前几天我的电脑中了病毒和木马,我杀完后,现在每次开机都会有错误警报 c:windows\system32\vcxy_b.dll.我用系统帮助里的方法试过了还是不行.请各位指教!

http://forum.ikaka.com/topic.asp?board=3&artid=8262187

启动项里找不到文件.你说的这个方法系统帮助里有的.我试过了，以诊断式模式启动,关闭所有启动项后,还是有这个错误提示.公司另外一台电脑我上次解决了这个问题,这台电脑不行了.

引用:

【wxp154的贴子】前几天我的电脑中了病毒和木马,我杀完后,现在每次开机都会有错误警报 c:windows\system32\vcxy_b.dll.我用系统帮助里的方法试过了还是不行.请各位指教! ………………

在“开始”→“运行”→输入“REGEDIT”回车，打开注册表编辑器再按F3键，在搜索项里输入弹出的对话框的“c:windows\system32\vcxy_b.dll”的绝对路径及文件名或它相对应的程序名及它相关的项目再删除即可，当搜索至删除完毕即可，再在“开始菜单”→“运行”→输入“msconfig”回车→进入“系统配置实用程序”→击“启动”卡找到它有关的项目去它掉的钩选项即可。（在修改注册表之前要先关闭瑞星所有监控完成之后再打开它）

在注册表里找过了，查不到相关文件.系统配置实用程序启动项里也没有.

我遇到过同样的问题
也实在是不知道怎么解决
一狠心直接用GHOST还原了
呵可
还望高手赐教
帮顶上去

晕.....楼主发日志吧！

搜索一下注册表。

我发上日志,请高手指点.
[CODE]

2007-02-03,08:35:28

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [(Verified)Yahoo! China]
    <TkBellExe><; rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RfwMain><"d:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <MSPY2002><; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <MplSetUp><; rem C:\Program Files\RMClient\MplSetUp.exe>  [N/A]
    <JobHisInit><; rem C:\Program Files\RMClient\JobHisInit.exe>  [N/A]
    <IMSCMig><; rem C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <Easy-PrintToolBox><; rem C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{E568441B-9EF3-49F8-9A67-4141AC41ADD4}><>  [N/A]
    <{4BAB150F-DD97-476D-9C1E-41B6CDC0CA7A}><C:\PROGRA~1\Yahoo!\Assistant\yClickOn.dll>  [(Verified)YAHOO Corporation Limited]
    <{3A00B453-B453-A002-53A0-45300453A002}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\B453A002.dll>  [N/A]
    <{2D49692C-A5FD-4E29-A3CD-37E9B182FCC6}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys>  [N/A]
    <{1A404685-7563-4d02-B0F6-58B308A406A9}><c:\program files\internet explorer\temuehzw.dll>  [N/A]
    <{33552B2C-2DD3-47E8-9C0A-9600FE39FD3C}><C:\WINDOWS\system32\gpkiller.dll>  [YAHOO]

启动文件夹
N/A

==================================
服务
[2B514324 / 2B514324][Stopped/Disabled]
  <C:\WINDOWS\system32\2B514324.EXE -service><N/A>
[49CD654E / 49CD654E][Stopped/Disabled]
  <C:\WINDOWS\system32\49CD654E.EXE -service><N/A>
[6055E576 / 6055E576][Stopped/Disabled]
  <C:\WINDOWS\system32\6055E576.EXE -service><N/A>
[Adobe LM Service / Adobe LM Service][Running/Auto Start]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Stopped/Manual Start]
  <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[C-DillaSrv / C-DillaSrv][Stopped/Manual Start]
  <C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE><C-Dilla Ltd>
[Dds Scheduler Deamon / DdsSched][Stopped/Manual Start]
  <d:\Program Files\RDS\ddsschednt.exe><RICOH Company Ltd.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Imsvc / Imsvc][Stopped/Manual Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Webmail.dll><>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <d:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Ridoc Server Information Service / RsiSvc][Stopped/Manual Start]
  <d:\Program Files\RDS\RsiSvc.exe><RICOH Company Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[ScanRouterDriverV2 / ScanRouterDriverV2][Stopped/Manual Start]
  <d:\Program Files\RDS\srscandr.exe><Ricoh Co.,Ltd.>
[SOption / SOption][Stopped/Manual Start]
  <d:\Program Files\RDS\SOption.exe><RICOH Company Ltd.>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,input><Microsoft Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[ADProt / ADProt][Stopped/System Start]
  <\SystemRoot\system32\drivers\ADProt.sys><N/A>
[ATSpy / ATSpy][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\ATSpy.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[C-Dilla / C-Dilla][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\CDANT.SYS><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\cdcd.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[usb Card Device 1000 / ft1kEnum][Running/Manual Start]
  <system32\DRIVERS\ic1kenum.sys><OEM Corporation>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HookApi.Sys><瑞星软件有限公司>
[HookCont / HookCont][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[HOSTNT / HOSTNT][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\hostnt.sys><N/A>
[Senselock USB Lock 1.5S Driver / Lock15S][Running/Auto Start]
  <System32\Drivers\Lock15S.sys><Beijing Senselock Inc>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[MHDRV / MHDRV][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\mhdrv.sys><Rainbow China Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\d:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[nndymxr / nndymxr][Running/Boot Start]
  <\SystemRoot\system32\drivers\nndymxr.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RCMHDOG / RCMHDOG][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\rcmhdog.sys><Rainbow China Co., Ltd.>
[USB SmartCard Reader Device 1000  / Reader_1000][Running/Manual Start]
  <system32\DRIVERS\usbic1k.sys><OEM>
[rkvgysow / rkvgysow][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\rkvgysow.sys><Yahoo! China Corporation>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\d:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Others/Auto Start]
  <\??\D:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Sense3 / Sense3][Running/Auto Start]
  <System32\Drivers\sense3.sys><Beijing Senselock>
[usb driver for epass1k / token1k][Running/Manual Start]
  <system32\DRIVERS\eps1k.sys><OEM>
[yaskp / yaskp][Running/Boot Start]
  <\SystemRoot\system32\drivers\yaskp.sys><Copyright (C) yahoo Corporation.>
[ztksuub / ztksuub][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\ztksuub.sys><>