瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 『惊叹』800病毒闯进我本本,赶也赶不走,杀也杀不掉!!『求助』

123   2  /  3  页   跳转页

『惊叹』800病毒闯进我本本,赶也赶不走,杀也杀不掉!!『求助』

收藏
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 21:52 | 只看楼主 短消息 资料
字号： 小 中 大 11楼

[C:\WINDOWS\system32\wininet.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.1362 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5016.0]
    [C:\WINDOWS\System32\wsock32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\shsvcs.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\shell32.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\comctl32.dll]  [Microsoft Corporation, 5.82 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\WINSTA.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\dhcpcsvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\DNSAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\iphlpapi.dll]  [Microsoft Corporation, 5.1.2600.2 (xpsp1.020828-1920)]
    [c:\windows\system32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\rsaenh.dll]  [Microsoft Corporation, 5.1.2600.1029 (xpsp1.020426-1800)]
    [C:\WINDOWS\system32\mswsock.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\wshtcpip.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\termsrv.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\ICAAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\AUTHZ.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\mstlsapi.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\ACTIVEDS.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\adsldpc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\NETAPI32.dll]  [Microsoft Corporation, 5.1.2600.1343 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\WLDAP32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\ATL.DLL]  [Microsoft Corporation, 3.00.9435]
    [c:\windows\system32\wzcsvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\rtutils.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\WMI.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [c:\windows\system32\WTSAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\ESENT.dll]  [Microsoft Corporation, 5.1.2468.0 (Lab03_N(jliem).010306-1456)]
    [c:\windows\system32\irmon.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\USERENV.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\REGAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\SETUPAPI.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\rastls.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\CRYPTUI.dll]  [Microsoft Corporation, 5.131.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\WINTRUST.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\IMAGEHLP.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\MPRAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\SAMLIB.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\RASAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\rasman.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\TAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\WINMM.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\SCHANNEL.dll]  [Microsoft Corporation, 5.1.2600.1347 (xpsp2.040109-1800)]
    [C:\WINDOWS\System32\WinSCard.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\wshirda.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\raschap.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msv1_0.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\NTMARTA.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\CLBCATQ.DLL]  [Microsoft Corporation, 2001.12.4414.42]
    [C:\WINDOWS\System32\COMRes.dll]  [Microsoft Corporation, 2001.12.4414.42]
    [c:\windows\system32\schedsvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\NTDSAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\qdshm.dll]  [N/A, ]
    [C:\WINDOWS\System32\wship6.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wshisn.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\MSIDLE.DLL]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [c:\windows\system32\audiosrv.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\wkssvc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\dmserver.dll]  [Microsoft Corp., 2600.0.503.0]
    [c:\windows\system32\netman.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\srvsvc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\pchealth\helpctr\binaries\pchsvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\es.dll]  [Microsoft Corporation, 2001.12.4414.46]
    [c:\windows\system32\trkwks.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\tapisrv.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\PSAPI.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\srsvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\POWRPROF.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\avwlbmn.dll]  [N/A, ]
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 21:52 | 只看楼主 短消息 资料
字号： 小 中 大 12楼

[C:\WINDOWS\System32\winspool.drv]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\seclogon.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\sens.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\wuauserv.dll]  [Microsoft Corporation, 5.4.3630.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\wbem\wmisvc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\wbem\wbemcomn.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\VSSAPI.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\w32time.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\WINDOWS\System32\wuaueng.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
    [C:\WINDOWS\System32\WINHTTP.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Cabinet.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\mspatcha.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\rasmans.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\WINIPSEC.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\netcfgx.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\CLUSAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\6to4svc.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\kaqhdzy.dll]  [N/A, ]
    [C:\WINDOWS\System32\hnetcfg.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\netshell.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\credui.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\SXS.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\rastapi.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Wbem\wbemcore.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Wbem\esscli.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Wbem\FastProx.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wbem\wmiutils.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wbem\repdrvfs.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wbem\wmiprvsd.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\NCObjAPI.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wbem\wbemess.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\winrnr.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\rasadhlp.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\sfc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\unimdm.tsp]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\uniplat.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\browser.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\unimdmat.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\modemui.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\kmddsp.tsp]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\ndptsp.tsp]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\ipconf.tsp]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\h323.tsp]  [Microsoft Corporation, 5.1.2600.1348 (xpsp2.040109-1800)]
    [C:\WINDOWS\System32\hidphone.tsp]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\HID.DLL]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\rasppp.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\ntlsapi.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\ipxwan.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\adptif.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\ipnathlp.dll]  [Microsoft Corporation, 5.1.2600.1364 (xpsp2.040109-1800)]
    [C:\WINDOWS\System32\msctfime.ime]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\RASDLG.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wbem\ncprov.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\DOCUME~1\d\LOCALS~1\Temp\rsv10.tmp]  [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
    [C:\WINDOWS\System32\actxprxy.dll]  [Microsoft Corporation, 6.00.2600.0000 (XPClient.010817-1148)]
[PID: 1088 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.1230 (xpsp2.030527-2026)]
    [c:\windows\system32\dnsrslvr.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.1346 (xpsp2.040109-1800)]
    [c:\windows\system32\DNSAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\iphlpapi.dll]  [Microsoft Corporation, 5.1.2600.2 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\USP10.dll]  [Microsoft Corporation, 1.0409.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\kvdxcma.dll]  [N/A, ]
    [C:\WINDOWS\system32\wininet.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.1362 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5016.0]
    [C:\WINDOWS\system32\OLE32.DLL]  [Microsoft Corporation, 5.1.2600.1243 (xpsp2.030702-2125)]
    [C:\WINDOWS\System32\wsock32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\mswsock.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\wshtcpip.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\DOCUME~1\d\LOCALS~1\Temp\rsv10.tmp]  [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 1100 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.1230 (xpsp2.030527-2026)]
    [C:\WINDOWS\system32\ole32.dll]  [Microsoft Corporation, 5.1.2600.1243 (xpsp2.030702-2125)]
    [C:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.1346 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\USP10.dll]  [Microsoft Corporation, 1.0409.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\kvdxcma.dll]  [N/A, ]
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 21:53 | 只看楼主 短消息 资料
字号： 小 中 大 13楼

[C:\WINDOWS\system32\wininet.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.1362 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5016.0]
    [C:\WINDOWS\System32\wsock32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\lmhsvc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\iphlpapi.dll]  [Microsoft Corporation, 5.1.2600.2 (xpsp1.020828-1920)]
    [c:\windows\system32\webclnt.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\shell32.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\comctl32.dll]  [Microsoft Corporation, 5.82 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [c:\windows\system32\alrsvc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\windows\system32\NETAPI32.dll]  [Microsoft Corporation, 5.1.2600.1343 (xpsp2.040109-1800)]
    [C:\DOCUME~1\d\LOCALS~1\Temp\rsv10.tmp]  [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 1608 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.1230 (xpsp2.030527-2026)]
    [C:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.1346 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\USP10.dll]  [Microsoft Corporation, 1.0409.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\kvdxcma.dll]  [N/A, ]
    [C:\WINDOWS\system32\wininet.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.1362 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5016.0]
    [C:\WINDOWS\system32\OLE32.DLL]  [Microsoft Corporation, 5.1.2600.1243 (xpsp2.030702-2125)]
    [C:\WINDOWS\system32\wsock32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\SPOOLSS.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\DNSAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\rasadhlp.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\localspl.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\WINTRUST.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\IMAGEHLP.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\USERENV.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\winspool.drv]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\netapi32.dll]  [Microsoft Corporation, 5.1.2600.1343 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\cnbjmon.dll]  [Microsoft Corporation, 5.1.2503.0 (Lab06_N.010129-0357)]
    [C:\WINDOWS\system32\mswsock.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\OLFMNT40.DLL]  [Microsoft Corporation, 9.0.98.0105]
    [C:\WINDOWS\system32\pjlmon.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\tcpmon.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\usbmon.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\olfpnt40.dll]  [Microsoft Corporation, 9.0.98.0105]
    [C:\WINDOWS\System32\winrnr.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\WLDAP32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\win32spl.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\NETRAP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\CLBCATQ.DLL]  [Microsoft Corporation, 2001.12.4414.42]
    [C:\WINDOWS\system32\COMRes.dll]  [Microsoft Corporation, 2001.12.4414.42]
    [C:\WINDOWS\system32\inetpp.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\icmp.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\iphlpapi.DLL]  [Microsoft Corporation, 5.1.2600.2 (xpsp1.020828-1920)]
    [C:\DOCUME~1\d\LOCALS~1\Temp\rsv10.tmp]  [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 1780 / d][RsHide]  [N/A, ]
    [C:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\WINDOWS\system32\MSVCRT.dll]  [Microsoft Corporation, 7.0.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.1346 (xpsp2.040109-1800)]
    [C:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.1230 (xpsp2.030527-2026)]
    [C:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\COMCTL32.dll]  [Microsoft Corporation, 5.82 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\Program Files\Rising\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [C:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WINMM.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\USP10.dll]  [Microsoft Corporation, 1.0409.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\MFC42LOC.DLL]  [Microsoft Corporation, 6.00.8665.0]
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 21:58 | 只看楼主 短消息 资料
字号： 小 中 大 14楼

忘了这个了~`  我把报告发上来不就行了么~`  害我忙了半天~` 

呵呵~`

附件附件:

下载次数:142
文件类型:application/octet-stream
文件大小:
上传时间:2007-10-3 21:58:01
描述:
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 21:59 | 只看楼主 短消息 资料
字号： 小 中 大 15楼

等你消息哟
gototop
 
newcenturymoon
头像
社区嘉宾
  • 帖子:15158
  • 注册: 2005-08-03
  • 来自:
论坛8周年活动礼物幸运草
发表于： 2007-10-03 22:15 | 短消息 资料
字号： 小 中 大 16楼

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定

重命名以下文件
c:\windows\system32\raqjbpi.dll
c:\windows\system32\avzxdmn.dll
c:\windows\system32\ratbfpi.dll
c:\windows\system32\kvdxcma.dll
c:\windows\system32\kawdbzy.dll
c:\windows\system32\sidjazy.dll
c:\windows\system32\rsztcpm.dll
c:\windows\system32\kaqhdzy.dll
c:\windows\system32\kafyezy.dll
c:\windows\system32\avwlbmn.dll
c:\windows\system32\kapjbzy.dll
c:\windows\system32\kvmxdma.dll
c:\windows\system32\rsmydpm.dll
c:\windows\system32\winforms.dll
然后重启计算机 进入
安全模式下(开机后不断 按F8键  然后出来一个高级菜单 选择第一项 安全模式 进入系统)

打开sreng （就是你扫日志的软件）
启动项目  注册表 删除如下项目
[{24783410-4F90-34A0-7820-3230ACD05F42}]    <C:\WINDOWS\System32\raqjbpi.dll>
[{4859245F-345D-BC13-AC4F-145D47DA34F4}]    <C:\WINDOWS\System32\avzxdmn.dll>
[{24783410-4F90-34A0-7820-3230ACD05F42}]    <C:\WINDOWS\System32\raqjbpi.dll>
[{4859245F-345D-BC13-AC4F-145D47DA34F4}]    <C:\WINDOWS\System32\avzxdmn.dll>
[{66650011-3344-6688-4899-345FABCD1566}]    <C:\WINDOWS\System32\ratbfpi.dll>
[{3C87A354-ABC3-DEDE-FF33-3213FD7447C3}]    <C:\WINDOWS\System32\kvdxcma.dll>
[{28907901-1416-3389-9981-372178569982}]    <C:\WINDOWS\System32\kawdbzy.dll>
[{18847374-8323-FADC-B443-4732ABCD3781}]    <C:\WINDOWS\System32\sidjazy.dll>
[{334345F1-DACF-3452-CB7D-4620F34A1533}]    <C:\WINDOWS\System32\rsztcpm.dll>
[{47D81718-1314-5200-2597-587901018074}]    <C:\WINDOWS\System32\kaqhdzy.dll>
[{5B681598-AD5F-BC8C-77DC-748FAC8D3FB5}]    <C:\WINDOWS\System32\kafyezy.dll>
[{2960356A-458E-DE24-BD50-268F589A56A2}]    <C:\WINDOWS\System32\avwlbmn.dll>
[{2A321487-4977-D98A-C8D5-6488257545A2}]    <C:\WINDOWS\System32\kapjbzy.dll>
[{4D47B341-43DF-4563-753F-345FFA3157D4}]    <C:\WINDOWS\System32\kvmxdma.dll>
[{4E32FA58-3453-FA2D-BC49-F340348ACCE4}]    <C:\WINDOWS\System32\rsmydpm.dll>
[{AEB6717E-7E19-11d0-97EE-00C04FD91974}]    <winforms.dll>
[NVDispDrv]    <C:\WINDOWS\NVDispDrv.exe>
[mppds]    <C:\WINDOWS\mppds.exe>
[AVPSrv]    <C:\WINDOWS\AVPSrv.exe>
[Kvsc3]    <C:\WINDOWS\Kvsc3.exe>
[DiskMan32]    <C:\WINDOWS\dcqrqa.exe>
[aa]    <%SystemRoot%\SVchont.exe>
[rx]    <%SystemRoot%\winnt.exe>
[zx]    <%SystemRoot%\winadr.exe>
[mm]    <%SystemRoot%\sourro.exe>
[wl]    <%SystemRoot%\intent.exe>
[wm]    <%SystemRoot%\winlogor.exe>
[w]    <%SystemRoot%\WinRaR.exe>
双击AppInit_DLLs把器键值改为空

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
[76D2D128 / 76D2D128] 
[O&O Defrag / O&O Defrag] 
[File Replication Service / Ntfrs] 


系统修复－浏览器加载项－找到如下项目 点击删除项目，在弹出的对话框中点“是”


[MyIEHelper Class]    <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5043.dll>

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定
点击  菜单栏下方的 文件夹按钮（搜索右边的按钮）
在左边的资源管理器中单击C盘（千万不要双击打开）
删除如下文件c:\windows\system32\5f91a0e4.dll
c:\windows\system32\686bab3c.exe
c:\windows\system32\oodag.exe
c:\windows\system32\ntfrs.exe
c:\documents and settings\all users\application data\microsoft\iehelper\iehelper_5043.dll
c:\windows\system32\raqjbpi.dll
c:\windows\system32\avzxdmn.dll
c:\windows\system32\ratbfpi.dll
c:\windows\system32\kvdxcma.dll
c:\windows\system32\kawdbzy.dll
c:\windows\system32\sidjazy.dll
c:\windows\system32\rsztcpm.dll
c:\windows\system32\kaqhdzy.dll
c:\windows\system32\kafyezy.dll
c:\windows\system32\avwlbmn.dll
c:\windows\system32\kapjbzy.dll
c:\windows\system32\kvmxdma.dll
c:\windows\system32\rsmydpm.dll
c:\windows\system32\winforms.dll
c:\windows\nvdispdrv.exe
c:\windows\mppds.exe
c:\windows\avpsrv.exe
c:\windows\kvsc3.exe
c:\windows\dcqrqa.exe
c:\windows\svchont.exe
c:\windows\winnt.exe
c:\windows\winadr.exe
c:\windows\sourro.exe
c:\windows\intent.exe
c:\windows\winlogor.exe
C:\auto.exe
C:\autorun.inf

从左边的资源管理器 进入其他盘 （千万不要双击打开）
auto.exe
autorun.inf
修改你的各种网络游戏密码（包括QQ）

以下文件希望你发送给我newcenturymoon1986@yahoo.com.cn 压缩加密123
C:\auto.exe


附：此类病毒一般通过U盘等移动存储传播，所以如果你电脑最近有插过移动存储，那么大致可以判断病毒是从移动存储传播到你的电脑里的。
对于此类病毒，烦请大家做好如下预防工作，不要再让这类病毒扩散了。（这种东西下载的木马很多，看日志眼都会花的）

1.关闭自动播放
在“开始”菜单的“运行”框中运行“gpedit.msc”命令，在“组策略”找到“计算机配置”和“用户配置”下的“管理模板”功能，打开其中的“系统”菜单中的“关闭自动播放”的设置，在其属性里面选择“已启用”，接着选择“所有驱动器”，最后确定保存即可。

2.锁住某些注册表权限
开始－运行－输入regedit,展开HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2，右键单击这个键，权限，把管理员的权限设置为拒绝。

3.可以使用某些第三方的U盘病毒免疫工具对系统进行免疫
如超级巡警的U盘病毒免疫器：http://update3.dswlab.com/antiautorun.zip

4.克服拿来陌生U盘就双击打开的方法！！！
最安全的打开U盘方式如下
打开我的电脑 点击菜单栏下方的 文件夹按钮（搜索右边的按钮）
从左边的资源管理器 进入U盘（同上面清除病毒时打开磁盘分区的方法)
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 22:21 | 只看楼主 短消息 资料
字号： 小 中 大 17楼

好的~`  我试试看~` 

先谢谢这位斑竹咯~`
gototop
 
郑景瑞
头像
初生襁褓狮
  • 帖子:1
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 22:27 | 短消息 资料
字号： 小 中 大 18楼

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定

重命名以下文件
c:\windows\system32\raqjbpi.dll
c:\windows\system32\avzxdmn.dll
c:\windows\system32\ratbfpi.dll
c:\windows\system32\kvdxcma.dll
c:\windows\system32\kawdbzy.dll
c:\windows\system32\sidjazy.dll
c:\windows\system32\rsztcpm.dll
c:\windows\system32\kaqhdzy.dll
c:\windows\system32\kafyezy.dll
c:\windows\system32\avwlbmn.dll
c:\windows\system32\kapjbzy.dll
c:\windows\system32\kvmxdma.dll
c:\windows\system32\rsmydpm.dll
c:\windows\system32\winforms.dll
然后重启计算机 进入
安全模式下(开机后不断 按F8键 然后出来一个高级菜单 选择第一项 安全模式 进入系统)

打开sreng （就是你扫日志的软件）
启动项目 注册表 删除如下项目
[{24783410-4F90-34A0-7820-3230ACD05F42}] <C:\WINDOWS\System32\raqjbpi.dll>
[{4859245F-345D-BC13-AC4F-145D47DA34F4}] <C:\WINDOWS\System32\avzxdmn.dll>
[{24783410-4F90-34A0-7820-3230ACD05F42}] <C:\WINDOWS\System32\raqjbpi.dll>
[{4859245F-345D-BC13-AC4F-145D47DA34F4}] <C:\WINDOWS\System32\avzxdmn.dll>
[{66650011-3344-6688-4899-345FABCD1566}] <C:\WINDOWS\System32\ratbfpi.dll>
[{3C87A354-ABC3-DEDE-FF33-3213FD7447C3}] <C:\WINDOWS\System32\kvdxcma.dll>
[{28907901-1416-3389-9981-372178569982}] <C:\WINDOWS\System32\kawdbzy.dll>
[{18847374-8323-FADC-B443-4732ABCD3781}] <C:\WINDOWS\System32\sidjazy.dll>
[{334345F1-DACF-3452-CB7D-4620F34A1533}] <C:\WINDOWS\System32\rsztcpm.dll>
[{47D81718-1314-5200-2597-587901018074}] <C:\WINDOWS\System32\kaqhdzy.dll>
[{5B681598-AD5F-BC8C-77DC-748FAC8D3FB5}] <C:\WINDOWS\System32\kafyezy.dll>
[{2960356A-458E-DE24-BD50-268F589A56A2}] <C:\WINDOWS\System32\avwlbmn.dll>
[{2A321487-4977-D98A-C8D5-6488257545A2}] <C:\WINDOWS\System32\kapjbzy.dll>
[{4D47B341-43DF-4563-753F-345FFA3157D4}] <C:\WINDOWS\System32\kvmxdma.dll>
[{4E32FA58-3453-FA2D-BC49-F340348ACCE4}] <C:\WINDOWS\System32\rsmydpm.dll>
[{AEB6717E-7E19-11d0-97EE-00C04FD91974}] <winforms.dll>
[NVDispDrv] <C:\WINDOWS\NVDispDrv.exe>
[mppds] <C:\WINDOWS\mppds.exe>
[AVPSrv] <C:\WINDOWS\AVPSrv.exe>
[Kvsc3] <C:\WINDOWS\Kvsc3.exe>
[DiskMan32] <C:\WINDOWS\dcqrqa.exe>
[aa] <%SystemRoot%\SVchont.exe>
[rx] <%SystemRoot%\winnt.exe>
[zx] <%SystemRoot%\winadr.exe>
[mm] <%SystemRoot%\sourro.exe>
[wl] <%SystemRoot%\intent.exe>
[wm] <%SystemRoot%\winlogor.exe>
[w] <%SystemRoot%\WinRaR.exe>
双击AppInit_DLLs把器键值改为空

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
[76D2D128 / 76D2D128]
[O&O Defrag / O&O Defrag]
[File Replication Service / Ntfrs]


系统修复－浏览器加载项－找到如下项目 点击删除项目，在弹出的对话框中点“是”


[MyIEHelper Class] <C:\Documents and Settings\All Users\Application Data\Microsoft\IEHelper\IEHelper_5043.dll>

双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹" 并清除"隐藏受保护的操作系统文件（推荐）"前面的钩。在提示确定更改时，单击“是” 然后确定
点击 菜单栏下方的 文件夹按钮（搜索右边的按钮）
在左边的资源管理器中单击C盘（千万不要双击打开）
删除如下文件c:\windows\system32\5f91a0e4.dll
c:\windows\system32\686bab3c.exe
c:\windows\system32\oodag.exe
c:\windows\system32\ntfrs.exe
c:\documents and settings\all users\application data\microsoft\iehelper\iehelper_5043.dll
c:\windows\system32\raqjbpi.dll
c:\windows\system32\avzxdmn.dll
c:\windows\system32\ratbfpi.dll
c:\windows\system32\kvdxcma.dll
c:\windows\system32\kawdbzy.dll
c:\windows\system32\sidjazy.dll
c:\windows\system32\rsztcpm.dll
c:\windows\system32\kaqhdzy.dll
c:\windows\system32\kafyezy.dll
c:\windows\system32\avwlbmn.dll
c:\windows\system32\kapjbzy.dll
c:\windows\system32\kvmxdma.dll
c:\windows\system32\rsmydpm.dll
c:\windows\system32\winforms.dll
c:\windows\nvdispdrv.exe
c:\windows\mppds.exe
c:\windows\avpsrv.exe
c:\windows\kvsc3.exe
c:\windows\dcqrqa.exe
c:\windows\svchont.exe
c:\windows\winnt.exe
c:\windows\winadr.exe
c:\windows\sourro.exe
c:\windows\intent.exe
c:\windows\winlogor.exe
C:\auto.exe
C:\autorun.inf

从左边的资源管理器 进入其他盘 （千万不要双击打开）
auto.exe
autorun.inf
修改你的各种网络游戏密码（包括QQ）

以下文件希望你发送给我newcenturymoon1986@yahoo.com.cn 压缩加密123
C:\auto.exe


附：此类病毒一般通过U盘等移动存储传播，所以如果你电脑最近有插过移动存储，那么大致可以判断病毒是从移动存储传播到你的电脑里的。
对于此类病毒，烦请大家做好如下预防工作，不要再让这类病毒扩散了。（这种东西下载的木马很多，看日志眼都会花的）

1.关闭自动播放
在“开始”菜单的“运行”框中运行“gpedit.msc”命令，在“组策略”找到“计算机配置”和“用户配置”下的“管理模板”功能，打开其中的“系统”菜单中的“关闭自动播放”的设置，在其属性里面选择“已启用”，接着选择“所有驱动器”，最后确定保存即可。

2.锁住某些注册表权限
开始－运行－输入regedit,展开HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2，右键单击这个键，权限，把管理员的权限设置为拒绝。

3.可以使用某些第三方的U盘病毒免疫工具对系统进行免疫
如超级巡警的U盘病毒免疫器：http://update3.dswlab.com/antiautorun.zip

4.克服拿来陌生U盘就双击打开的方法！！！
最安全的打开U盘方式如下
打开我的电脑 点击菜单栏下方的 文件夹按钮（搜索右边的按钮）
从左边的资源管理器 进入U盘（同上面清除病毒时打开磁盘分区的方法)

 

gototop
 
吃大餐去
头像
快乐黄口狮
  • 帖子:224
  • 注册: 2007-05-07
  • 来自:
发表于： 2007-10-03 22:47 | 短消息 资料
字号： 小 中 大 19楼

楼主可以参考一下这个网站试试看吧！http://forum.ikaka.com/topic.asp?board=28&artid=8333360
gototop
 
废铁co
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2007-10-03
  • 来自:
发表于： 2007-10-03 23:41 | 只看楼主 短消息 资料
字号： 小 中 大 20楼

呵呵~` 

不要沉下去了~`
gototop
 
<<上一主题|下一主题>>
123   2  /  3  页   跳转页
页面顶部
Powered by Discuz!NT