Trojan.PSW.Win32.GameOL病毒,瑞星能查出来但是不能完全清除,全盘查杀能查杀出好多病毒,但是重起后这些又出现.
在进程中出现一个a.exe的进程,而且现在开机后瑞星监控会自动退出了.

附件: SREngLOG.log (2008-7-22 2:33:25, 196.44 K)
该附件被下载次数 98

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

操作方法见我签名
手工杀毒的操作方法，删除病毒文件建议用暴力删除工具删除文件并抑制再生
删除启动项
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]下
<svc><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a.exe>  []及
文件C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a.exe
修改注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe,gpr7B.exe,prB.exe,gprB.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
改为<shell><Explorer.exe,>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
修改注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><wcomipe.dll mssetd.dll raesony.dll,kmon.dll>  [N/A]
为 <AppInit_DLLs><kmon.dll,>
删除启动项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]下以下注册表项目及<>内
文件
    <{00150015-0015-0015-0015-00150015BB15}><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <{00300030-0030-0030-0030-00300030BB15}><C:\WINDOWS\system32\imgutilhx2.dll>  [File is missing]
    <{00070007-0007-0007-0007-00070007BB15}><C:\WINDOWS\system32\dpvvoxmh.dll>  []
    <{00170017-0017-0017-0017-00170017BB15}><C:\WINDOWS\system32\msobjstl.dll>  []
    <{00180018-0018-0018-0018-00180018BB15}><C:\WINDOWS\system32\mstimewd.dll>  []
    <{00010001-0001-0001-0001-00010001BB15}><C:\WINDOWS\system32\adsntzt.dll>  []
    <{8FD45A54-9875-698F-E56E-65102358FDF8}><C:\WINDOWS\system32\apsghjba.dll>  []
    <{00270027-0027-0027-0027-00270027BB15}><C:\WINDOWS\system32\wmpuiqhx.dll>  []
    <{00240024-0024-0024-0024-00240024BB15}><C:\WINDOWS\system32\scrruncqsj.dll>  []
    <{00230023-0023-0023-0023-00230023BB15}><C:\WINDOWS\system32\rasdlgcq.dll>  []
    <{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}><C:\WINDOWS\system32\dndsaf.dll>  []
    <{00040004-0004-0004-0004-00040004BB15}><C:\WINDOWS\system32\catsrvwl.dll>  []
    <{00120012-0012-0012-0012-00120012BB15}><C:\WINDOWS\system32\kbdswjr.dll>  []
    <{00030003-0003-0003-0003-00030003BB15}><C:\WINDOWS\system32\bootvidgj.dll>  []
    <{00330033-0033-0033-0033-00330033BB15}><C:\WINDOWS\system32\tscfgwmijxsj.dll>  []
    <{00130013-0013-0013-0013-00130013BB15}><C:\WINDOWS\system32\ksuserfy.dll>  []
    <{00250025-0025-0025-0025-00250025BB15}><C:\WINDOWS\system32\slbiopfs2.dll>  []
    <{00310031-0031-0031-0031-00310031BB15}><C:\WINDOWS\system32\sooirewlqx.dll>  []
    <{00050005-0005-0005-0005-00050005BB15}><C:\WINDOWS\system32\cliconfgzx.dll>  []
    <{00060006-0006-0006-0006-00060006BB15}><C:\WINDOWS\system32\dispexcb.dll>  []
删除启动项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]下以下注册表项目及<>内DLL文件
    <catsrvwl.dll><C:\WINDOWS\system32\catsrvwl.dll>  []
    <kbdswjr.dll><C:\WINDOWS\system32\kbdswjr.dll>  []
    <bootvidgj.dll><C:\WINDOWS\system32\bootvidgj.dll>  []
    <trjlkjxc.dll><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <tscfgwmijxsj.dll><C:\WINDOWS\system32\tscfgwmijxsj.dll>  []
    <ksuserfy.dll><C:\WINDOWS\system32\ksuserfy.dll>  []
    <slbiopfs2.dll><C:\WINDOWS\system32\slbiopfs2.dll>  []
    <imgutilhx2.dll><C:\WINDOWS\system32\imgutilhx2.dll>  [File is missing]
    <dpvvoxmh.dll><C:\WINDOWS\system32\dpvvoxmh.dll>  []
    <msobjstl.dll><C:\WINDOWS\system32\msobjstl.dll>  []
    <kpadbkgq.dll><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <mstimewd.dll><C:\WINDOWS\system32\mstimewd.dll>  []
    <adsntzt.dll><C:\WINDOWS\system32\adsntzt.dll>  []
    <wmpuiqhx.dll><C:\WINDOWS\system32\wmpuiqhx.dll>  []
    <scrruncqsj.dll><C:\WINDOWS\system32\scrruncqsj.dll>  []
    <spoblwfn.dll><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <rasdlgcq.dll><C:\WINDOWS\system32\rasdlgcq.dll>  []
    <sooirewlqx.dll><C:\WINDOWS\system32\sooirewlqx.dll>  []
    <gluerend.dll><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <tmaikwwl.dll><C:\WINDOWS\system32\tmaikwwl.dll>  []
    <cliconfgzx.dll><C:\WINDOWS\system32\cliconfgzx.dll>  []
    <dispexcb.dll><C:\WINDOWS\system32\dispexcb.dll>  []
删除驱动及驱动对应文件
[0b6e9cc4fe24b7c4 / 0b6e9cc4fe24b7c4][Stopped/Manual Start]
  <\??\C:\0b6e9cc4fe24b7c4.dat><N/A>
[1423640c8f256029 / 1423640c8f256029][Stopped/Manual Start]
  <\??\C:\1423640c8f256029.dat><N/A>
[17ffe04cd95a4548 / 17ffe04cd95a4548][Stopped/Manual Start]
  <\??\C:\17ffe04cd95a4548.dat><N/A>
[20b4a79451c7779d / 20b4a79451c7779d][Stopped/Manual Start]
  <\??\C:\20b4a79451c7779d.dat><N/A>
[250f0b38b1cf4f03 / 250f0b38b1cf4f03][Stopped/Manual Start]
  <\??\C:\250f0b38b1cf4f03.dat><N/A>
[360TimeProt / 360TimeProt][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\360TimeProt.sys><N/A>
[494b2bd88cf15c40 / 494b2bd88cf15c40][Stopped/Manual Start]
  <\??\C:\494b2bd88cf15c40.dat><N/A>
[5329ed20cba38711 / 5329ed20cba38711][Stopped/Manual Start]
  <\??\C:\5329ed20cba38711.dat><N/A>
[544c93e4966fed70 / 544c93e4966fed70][Stopped/Manual Start]
  <\??\C:\544c93e4966fed70.dat><N/A>
[5c8373c87c17f9ae / 5c8373c87c17f9ae][Stopped/Manual Start]
  <\??\C:\5c8373c87c17f9ae.dat><N/A>
[66ffa134abc75e29 / 66ffa134abc75e29][Stopped/Manual Start]
  <\??\C:\66ffa134abc75e29.dat><N/A>
[6e91c1b87c4e0a87 / 6e91c1b87c4e0a87][Stopped/Manual Start]
  <\??\C:\6e91c1b87c4e0a87.dat><N/A>
[7d6852c8eae7aa80 / 7d6852c8eae7aa80][Stopped/Manual Start]
  <\??\C:\7d6852c8eae7aa80.dat><N/A>
[8bc0fc7428b47c6b / 8bc0fc7428b47c6b][Stopped/Manual Start]
  <\??\C:\8bc0fc7428b47c6b.dat><N/A>
[8e53f9f4b1fd5aaa / 8e53f9f4b1fd5aaa][Stopped/Manual Start]
  <\??\C:\8e53f9f4b1fd5aaa.dat><N/A>
[aebaf190d7064c5e / aebaf190d7064c5e][Stopped/Manual Start]
  <\??\C:\aebaf190d7064c5e.dat><N/A>
[bc6edbdc6f630289 / bc6edbdc6f630289][Stopped/Manual Start]
  <\??\C:\bc6edbdc6f630289.dat><N/A>
[c97e06c867ae09c4 / c97e06c867ae09c4][Stopped/Manual Start]
  <\??\C:\c97e06c867ae09c4.dat><N/A>
[cnprov / cnprov][Running/Boot Start]
  <\SystemRoot\system32\drivers\cnprov.sys><中国互联网络信息中心(CNNIC)>
[dc3114188b343cac / dc3114188b343cac][Stopped/Manual Start]
  <\??\C:\dc3114188b343cac.dat><N/A>
[e50151c06f4c4a87 / e50151c06f4c4a87][Stopped/Manual Start]
  <\??\C:\e50151c06f4c4a87.dat><N/A>
[f33e850c7646189c / f33e850c7646189c][Stopped/Manual Start]
  <\??\C:\f33e850c7646189c.dat><N/A>
[f406b010180c3fd6 / f406b010180c3fd6][Stopped/Manual Start]
  <\??\C:\f406b010180c3fd6.dat><N/A>
[f8bb8f74584cea11 / f8bb8f74584cea11][Stopped/Manual Start]
  <\??\C:\f8bb8f74584cea11.dat><N/A>
[fbf34c54f1cba8c0 / fbf34c54f1cba8c0][Stopped/Manual Start]
  <\??\C:\fbf34c54f1cba8c0.dat><N/A>

删除IE加载项
[]
  {6C648541-1025-9650-9057-6541258720C6} <C:\WINDOWS\system32\mndhfdwd.dll, N/A>
[IEAux Class]
  {7605CC7C-00FD-4A5F-BAFD-828342DE6279} <C:\PROGRA~1\OCINS\ieaux.dll, 中国互联网络信息中心(CNNIC)>
[]
  {8A041F13-A111-12A3-B0CF-F99818AA68A8} <C:\WINDOWS\system32\zxmsewin.dll, N/A>
[中文上网]
  {B012491E-8FA4-4851-AA9B-22E33784FBAD} <C:\Program Files\OCINS\config.exe, 中国互联网络信息中心(CNNIC)>
[]
  {6C648541-1025-9650-9057-6541258720C6} <C:\WINDOWS\system32\mndhfdwd.dll, N/A>
[IEAux Class]
  {7605CC7C-00FD-4A5F-BAFD-828342DE6279} <C:\PROGRA~1\OCINS\ieaux.dll, 中国互联网络信息中心(CNNIC)>
[]
  {8A041F13-A111-12A3-B0CF-F99818AA68A8} <C:\WINDOWS\system32\zxmsewin.dll, N/A>

删除文件
C:\WINDOWS\system32\gprB.exe