一女同事不太懂电脑.不知道进哪得了病毒。
刚开始发现是中了很多病毒。安全模式下用EWIDO的最新版本。瑞星最新版本。360最新.清理助手,恶意软件清理大师.反正通通用过。然后剩下发现2个文件。一个是IF什么什么的.EXE文件。这个文件最后我是通过搜索注册表内相关内容。然后删除后再用KILLBOXER删除掉文件算没再出现过。剩下DCOMSVR这个文件怎么都搞不定.哭死.
用各种杀毒软件和EWIDO查这个文件还提示不是病毒。郁闷.请高手赐教啊。如何搞定这文件。在这边先说谢谢了.补丁已经全部打完。因为有相当一段时间没关注病毒新闻。现在流行什么病毒都不知道了.所以没法找专杀。如果有朋友指出这是什么病毒。指个专杀此病毒软件。同样感激不尽.
[CODE]
2007-04-15,10:50:18
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [N/A]
<y8x9><; C:\DOCUME~1\pyxf\LOCALS~1\Temp\c0nime.exe> [N/A]
<b><; C:\DOCUME~1\pyxf\LOCALS~1\Temp\servicer.exe> [N/A]
<edh1q0zlkv6k><; C:\DOCUME~1\pyxf\LOCALS~1\Temp\iexpl0re.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RfwMain><"f:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<RavTask><"f:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<!AVG Anti-Spyware><"E:\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [Anti-Malware Development a.s.]
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [N/A]
<Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IgfxTray><; C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Publisher]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PRONoMgr.exe><; C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe> [Intel(R) Corporation]
<SoundMan><; SOUNDMAN.EXE> [(Verified)Microsoft Windows Publisher]
<zzGBK><; G:\setup.exe> [N/A]
<360Safetray><E:\Program Files\360safe\safemon\360Tray.exe /start> [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{F9380104-ED78-482b-AA88-714D773131C4}><c:\program files\tencent\qq\xkdllken.dll> [N/A]
<{E272C1EF-275E-4733-FF5E-13455234524F}><C:\WINDOWS\system32\nwlpri.dll> [N/A]
<{4DEC9B29-F08F-4cbc-B179-592B9283FAB0}><c:\program files\symantec antivirus\qzbmtwrg.dll> []
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><e:\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellService
ObjectDelayLoad]
<dsqq><C:\PROGRA~1\crpp\dsqq.dll> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
<e:\Grisoft\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Messenger / Messenger][Running/Auto Start]
<C:\WINDOWS\System32\svchost -k netsvcs-->C:\WINDOWS\system32\msgsvc32.dll><Microsoft Corporation>
[Intel NCS NetService / NetSvc][Stopped/Manual Start]
<C:\Program Files\Intel\NCS\Sync\NetSvc.exe><Intel(R) Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<f:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<f:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"f:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"f:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Network IPSEC Connections / SHipING][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\UFNGY.DLL,Export 1087><N/A>
[VMware Windows Driver Extensions / VMwarenet][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k VMwarenet-->C:\WINDOWS\system32\dxdrawex32.dll><Microsoft Corporation>
[sun system evedant reporter / widanevent][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k widanevent-->c:\windows\system32\eventrep.dll><Microsoft Corporation>
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
<\??\e:\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
<System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[byhpgk3 / byhpgk37][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\byhpgk37.sys><N/A>
[C-Media WDM Audio Interface / cmuda][Stopped/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[cvykbr5 / cvykbr51][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\cvykbr51.sys><N/A>
[cxwcqe3 / cxwcqe37][Stopped/Disabled]
<System32\DRIVERS\cxwcqe37.sys><N/A>
[dbcxzw4 / dbcxzw48][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\dbcxzw48.sys><N/A>
[dcckk / dcckk][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\dcckk.sys><N/A>
[Intel(R) PRO Adapter Driver / E100B][Running/Manual Start]
<system32\DRIVERS\e100b325.sys><Intel Corporation>
[Symantec Eraser Control driver / eeCtrl][Stopped/System Start]
<\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\ExpScan.sys><>
[gdrv / gdrv][Stopped/Manual Start]
<\??\C:\WINDOWS\gdrv.sys><Windows (R) 2000 DDK provider>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\f:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\f:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[msvcrt4 / msvcrt42][Stopped/Disabled]
<System32\DRIVERS\msvcrt42.sys><N/A>
[ndlptu9 / ndlptu98][Stopped/Disabled]
<System32\DRIVERS\ndlptu98.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\f:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[orxack3 / orxack33][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\orxack33.sys><N/A>
[pfsxnj29 / pfsxnj29][Stopped/Boot Start]
<\SystemRoot\system32\\drivers\\system32\\drivers\\%s.sys.sys><N/A>
[profilenh / profilenh][Running/System Start]
<system32\drivers\profilenh.sys><Microsoft Corporation>
[proregnh / proregnh][Running/System Start]
<system32\drivers\proregnh.sys><Windows System Internal>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\f:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[twohq / twohq][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\twohq.sys><N/A>
[wwtqhg1 / wwtqhg12][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\wwtqhg12.sys><N/A>
[xqztey8 / xqztey80][Stopped/Disabled]
<System32\DRIVERS\xqztey80.sys><N/A>
[xspyof4 / xspyof41][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\xspyof41.sys><N/A>