RootKit.Hider.k和Trojan.Mnless.lvj 求救!!! bbs.ikaka.com

punkfish - 2007-5-19 18:06:00

RootKit.Hider.k
Trojan.Mnless.lvj

今天下午升级了瑞星之后,就查出来了这两个毒.而且开机慢许多.
请大家帮忙看看哦,怎么杀?

[CODE]

2007-05-19,17:46:09

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Publisher]
<SysExplr><D:\豪杰\SYSEXPLR.EXE> []
<ZcomClient><> [N/A]
<MINI_PCGAMES><D:\大富翁\PCGDownloader\PCGDownloader.exe> [N/A]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
<runeip><D:\卡卡上网助手\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<RavTask><"D:\新瑞星\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<KKDelay><D:\卡卡上网助手\RunOnce.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[QQ游戏启动加速程序]
<C:\Documents and Settings\Admin\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> D:\qq\QQGAME\Accel.exe [深圳市腾讯计算机系统有限公司]><N>
[Adobe Gamma]
<C:\Documents and Settings\Admin\「开始」菜单\程序\启动\Adobe Gamma.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[腾讯QQ]
<C:\Documents and Settings\Admin\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT]><N>

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Auto Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Office Backup Engine / Investor][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\jzbsp.dll><Microsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<d:\防火墙新的\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<d:\防火墙新的\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\新瑞星\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\新瑞星\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Microsoft Update Service / SOCEESe][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\PUBOM.DLL,Export 1087><Microsoft Corporation>

punkfish - 2007-5-19 18:07:00

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[djlcrodj / djlcrodj][Running/Boot Start]
<\SystemRoot\system32\drivers\djlcrodj.sys><>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\ExpScan.sys><>
[VIA Rhine-Family Fast Ethernet Adapter Driver Service / FETND5BV][Running/Manual Start]
<system32\DRIVERS\fetnd5bv.sys><VIA Technologies, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[gsux / gsuxc][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\gsuxc.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\D:\防火墙新的\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ianrey0 / ianrey07][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\ianrey07.sys><N/A>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\d:\防火墙新的\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Stopped/Auto Start]
<\??\D:\qq\传美\qq\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\Program Files\Tencent\QQ\TMDlls\npkycryp.sys><N/A>
[NTSIM / NTSIM][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\ntsim.sys><VIA Networking Technologies, Inc.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\D:\防火墙新的\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\新瑞星\Rising\Rav\RSPPSYS.sys><Rising>
[rtcckm3 / rtcckm35][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\rtcckm35.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[VCD VNC Virtual Network Adapter / vcddev][Stopped/Manual Start]
<system32\DRIVERS\vcdvnic.sys><VNN B.J.>
[Via4in1 / Via4in1][Stopped/Manual Start]
<\??\G:\Via4in1.sys><N/A>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[viamraid / viamraid][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[xtc / xtc][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\xtc.sys><N/A>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[]
{0A88C85A-9C11-4406-AE6D-A2010BA44758} <C:\WINDOWS\system32\Cgtye.dll, N/A>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[]
{198D710F-C688-48B5-981E-98F470473097} <C:\WINDOWS\system32\Rhyjj.dll, N/A>
[]
{2E062296-7BF2-4B08-ABFF-F95DA65128FC} <C:\WINDOWS\system32\Fsnjh.dll, N/A>
[]
{4C3F419F-A063-4929-8C19-74077914B79D} <C:\WINDOWS\system32\Sglm.dll, N/A>
[]
{556742D8-DB23-41EE-BC72-8526B925D2E3} <C:\WINDOWS\system32\Flir.dll, N/A>
[]
{5CD1C38D-C133-4CD0-AB90-A44BCE11AF06} <C:\WINDOWS\system32\Gmpb.dll, N/A>
[Thunder Browser Helper]
{7B9DFDB6-389D-AD55-A72A-DD0105975034} <D:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[PyqDatdl Class]
{7B9DFDB7-389D-AD55-A72A-DD0105975034} <C:\WINDOWS\DOWNLO~1\arxgh.dll, cdcvfsoft>
[]
{858E5F9E-A55F-4D8C-B7DC-E3210AA5F298} <C:\WINDOWS\system32\Mnhc.dll, N/A>
[]
{8813F7E4-C728-4B3C-9C0C-25C0A9AB53D0} <C:\WINDOWS\system32\Mlzmr.dll, N/A>
[]
{AD121BD6-474B-4EDC-AC4B-5E0DADD5A87A} <C:\WINDOWS\system32\Pezuzs.dll, N/A>
[]
{C6B72B18-E024-44FC-9F4E-726FEDD0A34C} <C:\WINDOWS\system32\Gkku.dll, N/A>
[]
{CFBFBDFF-B364-490B-8A5A-6F16E89D2F68} <C:\WINDOWS\system32\Bhbs.dll, N/A>
[]
{DC179F2A-6241-4F04-9C26-8B225458A783} <C:\WINDOWS\system32\Tacwk.dll, N/A>
[]
{F2EFF23A-D68D-4315-95B4-198EC51FA55B} <C:\WINDOWS\system32\Qzzwwz.dll, N/A>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>

punkfish - 2007-5-19 18:08:00

[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[Qzone Media Tools]
{AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <D:\PROGRA~1\Tencent\qq\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[WebActivater Control]
{C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINDOWS\system32\3DShowVM.ocx, QQ>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Yahoo! Toolbar Helper]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} <, N/A>
[]
{0A88C85A-9C11-4406-AE6D-A2010BA44758} <C:\WINDOWS\system32\Cgtye.dll, N/A>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[]
{198D710F-C688-48B5-981E-98F470473097} <C:\WINDOWS\system32\Rhyjj.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[]
{2E062296-7BF2-4B08-ABFF-F95DA65128FC} <C:\WINDOWS\system32\Fsnjh.dll, N/A>
[HtmlDlgSafeHelper Class]
{3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[]
{4C3F419F-A063-4929-8C19-74077914B79D} <C:\WINDOWS\system32\Sglm.dll, N/A>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\qq1\QQ\QQIEHelper.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[]
{556742D8-DB23-41EE-BC72-8526B925D2E3} <C:\WINDOWS\system32\Flir.dll, N/A>
[]
{5CD1C38D-C133-4CD0-AB90-A44BCE11AF06} <C:\WINDOWS\system32\Gmpb.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\迅雷\Components\InMedia\MediaAddin12.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{7B9DFDB6-389D-AD55-A72A-DD0105975034} <D:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[PyqDatdl Class]
{7B9DFDB7-389D-AD55-A72A-DD0105975034} <C:\WINDOWS\DOWNLO~1\arxgh.dll, cdcvfsoft>
[]
{858E5F9E-A55F-4D8C-B7DC-E3210AA5F298} <C:\WINDOWS\system32\Mnhc.dll, N/A>
[]
{8813F7E4-C728-4B3C-9C0C-25C0A9AB53D0} <C:\WINDOWS\system32\Mlzmr.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Qzone Media Tools]
{AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <D:\PROGRA~1\Tencent\qq\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[]
{AD121BD6-474B-4EDC-AC4B-5E0DADD5A87A} <C:\WINDOWS\system32\Pezuzs.dll, N/A>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[]
{C6B72B18-E024-44FC-9F4E-726FEDD0A34C} <C:\WINDOWS\system32\Gkku.dll, N/A>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[]
{CFBFBDFF-B364-490B-8A5A-6F16E89D2F68} <C:\WINDOWS\system32\Bhbs.dll, N/A>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[]
{DC179F2A-6241-4F04-9C26-8B225458A783} <C:\WINDOWS\system32\Tacwk.dll, N/A>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\CONFLICT.1\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[&Yahoo! Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} <, N/A>
[]
{F29304B5-8BE7-480B-A20A-E2ABFEE63AB1} <C:\WINDOWS\system32\Txcieh.dll, N/A>
[]
{F2EFF23A-D68D-4315-95B4-198EC51FA55B} <C:\WINDOWS\system32\Qzzwwz.dll, N/A>
[使用迅雷下载]
<D:\迅雷\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\迅雷\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\word文档\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\qq\AddEmotion.htm, N/A>

punkfish - 2007-5-19 18:09:00

==================================
正在运行的进程
[PID: 548][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 696][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\AppPatch\AcAdProc.dll] [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
[PID: 708][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 860][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 924][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1048][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\windows\system32\jzbsp.dll] [Microsoft Corporation, 5.1.2600.0]
[PID: 1160][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1320][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1600][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1796][D:\新瑞星\Rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
[D:\新瑞星\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\新瑞星\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 188][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\WPDShServiceObj.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\PortableDeviceTypes.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\PortableDeviceApi.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.6693]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.6693]
[C:\WINDOWS\system32\nvshell.dll] [NVIDIA Corporation, 6.14.10.6693]
[C:\WINDOWS\system32\Cgtye.dll] [N/A, ]
[D:\迅雷\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\迅雷\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\system32\Mlzmr.dll] [N/A, ]
[C:\WINDOWS\system32\Pezuzs.dll] [N/A, ]
[c:\windows\system32\jzbsp.dll] [Microsoft Corporation, 5.1.2600.0]
[D:\迅雷\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[D:\word文档\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\新瑞星\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll] [Microsoft Corporation, 8.1.0178.00]
[C:\WINDOWS\system32\wpdshext.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.5721.5145 (WMP_11.061018-2006)]
[PID: 968][d:\防火墙新的\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
[d:\防火墙新的\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[d:\防火墙新的\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[d:\防火墙新的\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[d:\防火墙新的\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[d:\防火墙新的\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[d:\防火墙新的\rising\rfw\PSAPI.DLL] [Microsoft Corporation, 4.00]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1672][D:\豪杰\SYSEXPLR.EXE] [N/A, ]
[D:\豪杰\AVCDROM.dll] [N/A, ]
[D:\豪杰\CoolMenu.dll] [N/A, ]
[D:\豪杰\Sys936.DLL] [N/A, ]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1920][D:\卡卡上网助手\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[D:\卡卡上网助手\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 2072][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 3348][D:\遨游\Maxthon2\Maxthon.exe] [Maxthon International ltd., 2, 0, 1, 9008]
[D:\遨游\Maxthon2\mxpp.dll] [Maxthon, 1, 0, 0, 50]
[D:\遨游\Maxthon2\MxSk.dll] [Maxthon, 1, 0, 0, 119]
[D:\遨游\Maxthon2\MxProxy2.dll] [, 1, 0, 0, 2868]
[D:\遨游\Maxthon2\MxFav.dll] [Maxthon, 1, 0, 0, 186]
[D:\遨游\Maxthon2\maxzlib.dll] [, 1.2.3]
[D:\遨游\Maxthon2\mxtool.dll] [, 1, 0, 0, 1]
[D:\遨游\Maxthon2\mxfeedU.dll] [, 1, 0, 45, 45]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[D:\新瑞星\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[D:\迅雷\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[PID: 616][D:\新建文件夹\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[D:\卡卡上网助手\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

punkfish - 2007-5-19 18:14:00

请大家帮忙看看 ,在这里谢谢大家!!

宝宝贼坏 - 2007-5-20 11:43:00

你和我中的病毒一样啊郁闷杀不掉啊在安全模式也杀不掉啊 - -!!!要怎么办哦 55```高手们快来撒 ```SOS!!!!!!!!!!!!!11救命拉`````````!!!

什么都不知道啊 - 2007-5-20 11:50:00

服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Auto Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><>
[Office Backup Engine / Investor][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\jzbsp.dll><Microsoft Corporation>
[xtc / xtc][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\xtc.sys><N/A>
浏览器加载项
修复类似{0A88C85A-9C11-4406-AE6D-A2010BA44758} <C:\WINDOWS\system32\Cgtye.dll, N/A>
的所有加载项
删除
C:\WINDOWS\system32\drivers\xtc.sys
C:\WINDOWS\system32\Mlzmr.dll
[C:\WINDOWS\system32\Pezuzs.dll
C:\WINDOWS\system32\Cgtye.dll
和上面浏览器加载里对应的DLL文件
修复下文件关联

punkfish - 2007-5-20 13:20:00

服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Auto Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><>
[Office Backup Engine / Investor][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\jzbsp.dll><Microsoft Corporation>
[xtc / xtc][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\xtc.sys><N/A>
浏览器加载项

问下 ,这个也要删掉是不?

583298059 - 2007-5-20 17:07:00

我也中了，不小心按了忽略，但是一切正常，什么都没发生。

火炬之星 - 2007-5-20 23:05:00

到底是怎么一回事，请各位高手认真指点呀。

青岛卓越 - 2007-5-21 8:21:00

瑞星的高手快出来啊,今天不是周末了啊。RootKit.Hider.k和Trojan.Mnless.lvj已经上班好几天了,快快快...

青岛卓越 - 2007-5-21 8:22:00

Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 08:08:42, on 2007-05-21
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.haokan123.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKLM\..\Run: [switch] ; c:\windows\system32\壁纸自动换.exe
O4 - HKLM\..\Run: [HControl] ; C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [igfxtray] ; C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] ; C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] ; C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio 属性页快捷方式] ; HDAShCut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [snp2std] ; C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] ; "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - Startup: desktop.ini =
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: desktop.ini =
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-2052-0000-7760-100000000002}\SC_Acrobat.exe
O8 - Extra context menu item: &使用快车(FlashGet)下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &使用快车(FlashGet)下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\QQ2007\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\QQ2007\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\QQ2007\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\QQ2007\SendMMS.htm
O8 - Extra context menu item: 转换为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换选定的链接为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: 转换选定的链接为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: 转换选项为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换选项为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: 转换链接目标为 Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: 转换链接目标为现有 PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra Button: 快车 - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: 快车(FlashGet) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O10 - Unknown file in Winsock LSP: C:\WINDOWS\system32\cdnns.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O18 - Filter : application/octet-stream - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-complus - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Filter : application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\Mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: igfxcui
O20 - Winlogon Notify: WgaLogon
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll
O23 - Service: Adobe LM Service (Adobe LM Service) - Adobe Systems - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"
O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Event Service (Popular) - - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\CCenter.exe"
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - "C:\Program Files\Rising\Rav\Ravmond.exe"
O23 - Service: System Event Logger (WalALET) - - C:\WINDOWS\system32\rundll2kxp.exe c:\windows\system32\wbem\gafdx.dll,export 1087

北京的云 - 2007-5-21 9:54:00

同样的病毒，请高手多帮忙

feifei9 - 2007-5-21 10:19:00

用冰刃找到C\SYSTEM32\DRIVERS\SPJKU.SYS强制删除,重起电脑.瑞星在扫描能杀掉3个文件.好了.我昨天杀掉了

feifei9 - 2007-5-21 10:21:00

用冰刃强删C\SYSTEM32\DRIVERS\SPJKU.SYS重起.瑞星扫描能杀掉3个文件.好了

tuleilei - 2007-5-21 13:22:00

非常的郁闷,按照14楼的大虾下了个冰刃,但在安装过程中一双击安装系统马上自动重新启动或者蓝屏,请教各位大虾帮帮忙,谢谢!

tuleilei - 2007-5-21 13:27:00

在线等各位大虾帮忙,谢谢!

北京的云 - 2007-5-21 13:29:00

难兄难弟我帮你顶，我也是同样的问题

loveperday - 2007-5-21 13:35:00

冰刃不需要安装的呀~解压缩就能用

tuleilei - 2007-5-21 13:43:00

是解了压缩,应该是说运行吧.一点图标就马上自动重新启动.

loveperday - 2007-5-21 13:58:00

<ZcomClient><> [N/A]

npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\Program Files\Tencent\QQ\TMDlls\npkycryp.sys><N/A
你机器里有好多不认识的文件。
这两个也要删除。
冰刃不能用就用UNLOCKER，或者KILLBOX

tuleilei - 2007-5-21 14:10:00

真是气人啊,用BAIDU收索UNLOCKER和KILLBOX显示有很多(有华军,天空啊,等等),但是一点连接这些网站,马上关闭了.其他电脑可以连接

北京的云 - 2007-5-21 14:16:00

引用:

【tuleilei的贴子】是解了压缩,应该是说运行吧.一点图标就马上自动重新启动.

………………

谢谢你的解答，是不是大家被感染都是一样的文件那。我是刚重新安装的系统（重格C:D:，因为感染木马)安装瑞星后查毒发现感染的。

不能让病毒横行 - 2007-5-21 14:19:00

这两个病毒一直存在,无论如何都删不掉.晕死了.杂种的病毒?迷糊中.

青岛卓越 - 2007-5-21 14:24:00

顶顶顶,为什么瑞星连这个问题处理不了,好象大家中毒的都是用的瑞星正版软件啊.怎么办呢?

不能让病毒横行 - 2007-5-21 14:28:00

有能解决的吗?这两个病毒一直活跃在我的电脑中,瑞星刚刚又升级了,依然杀不掉.

电脑最怕中毒 - 2007-5-21 15:02:00

<C:\WINDOWS\SYSTEM32\RUNDLL2KXP.EXE C:\WINDOWS\SYSTEM32\WBEM\PUBOM.DLL,Export 1087><Microsoft Corporation>

北京的云 - 2007-5-21 15:14:00

看来受害的人还是很多的，斑竹出来帮帮大家吧

不能让病毒横行 - 2007-5-21 15:29:00

又杀了一边,依然存在.这两个可恶的病毒.

天月来了 - 2007-5-21 15:41:00

哎呀！！
不要太依赖杀软啊。

你们中毒的系统又和楼主的不一定一个样。

自己开个新贴，发好日志，等看哦。

这样夹别人的贴里，挤来挤去的搞不好的哦。

不要光看别人的东西，自己的才最重要。

瑞星卡卡安全论坛