病毒在进程中叫:a9601.exe
在系统盘 System32 中有个 a9601的执行文件..删除后 打开IE 还会再次生成..
我都快晕了..求高手救我..~这是日志..分成两部分发..病毒名:a9601.exe
瑞星卡卡电脑诊断日志 v1.20 (2007-7-11 11:34:16)  北京瑞星科技股份有限公司

注释:    [A]表示该文件存在自启动关联;
    [M]表示该文件在内存中;

+ 注册表自运行项目
  + Win32 Services
    + HKLM\System\CurrentControlSet\Services
      ms_2fax
        [AM] 1. c:\windows\system32\a9601.exe
      NVSvc
        [AM] 2. c:\windows\system32\nvsvc32.exe
      RfwProxySrv
        [A ] 3. c:\program files\rising\rfw\rfwproxy.exe
      RfwService
        [A ] 4. c:\program files\rising\rfw\rfwsrv.exe
      RsCCenter
        [A ] 5. c:\program files\rising\rav\ccenter.exe
      RsRavMon
        [A ] 6. c:\program files\rising\rav\ravmond.exe
      UMWdf
        [A ] 7. c:\windows\system32\wdfmgr.exe
      VKYNCQFUIWL
        [AM] 8. c:\windows\system32\jrzis.dll
  + Kernel Drivers
    + HKLM\System\CurrentControlSet\Services
      aeaudio
        [A ] 9. c:\windows\system32\drivers\aeaudio.sys
      BaseTDI
        [A ] 10. c:\windows\system32\drivers\basetdi.sys
      CMB8100
        [A ] 11. c:\windows\system32\drivers\certclient.dat
      CMBProtector
        [A ] 12. c:\windows\system32\drivers\cmbprotector.dat
      DCN530
        [A ] 13. c:\windows\system32\drivers\dcn530n5.sys
      EagleNT
        [A ] 14. c:\windows\system32\drivers\eaglent.sys
      ExpScaner
        [A ] 15. c:\program files\rising\rav\expscan.sys
      HookCont
        [A ] 16. c:\program files\rising\rav\hookcont.sys
      HookReg
        [A ] 17. c:\program files\rising\rav\hookreg.sys
      HookSys
        [A ] 18. c:\program files\rising\rav\hooksys.sys
      HookUrl
        [A ] 19. c:\program files\rising\rfw\hookurl.sys
      MegaIDE
        [A ] 20. c:\windows\system32\drivers\megaide.sys
      MEMSCAN
        [A ] 21. c:\program files\rising\rav\memscan.sys
      mProcRs
        [A ] 22. c:\program files\rising\rfw\mprocrs.sys
      npkcrypt
        [A ] 23. e:\tencent\qq\npkcrypt.sys
      npkycryp
        [A ] 24. d:\qq\npkycryp.sys
      oreans32
        [A ] 25. c:\windows\system32\drivers\oreans32.sys
      P2k
        [A ] 26. c:\windows\system32\drivers\p2k.sys
      RsAntiSpyware
        [A ] 27. c:\windows\system32\drivers\rsboot.sys
      RsFwDrv
        [A ] 28. c:\program files\rising\rfw\rsfwdrv.sys
      RsNTGDI
        [A ] 29. c:\windows\system32\drivers\rsntgdi.sys
      RSPPSYS
        [A ] 30. c:\program files\rising\rav\rsppsys.sys
      Secdrv
        [A ] 31. c:\windows\system32\drivers\secdrv.sys
      sf
        [A ] 32. c:\windows\system32\drivers\sf.sys
      smwdm
        [A ] 33. c:\windows\system32\drivers\smwdm.sys
      sptd
        [A ] 34. c:\windows\system32\drivers\sptd.sys
      tapvpn
        [A ] 35. c:\windows\system32\drivers\tapvpn.sys
      usbsermpt
        [A ] 36. c:\windows\system32\drivers\usbsermpt.sys
      usbsermptxp
        [A ] 37. c:\windows\system32\drivers\usbsermptxp.sys
      XDva001
        [A ] 38. c:\windows\system32\xdva001.sys
      XDva009
        [A ] 39. c:\windows\system32\xdva009.sys
      ZSMC301b
        [A ] 40. c:\windows\system32\drivers\usbvm31b.sys
  + Winlogon
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
      WBSrv
        [AM] 41. e:\jimpossible\windowblinds\wbsrv.dll
    + HKCU\Control Panel\Desktop
      Scrnsave.exe
        [A ] 42. c:\windows\system32\hello kitty.scr
  + Internet Explorer
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
        [A ] 43. c:\windows\system32\kakatool.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
      {FAAAC0F6-94BE-4466-934B-7C53666A2F41}
        [AM] 44. c:\windows\system32\9a91.dll
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
      Exec
        [A ] 45. e:\迅雷\thunder.exe
      Exec
        [A ] 46. c:\program files\messenger\msmsgs.exe
  + Explorer
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 47. c:\windows\system32\hticons.dll
      WinRAR shell extension
        [A ] 48. c:\program files\winrar\rarext.dll
      Portable Media Devices
        [A ] 49. c:\windows\system32\audiodev.dll
      Portable Media Devices Menu
        [A ] 49. c:\windows\system32\audiodev.dll
      Web Folders
        [A ] 50. c:\program files\common files\microsoft shared\web folders\msonsext.dll
      RISING
        [A ] 51. c:\windows\system32\ravext.dll
      NvCpl DesktopContext Class
        [AM] 52. c:\windows\system32\nvcpl.dll
      Play on my TV helper
        [AM] 52. c:\windows\system32\nvcpl.dll
      Desktop Explorer
        [AM] 53. c:\windows\system32\nvshell.dll
      Desktop Explorer Menu
        [AM] 53. c:\windows\system32\nvshell.dll
      nView Desktop Context Menu
        [AM] 53. c:\windows\system32\nvshell.dll
  + Logon
    + HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      Super Rabbit IEPro
        [A ] 54. e:\magicset\magicset\sriecli.exe
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      RavTask
        [A ] 55. c:\program files\rising\rav\ravtask.exe
      runeip
        [A ] 56. c:\program files\rising\antispyware\runiep.exe
  + Boot Execute
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 57. c:\windows\system32\bsmain.exe

+ 系统活动模块
  + 000001f4(500) smss.exe
  + 0000023c(572) csrss.exe
  + 00000254(596) winlogon.exe
    10000000[00034000]
      [AM] 41. e:\jimpossible\windowblinds\wbsrv.dll
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
    58050000[0008A000]
      [ M] 61. c:\windows\system32\l3codeca.acm
  + 00000280(640) services.exe
  + 0000028c(652) lsass.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 00000320(800) svchost.exe
  + 0000036c(876) svchost.exe
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 000003dc(988) svchost.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 00000408(1032) svchost.exe
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 0000044c(1100) svchost.exe
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 00000484(1156) 广电认证.exe
    00400000[001DA000]
      [ M] 63. c:\program files\广电嘉和\济南广电嘉和认证客户端\广电认证.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 0000049c(1180) ctfmon.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
  + 00000560(1376) Explorer.EXE
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[00008000]
      [ M] 64. e:\jimpossible\windowblinds\tray.dll
    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
    02640000[006D9000]
      [AM] 52. c:\windows\system32\nvcpl.dll
    02190000[00034000]
      [ M] 65. c:\windows\system32\nvrszhc.dll
    02210000[00073000]
      [AM] 53. c:\windows\system32\nvshell.dll
    02E10000[00022000]
      [AM] 44. c:\windows\system32\9a91.dll
  + 00000730(1840) nvsvc32.exe
    00400000[00021000]
      [AM] 2. c:\windows\system32\nvsvc32.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
  + 00000750(1872) svchost.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
  + 00000778(1912) svchost.exe
    00A30000[00090000]
      [AM] 8. c:\windows\system32\jrzis.dll
  + 00000898(2200) a9601.exe
    00400000[0001E000]
      [AM] 1. c:\windows\system32\a9601.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
  + 00000930(2352) alg.exe
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 0000096c(2412) rundll32.exe
    10000000[00115000]
      [ M] 66. c:\windows\system32\591.dll
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    010E0000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 000009fc(2556) VPNClient.exe
    00400000[00012000]
      [ M] 67. e:\e路通拨号器\vpnclient.exe
    7C140000[00103000]
      [ M] 68. e:\e路通拨号器\mfc71.dll
    7C340000[00056000]
      [ M] 69. e:\e路通拨号器\msvcr71.dll
    7C3A0000[0007B000]
      [ M] 70. e:\e路通拨号器\msvcp71.dll
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
  + 00000d04(3332) QQ.exe
    00400000[00187000]
      [ M] 71. e:\tencent\qq\qq.exe
    10000000[00022000]
      [ M] 72. e:\tencent\qq\coralassist.dll
    003A0000[0003E000]
      [ M] 73. e:\tencent\qq\coralqq.dll
    005A0000[00029000]
      [ M] 74. e:\tencent\qq\kql.dll
    7C420000[00087000]
      [ M] 75. e:\tencent\qq\msvcp80.dll
    78130000[0009B000]
      [ M] 76. e:\tencent\qq\msvcr80.dll
    60A10000[000F2000]
      [ M] 77. e:\tencent\qq\mfc42.dll
    005D0000[00007000]
      [ M] 78. e:\tencent\qq\ipsearcher.dll
    61360000[00236000]
      [ M] 79. e:\tencent\qq\qqbaseclassindll.dll
    616B0000[00099000]
      [ M] 80. e:\tencent\qq\qqhelperdll.dll
    60090000[00040000]
      [ M] 81. e:\tencent\qq\basicctrldll.dll
    00D50000[00008000]
      [ M] 82. e:\tencent\qq\nodisturbfilter.cqx
    00D70000[00006000]
      [ M] 83. e:\tencent\qq\confighotkey.cqx
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    620B0000[00005000]
      [ M] 84. e:\tencent\qq\riched32.dll
    62040000[00068000]
      [ M] 85. e:\tencent\qq\riched20.dll
    612E0000[00038000]
      [ M] 86. e:\tencent\qq\qqapi.dll
    621F0000[00007000]
      [ M] 87. e:\tencent\qq\timproxy.dll
    01380000[00006000]
      [ M] 88. e:\tencent\qq\autoreconnect.cqx
    013A0000[00033000]
      [ M] 89. e:\tencent\qq\loginctrl.dll
    01A10000[00044000]
      [ M] 90. e:\tencent\qq\npkcntc.dll
    013E0000[0000E000]
      [ M] 91. e:\tencent\qq\npkpdb.dll
    608B0000[00054000]
      [ M] 92. e:\tencent\qq\loginctrlres.dll
    02380000[0041A000]
      [ M] 93. e:\tencent\qq\qqres.dll
    61780000[0008A000]
      [ M] 94. e:\tencent\qq\qqmainframe.dll
    601A0000[00119000]
      [ M] 95. e:\tencent\qq\cqqapplication.dll
    60BB0000[0005D000]
      [ M] 96. e:\tencent\qq\newskin.dll
    60680000[000B0000]
      [ M] 97. e:\tencent\qq\hostingmgr.dll
    600F0000[00022000]
      [ M] 98. e:\tencent\qq\cameradll.dll
    609E0000[0002F000]
      [ M] 99. e:\tencent\qq\mailsummary.dll
    03140000[0000C000]
      [ M] 100. e:\tencent\qq\coralhotkey.cqx
    61750000[00015000]
      [ M] 101. e:\tencent\qq\qqknowledgesearch.dll
    03C40000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll
    61100000[001D3000]
      [ M] 102. e:\tencent\qq\qqallinone.dll
    60640000[00034000]
      [ M] 103. e:\tencent\qq\grouplive.dll
    620D0000[0002A000]
      [ M] 104. e:\tencent\qq\sccore.dll
    60350000[001A3000]
      [ M] 105. e:\tencent\qq\gdiplus.dll
    61EF0000[0001E000]
      [ M] 106. e:\tencent\qq\qqspace.dll
    62240000[00071000]
      [ M] 107. e:\tencent\qq\vbscript.dll
    61640000[0006B000]
      [ M] 108. e:\tencent\qq\qqgroupmng.dll
    60310000[0003E000]
      [ M] 109. e:\tencent\qq\flashavatardll.dll
    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
    61320000[00032000]
      [ M] 110. e:\tencent\qq\qqavatar.dll
    62220000[00017000]
      [ M] 111. e:\tencent\qq\userdefinedhead.dll
    61950000[000CE000]
      [ M] 112. e:\tencent\qq\qqplugin.dll
    615B0000[00032000]
      [ M] 113. e:\tencent\qq\qqcustomface.dll
    72C60000[00007000]
      [ M] 114. c:\windows\system32\msadp32.acm
    61910000[0002A000]
      [ M] 115. e:\tencent\qq\qqpet.dll
    60610000[00024000]
      [ M] 116. e:\tencent\qq\groupconnection.dll
    06110000[000A6000]
      [ M] 117. e:\tencent\qq\longconnection.dll
    615A0000[0000C000]
      [ M] 118. e:\tencent\qq\qqconfigplugin.dll
    62020000[00016000]
      [ M] 119. e:\tencent\qq\qringmng.dll
    60730000[0001A000]
      [ M] 120. e:\tencent\qq\imageole.dll
    61770000[0000E000]
      [ M] 121. e:\tencent\qq\qqmagicface.dll
    61E40000[0002D000]
      [ M] 122. e:\tencent\qq\qqscenemng.dll
    60D10000[00026000]
      [ M] 123. e:\tencent\qq\phoneapi.dll
    602C0000[0000D000]
      [ M] 124. e:\tencent\qq\dialerallinone.dll
    61E70000[00062000]
      [ M] 125. e:\tencent\qq\qqsettingctrl.dll
    06510000[00041000]
      [ M] 126. e:\tencent\qq\qqsysmsgmng.dll
    600D0000[0001F000]
      [ M] 127. e:\tencent\qq\bqqapplication.dll
    06990000[001D1000]
      [ M] 128. c:\windows\system32\unispim5.ime
    60120000[0004F000]
      [ M] 129. e:\tencent\qq\commercesmng.dll
    60C90000[0000F000]
      [ M] 130. e:\tencent\qq\personaldesktop.dll
    075B0000[0028B000]
      [ M] 131. e:\tencent\qq\qqaddr.dll
    61FC0000[0005B000]
      [ M] 132. e:\tencent\qq\qqzip.dll
    62650000[0002A000]
      [ M] 133. e:\tencent\qq\vqqmodule.dll
    017B0000[0002A000]
      [ M] 134. e:\tencent\qq\qqphonehelper.dll
    01730000[0002A000]
      [ M] 135. e:\tencent\qq\qqfiletransfer.dll
  + 00000d98(3480) TIMPlatform.exe
    00400000[00013000]
      [ M] 136. e:\tencent\qq\timplatform.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    621F0000[00007000]
      [ M] 87. e:\tencent\qq\timproxy.dll
  + 00000ea0(3744) Ras.exe
    00400000[0013E000]
      [ M] 137. c:\program files\rising\antispyware\ras.exe
    66000000[0008F000]
      [ M] 58. e:\jimpossible\windowblinds\wblind.dll
    66600000[00017000]
      [ M] 59. e:\jimpossible\windowblinds\wbhelp.dll
    10000000[000A3000]
      [ M] 138. c:\program files\rising\antispyware\rasgui.dll
    01FE0000[005CF000]
      [ M] 62. c:\windows\system32\gamelink.dll

救命啊..我电脑快完了..

网上也查不到..