瑞星查出中了Trojan.DL.Win32.Mnless.xr，病毒一个～
路径c:/windows/system32/a.exe>>upack0.39
系统未有异常～
昨天瑞星查出后删除文件，今天又有了～～
求助大侠～～过年的，帮个忙谢谢阿

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; 56flvplayer 1.0)

诊断时间: 2008-02-06  21:52:37
诊断平台: Microsoft Windows XP  Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:511.49MB - 当前可用内存:141.09MB

100 - 未知 - Process: RavMonD.exe [Rising Realtime Moniter] - D:\RISING\RAV\Ravmond.exe
100 - 未知 - Process: rfwsrv.exe [Rising Personal FireWall Service] - d:\rising\rfw\rfwsrv.exe
100 - 未知 - Process: rfwstub.exe [Rising Personal FireWall Service Rfwstub ] - d:\rising\rfw\rfwstub.exe
100 - 未知 - Process: rfwProxy.exe [Rising Personal Proxy Service] - d:\rising\rfw\rfwproxy.exe
100 - 未知 - Process: RavStub.exe [Rising RavStub] - D:\RISING\RAV\RavStub.exe /RAVMOND=1023
100 - 未知 - Process: rfwmain.exe [Rising Personal FireWall Main Program] - d:\rising\rfw\RfwMain.exe
100 - 未知 - Process: RavTask.exe [RavTimer] - D:\Rising\Rav\RavTask.exe
100 - 未知 - Process: runiep.exe [Rising AntiSpyware Monitor] - D:\Rising\AntiSpyware\runiep.exe
100 - 未知 - Process: RavMon.exe [Rising realtime monitor shell] - D:\Rising\Rav\Ravmon.exe
100 - 未知 - Process: RsAgent.exe [RsAgent Application] - D:\Rising\Rav\RsAgent.exe
100 - 未知 - Process: QQ.exe [] -
100 - 未知 - Process: TIMPlatform.exe [TIMPlatform] - E:\qq\TIMPlatform.exe -Embedding
100 - 未知 - Process: TTPlayer.exe [千千静听] - E:\Program Files\ttpsetup\ttjt\TTPlayer.exe
O2 - 未知 - BHO: (ThunderAtOnce Class) - [迅雷浏览器高级特性支持模块] - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - E:\Program Files\xunlei\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - 未知 - BHO: (Thunder Browser Helper) - [XunLeiBHO] - {39F7E361-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\xunlei\Thunder\ComDlls\xunleiBHO_Now.dll
O4 - 未知 - HKLM\..\RunOnce: [KKDelay] [RunOnce Application] D:\Rising\AntiSpyware\RunOnce.exe
O8 - 未知 - Extra context menu item: &使用BitComet下载 - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - 未知 - Extra context menu item: &使用BitComet下载全部链接 - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - 未知 - Extra context menu item: &使用BitComet下载本页视频 - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载 - E:\Program Files\xunlei\Thunder\Program\geturl.htm
O8 - 未知 - Extra context menu item: 使用迅雷下载全部链接 - E:\Program Files\xunlei\Thunder\Program\getallurl.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - E:\qq\AddEmotion.htm
O9 - 未知 - Extra button: 启动迅雷5(HKLM) - E:\Program Files\Thunder\Thunder.exe
O9 - 未知 - Extra button: 资源搜索(HKLM) - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O15 - 未知 - Trusted Zone: https://mybank.icbc.com.cn
O15 - 未知 - Trusted Zone: http://www.icbc.com.cn
O16 - 未知 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab
O18 - 未知 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - E:\PROGRA~1\kugoo\KUGOO2~1\InExtend\KUGOO3~1.OCX
O23 - 未知 - Service: RfwProxySrv [Rising Personal Proxy Service] - d:\rising\rfw\rfwproxy.exe - (running)
O23 - 未知 - Service: RfwService [Rising Personal Firewall Service] - d:\rising\rfw\rfwsrv.exe - (running)
O23 - 未知 - Service: RsCCenter [Rising Process Communication Center] - "D:\Rising\Rav\CCenter.exe" - (running)
O23 - 未知 - Service: RsRavMon [Rising RealTime Monitor] - "D:\RISING\RAV\Ravmond.exe" - (running)
O23 - 未知 - Service: SLService [SmartLinkService] - slserv.exe - (running)

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: CCenter.exe [瑞星杀毒软件控制台相关程序。] - D:\Rising\Rav\CCenter.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: LEXBCES.EXE [利盟lexmark打印机相关软件。] - C:\WINDOWS\system32\LEXBCES.EXE
100 - 安全 - Process: LEXPPS.EXE [利盟lexmark打印机或扫描仪后台程序。] - C:\WINDOWS\system32\LEXPPS.EXE
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: 360tray.exe [360安全卫士实时保护模块] - E:\Program Files\360safe\360safe\safemon\360Tray.exe
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: RichVideo.exe [CyberLink PowerDVD（媒体播放器）相关程序。] - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
100 - 安全 - Process: slserv.exe [modem猫相关软件。] - C:\WINDOWS\system32\slserv.exe
100 - 安全 - Process: alg.exe [这是一个应用层网关服务用于网络共享。] - C:\WINDOWS\System32\alg.exe
100 - 安全 - Process: VnetClient.exe [vnet虚拟拨号软件，用于adsl宽带拨号。] - C:\Program Files\ChinaNet\VnetClient.exe
100 - 安全 - Process: agentsvr.exe [是一个ActiveX插件，用于多媒体程序。] - C:\WINDOWS\msagent\AgentSvr.exe -Embedding
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士] - E:\Program Files\360safe\360safe\360safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R1 - 安全 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (BitComet Helper) - [下载软件BitComet的相关程序。] - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - E:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - 安全 - BHO: (VnetCookie Class) - [星空极速， 拨号软件。] - {4E83D567-4697-4F7B-B1F0-A513B01DB89A} - c:\program files\chinanet\vnettransfer.dll
O3 - 安全 - Toolbar: (卡卡上网安全助手) - [卡卡安全助手工具条软件相关程序。] - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 安全 - HKLM\..\Run: [360Safetray] [360safe实时保护功能模块。] E:\Program Files\360safe\360safe\safemon\360Tray.exe /start
O4 - 安全 - HKLM\..\Run: [RavTask] [瑞星杀毒软件的任务计划程序。] "D:\Rising\Rav\RavTask.exe" -system
O4 - 安全 - HKLM\..\Run: [RfwMain] [瑞星防火墙程序，抵御黑客攻击。] "D:\Rising\Rfw\rfwmain.exe" -Startup
O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] "D:\Rising\AntiSpyware\runiep.exe" /startup
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O16 - 安全 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (招商银行个人版) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - 安全 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN照片上传插件) -
O16 - 安全 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (中国工商银行个人银行) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - 安全 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Flash播放器) -
O23 - 安全 - Service: LexBceS [是利盟Lexmark相关服务，用于调用利盟Lexmark网络打印服务。] - C:\WINDOWS\system32\LEXBCES.EXE - (running)
O23 - 安全 - Service: RichVideo [cyberlink公司出品的DVD播放软件相关服务。] - "C:\Program Files\CyberLink\Shared Files\RichVideo.exe" - (running)
O23 - 安全 - Service: SymWSC [是Symantec安全中心程序相关服务。] - "C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe" - (not running)

O31 - 未知 - Folder Menu: {F9DB5320-233E-11D1-9F84-707F02C10627} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll - Adobe Systems, Inc. - PDF Shell Extension - 8.1.0.0 - 372736 - 2094bc9a0fc9c0e15eea5f4a9581dd14
O31 - 未知 - SEApproved: {42071714-76d4-11d1-8b24-00a0c9068ff3} - deskpan.dll -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：Shell extensions for file compression -  -  -  -  - 0 -
O31 - 未知 - SEApproved: 无效的CLSID：加密上下文菜单 -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {0DF44EAA-FF21-4412-828E-260A8728E7F1} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {7A9D77BD-5403-11d2-8785-2E0420524153} -  -  -  -  - 0 -
O31 - 未知 - SEApproved: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll -  -  -  - 120320 - 3e5633c7d768ea333a65a9e8a1095633
O31 - 未知 - SEApproved: {0006F045-0000-0000-C000-000000000046} - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL - Microsoft Corporation - Microsoft Outlook Shell Hook for Start/Find - 9.0.0.2416 - 49202 - aea9e41eed49e0b95d9d5078fc84d8e6
O31 - 未知 - Directory Menu: {B41DB860-8EE4-11D2-9906-E49FADC173CA} - C:\Program Files\WinRAR\rarext.dll -  -  -  - 120320 - 3e5633c7d768ea333a65a9e8a1095633
O31 - 未知 - BootExecute: bsmain -  -  -  - 0 -
O31 - 未知 - BootExecute: KNative.exe -  -  -  - 0 -
O31 - 未知 - LSA: Security Packages - sv1_0.dll -  -  -  - 0 -
O31 - 未知 - LSA: Security Packages - channel.dll -  -  -  - 0 -

O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\WINDOWS\system32\shlhook.dll - shlhook Module - 47c020cafb8486eb33061f7ccdf206b6
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - D:\Rising\AntiSpyware\ieprot.dll - IE Protector - c03fc56e7d933a2478f65ddb371353bb
O40 - Explorer.EXE - Adobe Systems, Inc. - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll - PDF Shell Extension - 2094bc9a0fc9c0e15eea5f4a9581dd14

=======================================

O41 - BaseTDI - basetdi - C:\WINDOWS\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937
O41 - machobus - machobus - C:\WINDOWS\system32\drivers\machobus.sys - (running) -  -  - 1cf01e6a1f9d00a41649b30e90fca1fe
O41 - NPF - NPF Driver - TME extensions - C:\WINDOWS\system32\drivers\npf.sys - (running) - NPF Driver - TME extensions - Politecnico di Torino - f498c5c3399a60933196fc215ef074f9
O41 - npkcrypt - nProtect KeyCrypt Driver - E:\qq\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - prodrv06 - StarForce Protection Environment Driver - C:\WINDOWS\system32\drivers\prodrv06.sys - (running) - StarForce Protection Environment Driver - Protection Technology - 18d9789a4664bf417eea944d2776091a
O41 - prohlp02 - StarForce Protection Helper Driver - C:\WINDOWS\system32\drivers\prohlp02.sys - (running) - StarForce Protection Helper Driver - Protection Technology - 8cc9671a7ed2902e747ee0892e1c8575
O41 - prosync1 - StarForce Protection Synchronization Driver - C:\WINDOWS\system32\drivers\prosync1.sys - (running) - StarForce Protection Synchronization Driver - Protection Technology - 960bce3ed38761b446aabac06c76badf
O41 - RsAntiSpyware - Anti-RootKit Driver - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - Anti-RootKit Driver - Beijing Rising Technology Co., Ltd. - f9edc97f228c046832a24b5a76017912
O41 - sfhlp01 - StarForce Protection Helper Driver - C:\WINDOWS\system32\drivers\sfhlp01.sys - (running) - StarForce Protection Helper Driver - Protection Technology - 462aee0ea0481ea8bd45cac876a4ccc4
O41 - SVKP - SVKP driver for NT - C:\WINDOWS\system32\SVKP.sys - (running) - SVKP driver for NT - AntiCracking - f05028b163b92c302a74409d683ac9b0
O41 - VIAudio - Vinyl AC'97 Codec Combo WDM Driver - C:\WINDOWS\system32\drivers\viaudios.sys - (running) - Vinyl AC'97 Codec Combo WDM Driver - VIA Technologies, Inc. - 6d0b25ad3ceec6a5bd37aedf36f1e53e
O41 - ADProt - ADProt - C:\WINDOWS\system32\drivers\ADProt.sys - (not running) -  -  -
O41 - CDGscsi - CDGscsi - C:\WINDOWS\System32\Drivers\cdgscsi.sys - (not running) -  -  -
O41 - d343bus - d343bus - C:\WINDOWS\system32\DRIVERS\d343bus.sys - (not running) -  -  -
O41 - EagleNT - EagleNT - C:\WINDOWS\system32\drivers\EagleNT.sys - (not running) -  -  -
O41 - kmsinput - kmsinput - C:\WINDOWS\system32\drivers\kmsinput.sys - (not running) -  -  - f8d6ebcb50c02b42c5ffd5393229c6b6

=======================================
360Safe.exe=3.7.0.1005
AntiAdwa.dll=3.6.3.1001
AntiEng.dll=3.6.4.1001
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
safelive.exe=1.0.0.2007
live.dll=1.0.1.1021

清理下IE缓存和临时文件夹，然后再升级瑞星安全模式杀毒看下，顺便清理下其它木马。