卡巴斯基查出来的：
system32\wininet.dll感染了病毒：virus.win32.nsag.b无法清除。
现象：系统速度变慢，资源占用过多。

【回复“闹闹123”的帖子】
重启一下。一般咔吧可以将其搞定。

重启无数遍了，用的就是卡巴，搞不定啊

【回复“闹闹123”的帖子】
用HijackThis1.99.1扫系统日志贴上来看看。

Logfile of HijackThis v1.99.1
Scan saved at 17:19:53, on 2005-8-5
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\drivers\WDelMgr20.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\Explorer.exe
C:\dzh\internet\hypwise.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\wb\桌面\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
O1 - Hosts: localhost 127.0.0.1
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [Super Rabbit SRRestore] C:\PROGRA~1\SUPERR~1\MAGICSET\SRRest.exe /autosave
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D0A29C6C-AA71-4423-8C4A-5998B774C448} (IEDown Class) - http://download.ourgame.com/IEDown4.cab
O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.172.102/340//main.chm::/update.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{71038895-4337-449A-B528-E3AA034DB37A}: NameServer = 195.95.218.1,85.255.112.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE0E9F04-F31A-44E3-8CC1-777FD5946BC7}: NameServer = 195.95.218.1 85.255.112.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{71038895-4337-449A-B528-E3AA034DB37A}: NameServer = 195.95.218.1,85.255.112.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{71038895-4337-449A-B528-E3AA034DB37A}: NameServer = 195.95.218.1,85.255.112.7
O23 - Service: DirectX Graphics (dxdmain) - Unknown owner - C:\WINDOWS\System32\dxdmain.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: WDelMgr20 - Unknown owner - C:\WINDOWS\System32\drivers\WDelMgr20.exe

另外还有一个病毒文件system32\init32m.exe被我在安全模式下删除了，可是现在一开机，系统就提示找不到这个文件。怎么能让这个提示不在出现呢，挺烦的。编个假文件，名字也叫init32m.exe放在system32文件夹中行吗

【回复“闹闹123”的帖子】
C:\WINDOWS\System32\drivers\WDelMgr20.exe
这个文件十分可疑（跑到驱动文件夹里去了！）。请用WINRAR打包、作为回帖的附件传到这个论坛上，我帮你看看是否有问题。

O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe

这两项好像是木马。建议修复。先在进程列表中结束进程msupdate32.exe‘然后在系统盘搜索msupdate32.exe。找到后删除。

曾经安装过FinalData 2.0应该不是病毒

msupdate32.exe搜不到了

ding