瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中了XYDLL病毒,连瑞星也进不了了,怎办?(附扫描日志)

1   1  /  1  页   跳转

中了XYDLL病毒,连瑞星也进不了了,怎办?(附扫描日志)

中了XYDLL病毒,连瑞星也进不了了,怎办?(附扫描日志)

电脑对所有EXE文件都有错误提示,如启动AAA。EXE,则提示"AAA错误(XYDLL。DLL),AAA即将关闭",连瑞星也进不了,瑞星也是。EXE的文件。附上日志,请求帮助
2006-11-28,21:33:51

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows Millennium Edition -

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><internat.exe>  [Microsoft Corporation]
    <ScanRegistry><C:\WINDOWS\scanregw.exe /autorun>  [Microsoft Corporation]
    <TaskMonitor><C:\WINDOWS\taskmon.exe>  [Microsoft Corporation]
    <SystemTray><SysTray.Exe>  [Microsoft Corporation]
    <LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme>  [Microsoft Corporation]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <PCHealth><C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s>  [Microsoft Corporation]
    <SelfHostUtil><C:\WINDOWS\selfhost.exe /L>  [Microsoft Corporation]
    <helper.dll><C:\WINDOWS\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>  [$]
    <YLive.exe><C:\PROGRA~1\YAHOO!\ASSIST~1\YLive.exe>  [Yahoo! China]
    <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32>  [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme>  [Microsoft Corporation]
    <SchedulingAgent><mstask.exe>  [Microsoft Corporation]
    <*StateMgr><C:\WINDOWS\System\Restore\StateMgr.exe>  [Microsoft Corporation]
    <RsCcenter><"C:\Program Files\Rising\Rav\CCenter.exe">  [Beijing Rising Technology Co., Ltd.]
    <RavMond><"C:\Program Files\Rising\Rav\RavMond.exe">  [Beijing Rising Technology Co., Ltd.]
    <RavMon><"C:\Program Files\Rising\Rav\RavMon.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <HiberMonitor><C:\WINDOWS\HCount.exe>  [N/A]

==================================
启动文件夹
N/A

==================================
服务
N/A

==================================
驱动程序
N/A

==================================
浏览器加载项
[assist]
  {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRAM FILES\YAHOO!\ASSISTANT\ASSIST\YASSIST.DLL, Yahoo! China>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHOOK.DLL, 北京三七二一科技有限公司>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\PROGRA~1\MESSEN~1\MSMSGS.EXE, Microsoft Corporation>
[NetAnts]
  {57E91B47-F40A-11D1-B792-444553540000} <C:\PROGRA~1\NETANTS\NetAnts.exe,  >
[江民在线杀毒]
  {06926B30-424E-4f1c-8EE3-543CD96573DC} <http://online.jiangmin.com/online.asp, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[名品折扣]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[Yahoo 3.5G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[雅虎WIDGET]
  {6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH9B.OCX, Adobe Systems, Inc.>
[AutoLive]
  {7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRAM FILES\3721\AUTOLIVE.DLL, $>
[&Download by NetAnts]
  <C:\PROGRA~1\NETANTS\NAGet.htm, N/A>
[Download &All by NetAnts]
  <C:\PROGRA~1\NETANTS\NAGetAll.htm, N/A>
[雅虎搜索]
  <res://C:\PROGRAM FILES\YAHOO!\ASSISTANT\ASSIST\YASBAR.DLL/203, N/A>
最后编辑2006-11-29 09:59:26
分享到:
gototop
 

==================================
正在运行的进程
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
[PID: 4294963039][C:\WINDOWS\SYSTEM\SPOOL32.EXE]  [Microsoft Corporation, 4.90.3000]
[PID: 4294841075][C:\WINDOWS\SYSTEM\MPREXE.EXE]  [Microsoft Corporation, 4.90.3000]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
[PID: 4294884275][C:\WINDOWS\SYSTEM\MSTASK.EXE]  [Microsoft Corporation, 4.71.2721.1]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
[PID: 4294894391][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
[PID: 4294827279][C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE]  [Microsoft Corporation, 4.90.0.2533]
    [C:\PROGRAM FILES\3721\ALLIVEEX.DLL]  [ , 1, 0, 3, 1006]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\NOTIFIER.DLL]  [$, 1, 0, 0, 5]
    [C:\PROGRAM FILES\3721\AUTOLIVE.DLL]  [$, 1, 2, 0, 1330]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
[PID: 4294891779][C:\RUNDLL32.EXE]  [Microsoft Corporation, 4.90.3000]
    [C:\PROGRAM FILES\3721\ALLIVEEX.DLL]  [ , 1, 0, 3, 1006]
    [C:\PROGRAM FILES\3721\AUTOLIVE.DLL]  [$, 1, 2, 0, 1330]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YALIVE.DLL]  [yahoo! china, 3,5,1,1102]
    [C:\WINDOWS\SYSTEM\DCIMAN32.DLL]  [Intel(R) Corp., Microsoft Corp., 4.90.3000]
    [C:\PROGRAM FILES\WINRAR\RAREXT.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\SYSTEM\RAVEXT.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
    [C:\PROGRAM FILES\3721\SKE\CONTMENU.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YHELPER.DLL]  [Yahoo! China, 3, 0, 4, 1022]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\WININFO.RXK]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\ALREX.DLL]  [$, 1, 0, 1, 1001]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
[PID: 4294882135][C:\WINDOWS\EXPLORER.EXE]  [Microsoft Corporation, 5.50.4134.100]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
[PID: 4294712855][C:\WINDOWS\SYSTEM\RPCSS.EXE]  [Microsoft Corporation, 4.71.3328]
[PID: 4294817535][C:\WINDOWS\RUNDLL32.EXE]  [N/A, N/A]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YHELPER.DLL]  [Yahoo! China, 3, 0, 4, 1022]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINEX.DLL]  [国风因特软件(北京)有限公司, 1, 0, 3, 5]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSIO.DLL]  [北京三七二一科技有限公司, 1, 0, 2, 8]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMINIO.DLL]  [北京三七二一科技有限公司, 1, 0, 3, 7]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
[PID: 4294790235][C:\RUNDLL32.EXE]  [Microsoft Corporation, 4.90.3000]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
[PID: 4294767367][C:\WINDOWS\SYSTEM\INTERNAT.EXE]  [Microsoft Corporation, 4.90.1000.0]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
[PID: 4294671823][C:\WINDOWS\TASKMON.EXE]  [Microsoft Corporation, 4.90.3000]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
[PID: 4294644683][C:\WINDOWS\SYSTEM\SYSTRAY.EXE]  [Microsoft Corporation, 4.90.3000]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
[PID: 4294662587][C:\WINDOWS\RUNDLL32.EXE]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YHELPER.DLL]  [Yahoo! China, 3, 0, 4, 1022]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMX.DLL]  [rising, 18, 0, 0, 1]
    [C:\PROGRAM FILES\RISING\RAV\CFGDLL.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
    [C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 4294699035][C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[PID: 4294596419][C:\WINDOWS\RUNDLL32.EXE]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YALIVE.DLL]  [yahoo! china, 3,5,1,1102]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YHELPER.DLL]  [Yahoo! China, 3, 0, 4, 1022]
[PID: 4294581403][C:\PROGRAM FILES\YAHOO!\ASSISTANT\YLIVE.EXE]  [Yahoo! China, 3, 1, 7, 1023]
[PID: 4294578999][C:\WINDOWS\RUNDLL32.EXE]  [N/A, N/A]
[PID: 4294515211][C:\WINDOWS\SYSTEM\WMIEXE.EXE]  [Microsoft Corporation, 4.90.2452.1]
    [C:\WINDOWS\SYSTEM\DHCPCSVC.DLL]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM\XYDLL.DLL]  [N/A, N/A]
    [C:\PROGRAM FILES\INTERNET EXPLORER\PLUGINS\SYSTEM16.SYS]  [N/A, N/A]
    [C:\PROGRAM FILES\3721\HELPER.DLL]  [$, 1, 1, 1, 1327]
    [C:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSMIN.DLL]  [北京三七二一科技有限公司, 1, 5, 4, 0]
    [C:\PROGRAM FILES\YAHOO!\ASSISTANT\YHELPER.DLL]  [Yahoo! China, 3, 0, 4, 1022]
[PID: 4294450315][C:\WINDOWS\DESKTOP\SRENG2\SRENG\SRENG.EXE]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\SYSTEM\NETBIOS.DLL]  [N/A, N/A]
gototop
 

==================================
文件关联
.TXT  OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [C:\WINDOWS\winhlp32.exe %1]
.INI  OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF  OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS  OK. [C:\WINDOWS\WScript.exe "%1" %*]
.JS  OK. [C:\WINDOWS\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
gototop
 

除了这没别的办法了?xydll.dll如删了,等一下还是会有的,这一定还有其他的文件为主,xydll.dll只是某个文件运行后派生的,究竟最原始的是哪个文件?
gototop
 

还有有时在windows\temp\建立1.EXE,2.exe,3.exe文件
gototop
 

各位大虾,请看一下呀
gototop
 

不能
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT