请教各位怎样杀“Trojan.Clicker.Agent.bbz ”病毒 bbs.ikaka.com

大漠之鹰 - 2007-3-26 17:37:00

请教高手为何我的电脑自从感染这个病毒后每天在安全监控下就能发现，瑞星每次都忽略，而在全盘扫描下又发现不了这个病毒，监控发现的文件路径是：C:\windows\system32\winlib.dll，可我又在system32下找不到winlib.dll这个文件，怎么办啊？

附件: 5068002007328151423.jpg

大漠之鹰 - 2007-3-27 12:22:00

斑竹呢？

附件: 5068002007328151516.jpg

枫笑九洲 - 2007-3-27 12:33:00

显示隐藏文件选项勾了没

大漠之鹰 - 2007-3-28 10:05:00

勾了。

天血龙魔 - 2007-3-28 10:28:00

我和你一样，呵呵，不过
我还中了Trojan.DL.QQhelper.fck这个病毒，瑞星只能报不能杀，一重启就说那个文件加载错误，郁闷

大漠之鹰 - 2007-3-28 15:45:00

有没有知道的啊

水树雨下 - 2007-3-28 15:48:00

去下载sreng2,关闭qq，下载软件等一切不必要的程序后扫个日志上来，一次贴不完分段贴，不要修改
http://www.kztechs.com/sreng/sreng2.zip

大漠之鹰 - 2007-3-28 15:59:00

[CODE]

2007-03-28,15:46:48

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<TWCU><"C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui> [TP-LINK TECHNOLOGIES CO., LTD]
<NWEReboot><> [N/A]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
<WinlogonNotify: PCANotify><PCANotify.dll> [Symantec Corporation]

大漠之鹰 - 2007-3-28 16:00:00

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Service Manager]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Service Manager.lnk --> D:\MSSQL7\Binn\sqlmangr.exe [Microsoft Corporation]><N>

==================================
服务
[TP-LINK 配置服务 / ACS][Running/Auto Start]
<C:\WINDOWS\system32\acs.exe><N/A>
[Symantec pcAnywhere Host Service / awhost32][Running/Auto Start]
<"C:\Program Files\Symantec\pcAnywhere\awhost32.exe"><Symantec Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MSSQLServer / MSSQLServer][Running/Auto Start]
<D:\MSSQL7\binn\sqlservr.exe><Microsoft Corporation>
[Vsn qmxo Service / qmxo][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\wsdu\awky.dll,Service><Microsoft Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SQLServerAgent / SQLServerAgent][Stopped/Manual Start]
<D:\MSSQL7\binn\sqlagent.exe><Microsoft Corporation>
[NT Data Provider / WalALET][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\IQSSD.DLL,Export 1087><N/A>
[VNC 服务器版本 4 / WinVNC4][Running/Auto Start]
<"C:\Program Files\RealVNC\WinVNC4.exe" -service><RealVNC Ltd.>

==================================
驱动程序
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[AEGIS Protocol (IEEE 802.1x) v3.2.0.3 / AegisP][Running/Auto Start]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[awecho / awecho][Running/System Start]
<system32\drivers\awechomd.sys><Symantec Corporation>
[awlegacy / awlegacy][Running/System Start]
<\SystemRoot\System32\Drivers\awlegacy.sys><Symantec Corporation>
[AW_HOST / AW_HOST][Running/System Start]
<system32\drivers\aw_host5.sys><Symantec Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BdGuard / BdGuard][Stopped/]
<2 - 系统找不到指定的文件。
><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[phfq / phfqc][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\phfqc.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[TP-LINK 54M Wireless Adapter Driver for Windows XP / W8335XP][Running/Manual Start]
<system32\DRIVERS\MRV8335XP.sys><Marvell Semiconductor, Inc>

大漠之鹰 - 2007-3-28 16:04:00

==================================
浏览器加载项
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[njxl]
{32638C68-BD08-4FD1-BDBF-8A410BFBF7B6} <, N/A>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[快车(FlashGet)]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================
正在运行的进程
[PID: 572][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 660][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\PCANotify.dll] [Symantec Corporation, 12.0.0.123]
[C:\WINDOWS\system32\MSVCR70.dll] [Microsoft Corporation, 7.00.9466.0]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 728][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 640][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3847]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 1520][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
[c:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[c:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[c:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[c:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[c:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[c:\program files\rising\rfw\PSAPI.DLL] [Microsoft Corporation, 4.00]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2104][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.00]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2112][C:\WINDOWS\system32\igfxtray.exe] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.3847]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2124][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxdev.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxhk.dll] [Intel Corporation, 3.0.0.3847]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.3847]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2144][C:\Program Files\TP-LINK\TWCU\TWCU.exe] [TP-LINK TECHNOLOGIES CO., LTD, 4.1.2.25]
[C:\WINDOWS\system32\wcapi.dll] [Atheros, 4.1.2.25]
[C:\WINDOWS\system32\athcfg11.dll] [Atheros, 4.1.2.25]
[C:\WINDOWS\system32\athcfg11Res.dll] [Atheros Communications, Inc., 4.1.2.25]
[C:\WINDOWS\system32\wgapi.dll] [TP-LINK TECHNOLOGIES CO., LTD, 4.1.2.25]
[C:\WINDOWS\system32\wgapiloc.dll] [TP-LINK, 4.1.2.25]
[C:\Program Files\TP-LINK\TWCU\TWCUloc.dll] [TP-LINK TECHNOLOGIES CO., LTD., 4.1.2.25]
[C:\Program Files\TP-LINK\TWCU\oemresloc.dll] [TP-LINK TECHNOLOGIES CO., LTD., 4.1.2.25]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2196][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[PID: 2248][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2288][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3001]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3960][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3984][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1256][C:\Program Files\TP-LINK\54M Wireless Adapter\Mrv8000x.exe] [TP-LINK TECHNOLOGIES CO., LTD., 3.02.00.03]
[C:\Program Files\TP-LINK\54M Wireless Adapter\Mrv8000x.dll] [Wireless, 3.02.00.03]
[C:\Program Files\TP-LINK\54M Wireless Adapter\odSupp_M.dll] [Funk Software, Inc., 3.02.00.008]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3036][H:\MagicSet\srgui.exe] [N/A, ]
[H:\MagicSet\msvbvm60.dll] [N/A, ]
[H:\MagicSet\vb6chs.dll] [N/A, ]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3128][F:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\IMSC40A.IME] [Microsoft Corporation, 6.0.0.2527]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

大漠之鹰 - 2007-3-28 16:05:00

拜托了！

水树雨下 - 2007-3-28 16:21:00

运行sreng2启动项目，服务,win32服务应用程序，勾选隐藏微软服务后删除
[Vsn qmxo Service / qmxo][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\wsdu\awky.dll,Service><Microsoft Corporation>
[NT Data Provider / WalALET][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\IQSSD.DLL,Export 1087><N/A>
重启后打开我的电脑，工具，文件夹选项，查看，显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉删除
C:\PROGRA~1\COMMON~1\wsdu\awky.dll
C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE
你那张图不是没查出winlib.dll吗？

大漠之鹰 - 2007-3-28 17:00:00

老大，我找你说的把C[Vsn qmxo Service / qmxo][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\wsdu\awky.dll,Service><Microsoft Corporation>
[NT Data Provider / WalALET][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINDOWS\SYSTEM32\WBEM\IQSSD.DLL,Export 1087><N/A>
删除了，然后重启后打开我的电脑，工具，文件夹选项，查看，显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉删除
可怎么还是找不到c:\PROGRA~1\COMMON~1\wsdu\awky.dll
C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE 阿

我也纳闷为什么每天在安全监控下就能发现，可找右找不到？

我是来来 - 2007-3-28 17:18:00

C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE

大漠之鹰 - 2007-3-29 9:52:00

老大，我的电脑下的文件夹选项，不显示隐藏文件和文件夹的勾也去掉了，可还是没找到啊！C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE

附件: 506800200732994314.jpg

天月来了 - 2007-3-29 10:39:00

你用WinRAR打开C:\WINDOWS\SYSTEM32文件夹看看。
快哦！！

Reita - 2007-3-29 12:34:00

好复杂呀`~
- -!

大漠之鹰 - 2007-3-29 16:08:00

引用:

【天月来了的贴子】你用WinRAR打开C:\WINDOWS\SYSTEM32文件夹看看。
快哦！！
………………

还是找不到啊！

现在不在 - 2007-3-30 3:36:00

我也是同样的问题，注册表里面的seach Assistant/acmru/503里面发现winlib.dll,这个毒没人能解么？瑞星的技术人员不知道他们的软件无能为力么？

天月来了 - 2007-3-30 9:18:00

那你那电脑还提示那个了吗？
在处理以后。

天月来了 - 2007-3-30 9:23:00

【回复“现在不在”的帖子】
你那是winlib.dll

他这是winlib .dll

winlib后面有个空格呢。

天月来了 - 2007-3-30 9:30:00

http://hi.baidu.com/killvir/blog/item/c8a07bf4b878d0d9f3d38537.html

这上说的不知对不对？？？？？？？？？？？？？？？

大漠之鹰 - 2007-3-30 12:17:00

引用:

【天月来了的贴子】【回复“现在不在”的帖子】
你那是winlib.dll

他这是winlib .dll

winlib后面有个空格呢。
………………

是啊，怎么办呢？

现在不在 - 2007-3-30 13:16:00

所有网上能搜到方法都试过了，全部不行！

大漠之鹰 - 2007-4-2 15:01:00

看来只好先养着了！

ym1991 - 2007-4-22 0:05:00

【回复“大漠之鹰”的帖子】
哎....同病相怜啊!~~~
真勒不知道Trojan.Clicker.Agent.bbz怎么整了

瑞星卡卡安全论坛