附件: SREngLOG.log (2008-11-24 18:41:02, 71.69 K)
该附件被下载次数 168

这下麻烦了，我电脑中病毒了，瑞星开不了，先前用360杀了木马后能启动，但是杀了毒以后就出了问题，网站打不开部分下级网页，没有任务栏，在网页里能复制但是不能粘贴，文本里可以！这是什么问题啊！后来我去病毒隔离里面把文件恢复了又正常了，但病毒依然还在！怎么弄啊！

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; 360SE)

如下删除
<ssServ><; E:\Wx2004new\Server.exe>
<HBService32><System.exe>
<nwiz><chmhp.exe>
<AppInit_DLLs><HBmhly.dll,HBASKTAO.dll,HBWOW.dll,HBTL.dll,HBQQSG.dll,HBWD.dll,HBJTLQ.dll>
把上面一行红色的清除，黑色的不用
<{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}><5934EA2B.dll>  [N/A]
    <{16AF66EB-93C8-49F9-BB09-B4F87CEDCE46}><16AF66EB.dll>  []
    <{AD794E6B-90B7-4F9D-8FD6-0C16E3298FF2}><AD794E6B.dll>  []
    <{D7C79813-9233-4AE0-832C-99B2E8019673}><D7C79813.dll>  []
    <{201476D0-2B18-462E-AB9F-3E2B0CC8732B}><201476D0.dll>  []
    <{58FF3024-8A83-4B1A-88E9-302F47646EEE}><58FF3024.dll>  []
    <{3B8DA919-1139-4B10-AD8F-91E8FBCFD375}><3B8DA919.dll>  []
    <{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll>  []
    <{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll>  []
    <{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}><E1D19FCC.dll>  []
    <{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll>  []
    <{8566F82E-03A4-416E-AEAC-66600D8881F1}><8566F82E.dll>  []
    <{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll>  []
    <{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}><4FBFD5A4.dll>  []
    <{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll>  []
    <{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll>  []
    <{BA7EDF54-8408-4B21-B351-7B447B344BA4}><BA7EDF54.dll>  []
    <{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll>  []
    <{B3721C07-62B3-411A-9DC7-F5F27E3E21FF}><B3721C07.dll>  []
    <{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}><66AFCB56.dll>  []
    <{DFEC5CB7-E2AA-4B0A-BEB3-D140E59ED53A}><DFEC5CB7.dll>  []
    <{C8EB51BC-82D8-4018-8678-5A0580DBA04A}><C8EB51BC.dll>  []
    <{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll>  []
    <{B8E83D3C-9466-4091-9AD1-1F89418A6EB7}><B8E83D3C.dll>  []
    <{202AEF39-2BFA-4A5F-B526-390FDE0BC675}><C:\Program Files\Internet Explorer\VitnNt64.987>  []
    <{E0D39066-96D7-4891-8527-488ADAFCD60F}><E0D39066.dll>  []
    <{B05A92B0-F7B0-4E5B-884E-3D5FB2D4552A}><C:\Program Files\Internet Explorer\Vet4321t.321>  []
    <{E59C8BDA-489C-47EC-8967-A33C6A730B10}><C:\Program Files\Internet Explorer\Explo2eMt.456>  []
一大堆IFEO
<C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><N/A>
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
…………
……

首先要断网，替换userinit.exe 和 rpcss.dll
一、用XDelBox1.8 删除文件
-----------------------------------------------------------
C:\WINDOWS\system32\System.exe
C:\WINDOWS\system32\chmhp.dll
C:\WINDOWS\system32\chmhp.exe
C:\WINDOWS\system32\HBmhly.dll
C:\WINDOWS\system32\HBASKTAO.dll
C:\WINDOWS\system32\HBWOW.dll
C:\WINDOWS\system32\HBTL.dll
C:\WINDOWS\system32\HBQQSG.dll
C:\WINDOWS\system32\HBWD.dll
C:\WINDOWS\system32\HBJTLQ.dll
C:\WINDOWS\system32\5934EA2B.dll
C:\WINDOWS\system32\16AF66EB.dll
C:\WINDOWS\system32\AD794E6B.dll
C:\WINDOWS\system32\D7C79813.dll
C:\WINDOWS\system32\201476D0.dll
C:\WINDOWS\system32\58FF3024.dll
C:\WINDOWS\system32\3B8DA919.dll
C:\WINDOWS\system32\08223B03.dll
C:\WINDOWS\system32\122B901E.dll
C:\WINDOWS\system32\E1D19FCC.dll
C:\WINDOWS\system32\9CA963CA.dll
C:\WINDOWS\system32\8566F82E.dll
C:\WINDOWS\system32\DA63E650.dll
C:\WINDOWS\system32\4FBFD5A4.dll
C:\WINDOWS\system32\A1A6BC2E.dll
C:\WINDOWS\system32\E4814792.dll
C:\WINDOWS\system32\BA7EDF54.dll
C:\WINDOWS\system32\34A25F04.dll
C:\WINDOWS\system32\B3721C07.dll
C:\WINDOWS\system32\66AFCB56.dll
C:\WINDOWS\system32\DFEC5CB7.dll
C:\WINDOWS\system32\C8EB51BC.dll
C:\WINDOWS\system32\2EF0D734.dll
C:\WINDOWS\system32\B8E83D3C.dll
C:\Program Files\Internet Explorer\VitnNt64.987
C:\WINDOWS\system32\E0D39066.dll
C:\Program Files\Internet Explorer\Vet4321t.321
C:\Program Files\Internet Explorer\Explo2eMt.456
C:\WINDOWS\system32\Drivers\aliimz.sys
C:\WINDOWS\system32\DRIVERS\comint32.sys
C:\WINDOWS\system32\drivers\HBKernel32.sys
C:\WINDOWS\system32\drivers\klif.sys
C:\WINDOWS\system32\c39e8db.sys
C:\WINDOWS\system32\d435fd4.sys
C:\WINDOWS\system32\f35ee9e.sys
C:\WINDOWS\system32\b160485.sys
C:\WINDOWS\system32\gdipro.dll
C:\WINDOWS\system32\sys05030.dll
C:\Documents and Settings\All Users\Application Data\Microsoft\Media Player\obj\wmpobj.sys
-------------------------------------------------------------------
S1：复制所有病毒文件的路径
S2：在待删除文件列表的框里右键→“剪贴板导入不检查路径（Y）”
S3：导入路径后再次右键点击“立刻重启执行删除”

二、用SREng修复注册表
    启动项目 —— 注册表
删除下面的项目
    <HBService32><System.exe>  []
    <nwiz><chmhp.exe>  []
    <{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}><5934EA2B.dll>  [N/A]
    <{16AF66EB-93C8-49F9-BB09-B4F87CEDCE46}><16AF66EB.dll>  []
    <{AD794E6B-90B7-4F9D-8FD6-0C16E3298FF2}><AD794E6B.dll>  []
    <{D7C79813-9233-4AE0-832C-99B2E8019673}><D7C79813.dll>  []
    <{201476D0-2B18-462E-AB9F-3E2B0CC8732B}><201476D0.dll>  []
    <{58FF3024-8A83-4B1A-88E9-302F47646EEE}><58FF3024.dll>  []
    <{3B8DA919-1139-4B10-AD8F-91E8FBCFD375}><3B8DA919.dll>  []
    <{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll>  []
    <{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll>  []
    <{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}><E1D19FCC.dll>  []
    <{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll>  []
    <{8566F82E-03A4-416E-AEAC-66600D8881F1}><8566F82E.dll>  []
    <{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll>  []
    <{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}><4FBFD5A4.dll>  []
    <{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll>  []
    <{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll>  []
    <{BA7EDF54-8408-4B21-B351-7B447B344BA4}><BA7EDF54.dll>  []
    <{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll>  []
    <{B3721C07-62B3-411A-9DC7-F5F27E3E21FF}><B3721C07.dll>  []
    <{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}><66AFCB56.dll>  []
    <{DFEC5CB7-E2AA-4B0A-BEB3-D140E59ED53A}><DFEC5CB7.dll>  []
    <{C8EB51BC-82D8-4018-8678-5A0580DBA04A}><C8EB51BC.dll>  []
    <{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll>  []
    <{B8E83D3C-9466-4091-9AD1-1F89418A6EB7}><B8E83D3C.dll>  []
    <{202AEF39-2BFA-4A5F-B526-390FDE0BC675}><C:\Program Files\Internet Explorer\VitnNt64.987>  []
    <{E0D39066-96D7-4891-8527-488ADAFCD60F}><E0D39066.dll>  []
    <{B05A92B0-F7B0-4E5B-884E-3D5FB2D4552A}><C:\Program Files\Internet Explorer\Vet4321t.321>  []
    <{E59C8BDA-489C-47EC-8967-A33C6A730B10}><C:\Program Files\Internet Explorer\Explo2eMt.456>  []

编辑下面的项目
<AppInit_DLLs>编辑为<>  (即空)

SREng的各项操作看这里

请楼主打包上来看看
C:\WINDOWS\System32\dnsrslvr.dll
C\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
C:\WINDOWS\system32\HookHelp.sys

顺便看看QQ目录内有没有psapi.dll这个文件
如有一并打包上来
并卸载QQ
粉碎QQ目录