中毒啦！好老火 高手帮个忙 在线等





                        很多歌病毒  还有木马  多得很 :kaka4:
这是木马Trojan.ytewcxzsw.wrew2ds(C:\WINDOWS\SYSTEM32\DRIVERS\TXP1ATFORM.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVENGINE.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVGUARD.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVLTMAIN.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVTASK.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BDWIZREG.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BOXMOD.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CCREGVFY.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FRWSTUB.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KNOWNSVR.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\LIVESRV.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MAKEREPORT.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MCDASH.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MCDETECT.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MCVSESCN.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MCVSSHLD.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MGHTML.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NAPRDMGR.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\OASCLNT.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PAVSRV51.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PSCTRLS.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PSIMREAL.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PSIMSVC.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\QQDOCTORMAIN.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RSMAIN.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RSNETSVR.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RSSAFETY.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCANFRM.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SCHED.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SECNOTIFIER.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETUPLD.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SHSTAT.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SNDSRVC.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPBBCSVC.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TBMON.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\UPDATERUI.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCR32.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VSSERV.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VSTSKMGR.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WEBPROXY.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\XCOMMSVR.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\XNLSCN.EXE


trojan.winsp.tdffdl(HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VPTRAY.EXE)

Trojan.msosiocp.dosjisnHKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EGUI.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KACCORE.EXE
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\KISSVC.EXE



Trojan.Driver exdenHKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CCAPP.EXE


trojan files2HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RFWPROXY.EXE


还很多·························
用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 1.7; TencentTraveler 4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727)

注意先操作：
找到c:\windows\system32\appmgmts.dll文件，右键重命名为“1.dll”；
下载2个附件附件，解压“appmgmts.rar”后复制“appmgmts.dll”文件粘贴到c:\windows\system32\文件夹内；

用XDelBox勾选抑制再生后删除以下文件：(XDelBox1.8剑盟版下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

c:\windows\system32\drivers\txp1atform.exe
c:\windows\system32\bc7a.dll
c:\windows\system\nb9ming32c090423.dll
c:\windows\system\ming9b090423.exe
c:\documents and settings\admin\「开始」菜单\程序\启动\dfhbsming9.exe
c:\windows\system32\bc7a.dll
c:\program files\common files\musvus\gehese.exe
c:\windows\system32\drivers\klan.sys
c:\docume~1\admin\locals~1\temp\vtayn.sys
c:\windows\system32\sx.sys
c:\windows\system32\drivers\sr.sys
c:\progra~1\iefxz\iefxz.dll
c:\windows\downloaded program files\hansetup1020.dll
c:\windows\system32\1.dll

删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[ming9bstart] 

    启动项目 －－　启动文件夹之如下项删除：
[dfhbsming9]   

    启动项目 －－ 服务 －－ Win32服务应用程序之如下项禁用：
[Microsoft Device Logical / porting]
[System Log Data Manager / sldm]   

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
[klan / klan]   
[vtayn / vtayn] 
[sx / sx]       

    系统修复－－　浏览器加载项之如下项删除：
[IEFXZ]   
[IEFXZHelper]   
[QQRightClick Class] 
[Zyzzyva] 
[HanSetupCtrl1010 Class]   
[IEFXZTool] 

解压附件“映像劫持清除工具.rar”，参考图片使用方法运行“映像劫持修复工具.exe”修复IFEO映像劫持；

做完下载以下软件清理一次并更新杀毒软件至最新进行全盘杀毒一次

清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe
下载 windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.zip

c:\windows\system32\drivers\txp1atform.exe
宝马？

什么宝马