1   1  /  1  页   跳转

【求助】帮我看看中了什么病毒~

【求助】帮我看看中了什么病毒~

瑞星杀毒天天能杀出病毒可是就不能杀干净,求高手帮我看看是否中了木马呀

[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

附件附件:

下载次数:84
文件类型:application/octet-stream
文件大小:
上传时间:2008-4-20 10:59:42
描述:

最后编辑2008-04-20 11:02:15
分享到:
gototop
 

3721的东西你还是去设法卸载它吧,怎那么喜欢用呢??

————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除:
启动项目
注册表
(WinShell)("C:\WINDOWS\system32\Rundll32.exe" "C:\WINDOWS\system32\shell32.dll",Control_RunDLL "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat3E.tmp") [N/A]
(HB Kernel)(RUNDLL32.EXE C:\WINDOWS\system32\HBKrnl.dll,DllRegisterServer) [N/A]
(WINSvr32)(C:\WINDOWS\WINSvr32.exE) [N/A]
(upxdnd)(C:\WINDOWS\upxdnd.exe) [N/A]
(fmsbbqi)(C:\WINDOWS\fmsbbqi.exe) [N/A]
(Kvsc3)(C:\WINDOWS\Kvsc3.exE) [N/A]
(MSDWG32)(LYLoadbr.exe) [N/A]
(MSDCG32 )(LYLeador.exe) [N/A]
(MSDOG32)(LYLoador.exe) [N/A]
(MSDSG32)(LYLoadar.exe) [N/A]
(MSDMG32)(LYLoadmr.exe) [N/A]
(MSDHG32)(LYLoadhr.exe) [N/A]
(MSDQG32)(LYLoadqr.exe) [N/A]
({6167F471-EF2B-41DD-A5E5-C26ACDB5C096})(C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys) [N/A]
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将下面项目置空(就是选择“编辑”)这必须关闭杀毒软件的监控,否则改不了可能。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)(ghjdtry.dll,kghk.dll,lfsjgf.dll,stehs.dll,fghshj.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,sperls.dll,) [N/A]

就是将 (AppInit_DLLs)(ghjdtry.dll,kghk.dll,lfsjgf.dll,stehs.dll,fghshj.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,sperls.dll,) [N/A] 的“值”项编辑置空为:

(AppInit_DLLs)() [N/A]

你可以选择其中一个红色项,然后编辑时你可能看不到什么,只需要在值项里输入任意一个字母或数字即可。

——————————————————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除,
--------------------
服务
[B302EC43 / B302EC43][Stopped/Auto Start]
(C:\WINDOWS\system32\75D23BE4.EXE -d)(N/A)
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除,
-------------------
驱动程序
[dohs / dohs][Stopped/Auto Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp7.tmp)(N/A)

[drop / drop][Stopped/Auto Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpAE.tmp)(N/A)

[fmsq / fmsq][Stopped/Auto Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp72.tmp)(N/A)

[HBKernel Driver / HBKernel][Running/Auto Start]
(\??\C:\WINDOWS\system32\drivers\HBKernel.sys)(N/A)

[iCafe Service / iCafe Service][Stopped/Manual Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a.sys)(N/A)

[mhfp / mhfp][Stopped/Auto Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp117.tmp)(N/A)

[mseion / mseion][Stopped/Manual Start]
(\??\C:\WINDOWS\system32\mseion.sys)(N/A)

[nbrirho / nbrirho][Stopped/Boot Start]
(\SystemRoot\\SystemRoot\System32\drivers\nbrirho.sys)(N/A)

[Net Manager / Net Manager][Stopped/Manual Start]
(\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\b.sys)(N/A)

[R2A / R2A][Stopped/Disabled]
(\??\C:\WINDOWS\system32a2.sys)(N/A)
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
------------------
浏览器加载项
[IE搜索工具条]
{BE830FD4-E393-417F-9F4B-CC70ABB3384C} (C:\WINDOWS\system32\IETool.dll, )
[]
{6167F471-EF2B-41DD-A5E5-C26ACDB5C096} (C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys, N/A)
[]
{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E} (C:\Program Files\Internet Explorer\IEXPLORE32.win, N/A)
[IE搜索工具条]
{BE830FD4-E393-417F-9F4B-CC70ABB3384C} (C:\WINDOWS\system32\IETool.dll, )
[]
{EE12D60D-AD9A-4095-B839-3BE6862679FD} (C:\Program Files\Internet Explorer\IEXPLORE32.Dat, N/A)
————————————————————————————————————
再重启电脑,反复检查,操作删除,

————————————————————————————————————
再重启电脑,

用下载的“清理临时文件工具ATF-Cleaner-cn”,全选所有项目,点击“立即清理”
下载:http://www.qispace.com.cn/attachment.php?fid=34

用W i n d o w s 清理助手 ,清理你那系统。
W i n d o w s 清理助手 下载:http://www.arswp.com/

升级杀毒软件至最新版本全盘杀毒。
下载卡卡助手,清理你那系统。
记得打打系统漏洞补丁

再详细说说杀出的病毒文件名和路径
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT