[PID: 1248 / guoge][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\documents and settings\guoge.my-tomato\application data\ppstream\bin\1.0.0.2\vodrc.dll]  [ppstream.com, 1.0.0.2]
    [F:\xunlei\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
    [F:\xunlei\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
    [F:\xunlei\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 11]
    [F:\xunlei\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx]  [Adobe Systems, Inc., 9,0,47,0]
    [C:\WINDOWS\system32\tdxykg.dll]  [N/A, ]
    [C:\WINDOWS\system32\vnxpto.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhgfop.dll]  [N/A, ]
    [C:\WINDOWS\system32\outuco.dll]  [N/A, ]
    [C:\WINDOWS\system32\iwzpoh.dll]  [N/A, ]
    [C:\WINDOWS\system32\tkkgjv.dll]  [N/A, ]
    [C:\WINDOWS\system32\DbgHlp32.dll]  [N/A, ]
    [C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
    [C:\WINDOWS\system32\lhlriu.dll]  [N/A, ]
[PID: 3056 / guoge][D:\Program Files\Rising\Rav\Rav.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
    [D:\Program Files\Rising\Rav\PlugIn\RsPgScan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 17]
    [D:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [D:\Program Files\Rising\Rav\RavUI.Dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
    [D:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [D:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [D:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\system32\lhlriu.dll]  [N/A, ]
    [C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
    [C:\WINDOWS\system32\DbgHlp32.dll]  [N/A, ]
    [C:\WINDOWS\system32\tkkgjv.dll]  [N/A, ]
    [C:\WINDOWS\system32\iwzpoh.dll]  [N/A, ]
    [C:\WINDOWS\system32\outuco.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhgfop.dll]  [N/A, ]
    [C:\WINDOWS\system32\vnxpto.dll]  [N/A, ]
    [C:\WINDOWS\system32\tdxykg.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [D:\Program Files\Rising\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
    [D:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [c:\documents and settings\guoge.my-tomato\application data\ppstream\bin\1.0.0.2\vodrc.dll]  [ppstream.com, 1.0.0.2]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
[PID: 3284 / guoge][F:\SRENG\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [C:\WINDOWS\system32\lhlriu.dll]  [N/A, ]
    [C:\WINDOWS\system32\tkkgjv.dll]  [N/A, ]
    [C:\WINDOWS\system32\iwzpoh.dll]  [N/A, ]
    [C:\WINDOWS\system32\outuco.dll]  [N/A, ]
    [C:\WINDOWS\system32\dhgfop.dll]  [N/A, ]
    [C:\WINDOWS\system32\vnxpto.dll]  [N/A, ]
    [C:\WINDOWS\system32\tdxykg.dll]  [N/A, ]
    [F:\SRENG\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [D:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1404, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1540, D:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1584, D:\PROGRAM FILES\RISING\RAV\RAVMON.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2936, D:\PROGRAM FILES\RISING\RAV\RSAGENT.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 3512, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3512, C:\PROGRAM FILES\RISING\ANTISPYWARE\RAS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3056, D:\PROGRAM FILES\RISING\RAV\RAV.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

高手们 帮帮忙啊...
我都重装万多次系统了...
- -

顶到有人解决为止...
- -

LZ看看阳光斑竹发的帖子就可以解决
http://forum.ikaka.com/topic.asp?board=28&artid=8362073
如果看不懂~速度跟贴，我再说一遍咯

看不懂啊
那个是AGENT
我这个是 ONLINE GAME啊...
麻烦大大指点一下

欢迎喜欢反病毒的各位高手朋友们加盟，共同学习、共同提高、再创辉煌。 群号:25306509 反病毒救援中心
望各位多多支持!!!!!!!!

LZ会使用SRENG么？

会啊
我都下了
我也按照那方法试了一次
还是没法...
你加我QQ说嘛
230968527

不加你QQ了，这个会盗QQ的，我测试这个病毒的时候没关QQ，就把QQ丢掉了

先下载arswp(Windows清理助手)（备用）
http://www.arswp.com/download/arswp/arswp.rar

我尽量把处理方法说的简单点吧：
用SRENG启动项目——注册表  ——找出：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<DiskMan32><C:\WINDOWS\DiskMan32.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
删除~！

启动项目——服务——WIN32应用程序服务——隐藏已认证的微软服务——找出
[FB000E3A / FB000E3A][Stopped/Auto Start]
<C:\WINDOWS\system32\F77B20D5.EXE -k><Microsoft Corporation>
删除服务——设置——否

重起进入安全模式（开机按F8）
使用WINDOWS清理助手，清理下

再打开SRENG删除注册表中：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS\system32\rsmyapm.dll> [N/A]
<{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}><C:\WINDOWS\system32\kvdxbma.dll> [N/A]
<{28907901-1416-3389-9981-372178569982}><C:\WINDOWS\system32\kawdbzy.dll> [N/A]
<{1859245F-345D-BC13-AC4F-145D47DA34F1}><C:\WINDOWS\system32\avzxamn.dll> [N/A]
<{14783410-4F90-34A0-7820-3230ACD05F41}><C:\WINDOWS\system32\raqjapi.dll> [N/A]
<{2A1247C1-53DA-FF43-ABD3-345F323A48D2}><C:\WINDOWS\system32\avwgbmn.dll> [N/A]
<{1A321487-4977-D98A-C8D5-6488257545A1}><C:\WINDOWS\system32\kapjazy.dll> [N/A]
<{37D81718-1314-5200-2597-587901018073}><C:\WINDOWS\system32\kaqhczy.dll> [N/A]
<{1960356A-458E-DE24-BD50-268F589A56A1}><C:\WINDOWS\system32\avwlamn.dll> [N/A]
<{6B3FCDC8-E5C7-477a-817E-72865A7758AE}><C:\WINDOWS\Winhelp.dll> [N/A]

嘎嘎
谢谢大大
已经OK啦...