1   1  /  1  页   跳转

高手来看~

高手来看~

电脑中毒,高手帮忙看下.

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 1.7; MAXTHON 2.0)

附件附件:

文件名:SREngLOG.log
下载次数:111
文件类型:application/octet-stream
文件大小:
上传时间:2008-6-4 12:01:52
描述:log

分享到:
gototop
 

回复:高手来看~

现在的电脑有什么状况呢?

先说说看?
gototop
 

回复:高手来看~

一直发关ARP包,还有杀毒软件被动持了,毒也一直杀不掉
gototop
 

回复:高手来看~

那你等一下啊,高手都去吃饭了~
gototop
 

回复:高手来看~

这样啊
gototop
 

回复:高手来看~

c:\program files\windows media player\cmsek.dll这个文件不认识,到底什么呢?第三次见它了。
我已将其添加在删除操作中了,你自己选择。

这里官网下载费尔木马强力清除助手,勾选“抑制文件再生”删除。
http://dl.filseclab.com/down/powerrmv.zip

删除:
c:\program files\windows media player\cmsek.dll
c:\program files\internet explorer\iexplore32.dat
c:\program files\internet explorer\iexplore32.sys
c:\windows\system32\hfrdzx.dll
c:\windows\system32\syswowct.dll
c:\windows\system32\tisqatyu.dll
c:\windows\system32\wfrdvq.dll
c:\windows\system32\wyrsdj.dll
c:\windows\system32\zdesfx.dll
c:\windows\system32\midimapcb.dll
c:\windows\system32\midimapcq.dll
c:\windows\system32\midimapjr.dll
c:\windows\system32\midimapmy.dll
c:\windows\system32\midimapqn3.dll
c:\windows\system32\midimaptl.dll
c:\windows\system32\midimapwd.dll
c:\windows\system32\midimapwl.dll
c:\windows\system32\midimapzt.dll
c:\windows\system32\midimapzx.dll
c:\program files\internet explorer\iexplore32.win
c:\windows\system32\apsgdjba.dll
c:\windows\system32\lofsdjbo.dll
c:\windows\system32\mmdxybqe1035.dll
c:\windows\system32\mndhddwd.dll
c:\windows\system32\nhmxbjkl.dll
c:\windows\system32\oohxdbyt.dll
c:\windows\system32\opshbbty.dll
c:\windows\system32\ozfydbyt.dll
c:\windows\system32\ptjhehlp.dll
c:\windows\system32\rijxbkin.dll
c:\windows\system32\yxcschlp.dll
c:\windows\system32\yxfhcjpg.dll
c:\windows\system32\zywmfime.dll
c:\windows\system32\mmdxybqe1034.dll
c:\docume~1\admini~1\locals~1\temp\bb.exe
c:\windows\system32\midimapms.dll
c:\windows\system32\zxptejpg.dll
c:\program files\internet explorer\plugins\winsys48.sys
c:\windows\system32\nhmxajkl.dll
c:\windows\system32\rijxakin.dll
c:\windows\system32\zycbdime.dll
c:\windows\system32\pjjxddwd.dll
c:\017056bcacc9a780.dat
c:\0c135c24d856bf54.dat
c:\123525ece83ef239.dat
c:\156ce2cc40838709.dat
c:\168f89902c8719d8.dat
c:\281ff01c36db4492.dat
c:\45f3ea38089f8026.dat
c:\4f4d70e0b15a62b2.dat
c:\5736a0cc72fafec6.dat
c:\5f9458acfc2ba214.dat
c:\75fd0a4029dace84.dat
c:\a184eea88623c3d2.dat
c:\a6aae9a889d74451.dat
c:\program files\microsoft office\system\apcdli.sys
c:\docume~1\admini~1\locals~1\temp\~wxp2ins.171.tmp
c:\docume~1\admini~1\locals~1\temp\~wxp2ins.468.tmp
c:\docume~1\admini~1\locals~1\temp\~wxp2ins.734.tmp
c:\documents and settings\all users\application data\microsoft\office\system\ntptdb.sys
c:\11127f280d1d2f9b.dat
c:\windows\system32\kkcodngdonznh.dll
c:\documents and settings\all users\application data\microsoft\office\userdata\2e8g6pvilb.dll

不论删除结果如何立即重启电脑,然后继续下面操作。
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将<AppInit_DLLs>项目置空(就是选择“编辑”)这必须关闭杀毒软件的监控,否则改不了可能。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><SysWoWCt.dll,msosmhfp00.dll,tisqatyu.dll,nhmxbjkl.dll>  [Microsoft Corporation]

就是将 <AppInit_DLLs> 的“值”项编辑置空
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除:
启动项目
注册表
    <svc><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bb.exe>  []
    <{4F4F0064-71E0-4f0d-0001-708476C7815F}><C:\WINDOWS\system32\midimapzt.dll>  [Microsoft Corporation]
    <{4F4F0064-71E0-4f0d-0015-708476C7815F}><C:\WINDOWS\system32\midimapmy.dll>  [Microsoft Corporation]
    <{528DF602-9541-A985-210A-984A698C6F25}><C:\WINDOWS\system32\ptjhehlp.dll>  []
    <{4F4F0064-71E0-4f0d-0023-708476C7815F}><C:\WINDOWS\system32\midimapcq.dll>  [Microsoft Corporation]
    <{4F4F0064-71E0-4f0d-0018-708476C7815F}><C:\WINDOWS\system32\midimapwd.dll>  [Microsoft Corporation]
    <{4F4F0064-71E0-4f0d-0014-708476C7815F}><C:\WINDOWS\system32\midimapms.dll>  [N/A]
    <{4F4F0064-71E0-4f0d-0005-708476C7815F}><C:\WINDOWS\system32\midimapzx.dll>  [Microsoft Corporation]
    <{4C648541-1025-9650-9057-6541258720C4}><C:\WINDOWS\system32\mndhddwd.dll>  []
    <{4F4F0064-71E0-4f0d-0017-708476C7815F}><C:\WINDOWS\system32\midimaptl.dll>  [Microsoft Corporation]
    <{4A069845-2036-6084-9054-6087502480A4}><C:\WINDOWS\system32\ozfydbyt.dll>  []
    <{4F4F0064-71E0-4f0d-0004-708476C7815F}><C:\WINDOWS\system32\midimapwl.dll>  [Microsoft Corporation]
    <{6319A1F1-9410-9654-3201-345FFA349136}><C:\WINDOWS\system32\zywmfime.dll>  []
    <{4F4F0064-71E0-4f0d-0012-708476C7815F}><C:\WINDOWS\system32\midimapjr.dll>  [Microsoft Corporation]
    <{4FD45A54-9875-698F-E56E-65102358FDF4}><C:\WINDOWS\system32\apsgdjba.dll>  []
    <{5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5}><C:\WINDOWS\system32\oohxdbyt.dll>  []
    <{35671234-7890-ABCD-CDEF-567801237653}><C:\WINDOWS\system32\yxcschlp.dll>  []
    <{44FAE856-AD58-20CB-A025-CD4895FA6E44}><C:\WINDOWS\system32\pjjxddwd.dll>  [N/A]
    <{6BBAA1E6-CF54-4139-AB9C-8491A9F909D7}><C:\WINDOWS\system32\wfrdvq.dll>  []
    <{18093456-9012-4568-9076-908765467181}><C:\WINDOWS\system32\tisqatyu.dll>  []
    <{22596546-2036-9451-6058-658402589722}><C:\WINDOWS\system32\opshbbty.dll>  []
    <{1DB3C525-5271-46F7-887A-D4E1ADAA7632}><C:\WINDOWS\system32\hfrdzx.dll>  []
    <{4A698102-5904-AFD0-20DF-CD1A65829CA4}><C:\WINDOWS\system32\zycbdime.dll>  [N/A]
    <{4F4F0064-71E0-4f0d-0022-708476C7815F}><C:\WINDOWS\system32\midimapqn3.dll>  [Microsoft Corporation]
    <{15FD6584-698F-BCD2-602C-698745210351}><C:\WINDOWS\system32\rijxakin.dll>  [N/A]
    <{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zdesfx.dll>  []
    <{17AC9076-C898-B098-D098-A18319080971}><C:\WINDOWS\system32\nhmxajkl.dll>  [N/A]
    <{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll>  []
    <{470165F1-9F65-569F-F895-F14F58F41074}><C:\WINDOWS\system32\lofsdjbo.dll>  []
    <{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}><C:\WINDOWS\system32\yxfhcjpg.dll>  []
    <{25FD6584-698F-BCD2-602C-698745210352}><C:\WINDOWS\system32\rijxbkin.dll>  []
    <{1AB1F65A-964F-4AE7-B254-05146A0E602E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys48.Sys>  [N/A]
    <{C5E87A05-F463-4841-B19E-DD3EC3862368}><C:\Program Files\Internet Explorer\IEXPLORE32.Sys>  []
    <{EE12D60D-AD9A-4095-B839-3BE6862679FD}><C:\Program Files\Internet Explorer\IEXPLORE32.Dat>  []
    <{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E}><C:\Program Files\Internet Explorer\IEXPLORE32.win>  []
    <{91698482-6555-3666-1222-954784129019}><C:\WINDOWS\system32\zxptejpg.dll>  [N/A]
    <{df902304-6ec6-43ad-a7f6-9491d89a2d84}><C:\WINDOWS\system32\MMDXYBQE1035.dll>  []
    <{4F4F0064-71E0-4f0d-0006-708476C7815F}><C:\WINDOWS\system32\midimapcb.dll>  [Microsoft Corporation]
    <{27AC9076-C898-B098-D098-A18319080972}><C:\WINDOWS\system32\nhmxbjkl.dll>  []
    <midimapzt><C:\WINDOWS\system32\midimapzt.dll>  [Microsoft Corporation]
    <midimapmy><C:\WINDOWS\system32\midimapmy.dll>  [Microsoft Corporation]
    <midimapcq><C:\WINDOWS\system32\midimapcq.dll>  [Microsoft Corporation]
    <midimapwd><C:\WINDOWS\system32\midimapwd.dll>  [Microsoft Corporation]
    <midimapms><C:\WINDOWS\system32\midimapms.dll>  [N/A]
    <midimapzx><C:\WINDOWS\system32\midimapzx.dll>  [Microsoft Corporation]
    <midimaptl><C:\WINDOWS\system32\midimaptl.dll>  [Microsoft Corporation]
    <midimapwl><C:\WINDOWS\system32\midimapwl.dll>  [Microsoft Corporation]
    <midimapjr><C:\WINDOWS\system32\midimapjr.dll>  [Microsoft Corporation]
    <midimapqn3><C:\WINDOWS\system32\midimapqn3.dll>  [Microsoft Corporation]
    <midimapcb><C:\WINDOWS\system32\midimapcb.dll>  [Microsoft Corporation]
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除,
==================================
驱动程序
[017056bcacc9a780 / 017056bcacc9a780][Stopped/Manual Start]
[0c135c24d856bf54 / 0c135c24d856bf54][Stopped/Manual Start]
[123525ece83ef239 / 123525ece83ef239][Stopped/Manual Start]
[156ce2cc40838709 / 156ce2cc40838709][Stopped/Manual Start]
[168f89902c8719d8 / 168f89902c8719d8][Stopped/Manual Start]
[281ff01c36db4492 / 281ff01c36db4492][Stopped/Manual Start]
[45f3ea38089f8026 / 45f3ea38089f8026][Stopped/Manual Start]
[4f4d70e0b15a62b2 / 4f4d70e0b15a62b2][Stopped/Manual Start]
[5736a0cc72fafec6 / 5736a0cc72fafec6][Stopped/Manual Start]
[5f9458acfc2ba214 / 5f9458acfc2ba214][Stopped/Manual Start]
[75fd0a4029dace84 / 75fd0a4029dace84][Stopped/Manual Start]
[a184eea88623c3d2 / a184eea88623c3d2][Stopped/Manual Start]
[a6aae9a889d74451 / a6aae9a889d74451][Stopped/Manual Start]
[apcdli / apcdli][Stopped/Auto Start]
[Atixeve2312 / Atixeve2312][Stopped/Manual Start]
[Atixeve2593 / Atixeve2593][Stopped/Manual Start]
[Atixeve2859 / Atixeve2859][Stopped/Manual Start]
[ntptdb / ntptdb][Stopped/Auto Start]
[11127f280d1d2f9b / 11127f280d1d2f9b][Running/Manual Start]
[msp2p32 / msp2p32][Running/]
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
浏览器加载项
[]
  {15FD6584-698F-BCD2-602C-698745210351} <C:\WINDOWS\system32\rijxakin.dll, N/A>
[]
  {17AC9076-C898-B098-D098-A18319080971} <C:\WINDOWS\system32\nhmxajkl.dll, N/A>
[]
  {18093456-9012-4568-9076-908765467181} <C:\WINDOWS\system32\tisqatyu.dll, N/A>
[]
  {1AB1F65A-964F-4AE7-B254-05146A0E602E} <C:\Program Files\Internet Explorer\PLUGINS\WinSys48.Sys, N/A>
[]
  {22596546-2036-9451-6058-658402589722} <C:\WINDOWS\system32\opshbbty.dll, N/A>
[]
  {25FD6584-698F-BCD2-602C-698745210352} <C:\WINDOWS\system32\rijxbkin.dll, N/A>
[]
  {27AC9076-C898-B098-D098-A18319080972} <C:\WINDOWS\system32\nhmxbjkl.dll, N/A>
[]
  {35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
  {44FAE856-AD58-20CB-A025-CD4895FA6E44} <C:\WINDOWS\system32\pjjxddwd.dll, N/A>
[]
  {470165F1-9F65-569F-F895-F14F58F41074} <C:\WINDOWS\system32\lofsdjbo.dll, N/A>
[]
  {4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
  {4A698102-5904-AFD0-20DF-CD1A65829CA4} <C:\WINDOWS\system32\zycbdime.dll, N/A>
[]
  {4C648541-1025-9650-9057-6541258720C4} <C:\WINDOWS\system32\mndhddwd.dll, N/A>
[]
  {4FD45A54-9875-698F-E56E-65102358FDF4} <C:\WINDOWS\system32\apsgdjba.dll, N/A>
[]
  {528DF602-9541-A985-210A-984A698C6F25} <C:\WINDOWS\system32\ptjhehlp.dll, N/A>
[]
  {5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5} <C:\WINDOWS\system32\oohxdbyt.dll, N/A>
[]
  {6319A1F1-9410-9654-3201-345FFA349136} <C:\WINDOWS\system32\zywmfime.dll, N/A>
[]
  {83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38} <C:\WINDOWS\system32\yxfhcjpg.dll, N/A>
[]
  {8DEBD4F0-5701-4ED9-94F1-3E79B7D9EBD9} <C:\WINDOWS\system32\kkcodngdonznh.dll, N/A>
[]
  {91698482-6555-3666-1222-954784129019} <C:\WINDOWS\system32\zxptejpg.dll, N/A>
[Adobe Common Objects]
  {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\2e8g6PVIlB.dll, N/A>
[]
  {A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E} <C:\Program Files\Internet Explorer\IEXPLORE32.win, N/A>
[]
  {C5E87A05-F463-4841-B19E-DD3EC3862368} <C:\Program Files\Internet Explorer\IEXPLORE32.Sys, N/A>
[]
  {EE12D60D-AD9A-4095-B839-3BE6862679FD} <C:\Program Files\Internet Explorer\IEXPLORE32.Dat, N/A>
[]
  {15FD6584-698F-BCD2-602C-698745210351} <C:\WINDOWS\system32\rijxakin.dll, N/A>
[]
  {17AC9076-C898-B098-D098-A18319080971} <C:\WINDOWS\system32\nhmxajkl.dll, N/A>
[]
  {18093456-9012-4568-9076-908765467181} <C:\WINDOWS\system32\tisqatyu.dll, N/A>
[]
  {1AB1F65A-964F-4AE7-B254-05146A0E602E} <C:\Program Files\Internet Explorer\PLUGINS\WinSys48.Sys, N/A>
[]
  {22596546-2036-9451-6058-658402589722} <C:\WINDOWS\system32\opshbbty.dll, N/A>
[]
  {25FD6584-698F-BCD2-602C-698745210352} <C:\WINDOWS\system32\rijxbkin.dll, N/A>
[]
  {27AC9076-C898-B098-D098-A18319080972} <C:\WINDOWS\system32\nhmxbjkl.dll, N/A>
[]
  {35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
  {44FAE856-AD58-20CB-A025-CD4895FA6E44} <C:\WINDOWS\system32\pjjxddwd.dll, N/A>
[]
  {470165F1-9F65-569F-F895-F14F58F41074} <C:\WINDOWS\system32\lofsdjbo.dll, N/A>
[]
  {4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
  {4A698102-5904-AFD0-20DF-CD1A65829CA4} <C:\WINDOWS\system32\zycbdime.dll, N/A>
[]
  {4C648541-1025-9650-9057-6541258720C4} <C:\WINDOWS\system32\mndhddwd.dll, N/A>
[]
  {4FD45A54-9875-698F-E56E-65102358FDF4} <C:\WINDOWS\system32\apsgdjba.dll, N/A>
[]
  {528DF602-9541-A985-210A-984A698C6F25} <C:\WINDOWS\system32\ptjhehlp.dll, N/A>
[]
  {5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5} <C:\WINDOWS\system32\oohxdbyt.dll, N/A>
[]
  {6319A1F1-9410-9654-3201-345FFA349136} <C:\WINDOWS\system32\zywmfime.dll, N/A>
[]
  {83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38} <C:\WINDOWS\system32\yxfhcjpg.dll, N/A>
[]
  {8DEBD4F0-5701-4ED9-94F1-3E79B7D9EBD9} <C:\WINDOWS\system32\kkcodngdonznh.dll, N/A>
[]
  {91698482-6555-3666-1222-954784129019} <C:\WINDOWS\system32\zxptejpg.dll, N/A>
[Adobe Common Objects]
  {986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\2e8g6PVIlB.dll, N/A>
[]
  {A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E} <C:\Program Files\Internet Explorer\IEXPLORE32.win, N/A>
[]
  {C5E87A05-F463-4841-B19E-DD3EC3862368} <C:\Program Files\Internet Explorer\IEXPLORE32.Sys, N/A>
[]
  {EE12D60D-AD9A-4095-B839-3BE6862679FD} <C:\Program Files\Internet Explorer\IEXPLORE32.Dat, N/A>
————————————————————————————————————
在扫日志的SRENG工具》系统修复》高级修复》重置Winsock
因为C:\Program Files\Windows Media Player\cmsek.dll文件的删除,你可能不能连网了,所以这必须修复成功。

—————————————————————————————————————
用下载的“清理临时文件工具ATF-Cleaner-cn”,全选所有项目,点击“立即清理”
下载:http://www.atribune.org/public-beta/ATF-Cleaner.exe

用W i n d o w s 清理助手 ,清理你那系统。
W i n d o w s 清理助手 下载:http://www.arswp.com/
————————————————————————————————————
再重启电脑,反复检查,操作的结果,
————————————————————————————————————
再重启电脑,
升级杀毒软件至最新版本全盘杀毒。
下载卡卡助手,清理你那系统。
记得打打系统漏洞补丁
最后编辑天月来了 最后编辑于 2008-06-04 16:10:57
百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复:高手来看~

3Q了
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT