啊!你TMD木马,我用AVAST!杀E盘你弹掉我的AVAST!杀毒窗口,杀D盘没关系,杀E,F盘你就弹,怎么办啊,赐教,我选显示隐藏文件或文件夹,刚回头你又把那个改回来了AVAST!杀全盘重起你又有了,还有,怎么去掉那个AUTO啊~~~~~~~~~

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

顶！

再顶!不能沉下去!

我也是，想知道

DD

弄个SRENG日志上来，光空顶有屁用……

hao

用卡巴试一下

注意：以下的操作都是用冰刃就可以解决了：

在操作前和过程都不要打开任何磁盘！！记住！否则，处理不好的话，病毒很快就会修改回来的。然后按

以下的步骤操作
由于系统中大部分的系统进程都被注入了！
先用冰刃强行卸掉以下进程中相应的模块：

[PID: 564 / SYSTEM][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation,

5.1.2600.0 (xpclient.010817-1148)]
    [C:\windows\system32\kashbzy.dll]  [N/A, ]
   
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
[PID: 612 / SYSTEM][C:\windows\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0

(xpclient.010817-1148)]
    [C:\windows\system32\kashbzy.dll]  [N/A, ]
[PID: 624 / SYSTEM][C:\windows\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.0

(xpclient.010817-1148)]
    [C:\windows\system32\kashbzy.dll]  [N/A, ]
PID: 792 / SYSTEM][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0

(xpclient.010817-1148)]
    [C:\windows\system32\kashbzy.dll]  [N/A, ]
[PID: 872 / SYSTEM][C:\windows\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0

(xpclient.010817-1148)]
    [C:\windows\System32\kashbzy.dll]  [N/A, ]
PID: 984 / NETWORK SERVICE][C:\windows\System32\svchost.exe]  [Microsoft Corporation,

5.1.2600.0 (xpclient.010817-1148)]
    [C:\windows\System32\kashbzy.dll]  [N/A, ]
PID: 1036 / LOCAL SERVICE][C:\windows\System32\svchost.exe]  [Microsoft Corporation,

5.1.2600.0 (xpclient.010817-1148)]
    [C:\windows\System32\kashbzy.dll]  [N/A, ]
PID: 1200 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashServ.exe]  [ALWIL Software, 4,

7, 1043, 0]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
[PID: 1396 / SYSTEM][C:\windows\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0

(XPClient.010817-1148)]
    [C:\windows\system32\kashbzy.dll]  [N/A, ]
PID: 1956 / Administrator][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000

(xpclient.010817-1148)]
[C:\windows\System32\kashbzy.dll]  [N/A, ]
   
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
   
PID: 232 / Administrator][C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe]  [ALWIL Software, 4, 7,

1043, 0]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
PID: 240 / Administrator][C:\windows\System32\ctfmon.exe]  [Microsoft Corporation,

5.1.2600.0 (xpclient.010817-1148)]
    [C:\windows\System32\kashbzy.dll]  [N/A, ]
   
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
PID: 248 / Administrator][C:\Program Files\Messenger\msmsgs.exe]  [Microsoft Corporation,

4.0.0155]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
PID: 260 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashWebSv.exe]  [ALWIL Software, 4,

7, 1043, 0]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
[PID: 348 / Administrator][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe] 

[Thunder Networking Technologies,LTD, 5.7.2.371]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A,
[PID: 392 / SYSTEM][C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe]  [ALWIL Software,

4, 7, 1043, 0]
  [C:\windows\system32\kapjazy.dll]  [N/A, ]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
PID: 3120 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft

Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A,
[PID: 3508 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft

Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\windows\System32\kapjazy.dll]  [N/A, ]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]
[PID: 3808 / Administrator][D:\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[C:\windows\System32\kapjazy.dll]  [N/A, ]
[C:\windows\system32\kashbzy.dll]  [N/A, ]
    [C:\windows\System32\mppds.dll]  [N/A, ]
    [C:\windows\System32\msccrt.dll]  [N/A, ]
    [C:\windows\System32\Kvsc3.dll]  [N/A, ]
    [C:\windows\System32\rsjzapm.dll]  [N/A, ]


然后用
用冰刃的文件功能删除下面每个盘的Autorun.inf
Autorun.inf
[C:\]
[AutoRun]
open=
shellexecute=
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=
shellexecute=
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=
shellexecute=
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=
shellexecute=
shell\Auto\command=auto.exe
最后用冰刃在注册表中删除以下的启动项：
删除：[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]下的
<Kvsc3><C:\windows\Kvsc3.exe>  []
    <mppds><C:\windows\mppds.exe>  []
    <msccrt><C:\windows\msccrt.exe>  []
删除[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]下的
    <MSDWG32><LYLoadbr.exe>  [N/A]
    <MSDCG32    ><LYLeador.exe>  [N/A]
    <MSDOG32><LYLoador.exe>  [N/A]
    <MSDSG32><LYLoadar.exe>  [N/A]
    <MSDHG32><LYLoadhr.exe>  [N/A]
    <MSDQG32><LYLoadqr.exe>  [N/A]
删除[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]下的
    <AppInit_DLLs><kapjazy.dll>  []
删除

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]下

的
    <{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\windows\System32\rsjzapm.dll>  []
    <{29FA4178-7749-A8D9-F5C8-886455257692}><C:\windows\System32\kashbzy.dll>  []
    <{1A321487-4977-D98A-C8D5-6488257545A1}><C:\windows\System32\kapjazy.dll>  []
    <{1960356A-458E-DE24-BD50-268F589A56A1}><C:\windows\System32\avwlamn.dll>  [N/A]
    <{1859245F-345D-BC13-AC4F-145D47DA34F1}><C:\windows\System32\avzxamn.dll>  [N/A]

操作完以上步骤，用SREngP最新版.EXE，修复下病毒修改的东西.把杀毒软件升到最新，然后全盘杀毒，

最后重启电脑
看看情况如何.........再回来说说你情况...
我只知道这么多了，不一定能彻底清除病毒....水平有限，希望有高手补充，谢谢