp\services.exe
O4 - 启动项HKLM\\Run: [wlzs] C:\DOCUME~1\pyb\LOCALS~1\Temp\conime.exe

上面的都是可疑文件，请自行查杀，删除

追加:处理方法同上.
C:\WINDOWS\system32\expiorer.exe
C:\WINDOWS\system32\lexplore.exe
O4 - HKCU\..\Run: [SyztMy] C:\WINDOWS\system32\expiorer.exe
O4 - HKCU\..\Run: [SywlMy] C:\WINDOWS\system32\lexplore.exe
O4 - HKCU\..\Run: [SyrxMy] C:\WINDOWS\system32\iexp1ore.exe

建议:备份重要数据,重装系统.(没有办法中的办法)

从进程看：
C:\WINDOWS\mhs2.exe
C:\WINDOWS\iexpiore.exe
C:\WINDOWS\wls3.exe
C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe
C:\WINDOWS\system32\expiorer.exe
C:\WINDOWS\system32\lexplore.exe
是病毒，但是启动项并不全面，不知道是不是有其他地方启动

最好用SRE进行扫描

当然上面的处理方法可以不用那么写了，肯定是病毒
别忘了清空C:\DOCUME~1\pyb\LOCALS~1\Temp\文件夹里面的所有文件及文件夹，还有他说的方法不一定管用，因为病毒没有结束，你修复的时候，病毒会重新添加，需要在安全模式下进行修复，这一点非常重要。
而且上面只支出了文件  并没有给出具体删除方法。所以用SRE扫描，可以给你具体的杀毒方法，手工删除

这是用SRE 扫的
启动项目


注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Corporation]
(myRx3)(C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe) [N/A]
(SyztMy)(C:\WINDOWS\system32\expiorer.exe) [N/A]
(SywlMy)(C:\WINDOWS\system32\lexplore.exe) [N/A]
(SyrxMy)(C:\WINDOWS\system32\iexp1ore.exe) [N/A]
(Vagaa)("D:\应用软件\最新版本V2.6.4.3\CX\Vagaa\vagaa.exe" -tray) [Vagaa Development Team]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(load)(; ?粓| ?) [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(IMJPMIG8.1)("C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Corporation]
(PHIME2002ASync)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Corporation]
(PHIME2002A)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Corporation]
(mhs2)(C:\WINDOWS\mhs2.exe) [N/A]
(zts2)(C:\DOCUME~1\pyb\LOCALS~1\Temp\services.exe) [N/A]
(wlzs)(C:\DOCUME~1\pyb\LOCALS~1\Temp\conime.exe) [N/A]
(stup.exe)(C:\PROGRA~1\TENCENT\Adplus\stup.exe) [Tencent]
(SoundMan)(SOUNDMAN.EXE) [(Verified)Avance Logic, Inc.]
(8dks)(C:\WINDOWS\iexpiore.exe) [N/A]
(wls3)(C:\WINDOWS\wls3.exe) [N/A]
(mytsf)(C:\DOCUME~1\pyb\LOCALS~1\Temp\csrss.exe) [N/A]
(RavTask)("C:\Program Files\Rising\Rav\RavTask.exe" -system) [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
(NiceMSoft)(C:\WINDOWS\system32\retemp.exe) [N/A]
(Nice)(C:\Program Files\Common Files\Microsoft Shared\MSINFO\LSASS.EXE) [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [(Verified)Microsoft Corporation]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(logonui.exe) [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
({32CD708B-60A7-4C00-9377-D73EAA495F0F})(C:\WINDOWS\system32\RavExt.dll) [Beijing Rising Technology Co., Ltd.]




--------------------------------------------------------------------------------



启动文件夹

N/A



--------------------------------------------------------------------------------



服务

[Human Interface Device Access / HidServ][Stopped/Disabled]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
("C:\Program Files\Rising\Rav\CCenter.exe")(Beijing Rising Technology Co., Ltd.)
[RsRavMon Service / RsRavMon][Running/Auto Start]
("C:\Program Files\Rising\Rav\Ravmond.exe")(Beijing Rising Technology Co., Ltd.)
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
(C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start)(Microsoft Corporation)



--------------------------------------------------------------------------------



驱动程序

[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
(system32\drivers\ALCXWDM.SYS)(Avance Logic, Inc.)
[BaseTDI / BaseTDI][Running/Auto Start]
(\??\C:\WINDOWS\system32\drivers\basetdi.sys)(Beijing Rising Technology Co., Ltd.)
[ExpScaner / ExpScaner][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\ExpScan.sys)()
[HookCont / HookCont][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HOOKCONT.sys)(Rising tech Co. ltd)
[HookReg / HookReg][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HookReg.sys)()
[HookSys / HookSys][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HookSys.sys)(Rising)
[MEMSCAN / MEMSCAN][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\MEMSCAN.sys)(瑞星软件有限公司)
[nv / nv][Running/Manual Start]
(system32\DRIVERS\nv4_mini.sys)(NVIDIA Corporation)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(system32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[RsAntiSpyware / RsAntiSpyware][Stopped/Disabled]
(\SystemRoot\system32\drivers\RsBoot.sys)(Beijing Rising)
[RSPPSYS / RSPPSYS][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\RSPPSYS.sys)(Rising)
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
(system32\DRIVERS\RTL8139.SYS)(Realtek Semiconductor Corporation)
[Secdrv / Secdrv][Stopped/Manual Start]
(system32\DRIVERS\secdrv.sys)(N/A)
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
(system32\DRIVERS\tcpip.sys)(Microsoft Corporation)



--------------------------------------------------------------------------------



浏览器加载项

[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} (C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD)
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} (C:\Program Files\TENCENT\Adplus\SSAddr1.dll, Tencent)
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} (c:\program files\google\googletoolbar2.dll, Google Inc.)
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} (E:\QQ下载\QQ\QQ.EXE, TENCENT)
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} (C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation)
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} (c:\program files\google\googletoolbar2.dll, Google Inc.)
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} (C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD)
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} (c:\program files\google\googletoolbar2.dll, Google Inc.)
[Tencent Browser Helper]
{0C7C23EF-A848-485B-873C-0ED954731014} (C:\Program Files\TENCENT\Adplus\SSAddr1.dll, Tencent)
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} (C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation)
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} (c:\program files\google\googletoolbar2.dll, Google Inc.)
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} (%SystemRoot%\system32\mshtml.dll, N/A)
[HtmlDlgSafeHelper Class]
{3050F819-98B5-11CF-BB82-00AA00BDCE0B} (C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation)
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} (C:\WINDOWS\system32\wmp.dll, Microsoft Corporation)
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} (c:\program files\google\googletoolbar2.dll, Google Inc.)
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} (%SystemRoot%\system32\shdocvw.dll, N/A)
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} (C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx, Macromedia, Inc.)
[&V使用Vagaa哇嘎下载]
(D:\应用软件\最新版本V2.6.4.3\CX\Vagaa\Data\vg.htm, N/A)
[&使用迅雷下载]
(D:\应用软件\迅雷5\迅雷5程序\geturl.htm, N/A)
[&使用迅雷下载全部链接]
(D:\应用软件\迅雷5\迅雷5程序\getallurl.htm, N/A)
[上传到QQ网络硬盘]
(E:\QQ下载\QQ\AddToNetDisk.htm, N/A)
[添加到QQ自定义面板]
(E:\QQ下载\QQ\AddPanel.htm, N/A)
[添加到QQ表情]
(E:\QQ下载\QQ\AddEmotion.htm, N/A)
[用QQ彩信发送该图片]
(E:\QQ下载\QQ\SendMMS.htm, N/A)

正在运行的进程

[PID: 428][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 484][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 552][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 564][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 716][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824][C:\Program Files\Rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 844][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 888][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 956][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1032][C:\Program Files\Rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 47]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RsPPsys.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 12]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\Rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\Rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\Rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 35]
[C:\Program Files\Rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 18]
[C:\Program Files\Rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\Rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 30]
[C:\Program Files\Rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]
[C:\Program Files\Rising\Rav\ExtFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 24]
[C:\Program Files\Rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\Rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\Rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[PID: 1260][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\Program Files\TENCENT\Adplus\SSAddr1.dll] [Tencent, 4, 4, 1, 14]
[PID: 1372][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1624][C:\WINDOWS\mhs2.exe] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[PID: 1648][C:\WINDOWS\SOUNDMAN.EXE] [Avance Logic, Inc., 5, 0, 0, 0]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[PID: 1656][C:\WINDOWS\iexpiore.exe] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[PID: 1668][C:\WINDOWS\wls3.exe] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[PID: 1692][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[PID: 1708][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 39]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[PID: 1060][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[PID: 1128][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1232][C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[PID: 1420][C:\WINDOWS\system32\expiorer.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[PID: 1516][C:\WINDOWS\system32\lexplore.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[PID: 2736][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[PID: 2776][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]

[PID: 3616][C:\Program Files\Rising\Rav\Rav.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 75]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 17]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\RavUI.Dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 65]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 26]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 33]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\Rising\Rav\RavUIMsg.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 27]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 2148][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\Program Files\TENCENT\Adplus\SSAddr1.dll] [Tencent, 4, 4, 1, 14]
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1020, 3054]
[C:\WINDOWS\system32\xunleibho_v14.dll] [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx] [Macromedia, Inc., 6,0,88,0]
[PID: 2920][D:\应用软件\迅雷5\迅雷5程序\Thunder.exe] [Thunder Networking Technologies,LTD, 5.1.4.174]
[D:\应用软件\迅雷5\迅雷5程序\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\应用软件\迅雷5\迅雷5程序\download_interface.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 66]
[D:\应用软件\迅雷5\迅雷5程序\log4cplus.dll] [, 1, 0, 2, 1]
[D:\应用软件\迅雷5\迅雷5程序\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[D:\应用软件\迅雷5\迅雷5程序\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
[D:\应用软件\迅雷5\迅雷5程序\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[D:\应用软件\迅雷5\迅雷5程序\iEmbed.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 22]
[D:\应用软件\迅雷5\迅雷5程序\RegisterDll.dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 7]
[D:\应用软件\迅雷5\迅雷5程序\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\应用软件\迅雷5\迅雷5程序\iTargetAd.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 59]
[C:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx] [Macromedia, Inc., 6,0,88,0]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[PID: 2672][C:\Documents and Settings\pyb\桌面\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\TENCENT\Adplus\Adplus1.dll] [Tencent, 4, 4, 1, 14]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll] [N/A, N/A]
[C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll] [N/A, N/A]



--------------------------------------------------------------------------------



文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



--------------------------------------------------------------------------------



Winsock 提供者

N/A



--------------------------------------------------------------------------------



Autorun.inf

N/A



--------------------------------------------------------------------------------



HOSTS 文件

127.0.0.1 localhost



--------------------------------------------------------------------------------



API HOOK

N/A

注册表项：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(myRx3)(C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe)
(SyztMy)(C:\WINDOWS\system32\expiorer.exe)
(SywlMy)(C:\WINDOWS\system32\lexplore.exe)
(SyrxMy)(C:\WINDOWS\system32\iexp1ore.exe)
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(mhs2)(C:\WINDOWS\mhs2.exe)
(zts2)(C:\DOCUME~1\pyb\LOCALS~1\Temp\services.exe)
(wlzs)(C:\DOCUME~1\pyb\LOCALS~1\Temp\conime.exe)
(8dks)(C:\WINDOWS\iexpiore.exe)
(wls3)(C:\WINDOWS\wls3.exe)
(mytsf)(C:\DOCUME~1\pyb\LOCALS~1\Temp\csrss.exe)

DLL钩子：
C:\DOCUME~1\pyb\LOCALS~1\Temp\wls0.dll
C:\DOCUME~1\pyb\LOCALS~1\Temp\mhs0.dll
C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyl.dll  //可疑
C:\DOCUME~1\pyb\LOCALS~1\Temp\LgSyz.dll  //可疑
C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxgx.dll    //可疑
EXE文件:
C:\WINDOWS\wls3.exe
C:\WINDOWS\mhs2.exe
C:\WINDOWS\iexpiore.exe
C:\WINDOWS\system32\expiorer.exe
C:\WINDOWS\system32\lexplore.exe

处里方法：(最好进入到安全模式）
1:打开：任务管理器(Ctrl+Alt+Del)或在任务栏上单击鼠标右键->任务管理器。

2:杀死一切可以杀掉的进程。

3:删除上面所EXE文件和DLL文件。清除注册表。

还有不足的地方，还有各位帮忙指正。

先下载冰刃IceSwordv1.20
下载地址: http://www.crsky.com/soft/6947.html
打开SRE和冰刃这两个工具,一定要先打开.因为禁止进程线创建,全部程序都会打不开
冰刃打开点文件设置禁止进程线创建,终止以下病毒进程
[PID: 1624][C:\WINDOWS\mhs2.exe] [N/A, N/A]
[PID: 1656][C:\WINDOWS\iexpiore.exe] [N/A, N/A]
[PID: 1668][C:\WINDOWS\wls3.exe] [N/A, N/A]
[PID: 1232][C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe] [N/A, N/A]
[PID: 1420][C:\WINDOWS\system32\expiorer.exe] [N/A, N/A]
[PID: 1516][C:\WINDOWS\system32\lexplore.exe] [N/A, N/A]

再删除启动项
(myRx3)(C:\DOCUME~1\pyb\LOCALS~1\Temp\Rxa3\iexp1ore.exe) [N/A]
(SyztMy)(C:\WINDOWS\system32\expiorer.exe) [N/A]
(SywlMy)(C:\WINDOWS\system32\lexplore.exe) [N/A]
(SyrxMy)(C:\WINDOWS\system32\iexp1ore.exe) [N/A]
(load)(; ?粓| ?) [N/A]
(mhs2)(C:\WINDOWS\mhs2.exe) [N/A]
(zts2)(C:\DOCUME~1\pyb\LOCALS~1\Temp\services.exe) [N/A]
(wlzs)(C:\DOCUME~1\pyb\LOCALS~1\Temp\conime.exe) [N/A]
(stup.exe)(C:\PROGRA~1\TENCENT\Adplus\stup.exe) [Tencent]
(8dks)(C:\WINDOWS\iexpiore.exe) [N/A]
(wls3)(C:\WINDOWS\wls3.exe) [N/A]
(mytsf)(C:\DOCUME~1\pyb\LOCALS~1\Temp\csrss.exe) [N/A]
(NiceMSoft)(C:\WINDOWS\system32\retemp.exe) [N/A]
(Nice)(C:\Program Files\Common Files\Microsoft Shared\MSINFO\LSASS.EXE) [N/A]

删除服务项和驱动服务项
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
(C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start)(Microsoft Corporation)

删除浏览器加载项
[Tencent Browser Helper]彩信通流氓
{0C7C23EF-A848-485B-873C-0ED954731014} (C:\Program Files\TENCENT\Adplus\SSAddr1.dll, Tencent)

删除以下文件(文件无法删除可用冰刃工具强制删除)
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
C:\Program Files\TENCENT\Adplus控制面板卸载彩信通,
C:\WINDOWS\mhs2.exe] [N/A, N/A]
C:\WINDOWS\iexpiore.exe] [N/A, N/A]
][C:\WINDOWS\wls3.exe] [N/A, N/A]
C:\WINDOWS\system32\expiorer.exe]
]C:\WINDOWS\system32\retemp.exe
C:\Program Files\Common Files\Microsoft Shared\MSINFO\LSASS.EXE
C:\WINDOWS\system32\iexp1ore.exe
C:\WINDOWS\system32\lexplore.exe

做完以上操作点冰刃菜单文件设置取消禁止进程线
重启并监视 . 重启之后看看病毒还有没有
删除后再扫个日志上来