听闻贵论坛高手如云想请各位帮忙解决个问题[用rar解压文件就出错误] bbs.ikaka.com

自焚男 - 2005-7-28 1:48:00

确切的说是，能打开但不能解压缩，一解压缩rar就没有反应了，我预感到是不是中毒了，于是上互联星空在线杀毒[那里只要是电信的宽带用户就可以免费杀毒的，我穷没的选...

],果不其然扫出来3百多个，按照提示删了，然后我再打开个rar一看还是死了，于是我再次在线毒发现2百多个文件被感染，比上次少了在c盘下的100个

[我c盘装的是xp ,g盘装的是win2000,平时不用win2000的]
我在这里先提前谢谢大家对我的帮助

Logfile of HijackThis v1.99.1
Scan saved at 1:59:16, on 2005-7-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
D:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\conime.exe
C:\DOCUME~1\MSUSER~1\LOCALS~1\Temp\1903632005219183744.zip 的临时目录 2\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v5.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\qq\QQIEHelper.dll
O3 - Toolbar: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - C:\WINDOWS\WORLD2\TOOLBAR\~hmtoolbar.dll
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [ExFilter] Rundll32.exe C:\WINDOWS\system32\hookdll.dll,ExecFilter solo
O4 - HKLM\..\Run: [DAEMON Tools-2052] "D:\Program Files\D-Tools\daemon.exe" -lang 2052
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [StormCodec_Helper] "D:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - I:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - I:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 使用Kugoo下载 - G:\KUGOO2\KugooDownX.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 火狐Flash保存 - D:\Program Files\FoxFlashplayer\PlugIns\GetFlash.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: 易趣购物 - {DE60714F-AC19-427e-861A-FD60ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE60714F-AC19-427e-861A-FD60ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\qq\QQIEHelper.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall 在线扫毒) - http://218.1.71.168:88/housecall/xscan60.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (趋势科技在线扫毒程序) - http://218.1.71.168:88/housecall/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{832B6B46-F624-46F8-BFFD-29A617B66E35}: NameServer = 202.96.209.5 202.96.209.133
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: rundll - Unknown owner - C:\WINDOWS\rundll32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

自焚男 - 2005-7-28 1:50:00

这是在线杀毒后扫描出来的结果

扫描结果:
我们在您的计算机中发现 233 个受感染文件，共感染 233 个病毒。以下列出前 0 个受感染文件的详细信息（共0个）。
受感染文件病毒名称
C:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051286.DLL BKDR_FUETEL.B
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051287.exe WORM_RBOT.GEN
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051288.exe WORM_RBOT.AMP
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051289.exe WORM_RBOT.GEN
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051290.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051291.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051292.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051293.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051294.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051295.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051296.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051297.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051298.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051299.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051300.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051301.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051302.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051303.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051304.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051305.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051306.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051307.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051308.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051309.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051310.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051311.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051312.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051313.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051314.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051315.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051316.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051317.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051318.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051319.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051320.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051321.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051322.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051323.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051324.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051325.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051326.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051327.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051328.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051329.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051330.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051331.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051332.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051333.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051334.exe WORM_RBOT.AN
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051335.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051336.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051337.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051338.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051339.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051340.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051341.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051342.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051343.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051344.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051345.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051346.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051347.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051348.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051349.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051350.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051351.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051352.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051353.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051354.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051355.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051356.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051357.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051358.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051359.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051360.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051361.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051362.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051363.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051364.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051365.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051366.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051367.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051368.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051369.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051370.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051371.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051372.exe WORM_POEBOT.I

自焚男 - 2005-7-28 1:50:00

G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051373.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051374.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051375.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051376.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051377.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051378.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051379.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051380.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051381.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051382.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051383.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051384.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051385.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051386.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051387.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051388.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051389.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051390.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051391.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051392.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051393.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051394.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051395.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051396.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051397.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051398.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051399.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051400.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051401.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051402.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051403.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051404.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051405.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051406.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051407.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051408.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051409.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051410.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051411.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051412.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051413.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051414.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051415.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051416.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051417.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051418.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051419.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051420.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051421.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051422.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051423.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051424.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051425.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051426.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051427.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051428.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051429.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051430.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051431.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051432.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051433.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051434.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051435.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051436.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051437.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051438.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051439.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051440.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051441.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051442.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051443.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051444.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051445.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051446.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051447.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051448.exe WORM_POEBOT.I

自焚男 - 2005-7-28 1:50:00

G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051449.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051450.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051451.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051452.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051453.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051454.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051455.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051456.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051457.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051458.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051459.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051460.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051461.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051462.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051463.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051464.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051465.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051466.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051467.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051468.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051469.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051470.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051471.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051472.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051473.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051474.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051475.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051476.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051477.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051478.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051479.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051480.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051481.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051482.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051483.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051484.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051485.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051486.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051487.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051488.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051489.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051490.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051491.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051492.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051493.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051494.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051495.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051496.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051497.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051498.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051499.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051500.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051501.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051502.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051503.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051504.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051505.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051506.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051507.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051508.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051509.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051510.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051511.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051512.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051513.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051514.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051515.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051516.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051517.exe WORM_POEBOT.I
G:\System Volume Information\_restore{9C6B47D9-A119-4B7F-BDF7-FCB0AA487DF7}\RP117\A0051518.exe WORM_POEBOT.I

自焚男 - 2005-7-28 15:57:00

睡了一觉后发现这幅帖子沉了n页了....

hellokiddy - 2005-7-28 16:07:00

先用HijackThis修复
O23 - Service: rundll - Unknown owner - C:\WINDOWS\rundll32.exe
在安全模式下搜索删除C:\WINDOWS\rundll32.exe
注册表中也要搜索删除这个路径下的rundll32.exe

另：杀毒软件不装，但起码也要装个防火墙.

自焚男 - 2005-7-28 16:37:00

先谢谢hellokiddy对我的帮助

你说的3步中前两步我已经完成[rundll32.exe果然有问题，它的图标尽然是图片格式的，同时我在windows目录下还发现3个可疑的文件rundll32_Hook.DLL,runtsckl.exe rundll32.dll，不知道有没有问题，]，但第3步我没有在注册表中搜索到rundll32.exe，其他3个可疑文件我也搜索了一遍也没有

自焚男 - 2005-7-28 17:11:00

我现在什么都没干就不停的按f5，眼都酸了

花落花又开 - 2005-7-28 17:15:00

【回复“自焚男”的帖子】

您好,请先关闭系统还原:

开始--控制面版--系统--系统还原选项卡--关闭在所有驱动器上的系统还原前打钩

删除WINDOWS目录下的rundll32.exe,rundll32.dll,rundll32key.dll,rundll32_Hook.dll
把注册表展开到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下查找“rundll32.EXE”，然后删除，重新启动

请为您的系统打全补丁以免重复感染.

现在进行时 - 2005-7-28 17:16:00

关闭系统还原.所有感染的路径都是系统还原文件夹.关闭系统还原后,文件应该自动删除.

自焚男 - 2005-7-28 17:43:00

我在c:\windows\system32目录下发现rundll32.exe runas.exe 这也要删除吗？

弱弱的问一下哪里能找到补丁阿？而且补丁的种类繁多，哪种又是我所需要的？

再次谢谢楼上的两位的帮助

自焚男 - 2005-7-28 18:06:00

引用:

【hellokiddy的贴子】先用HijackThis修复
O23 - Service: rundll - Unknown owner - C:\WINDOWS\rundll32.exe
在安全模式下搜索删除C:\WINDOWS\rundll32.exe
注册表中也要搜索删除这个路径下的rundll32.exe

另：杀毒软件不装，但起码也要装个防火墙.
...........................

sp2中不是自带了防火墙了吗？至于杀毒软件，我比较迷茫不知道该买那款好
顺便问一下杀毒软件每年都有新的版本出来，那是不是说我每年都要付钱升级？否则就不能用了？

bobo无极限 - 2005-7-28 18:11:00

引用:

【自焚男的贴子】
sp2中不是自带了防火墙了吗？至于杀毒软件，我比较迷茫不知道该买那款好
顺便问一下杀毒软件每年都有新的版本出来，那是不是说我每年都要付钱升级？否则就不能用了？
...........................

可以下载免费的安全升级包.
另外最好安装瑞星防火墙.不是我个人的意见
很多人都承认瑞星防火墙.

baohe - 2005-7-28 18:13:00

引用:

【自焚男的贴子】先谢谢hellokiddy对我的帮助

你说的3步中前两步我已经完成[rundll32.exe果然有问题，它的图标尽然是图片格式的，同时我在windows目录下还发现3个可疑的文件rundll32_Hook.DLL,runtsckl.exe rundll32.dll，不知道有没有问题，]，但第3步我没有在注册表中搜索到rundll32.exe，其他3个可疑文件我也搜索了一遍也没有
...........................

rundll32_Hook.DLL,runtsckl.exe rundll32.dll——统统删除。

自焚男 - 2005-7-28 18:17:00

引用:

【花落花又开的贴子】【回复“自焚男”的帖子】

您好,请先关闭系统还原:

开始--控制面版--系统--系统还原选项卡--关闭在所有驱动器上的系统还原前打钩

删除WINDOWS目录下的rundll32.exe,rundll32.dll,rundll32key.dll,rundll32_Hook.dll
把注册表展开到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下查找“rundll32.EXE”，然后删除，重新启动

请为您的系统打全补丁以免重复感染.
...........................

在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下没有rundll32.exe,确切的说整个注册表都没有找到rundll32.exe

自焚男 - 2005-7-28 18:51:00

在c:\windows\system32种的rundll32.exe删不掉啊，删掉后过几秒种就会又出现了

命运里の金色 - 2005-7-28 19:16:00

引用:

【自焚男的贴子】

在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下没有rundll32.exe,确切的说整个注册表都没有找到rundll32.exe

...........................

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services下的找的是rundll这个服务.把他删除

瑞星卡卡安全论坛