瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 更新至18日病毒库都无法删除的病毒,请帮忙查看扫描日志,紧急在线求助
黑色五月 - 2007-5-18 18:04:00
我的电脑中了Trojan.DL.MNLess.oq病毒，用瑞星扫描得知，但无法删除，每次都忽略，而且打开浏览器有一个莫名的链接，删除时提示为系统文件，有可能造成系统不稳定，但删除后开机又有了，真麻烦，请高手指点如何清除，已用SRENG将扫描结果上传。
[CODE]

2007-05-18,17:35:47

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <WMPNSCFG><C:\Program Files\Windows Media Player\WMPNSCFG.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <VTTimer><VTTimer.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\Program Files\lockfile\hkey.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}><C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys>  []
    <{5D06580A-08EB-4DD0-8425-DDBB5198B30C}><C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
    <WinlogonNotify: PCANotify><PCANotify.dll>  [Symantec Corporation]

==================================
启动文件夹
[开屏桌面画报]
  <C:\Documents and Settings\pc1\「开始」菜单\程序\启动\开屏桌面画报.lnk --> C:\PROGRA~1\coopen\Coopen.exe [Beijing Capital Online Network Technology Co.,Ltd]><N>

==================================
服务
[pcAnywhere Host Service / awhost32][Stopped/Manual Start]
  <C:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[BlueSoleil Hid Service / BlueSoleil Hid Service][Running/Auto Start]
  <C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
  <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[tcUpdt / tcUpdt][Running/Auto Start]
  <C:\PROGRA~1\tcclient\TCUpdt.exe -R><N/A>
黑色五月 - 2007-5-18 18:06:00
==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[awecho / awecho][Running/System Start]
  <system32\drivers\awechomd.sys><Symantec Corporation>
[AW_HOST / AW_HOST][Running/System Start]
  <system32\drivers\aw_host5.sys><Symantec Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Bluetooth Audio Service / BlueletAudio][Running/Manual Start]
  <system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[Bluetooth PAN Network Adapter / BT][Stopped/Manual Start]
  <system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth USB For Bluetooth Service / Btcsrusb][Stopped/Manual Start]
  <System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth HID Enumerator / BTHidEnum][Running/Manual Start]
  <system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr][Running/Boot Start]
  <\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[Bluetooth Network Filter / BTNetFilter][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[New0 / New0][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\new.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SENSE3 / SENSE3][Running/Auto Start]
  <system32\drivers\sense3.sys><Beijing Senselock>
[Serial port driver / Serial][Running/System Start]
  <System32\DRIVERS\HiSerial.sys><André Rippstein>
[SAMSUNG USB Composite Device driver (WDM) / sscdbus][Stopped/Manual Start]
  <system32\DRIVERS\sscdbus.sys><MCCI>
[SAMSUNG CDMA Modem Filter / sscdmdfl][Stopped/Manual Start]
  <system32\DRIVERS\sscdmdfl.sys><MCCI>
[SAMSUNG CDMA Modem Drivers / sscdmdm][Stopped/Manual Start]
  <system32\DRIVERS\sscdmdm.sys><MCCI>
[SAMSUNG Mobile USB Device 1.0 driver (WDM) / ss_bus][Stopped/Manual Start]
  <system32\DRIVERS\ss_bus.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Filter / ss_mdfl][Stopped/Manual Start]
  <system32\DRIVERS\ss_mdfl.sys><MCCI>
[SAMSUNG Mobile USB Modem 1.0 Drivers / ss_mdm][Stopped/Manual Start]
  <system32\DRIVERS\ss_mdm.sys><MCCI>
[SymEvent / SymEvent][Stopped/Manual Start]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[Virtual Serial port driver / VComm][Running/Manual Start]
  <system32\DRIVERS\VComm.sys><IVT Corporation>
[Bluetooth VComm Manager Service / VcommMgr][Running/Manual Start]
  <System32\Drivers\VcommMgr.sys><IVT Corporation>
[viagfx / viagfx][Running/Manual Start]
  <system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[QQCycloneHelper Class]
  {00000000-12B3-4305-82F9-43058F20E8D2} <C:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[Thunder Browser Helper]
  {00000000-12B4-4305-82F9-43058F20E8D2} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[BrowserHook Class]
  {40BC4903-B9E3-4EED-9E84-80D14DF603EC} <C:\PROGRA~1\tcclient\TCClient.dll, >
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[访问瑞星网站]
  {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A>
[访问卡卡社区]
  {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, >
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[QQCycloneHelper Class]
  {00000000-12B3-4305-82F9-43058F20E8D2} <C:\Program Files\Tencent\QQDownload\QQIEHelper01.dll, 腾讯公司>
[Thunder Browser Helper]
  {00000000-12B4-4305-82F9-43058F20E8D2} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[BrowserHook Class]
  {40BC4903-B9E3-4EED-9E84-80D14DF603EC} <C:\PROGRA~1\tcclient\TCClient.dll, >
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
  {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件（中国）有限公司>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>
[&使用BitComet下载]
  <res://D:\BT\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://D:\BT\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://D:\BT\BitComet.exe/AddVideo.htm, N/A>
[&使用超级旋风下载]
  <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
[&使用超级旋风下载全部链接]
  <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
[&使用迅雷下载]
  <C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
黑色五月 - 2007-5-18 18:06:00
==================================
正在运行的进程
[PID: 688][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 784][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 808][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\PCANotify.dll]  [Symantec Corporation, 11.5.0.121]
    [C:\WINDOWS\system32\MSVCR70.dll]  [Microsoft Corporation, 7.00.9466.0]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 852][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 864][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3860][C:\Program Files\lockfile\hkey.exe]  [N/A, ]
    [C:\Program Files\lockfile\krnln.fne]  [, 1, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
[PID: 3976][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\HOOKLFp.dll]  [N/A, ]
    [C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, ]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.0.2003051500]
    [C:\PROGRA~1\tcclient\TCClient.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 3908][C:\WINDOWS\system32\VTTimer.exe]  [S3 Graphics, Inc., 2.00.01-0307]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3568][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5, 1, 0, 51]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2784][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3784][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2208][C:\Program Files\Windows Media Player\WMPNSCFG.exe]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Windows Media Player\wmpnssci.dll]  [Microsoft Corporation, 11.0.5721.5145 (WMP_11.061018-2006)]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3960][C:\Program Files\coopen\Coopen.exe]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\coopen\CoopenActiveControl30143.dll]  [北京首都在线, 3.0.1.43]
    [C:\Program Files\coopen\CoopenPlayer.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenHttpDownload.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenLocalPlayer.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3.0.1.43]
    [C:\Program Files\coopen\CoopenModeA.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3.0.1.43]
    [C:\Program Files\coopen\CoopenNotify.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenPlay.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenShare.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenUI.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\coopen\CoopenUpdate.cop]  [Beijing Capital Online Network Technology Co.,Ltd, 3, 0, 1, 43]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1720][C:\Program Files\Rising\Rav\RsLogVw.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [C:\Program Files\Rising\Rav\RsCommx.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\rsguilib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [C:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [C:\Program Files\Rising\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[PID: 1376][C:\Program Files\Tencent\TT\TTraveler.exe]  [腾讯公司, 3, 3, 200, 290]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\kakatool.dll]  [Beijing Rising Technology Co., Ltd., 2, 0, 3, 0]
    [C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, ]
    [C:\Program Files\Tencent\TT\TTNetFavor.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\JPWB.IME]  [常诚研制, 4.00.950]
[PID: 3016][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2464][C:\Documents and Settings\pc1\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, ]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
192.168.10.20 zxserver

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
黑色五月 - 2007-5-18 20:25:00
各位大哥帮帮忙呀,谢谢了
黑色五月 - 2007-5-18 22:25:00
紧急求助高手呀
黑色五月 - 2007-5-18 23:16:00
大家帮帮忙呀~~~~~~~~~
loveperday - 2007-5-18 23:45:00
========Content========
注册表删除：
<{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}><C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys> []
<{5D06580A-08EB-4DD0-8425-DDBB5198B30C}><C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys> []
服务删除：
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
tcUpdt / tcUpdt][Running/Auto Start]
<C:\PROGRA~1\tcclient\TCUpdt.exe -R><N/A>
驱动删除：
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[New0 / New0][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\new.sys><N/A>
文件删除：
[C:\WINDOWS\system32\cmdbcs.dll
C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys

用SREng就是扫日志的这个还有冰刃（华军有下）删除。
软件的使用方法见置顶贴

ysys1 - 2007-5-19 0:56:00
象是一个视频聊天网站的病毒

Logfile of HijackThis v1.99.1
Scan saved at 0:12:45, on 2007-4-25
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
d:\Program Files\Rising\Rav\CCenter.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
d:\Program Files\Rising\Rav\Ravmond.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\Rundll32.exe
D:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Rising\Rav\RavStub.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\COMM\Network.exe
D:\WINDOWS\SYSTEM32\RUNDLL32.EXE
D:\WINDOWS\System32\RUNDLL32.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\WINDOWS\system32\rundll32.exe
D:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\WINDOWS\vsnpstd3.exe
D:\WINDOWS\System32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\System32\conime.exe
D:\Program Files\Internet Explorer\iexplore.exe
C:\迅雷\Thunder.exe
d:\Program Files\Rising\Rav\RsAgent.exe
D:\WINDOWS\msagent\AgentSvr.exe
D:\Program Files\Internet Explorer\iexplore.exe
C:\瑞星杀毒\hijackthis\HijackThis\HijackThis.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn/
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn/
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn/
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 www.YSYSW.COM.CN
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn
O1 - Hosts: 218.85.139.122 ysysw.com.cn/
O1 - Hosts: 218.85.139.122 www.ysysw.com.cn/
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O1 - Hosts: 218.85.139.122 5ieb.cn
O1 - Hosts: 218.85.139.122 www.5ieb.cn
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - D:\WINDOWS\System32\xunleibho_v13.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - D:\WINDOWS\downlo~1\CnsHook.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RavTask] "d:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [helper.dll] D:\WINDOWS\system32\rundll32.exe D:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe D:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [snpstd3] D:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &使用迅雷下载 - C:\迅雷\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\迅雷\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\网际快车\FLASHGET\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\网际快车\FLASHGET\jc_all.htm
O8 - Extra context menu item: 加入POCO网摘(&K) - http://www.ysysw.com.cn/
O8 - Extra context menu item: 我的POCO网摘(&O) - http://www.ysysw.com.cn/
O8 - Extra context menu item: 易趣购物 - D:\Program Files\AD4All\link1\ebaylink.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\QQ\SendMMS.htm
O8 - Extra context menu item: 精彩图铃 - D:\Program Files\AD4All\link2\phone.htm
O9 - Extra button: 解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - D:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: 超级解霸 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - D:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://www.ysysw.com.cn/
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://www.ysysw.com.cn/
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\网际快车\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\网际快车\FLASHGET\flashget.exe
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: 易趣购物 - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=159 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {EE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=159 (file missing)
O9 - Extra button: 精彩图铃 - {EE60714F-AC27-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=162 (file missing)
O9 - Extra 'Tools' menuitem: 精彩图铃 - {EE60714F-AC27-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=162 (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 上网助手-地址栏搜索
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE38520F-C41B-4458-A05B-A2C332DA9AB4}: NameServer = 211.98.2.4,211.98.4.1
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - d:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - D:\Program Files\Common Files\COMM\Network.exe
火影忍者 - 2007-5-19 1:11:00
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\Program Files\lockfile\hkey.exe> [N/A]
loveperday - 2007-5-19 1:17:00
寒，这个居然没发现。。。。郁闷ING.。
楼主最好确认下lockfile这个文件夹是不是你建的
sanjingshou - 2007-5-19 1:34:00
引用:
【loveperday的贴子】========Content========
注册表删除：
<{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}><C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys> []
<{5D06580A-08EB-4DD0-8425-DDBB5198B30C}><C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys> []
服务删除：
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
tcUpdt / tcUpdt][Running/Auto Start]
<C:\PROGRA~1\tcclient\TCUpdt.exe -R><N/A>
驱动删除：
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[New0 / New0][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\new.sys><N/A>
文件删除：
[C:\WINDOWS\system32\cmdbcs.dll
C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys

用SREng就是扫日志的这个还有冰刃（华军有下）删除。
软件的使用方法见置顶贴


………………

貌似这个服务不是病毒开的
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
cdac11ba.exe - cdac11ba - 进程管理信息
进程文件： cdac11ba or cdac11ba.exe
进程名称： cdac11ba
进程类别：应用进程
英文描述：
cdac11ba.exe is a part of MacroVision safeCast copy protection software. This piece of software allows manufacturers to protect their products from illegal duplication. Disabling, or deleting this process may corrupt the product it was supplied with.
中文参考：
cdac11ba.exe是MacroVision safeCast反复制保护软件。该进程是一些软件为了保护其产品不被盗版而安装的。
出品者：MacroVision
属于：MacroVision safeCast copy protection software
系统进程：No
后台程序：Yes
网络相关：No
常见错误：N/A
内存使用：N/A
安全等级 (0-5): 0
间谍软件：No
广告软件：No
病毒：No
木马：No
loveperday - 2007-5-19 9:40:00
恩恩。学习ING。。。。。
楼主不好意思。
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
这个服务和对应文件不用删除。
谢谢sanjingshou！
黑色五月 - 2007-5-25 17:39:00
已解决,通过冰刃扫描强行删除病毒文件,也不存在问题,多谢大家的帮助
1
查看完整版本: 更新至18日病毒库都无法删除的病毒,请帮忙查看扫描日志,紧急在线求助
© 2000 - 2026 Rising Corp. Ltd.