1   1  /  1  页   跳转

[B]求助!!!!!!![/B]

[B]求助!!!!!!![/B]


请教各位我电脑中病毒了,使用了卡卡查杀掉了,但是后来又出


Files\superutilbar\superutilbar.dll
O4 - HKCU\..\Run: [muuxh16qk7] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\servicer.exe
O4 - HKCU\..\Run: [63hlzx5j1lmq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe /auto
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [winform] C:\WINDOWS\winform.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [uanl] C:\WINDOWS\uanl.exe
O4 - HKLM\..\Run: [wsttrs] C:\WINDOWS\wsttrs.exe
O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - Startup: desktop.ini =
O4 - Global Startup: desktop.ini =
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O15 - Trusted Zone: mybank.icbc.com.cn
O15 - Trusted Zone: http://www.icbc.com.cn
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX) - https://esis.aia.com.cn/sis_cn/cab/ScriptX.cab
O16 - DPF: {3DD98C55-74CC-4B7C-B5F1-45913F368388} - http://wellocx.cuic.org.cn/cuicdown/urn.dll
O16 - DPF: {474C3391-9226-4EB0-A15A-CBB03FED7830} - http://www.591bo.com/bcCab/bc.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1106897910625
O16 - DPF: {7738573A-D66D-4002-8500-3F7A0E12E105} (PGFund Class) - https://www.gnetpg.com/PlugIn/PGFundATL.cab
O16 - DPF: {9ADACAA6-533E-4383-AFA7-F0A66650B6D8} (VqqSpeedDlProxy Class) - http://im.qq.com/vqqsdl1230.cab
O16 - DPF: {A3CD7F74-93C9-4BC4-B892-CCDF1514F714} (Submit Class) - https://pbank.95559.com.cn/personbank/ocx/safe.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2007/OL2006.cab
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O21 - SSODL: scqq - {9061B668-5ECC-4C9C-AB37-33FB7550C57F} - C:\PROGRA~1\ybpp\scqq.dll
O23 - Service: Autodesk Licensing Service (Autodesk Licensing Service) - Autodesk, Inc. - "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"
O23 - Service: Std bess Service (bess) -  - C:\WINDOWS\system32\rundll32.exe c:\progra~1\wwkk\gjxx.dll,service -s
O23 - Service: bkvoebc (bkvoebc) - Microsoft Corporation - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Human Interface Device Access (HidServ) -  - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: RavService (RavService) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\RavService.exe" /service
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe"
O23 - Service: ykuzoy (ykuzoy) -  - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Navoct (Navoct) -  - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Print Manager (MouTALS) -  - C:\WINDOWS\system32\rundll2000.exe c:\windows\system32\wbem\tmvmf.dll,export 1087
gò8@/²%({bbs.ikaka.com<&defdÞAƒû­
最后编辑2007-03-21 17:05:16
分享到:
gototop
 

C:\WINDOWS\winform.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\uanl.exe
C:\WINDOWS\wsttrs.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\servicer.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe
上报分析,最好使用卡卡上网安装助手清理流氓软件,并修复IE及系统文件。gò8@/²%({bbs.ikaka.com<&defdÞAƒû­
gototop
 

去自启动项里面看看,关掉一些不用自动启动的项目.
很多流氓软件都会自动加载开机启动的.gò8@/²%({bbs.ikaka.com<&defdÞAƒû­
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT