瑞星卡卡安全论坛

我点了结束进程过不了多久它又自动出来了，怎么回事啊？

附件: 8654912007410234950.bmp

和我处理的这个一样：
如果有疑问，请扫日志来
运行SRENG
删除启动项注册表：
<EXPLORER><C:\Program Files\Common Files\System\wab32res.exe>  [N/A]
<6z6lfq1rlid5iq2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
    <h><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe>  []
    <y4bixb2qymdcb><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1explore.exe>  []
    <qmz48c78><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe>  []
    <wi5mrdz76fmjm><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe>  []
    <iq9dhfg04><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe>  []
    <t1078j9j9g3><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe>  []

  <mppds><C:\WINDOWS\mppds.exe>  []
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  []
    <twin><C:\WINDOWS\system32\twunk32.exe>  []

删除服务：
[IPSEC Client / DATEING][Stopped/Auto Start]
  <C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL,Export 1087><N/A>
[TomDemoService / TomDemoService][Running/Auto Start]
  <C:\CONFIG.EXE><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinFYService / WinFYService][Stopped/Auto Start]
  <C:\WINDOWS\system32\RAVFY.EXE><N/A>
[WinWLService / WinWLService][Stopped/Auto Start]
  <C:\WINDOWS\system32\RAVWL.EXE><N/A>

备份删除驱动：[vczfuo6 / vczfuo64][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\vczfuo64.sys><N/A>

删除文件：C:\WINDOWS\system32\mppds.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav20.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo0.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav30.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fyzo0.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Msxo0.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll
C:\Program Files\Common Files\System\wab32res.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1explore.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL
C:\CONFIG.EXE
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\RAVFY.EXE
C:\WINDOWS\system32\RAVWL.EXE 

谢谢