病毒文件在C\WINDOWS下，每次出现都会把瑞星监控消失掉，不是任何时候都出现，是一打开大程序或者打开ACDSEE就会出现，而且两个病毒文件的图标会变，假如我打开游戏，图标就变成我打开那个游戏的图标，假如我打开ACDSS，那么图标就变成ACDSEE的图标，，我已经手动将两个文件删除，但是只要一运行一些程序就会出来，

而且只要Logo1_.EXE和rundl132.exe 的出现,那么又会生成其它文件到其他地方

........虽然是能杀得掉,但是那两个文件还是杀不了,,而且还在C\WINDOWS下生成COMMAND文件夹里面再声称RUNDLL32.EXE文件,还有一个在在C\WINDOWS下生成1SY.EXE,,其他SY.EXE都能杀掉,这个1SY.EXE和COMMAND下的RUNDLL32.EXE瑞星都检查不到,杀不到,,,
而且还发现在"病毒隔离"里看到的那几个文件,瑞星是能杀得到,但是病毒警告不停的弹出来,直到瑞星监控挺不住消失为止

哦 还有三个现象就是昨天到现在我与另外一台电脑都动不动就断线,重启路油和MODEM才能继续上网.
另外一个现在就是 :只要出现那两个文件,那么还会在每个盘符和每个文件夹下生成_desktop.INI隐藏文件,弄的要清理很难清理
第三个还会在生成C:\WINDOWS\Intel\rundll32.exe

引用:

【deadmanzj的贴子】是威金，把样本发给我好吗？压缩加密123，发送到gudugd@yahoo.com.cn ………………

两个文件我手动删除了,,等再出现再发给你

2006-09-10,17:20:54

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <msnappau><"C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\msnappau.exe">  [Microsoft Corporation]
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <HDDGMon><C:\program files\YuanZhi\Recovery Genius\WinNT\HDDGMon.exe>  []
    <RavTask><"d:\Program Files\Rising\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <Tray><C:\WINDOWS\command\rundll32.exe>  []
    <zt><C:\WINDOWS\Intel\rundll32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <RavStub><"d:\Program Files\Rising\ravstub.exe" /RUNONCE>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><KB391231M.LOG>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys>  []

==================================
启动文件夹
[INTERNAT]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\INTERNAT.lnk><N>

==================================

服务
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"d:\Program Files\Rising\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"d:\Program Files\Rising\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Symantec Network Drivers Service / SNDSrvc]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><N/A>
[VMware Authorization Service / VMAuthdService]
  <D:\Program Files\VMware Workstation\vmware-authd.exe><VMware, Inc.>
[VMware DHCP Service / VMnetDHCP]
  <C:\WINDOWS\System32\vmnetdhcp.exe><VMware, Inc.>
[VMware Virtual Mount Manager Extended / vmount2]
  <C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe><VMware, Inc.>
[VMware NAT Service / VMware NAT Service]
  <C:\WINDOWS\System32\vmnat.exe><VMware, Inc.>

==================================
浏览器加载项
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FlashGet\jccatch.dll, Amaze Soft>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\game\浩方对战平台\GameClient.exe, >
[超级解霸10 Beta]
  {367E0A21-8601-4986-9C9A-153BF5ACA118} <d:\Program Files\超级解霸10\STHSDVD.EXE, herosoft>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\OFFICE~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\flashget.exe, >
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[MSN 工具栏]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[使用网际快车下载]
  <D:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\Program Files\FlashGet\jc_all.htm, N/A>
[使用超级解霸播放]
  <d:\Program Files\超级解霸10\MPURLGET.HTM, N/A>
[在Foxmail中添加该RSS频道/频道组]
  <res://C:\WINDOWS\System32\fmrsslink.dll/201, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\OFFICE~1\OFFICE11\EXCEL.EXE/3000, N/A>
[用比特精灵下载(&B)]
  <D:\Program Files\BitSpirit\bsurl.htm, N/A>

==================================
正在运行的进程
[PID: 480][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 536][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 608][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 620][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 780][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 832][d:\Program Files\Rising\CCenter.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 860][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 956][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1112][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1152][d:\Program Files\Rising\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 35>
    [d:\Program Files\Rising\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [d:\Program Files\Rising\RsCommX.dll]  <rising><18, 0, 0, 1>
    [d:\Program Files\Rising\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [d:\Program Files\Rising\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [d:\Program Files\Rising\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\Program Files\Rising\RsLog.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [d:\Program Files\Rising\HOOKSYS.dll]  <Beijing Rising Technology Co., Ltd.><18, 1, 0, 11>
    [d:\Program Files\Rising\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [d:\Program Files\Rising\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [d:\Program Files\Rising\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [d:\Program Files\Rising\regmon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [d:\Program Files\Rising\HookWeb.dll]  <rising><18, 0, 0, 2>
    [d:\Program Files\Rising\MemMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [d:\Program Files\Rising\expscan.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\Program Files\Rising\mPorts.dll]  <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
    [d:\Program Files\Rising\MailMon.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [d:\Program Files\Rising\SpamEng.dll]  <N/A><18, 0, 0, 6>
    [d:\Program Files\Rising\engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 34>
    [d:\Program Files\Rising\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [d:\Program Files\Rising\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [d:\Program Files\Rising\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [d:\Program Files\Rising\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
    [d:\Program Files\Rising\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
    [d:\Program Files\Rising\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [d:\Program Files\Rising\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [d:\Program Files\Rising\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [d:\Program Files\Rising\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\Program Files\Rising\ExtFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [d:\Program Files\Rising\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [d:\Program Files\Rising\RsStore.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [d:\Program Files\Rising\ScanNet.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1340][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1556][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [D:\PROGRA~1\FlashGet\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [d:\Program Files\Rising\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [d:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\l3codeca.acm]  <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
    [C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  <Adobe Systems, Incorporated><7.0>
    [d:\Program Files\UltraEdit-32\ue32ctmn.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\WINABCX.IME]  <PKUETI><5.22.216>
[PID: 1676][d:\Program Files\Rising\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [d:\Program Files\Rising\RsCommX.dll]  <rising><18, 0, 0, 1>
    [d:\Program Files\Rising\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1856][C:\WINDOWS\System32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5216>
[PID: 220][C:\program files\YuanZhi\Recovery Genius\WinNT\HDDGMon.exe]  <><5, 0, 0, 350>
    [C:\program files\YuanZhi\Recovery Genius\WinNT\SimCom.dll]  <N/A><N/A>
    [C:\program files\YuanZhi\Recovery Genius\WinNT\chkID.dll]  <N/A><N/A>
    [C:\program files\YuanZhi\Recovery Genius\WinNT\HMRes.dll]  <><5, 0, 0, 350>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 228][D:\Program Files\Rising\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [D:\Program Files\Rising\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\Rising\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
[PID: 328][C:\Program Files\MSN Messenger\MsnMsgr.Exe]  <Microsoft Corporation><8.0.0792.00>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
[PID: 432][C:\WINDOWS\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 1132][D:\Program Files\Winamp\Winamp.exe]  <Nullsoft><2.81>
    [D:\Program Files\Winamp\Plugins\IN_CDDA.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\IN_MIDI.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\read_file.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\IN_MOD.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\IN_MP3.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\in_vorbis.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\IN_WAVE.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\IN_WM.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\OUT_DISK.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\OUT_DS.DLL]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\out_wave.dll]  <N/A><N/A>
    [D:\Program Files\Winamp\Plugins\OUT_WM.DLL]  <N/A><N/A>
    [C:\WINDOWS\System32\tssoft32.acm]  <DSP GROUP, INC.><1.01>
    [C:\WINDOWS\System32\tsd32.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\sl_anet.acm]  <Sipro Lab Telecom Inc.><3.02>
    [C:\WINDOWS\System32\l3codeca.acm]  <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>

[PID: 3152][C:\WINDOWS\System32\conime.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 2292][C:\WINDOWS\System32\taskmgr.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 1936][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 3084][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\msntb.dll]  <Microsoft Corporation><01.01.2607.0>
    [C:\Program Files\MSN Toolbar\01.01.2607.0\zh-cn\mtbres.dll]  <Microsoft Corporation><01.01.2607.0>
    [D:\PROGRA~1\FlashGet\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\WINDOWS\System32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
    [C:\WINDOWS\System32\WINABCX.IME]  <PKUETI><5.22.216>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
    [C:\Documents and Settings\Administrator\桌面\VirusKiller.scr]  <Beijing Rising Tech. Co., Ltd.><1, 0, 0, 1>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 2752][C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\msnappau.exe]  <Microsoft Corporation><01.02.0002.1001>
    [C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\au_util.dll]  <Microsoft Corporation><01.02.0002.1001>
    [C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-cn\TBDwnMgr.dll]  <Microsoft Corporation><01.02.0002.1001>
[PID: 3880][D:\Program Files\Rising\RavMon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 33>
    [D:\Program Files\Rising\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 26>
    [D:\Program Files\Rising\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [D:\Program Files\Rising\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [D:\Program Files\Rising\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [D:\Program Files\Rising\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [D:\Program Files\Rising\RsCommX.dll]  <rising><18, 0, 0, 1>
    [D:\Program Files\Rising\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>
[PID: 2084][D:\资料\软件\系统工具\sreng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Internet Explorer\PLUGINS\system.sys]  <N/A><N/A>
    [C:\MICKNEWWOWTRO\MICKNEWWOWTRO.DLL]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  Error. ["d:\网页三剑客\Dreamweaver MX 2004\Dreamweaver.exe" "%1"]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

引用:

【songsong123的贴子】Mcafee 4850病毒库已经可以查杀，清除这个病毒了，我今天修复了600多个exe文件。Mcafee不愧是杀软大厂，大家快去试试。 什么地方有下载啊?? ………………

哇  都什么时候拉，还回帖，，病毒早就清除完了