【求助】删不掉的木马，删不掉的病毒，删不掉的流氓软件，日志 bbs.ikaka.com

qw516888 - 2007-4-16 22:08:00

我在这里发个日志，希望有高手指点，我把瑞星杀完在拿兔子清理了是没了，可是过一会就又出现了瑞星就提示又有病毒，并且杀掉，可是还是会在出现，我的IE都变样了

[CODE]

2007-04-16,21:47:57

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<BigDog303><C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)> [N/A]
<winform><C:\WINDOWS\winform.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<shualai><C:\WINDOWS\shualai.exe /i> []
<upxmdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxmdnd.exe> []
<System><C:\Program Files\Common Files\System\Updaterun.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<Super Rabbit SRCK><"D:\Program Files\MagicSet\srck.exe" /autokill:289> [Super Rabbit Soft]
<KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[6B5CD8DC / 6B5CD8DC][Stopped/Auto Start]
<C:\WINDOWS\system32\6B5CD8DC.EXE -d><Microsoft Corporation>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Network IPSEC Connections / SHipING][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\CECDG.DLL,Export 1087><Microsoft Corporation>
[Network Engine / Patterns][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\dzhpl.dll><Microsoft Corporation>

附件: 7374372007416220225.jpg

qw516888 - 2007-4-16 22:10:00

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\腾迅\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303][Running/Manual Start]
<System32\Drivers\usbVM303.sys><Vimicro Corporation>

==================================
浏览器加载项
[实用搜索]
{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\迅雷\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <D:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[实用搜索工具条2.0]
{03465FF5-00AE-411a-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[UploadControl Control]
{52FF336D-A05D-4A14-A3A1-7B6B4B427F88} <C:\WINDOWS\system32\UPLOAD~1.OCX, 广州网易互动娱乐有限公司>
[DopStreamer Class]
{65DEDD9B-24D3-4EDD-A8BA-371A06679A09} <C:\WINDOWS\DopCom.dll, 北京闪动科技有限公司>
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <D:\Program Files\baofengII\Codec\QTSystem\QTPlugin.ocx, N/A>
[实用搜索工具条2.0]
{03465FF5-00AE-411A-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[Fade]
{16B280C5-EE70-11D1-9066-00C04FD9189D} <C:\WINDOWS\system32\dxtmsft.dll, Microsoft Corporation>
[EWA Control]
{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <D:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[PortalCom AAA 1.0]
{414E7D87-8073-4EFB-9E4B-C8DF04C979EE} <C:\WINDOWS\PortalAX02.ocx, Huawei Co. Ltd.>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\Program Files\迅雷\ComDlls\ThunderAgent_007.dll, Thunder Networking Technologies,LTD>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[UploadControl Control]
{52FF336D-A05D-4A14-A3A1-7B6B4B427F88} <C:\WINDOWS\system32\UPLOAD~1.OCX, 广州网易互动娱乐有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[DopStreamer Class]
{65DEDD9B-24D3-4EDD-A8BA-371A06679A09} <C:\WINDOWS\DopCom.dll, 北京闪动科技有限公司>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[实用搜索]
{6CFD436C-7AAD-4E50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\Program Files\迅雷\Components\InMedia\MediaAddin11.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\迅雷\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\system32\SUBMIT~1.DLL, >
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML DOM Document 3.0]
{F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[Free Threaded XML DOM Document 3.0]
{F5078F33-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP 3.0]
{F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XSL Template 3.0]
{F5078F36-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML DOM Document]
{F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[&使用迅雷下载]
<D:\Program Files\迅雷\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Program Files\迅雷\Program\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<D:\Program Files\腾迅\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\腾迅\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\腾迅\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\腾迅\SendMMS.htm, N/A>

qw516888 - 2007-4-16 22:10:00

==================================
正在运行的进程
[PID: 440][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 532][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 576][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 588][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 728][C:\WINDOWS\system32\Ati2evxx.exe] [ATI Technologies Inc., 6.14.10.4116]
[C:\WINDOWS\system32\Ati2edxx.dll] [ATI Technologies, Inc., 6, 14, 10, 2497]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 768][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 824][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 908][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[c:\windows\system32\pzasn.dll] [Microsoft Corporation, 5.1.2600.0]
[PID: 1372][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\winform.dll] [N/A, ]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\superutilbar\superutilbar.dll] [www.shiyongsousuo.com, 2, 1, 8, 24]
[D:\Program Files\RAR\rarext.dll] [N/A, ]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[D:\Program Files\迅雷\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[PID: 1780][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 1808][C:\WINDOWS\VM303_STI.EXE] [Vimicro, 4, 3, 625, 61]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\VM303Prp.Ax] [Vimicro, 4.3. 625.61]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 1912][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 3280][D:\Program Files\腾迅\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Program Files\腾迅\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\BasicCtrlDll.dll] [Tencent, 7, 0, 101, 80]
[D:\Program Files\腾迅\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[D:\Program Files\腾迅\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\腾迅\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\Program Files\腾迅\QQAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[D:\Program Files\腾迅\LoginCtrl.dll] [N/A, ]
[D:\Program Files\腾迅\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\Program Files\腾迅\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Program Files\腾迅\LoginCtrlRes.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQMainFrame.dll] [N/A, ]
[D:\Program Files\腾迅\CQQApplication.dll] [N/A, ]
[D:\Program Files\腾迅\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQKnowledgeSearch.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQAllInOne.dll] [N/A, ]
[D:\Program Files\腾迅\GroupLive.dll] [N/A, ]
[D:\Program Files\腾迅\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\Program Files\腾迅\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program Files\腾迅\QQSpace.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\Program Files\腾迅\QQGroupMng.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\腾迅\QQSysMsgMng.dll] [N/A, ]
[D:\Program Files\腾迅\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QQPlugin.dll] [N/A, ]
[D:\Program Files\腾迅\QQCustomFace.dll] [N/A, ]
[D:\Program Files\腾迅\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\QRingMng.dll] [N/A, ]
[D:\Program Files\腾迅\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Program Files\腾迅\QQAvatar.dll] [N/A, ]
[D:\Program Files\腾迅\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\腾迅\QQPet.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\腾迅\BQQApplication.dll] [N/A, ]
[D:\Program Files\腾迅\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\腾迅\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\腾迅\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
[C:\WINDOWS\system32\winform.dll] [N/A, ]
[D:\Program Files\腾迅\QQSceneMng.dll] [N/A, ]
[D:\Program Files\腾迅\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 6, 60]
[C:\WINDOWS\SYSTEM32\WBEM\FMMGT.DLL] [Microsoft Corporation, 5, 1, 2600, 2709]
[C:\WINDOWS\SYSTEM32\WBEM\MLGKJ.DLL] [Microsoft Corporation, 5, 1, 2600, 2709]
[C:\WINDOWS\SYSTEM32\WBEM\CECDG.DLL] [Microsoft Corporation, 5, 1, 2600, 2709]
[PID: 3364][D:\Program Files\腾迅\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[D:\Program Files\腾迅\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 356][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\6B5CD8DC.DLL] [Microsoft Corporation, ]
[PID: 384][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 160][C:\WINDOWS\shualai.exe] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\shualai.dll] [N/A, ]
[PID: 1040][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1601, 4978]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\Program Files\superutilbar\superutilbar.dll] [www.shiyongsousuo.com, 2, 1, 8, 24]
[D:\Program Files\迅雷\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\winform.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3059 (xpsp_sp2_gdr.070104-0050)]
[PID: 1508][F:\我的下载\工具\新建文件夹\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\winform.dll] [N/A, ]

qw516888 - 2007-4-16 22:10:00

=================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost
127.0.0.1 popwin.9983.com
219.129.239.223 www.npjxjy.com
219.129.239.223 quxiuu.com
219.129.239.223 www.23b.cn
219.129.239.223 www.baidulink.com
219.129.239.223 www.ookkw.com
219.129.239.223 www.97725.com
219.129.239.223 www.54699.com
219.129.239.223 www.wu7x.cn
219.129.239.223 d.qbbd.com
219.129.239.223 w.qbbd.com
219.129.239.223 web.77276.com
219.129.239.223 www.77276.com
219.129.239.223 www.npjxjy.com
219.129.239.223 www.baidulink.com
219.129.239.223 www.ookkw.com
219.129.239.223 www.wu7x.cn
219.129.239.223 www.wwwlm.net
219.129.239.223 dm1.yiall.com
219.129.239.223 www.my6688.cn
219.129.239.223 www.union123.com
219.129.239.223 www.ktan.cn
219.129.239.223 www.2t2t.cn
219.129.239.223 www.cq530.com
219.129.239.223 www.365tc.com
219.129.239.223 ad.qucha.net
219.129.239.223 www.tan8.cn
219.129.239.223 www.itjj.net
219.129.239.223 www.start188.com
219.129.239.223 www.at58.cn
219.129.239.223 union.yxad.com
219.129.239.223 www.iptan.com
219.129.239.223 www.ip2008.net
219.129.239.223 www.yqif.com
219.129.239.223 www.2t2t.cn
219.129.239.223 www.688ip.com
219.129.239.223 www.17tc.com
219.129.239.223 www1.6tan.com
219.129.239.223 www2.6tan.com
219.129.239.223 www.6tan.com
219.129.239.223 www.zztan.com
219.129.239.223 www.5tanip.com
219.129.239.223 www.16tc.com
219.129.239.223 www.163se.net
219.129.239.223 www.168080.com
219.129.239.223 www.baidu8.org
219.129.239.223 www.qqwei.com
219.129.239.223 qz.magforum.net
219.129.239.223 www.nze21.com
219.129.239.223 www.437799.com
219.129.239.223 www.168080.com
219.129.239.223 new2.jixie123.cn
219.129.239.223 www.18dmm.com
219.129.239.223 www.souxse.cn
219.129.239.223 x.vvcyin.com
219.129.239.223 dm1.yiall.com
219.129.239.223 www.168080.com
219.129.239.223 www.nze21.com
219.129.239.223 www.puma163.com
219.129.239.223 www.138505.com

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

勇闯猪罗纪 - 2007-4-16 22:39:00

准备好并打开SRE和冰刃这2个工具

用冰刃设置=》禁止线程创建

删除注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]分支下的

<winform><C:\WINDOWS\winform.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<shualai><C:\WINDOWS\shualai.exe /i> []
<upxmdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxmdnd.exe> []

清空Internet的临时文件夹

删除服务项
[6B5CD8DC / 6B5CD8DC][Stopped/Auto Start]
<C:\WINDOWS\system32\6B5CD8DC.EXE -d><Microsoft Corporation>

用SRENG删除以下浏览器加载项
{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
{03465FF5-00AE-411a-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\system32\INPUTC~1.DLL, >
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\system32\SUBMIT~1.DLL, >

然后用冰刃结束以下进程并删除所对应的文件

C:\WINDOWS\system32\6B5CD8DC.DLL
C:\WINDOWS\system32\winform.dll
C:\WINDOWS\system32\mppds.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\shualai.exe]
C:\Program Files\superutilbar\superutilbar.dll
C:\WINDOWS\system32\INPUTC~1.DLL
C:\WINDOWS\system32\SUBMIT~1.DLL

解除冰刃的禁止线程创建重起

qw516888 - 2007-4-16 23:24:00

完全看不懂- -!!!

勇闯猪罗纪 - 2007-4-16 23:29:00

晕你一点电脑都不懂吗？
我白写了那么多。。。汗。。

SRE就是你用来扫描那个工具
冰刃你随便搜索就有了1。20版本的

qw516888 - 2007-4-17 16:11:00

我知道这些软件，但是我不会你那样的操作啊 - -!!!

逆天幻影 - 2007-4-21 15:40:00

注册表是在电脑哪里

瑞星卡卡安全论坛