12   2  /  2  页   跳转

大家快来救救我啊~!

浏览器加载项
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, N/A>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <d:\Program Files\Thunder Network\Thunder\Thunder.exe, N/A>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里软件(中国)有限公司>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[&使用迅雷下载]
  <d:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <d:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>

==================================
gototop
 

正在运行的进程
[PID: 396][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 532][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 576][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 588][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 748][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 880][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1248][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav20.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[PID: 268][C:\WINDOWS\system32\notepad.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2324][D:\Program Files\Alisoft\WangWang\WangWang.exe]  [阿里软件(中国)有限公司, 5, 0, 0, 3]
    [D:\Program Files\Alisoft\WangWang\AliViewCtrl.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 2]
    [D:\Program Files\Alisoft\WangWang\VLNetwork.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 6]
    [D:\Program Files\Alisoft\WangWang\MFC80.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Program Files\Alisoft\WangWang\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Program Files\Alisoft\WangWang\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Program Files\Alisoft\WangWang\AliViewMedia.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 2]
    [D:\Program Files\Alisoft\WangWang\VideoCap.dll]  [, 1, 0, 0, 4]
    [D:\Program Files\Alisoft\WangWang\VLAudio.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 5]
    [D:\Program Files\Alisoft\WangWang\JsmShow.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 4]
    [D:\Program Files\Alisoft\WangWang\AliSkin.dll]  [TODO: <公司名>, 1.0.0.1]
    [D:\Program Files\Alisoft\WangWang\zlib.dll]  [, 1.2.3]
    [D:\Program Files\Alisoft\WangWang\ww_network.dll]  [, 1, 0, 1, 22]
    [D:\Program Files\Alisoft\WangWang\MFC80CHS.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Program Files\Alisoft\WangWang\RICHED32.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\Alisoft\WangWang\RICHED20.dll]  [Microsoft Corporation, 5.30.23.1221]
    [D:\Program Files\Alisoft\WangWang\MessageNotify.dll]  [, 1, 0, 0, 1]
    [D:\Program Files\Alisoft\WangWang\Ali_Res.DLL]  [N/A, ]
    [D:\PROGRA~1\Alisoft\WangWang\TBATAB~1.OCX]  [alibaba, 1, 0, 0, 1]
    [D:\PROGRA~1\Alisoft\WangWang\MFC80.DLL]  [Microsoft Corporation, 8.00.50727.42]
    [D:\PROGRA~1\Alisoft\WangWang\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\PROGRA~1\Alisoft\WangWang\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Program Files\Alisoft\WangWang\WangWangX4.dll]  [阿里软件(中国)有限公司, 1, 0, 0, 1]
    [D:\Program Files\Alisoft\WangWang\RichOne.dll]  [阿里软件(中国)有限公司, 1.0.0.1]
    [D:\Program Files\Alisoft\WangWang\TBProgress.dll]  [阿里软件(中国)有限公司, 1.0.0.1]
    [D:\Program Files\Alisoft\WangWang\tbATabControl.ocx]  [alibaba, 1, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav20.dll]  [N/A, ]
[PID: 172][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav20.dll]  [N/A, ]
    [C:\Documents and Settings\Administrator\桌面\sreng2\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]

==================================
gototop
 





=



文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
127.0.0.1      mmm.caifu18.net
127.0.0.1      www.18dmm.com
127.0.0.1      d.qbbd.com
127.0.0.1      www.5117music.com
127.0.0.1      www.union123.com
127.0.0.1      www.wu7x.cn
127.0.0.1      www.54699.com
127.0.0.1      60.169.0.66
127.0.0.1      60.169.1.29
127.0.0.1      www.97725.com
127.0.0.1      down.97725.com
127.0.0.1      ip.315hack.com
127.0.0.1      ip.54liumang.com
127.0.0.1      www.41ip.com
127.0.0.1      xulao.com
127.0.0.1      www.heixiou.com
127.0.0.1      www.9cyy.com
127.0.0.1      www.hunll.com
127.0.0.1      www.down.hunll.com
127.0.0.1      do.77276.com
127.0.0.1      www.baidulink.com
127.0.0.1      adnx.yygou.cn
127.0.0.1      222.73.220.45
127.0.0.1      www.f5game.com
127.0.0.1      www.guazhan.cn
127.0.0.1      wm,103715.com
127.0.0.1      www.my6688.cn
127.0.0.1      i.96981.com
127.0.0.1      d.77276.com
127.0.0.1      www1.cw988.cn
127.0.0.1      cool.47555.com
127.0.0.1      www.asdwc.com
127.0.0.1      55880.cn
127.0.0.1      61.152.169.234
127.0.0.1      cc.wzxqy.com
127.0.0.1      www.54699.com

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

谢谢了啊,都上来了,帮我看看吧
gototop
 

我现在把他删除了看怎么样,呵呵
gototop
 

引用:
【baohe的贴子】【回复“baby2258”的帖子】
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<EXPLORER><C:\Program Files\Common Files\System\wab32res.exe> []
<9yuvf8t><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<vdyqydk30x><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe> [N/A]
<gm4xrdw01><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1explore.exe> [N/A]
<vgvwqxz><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe> [N/A]
<u2s2wv><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> [N/A]
<ury51wwwl2whxl3><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe> [N/A]
<t><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<checkinstall><C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\CheckInstall.exe> [N/A]
<MenuOrder><C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe> [N/A]

楼主节哀吧!
C:\Program Files\Common Files\System\wab32res.exe——————就这一个病毒,已经够你喝一壶的了!但愿杀软能“清除”所有被感染文件中的病毒代码且不影响其运行。

………………

难道只能格盘了啊,装系统能解决了问题吗
gototop
 

谢谢大家了,我格一下吧~!
gototop
 

真的不想格啊,难道没有好办法了吗
gototop
 

真的没有办法了吗,我几年的心血啊~
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT