系统盘下有个猪头叼着烟图标的文件...这是什么病毒啊...

在D盘下还有个myplayer.com的文件.



附上病毒图标:

我也中了shualai (耍赖)病毒,正在求救呢...这病毒好麻烦的///

扫描一份SRE日志上来

2005-05-04,15:14:48

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional Service Pack 2 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <cctray><"C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CAVRID><"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Kvsc3><; C:\WINDOWS\Kvsc3.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <shualai><; C:\WINDOWS\shualai.exe /i>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\System32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[CaCCProvSP / CaCCProvSP]
  <"C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe"><CA, Inc.>
[CAISafe / CAISafe]
  <C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe><Computer Associates International, Inc.>
[VET Message Service / VETMSGNT]
  <C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe><CA, Inc.>

==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet1.71\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet1.71\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 528][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1112][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1900][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\Ati2evxx.dll]  <ATI Technologies Inc.><6.14.10.4118>
[PID: 1132][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1192][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 996][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1960][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 800][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 1468][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 160][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 1148][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 936][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafServ.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\iSafProd.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\Arclib.dll]  <CA, Inc.><7.3.0.9>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafeEngine.dll]  <CA, Inc.><Version 30.7.0.0>
[PID: 1800][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 808][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\DriverIf.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetNtMsg.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 200][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
[PID: 404][C:\WINDOWS\system32\wbem\wmiprvse.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3612][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\pdkpri.dll]  <N/A><N/A>
[PID: 1880][C:\WINDOWS\system32\atiptaxx.exe]  <ATI Technologies, Inc.><6.14.10.5154>
    [C:\WINDOWS\system32\atipdsxx.dll]  <ATI Technologies, Inc.><6.14.10.5154>
    [C:\WINDOWS\system32\ATRPUIXX.CHS]  <ATI Technologies, Inc.><6.14.10.5154>
    [C:\WINDOWS\system32\atipdxxx.dll]  <ATI Technologies, Inc.><6.14.10.5154>
[PID: 2052][C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccGUIFrm.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccissImg.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccissPrd.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccissRes.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccGUIFrmRes.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\cctray\cctrayissplugin.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\cctray\cctrayavplugin.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\caissresource.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\caISSImages.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\caISSProduct.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\ccpriv.dll]  <Computer Associates International, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\EZAVLIC.DLL]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\calic.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\License.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\driverif.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavProduct.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavResource.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavImages.dll]  <CA, Inc.><Version 8.4.0.24>
[PID: 2072][C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\ccGUIFrm.dll]  <CA, Inc.><Version 3.2.1.12>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavProduct.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavResource.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\caavImages.dll]  <CA, Inc.><Version 8.4.0.24>
    [C:\Program Files\CA\CA Internet Security Suite\ccGUIFrmRes.dll]  <CA, Inc.><Version 3.2.1.12>
[PID: 412][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1320][F:\软件\系统工具\System Repair Engineer(调整和修复系统) 2.0.12.350 RC1 绿色版\sreng2\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\WINDOWS\system32\VetRedir.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>
    [C:\WINDOWS\system32\ISafeIf.dll]  <Computer Associates International, Inc.><Version 8.0.8.0>

==================================
文件关联
.TXT  Error. [notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
CA ISafe LSP over [MSAFD Tcpip [TCP/IP]]
    C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP over [MSAFD Tcpip [UDP/IP]]
    C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP over [MSAFD Tcpip [RAW/IP]]
    C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)
CA ISafe LSP
    C:\WINDOWS\system32\VetRedir.dll(Computer Associates International, Inc., CA ISafe LSP DLL)

==================================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kvsc3><; C:\WINDOWS\Kvsc3.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<shualai><; C:\WINDOWS\shualai.exe /i>
删除对应的注册表项目和文件

并删除那些猪头的文件，具体如果EXE文件都被感染，那么就要找mopery去处理，我不太会

<font size=4>另外还有个问题就是..用论坛提供的威金熊猫通用专杀工具..在没有感染病毒的盘中..exe文件会被修复吗..还是..不管exe文件有没有被感染都会去修复....因为我用了之后..发现本来一个软件可以进..但是用了这个软件之后..软件就进不去了...</font>

那些猪 的文件 打包压缩发给我  密码 123

引用:

【newcenturymoon的贴子】那些猪 的文件 打包压缩发给我  密码 123 ………………

楼上的..坛子里有人有的话就帮发下吧,....我的已经被我删掉了...

再顺便问下楼上的兄弟..我下了那个威金熊猫番茄exe修复专杀..会不会把那些没有中毒的exe文件修改.啊....我好象杀了之后...就运行不了了