中了BACKdoor.poedot.e 系统反复重起！瑞星升级到最新版也不行~！
怎么解决呢？
给个提示阿~！

病毒路径为:c:\windows\system32 \nddjwhb.exe(此文件名每次都是变化的)
病毒名称为:Backdoor.Poebot.e
瑞星显示清除失败~!
忘DX 指点

没有工具啊~!请楼上的给个工具

引用:

【命运里の金色的贴子】有没有到安全模式下查杀过? ...........................

杀过了
还是不行

系统是SP1
不能正常打补丁~!

System Information Collect Tool - Designed By Smallfrogs


20050911-10:02
Windows XP Service Pack 1
Internet Explorer: 6.0.2800.1106


*****************************************************************
      Runing Processes information
*****************************************************************
=====================================================
PROCESS NAME:  System
-----------------------------------------------------
  Process ID  = 0x00000004
  Thread count= 52
  Parent process ID = 0
  Priority Class    = 32


Modules:
------------------------------------


=====================================================
PROCESS NAME:  SMSS.EXE
-----------------------------------------------------
  Process ID  = 0x000001a8
  Thread count= 3
  Parent process ID = 4
  Priority Class    = 32


Modules:
------------------------------------
\SystemRoot\System32\smss.exe (0x48580000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)



=====================================================
PROCESS NAME:  CSRSS.EXE
-----------------------------------------------------
  Process ID  = 0x000001e4
  Thread count= 13
  Parent process ID = 424
  Priority Class    = 32


Modules:
------------------------------------
\??\C:\WINDOWS\system32\csrss.exe (0x4A680000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)

C:\WINDOWS\system32\CSRSRV.dll (0x75AA0000)

C:\WINDOWS\system32\basesrv.dll (0x75AB0000)

C:\WINDOWS\system32\winsrv.dll (0x75AC0000)

C:\WINDOWS\system32\USER32.dll (0x77D10000)

C:\WINDOWS\system32\KERNEL32.dll (0x77E40000)

C:\WINDOWS\system32\GDI32.dll (0x77C40000)

C:\WINDOWS\system32\ADVAPI32.dll (0x77DA0000)

C:\WINDOWS\system32\RPCRT4.dll (0x78000000)

C:\WINDOWS\System32\LPK.DLL (0x62C20000)

C:\WINDOWS\System32\USP10.dll (0x72F10000)

C:\WINDOWS\System32\sxs.dll (0x75E00000)



=====================================================
PROCESS NAME:  WINLOGON.EXE
-----------------------------------------------------
  Process ID  = 0x000001fc
  Thread count= 19
  Parent process ID = 424
  Priority Class    = 128


Modules:
------------------------------------
\??\C:\WINDOWS\system32\winlogon.exe (0x01000000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)

C:\WINDOWS\system32\kernel32.dll (0x77E40000)

C:\WINDOWS\system32\msvcrt.dll (0x77BE0000)

C:\WINDOWS\system32\ADVAPI32.dll (0x77DA0000)

C:\WINDOWS\system32\RPCRT4.dll (0x78000000)

C:\WINDOWS\system32\GDI32.dll (0x77C40000)

C:\WINDOWS\system32\USER32.dll (0x77D10000)

C:\WINDOWS\system32\USERENV.dll (0x759D0000)

C:\WINDOWS\system32\NDdeApi.dll (0x758A0000)

C:\WINDOWS\system32\CRYPT32.dll (0x76230000)

C:\WINDOWS\system32\MSASN1.dll (0x76210000)

C:\WINDOWS\system32\Secur32.dll (0x76F60000)

C:\WINDOWS\system32\WINSTA.dll (0x762D0000)

C:\WINDOWS\system32\PROFMAP.dll (0x75890000)

C:\WINDOWS\system32\NETAPI32.dll (0x71BA0000)

C:\WINDOWS\system32\REGAPI.dll (0x76B90000)

C:\WINDOWS\system32\WS2_32.dll (0x71A20000)

C:\WINDOWS\system32\WS2HELP.dll (0x71A10000)

C:\WINDOWS\system32\AUTHZ.dll (0x76C90000)

C:\WINDOWS\system32\PSAPI.DLL (0x76BC0000)

C:\WINDOWS\system32\VERSION.dll (0x77BD0000)

C:\WINDOWS\system32\SETUPAPI.dll (0x765E0000)

C:\WINDOWS\System32\IMM32.DLL (0x76300000)

C:\WINDOWS\System32\LPK.DLL (0x62C20000)

C:\WINDOWS\System32\USP10.dll (0x72F10000)

C:\WINDOWS\System32\MSGINA.dll (0x758D0000)

C:\WINDOWS\system32\SHELL32.dll (0x773A0000)

C:\WINDOWS\system32\SHLWAPI.dll (0x772A0000)

C:\WINDOWS\system32\COMCTL32.dll (0x77310000)

C:\WINDOWS\System32\ODBC32.dll (0x1F7B0000)

C:\WINDOWS\system32\comdlg32.dll (0x76320000)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll (0x78090000)

C:\WINDOWS\System32\odbcint.dll (0x1F850000)

C:\WINDOWS\System32\SHSVCS.dll (0x76BA0000)

C:\WINDOWS\system32\sfc.dll (0x76B80000)

C:\WINDOWS\System32\sfc_os.dll (0x76C30000)

C:\WINDOWS\System32\WINTRUST.dll (0x76C00000)

C:\WINDOWS\system32\ole32.dll (0x00A30000)

C:\WINDOWS\system32\IMAGEHLP.dll (0x76C60000)

C:\WINDOWS\System32\msctfime.ime (0x00E70000)

C:\WINDOWS\System32\WINSCARD.DLL (0x72360000)

C:\WINDOWS\System32\WTSAPI32.dll (0x76F20000)

C:\WINDOWS\System32\uxtheme.dll (0x5ADC0000)

C:\WINDOWS\System32\WINMM.dll (0x76B10000)

C:\WINDOWS\System32\SYNCOR11.DLL (0x6BD00000)

C:\WINDOWS\system32\cscdll.dll (0x76570000)

C:\WINDOWS\system32\WlNotify.dll (0x758B0000)

C:\WINDOWS\System32\WINSPOOL.DRV (0x72F70000)

C:\WINDOWS\system32\MPR.dll (0x71A90000)

C:\WINDOWS\System32\rsaenh.dll (0x0FFD0000)

C:\WINDOWS\System32\SAMLIB.dll (0x71B70000)

C:\WINDOWS\system32\msv1_0.dll (0x76CE0000)

C:\WINDOWS\System32\cscui.dll (0x76590000)

C:\WINDOWS\System32\wdmaud.drv (0x72C90000)

C:\WINDOWS\System32\NTMARTA.DLL (0x76CB0000)

C:\WINDOWS\system32\WLDAP32.dll (0x76F30000)

C:\WINDOWS\System32\msacm32.drv (0x72C80000)

C:\WINDOWS\System32\MSACM32.dll (0x77BB0000)

C:\WINDOWS\System32\midimap.dll (0x77BA0000)

C:\WINDOWS\System32\sxs.dll (0x75E00000)

C:\WINDOWS\etb\nt_hide66.dll (0x10000000)

C:\WINDOWS\System32\COMRes.dll (0x77020000)

C:\WINDOWS\system32\OLEAUT32.dll (0x770F0000)

C:\WINDOWS\System32\CLBCATQ.DLL (0x76FA0000)

C:\WINDOWS\System32\Cabinet.dll (0x750B0000)



=====================================================
PROCESS NAME:  SERVICES.EXE
-----------------------------------------------------
  Process ID  = 0x00000230
  Thread count= 18
  Parent process ID = 508
  Priority Class    = 32

*****************************************************************
      File association information
*****************************************************************
------------------------------------------------------------
0：HKEY_CLASSES_ROOT\.exe
------------------------------------------------------------
<DEFAULT> = exefile, 正常！
------------------------------------------------------------
1：HKEY_CLASSES_ROOT\exefile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
2：HKEY_CLASSES_ROOT\exefile\shell\runas\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
3：HKEY_CLASSES_ROOT\.txt
------------------------------------------------------------
<DEFAULT> = txtfile, 正常！
------------------------------------------------------------
4：HKEY_CLASSES_ROOT\txtfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = %SystemRoot%\system32\NOTEPAD.EXE %1, 正常！
------------------------------------------------------------
5：HKEY_CLASSES_ROOT\.reg
------------------------------------------------------------
<DEFAULT> = regfile, 正常！
------------------------------------------------------------
6：HKEY_CLASSES_ROOT\regfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = regedit.exe "%1", 正常！
------------------------------------------------------------
7：HKEY_CLASSES_ROOT\.bat
------------------------------------------------------------
<DEFAULT> = batfile, 正常！
------------------------------------------------------------
8：HKEY_CLASSES_ROOT\batfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
9：HKEY_CLASSES_ROOT\.com
------------------------------------------------------------
<DEFAULT> = comfile, 正常！
------------------------------------------------------------
10：HKEY_CLASSES_ROOT\comfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
11：HKEY_CLASSES_ROOT\.scr
------------------------------------------------------------
<DEFAULT> = scrfile, 正常！
------------------------------------------------------------
12：HKEY_CLASSES_ROOT\scrfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" /S, 正常！
------------------------------------------------------------
13：HKEY_CLASSES_ROOT\.pif
------------------------------------------------------------
<DEFAULT> = piffile, 正常！
------------------------------------------------------------
14：HKEY_CLASSES_ROOT\piffile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！

引用:

【命运里の金色的贴子】最好能到sp2,不然可能会反复感染 ...........................

不能升级到SP2 的~!

两位老大
赶紧看啊