求助???????autorun.inf yeyinhi.exe病毒 bbs.ikaka.com

孙建风月 - 2007-6-6 16:07:00

autorun.inf yeyinhi.exe病毒,太厉害,中了之后,杀毒软件都被黑了,删了也不行,
建立空文件autorun.inf也不行,正版的杀毒软件也杀不了,系统慢得很
如果有人想要这个病毒研究,我可以提供!
QQ:93920903

Jokkkka - 2007-6-6 16:17:00

该用户帖子内容已被屏蔽

suzhou758 - 2007-6-6 17:26:00

我是加你QQ的那个,你先照下面的做:
下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
友情提示：
扫描前关闭所有手工打开的软件和窗口，扫描后将日志发上来。但请不要用附件形式贴。
注意在没有进一步提示前，勿要胡乱修复，否则系统可能变的情况更糟。

如果发现SREng.exe运行无反应或者不能运行或者扫描出错,你可以将SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行.

火影忍者 - 2007-6-6 17:49:00

照楼上操作,下载SRE,下载后改名运行...如19.com/as.bat/15aq.scr/dfgh.exe不要有规律,多试几次.

hengfeng - 2007-6-7 12:45:00

[CODE]

2007-06-07,12:09:58

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<eMuleAutoStart><; E:\软件\eMule\eMule.exe -AutoStart> [http://www.emule-project.net]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<ykubdte><C:\Program Files\Common Files\System\rujrmue.exe> []
<yeyinhi><C:\Program Files\Common Files\Microsoft Shared\pumthsg.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><"\Program Files\Logonui\Royale.exe"> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{91B1E846-2BEF-4345-8848-7699C7C9935F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll> []
<{C54C4AFB-8A2A-6C1E-BA41-C20F02940401}><C:\WINDOWS\system32\18.dll> []
<{C51C4AFB-8A3A-6C1E-BA41-C20F02940603}><C:\WINDOWS\system32\20.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll> [(Verified)Microsoft Corporation]

==================================
启动文件夹
[蓝牙控制盘]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\蓝牙控制盘.lnk --> C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [Broadcom Corporation.]><N>

==================================
服务
[Bluetooth Service / btwdins][Running/Auto Start]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[Intel(R) PROSet/Wireless Event Log / EvtEng][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Logitech Process Monitor / LVPrcSrv][Running/Auto Start]
<c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe><Logitech>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Trend Micro Central Control Component / PcCtlCom][Running/Auto Start]
<C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe><Trend Micro Inc.>
[Trend Micro Protection Against Spyware / PcScnSrv][Running/Manual Start]
<"C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe"><Trend Micro Inc.>
[Intel(R) PROSet/Wireless Registry Service / RegSrvc][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Intel(R) PROSet/Wireless Service / S24EventMonitor][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[Trend Micro Real-time Service / Tmntsrv][Running/Auto Start]
<C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe><Trend Micro Inc.>
[Trend Micro Personal Firewall / TmPfw][Running/Auto Start]
<C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe><Trend Micro Inc.>
[Trend Micro Proxy Service / tmproxy][Running/Auto Start]
<C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe><Trend Micro Inc.>

hengfeng - 2007-6-7 12:47:00

==================================
驱动程序
[a320raid / a320raid][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>
[aar1210 / aar1210][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aar1210.sys><Adaptec, Inc.>
[abp480n5 / abp480n5][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\abp480n5.sys><Microsoft Corporation>
[adpu160m / adpu160m][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[adpu320 / adpu320][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[adsrsvc / adsrsvc][Running/Boot Start]
<\SystemRoot\system32\drivers\adsrsvc.sys><>
[ACARD AEC6210UF UltraDMA33 Controller / aec6210][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>
[ACARD AEC6260 UltraDMA-66 Controller / aec6260][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>
[aec6280 / aec6280][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>
[AEC6890 / AEC6890][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC6890.sys><ACARD Technology Corp.>
[aec68x5 / aec68x5][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>
[AEGIS Protocol (IEEE 802.1x) v3.4.10.0 / AegisP][Running/Auto Start]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[aha154x / aha154x][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aic78xx.sys><Microsoft Corporation>
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[asc / asc][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\asc.sys><Advanced System Products, Inc.>
[asc3550 / asc3550][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>
[BdGuard / BdGuard][Running/Boot Start]
<\SystemRoot\system32\drivers\BDGuard.SYS><>
[蓝牙音频设备 / btaudio][Running/Manual Start]
<system32\drivers\btaudio.sys><Broadcom Corporation.>
[蓝牙虚拟通信驱动程序 / BTDriver][Stopped/Manual Start]
<system32\DRIVERS\btport.sys><Broadcom Corporation.>
[蓝牙总线枚举器 / BTKRNL][Running/Manual Start]
<system32\DRIVERS\btkrnl.sys><Broadcom Corporation.>
[Bluetooth Serial Driver / BTSERIAL][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\btserial.sys><Broadcom Corporation.>
[蓝牙局域网接入服务器 / BTWDNDIS][Stopped/Manual Start]
<system32\DRIVERS\btwdndis.sys><Broadcom Corporation.>
[WIDCOMM USB Bluetooth Driver / BTWUSB][Stopped/Manual Start]
<System32\Drivers\btwusb.sys><Broadcom Corporation.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[dac2w2k / dac2w2k][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[Dritek Keyboard Filter Driver / DKbFltr][Running/Manual Start]
<system32\DRIVERS\DKbFltr.sys><Dritek System Inc.>
[dpti2o / dpti2o][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\dpti2o.sys><N/A>
[fasttrak / fasttrak][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttrak.sys><Promise Technology, Inc.>
[fasttx2k / fasttx2k][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttx2k.sys><Promise Technology, Inc.>
[fasttx2k2 / fasttx2k2][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttx2k2.sys><Promise Technology, Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Hpt366 / Hpt366][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\Hpt366.sys><Microsoft Corporation>
[HPT371 / HPT371][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\HPT371.sys><HighPoint Technologies, Inc.>
[hpt374 / hpt374][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\hpt374.sys><HighPoint Technologies, Inc.>
[hpt3xx / hpt3xx][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\hpt3xx.sys><HighPoint Technologies, Inc.>
[hptmv / hptmv][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\hptmv.sys><HighPoint Technologies, Inc.>
[hptpro / hptpro][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>
[Intel Integrated RAID / iaStor][Running/Boot Start]
<\SystemRoot\system32\drivers\iaStor.sys><Intel Corporation>
[ini910u / ini910u][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ini910u.sys><Microsoft Corporation>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[ITERAID_Service_Install / iteraid][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\iteraid.sys><Integrated Technology Express, Inc.>
[Logitech USB PC Camera (VC0321) / lv321av][Running/Manual Start]
<system32\DRIVERS\lv321av.sys><Logitech>
[Logitech Machine Vision Engine Loader / lvmvdrv][Running/Manual Start]
<\??\C:\WINDOWS\system32\drivers\lvmvdrv.sys><>
[Logitech LVPrcMon Driver / LVPrcMon][Running/Manual Start]
<\??\C:\WINDOWS\system32\drivers\LVPrcMon.sys><>
[Logitech USB Monitor Filter / LVUSBSta][Running/Manual Start]
<system32\DRIVERS\LVUSBSta.sys><Logitech>
[m5228 / m5228][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\m5228.sys><ALi Corporation.>
[m5281 / m5281][Running/Boot Start]
<\SystemRoot\system32\drivers\m5281.sys><ALi Corporation>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[mraid2k / mraid2k][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\mraid2k.sys><American Megatrends, Inc.>
[mraid35x / mraid35x][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\mraid35x.sys><American Megatrends Inc.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[SiI 680 ATA Controller / Pnp680][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\pnp680.sys><Silicon Image, Inc.>
[Silicon Image SiI 0680 Medley Raid Controller / Pnp680r][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\pnp680r.sys><Silicon Image, Inc>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ql1080 / ql1080][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ql1080.sys><QLogic Corporation>
[ql10wnt / ql10wnt][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ql10wnt.sys><Microsoft Corporation>
[ql12160 / ql12160][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1280 / ql1280][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ql1280.sys><QLogic Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[WLAN 传输 / s24trans][Running/Auto Start]
<system32\DRIVERS\s24trans.sys><Intel Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SiI-3512 SATALink Controller / SI3112][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SI3112.sys><Silicon Image, Inc.>
[Silicon Image SiI 3512 SATARaid Controller / SI3112r][Running/Boot Start]
<\SystemRoot\system32\drivers\SI3112r.sys><Silicon Image, Inc>
[SiI-3114 SATALink Controller / SI3114][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SI3114.sys><Silicon Image, Inc.>
[SiI-3114 SATARaid Controller / SI3114r][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SI3114R.sys><Silicon Image, Inc>
[SiI-3124 SATALink Controller / SI3124][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SI3124.sys><Silicon Image, Inc.>
[SiI-3124 SATARaid Controller / SI3124r][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SI3124R.sys><Silicon Image, Inc>
[SATALink driver accelerator / SiFilter][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SiWinAcc.sys><Silicon Image, Inc.>
[SiSRaid / SiSRaid][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SiSRaid.sys><Silicon Integrated Systems>
[SiSRaid1 / SiSRaid1][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\SiSRaid1.sys><Silicon Integrated Systems>
[SiSV / SiSV][Stopped/Manual Start]
<system32\DRIVERS\SiSV.sys><Silicon Integrated Systems Corporation>
[sparrow / sparrow][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[sptrak / sptrak][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sptrak.sys><Promise Technology, Inc.>
[symc810 / symc810][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\symc810.sys><Symbios Logic Inc.>
[symc8xx / symc8xx][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\symc8xx.sys><LSI Logic>
[sym_hi / sym_hi][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sym_u3.sys><LSI Logic>
[tifm21 / tifm21][Running/Manual Start]
<system32\drivers\tifm21.sys><Texas Instruments>
[Trend Micro Common Firewall Service / tmcfw][Running/Manual Start]
<system32\DRIVERS\TM_CFW.sys><Trend Micro Inc.>
[tmcomm / tmcomm][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\tmcomm.sys><Trend Micro Inc.>
[Trend Micro MBD Driver / tmmbd][Running/Auto Start]
<system32\DRIVERS\tm_mbd_c.sys><Trend Micro Inc.>
[tmpreflt / tmpreflt][Running/Auto Start]
<system32\DRIVERS\tmpreflt.sys><Trend Micro Inc.>
[Trend Micro TDI Driver / tmtdi][Running/System Start]
<system32\DRIVERS\tmtdi.sys><Trend Micro Incorporated.>
[tmxpflt / tmxpflt][Running/Auto Start]
<system32\DRIVERS\tmxpflt.sys><Trend Micro Inc.>
[UlSata / UlSata][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ulsata.sys><Promise Technology, Inc.>
[ultra / ultra][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\ultra.sys><Promise Technology, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[viamraid / viamraid][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[VIA ATA/ATAPI Host Controller / viapdsk][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\viapdsk.sys><VIA Technologies, Inc.>
[viaraid / viaraid][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\viaraid.sys><VIA Technologies inc,.ltd>
[viasraid / viasraid][Running/Boot Start]
<\SystemRoot\system32\drivers\viasraid.sys><VIA Technologies inc,.ltd>
[vmscsi / vmscsi][Running/Boot Start]
<\SystemRoot\system32\drivers\vmscsi.sys><VMware, Inc.>
[vsapint / vsapint][Running/Auto Start]
<system32\DRIVERS\vsapint.sys><Trend Micro Inc.>
[Intel(R) PRO/Wireless 3945ABG Adapter Driver / w39n51][Running/Manual Start]
<system32\DRIVERS\w39n51.sys><Intel? Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
<system32\DRIVERS\yk51x86.sys><Marvell>

hengfeng - 2007-6-7 12:48:00

==================================
浏览器加载项
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\软件\webxunlei\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v11.dll, Thunder Networking Technologies,LTD>
[BdSearchHook Class]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <C:\PROGRA~1\baidu\iexp\BDSrHook.dll, N/A>
[CLDown Object]
{0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <E:\软件\Tuotu\TuotuHelper_v8.dll, Tuotu.com>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[百度首页]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <http://baidu.com/index.php?tn=wz500_dg, N/A>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@btrez.dll,-4015]
{CCA281CA-C863-46ef-9331-5C8D4460577F} <, N/A>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\软件\webxunlei\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v11.dll, Thunder Networking Technologies,LTD>
[BdSearchHook Class]
{02496EBD-8455-48DB-B3C7-5DAC97D9F5A7} <C:\PROGRA~1\baidu\iexp\BDSrHook.dll, N/A>
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[CLDown Object]
{0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <E:\软件\Tuotu\TuotuHelper_v8.dll, Tuotu.com>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[BandIE Class]
{77FEF28E-EB96-44FF-B511-3185DEA48697} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[百度超级搜霸]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<E:\软件\software\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<E:\软件\webxunlei\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<E:\软件\webxunlei\GetAllUrl.htm, N/A>
[使用脱兔下载]
<E:\软件\Tuotu\TT_one.htm, N/A>
[使用脱兔下载全部链接]
<E:\软件\Tuotu\TT_all.htm, N/A>
[发送到 Bluetooth 设备(&B)...]
<C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm, N/A>
[添加到QQ自定义面板]
<E:\软件\software\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\软件\software\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\软件\software\QQ\SendMMS.htm, N/A>

hengfeng - 2007-6-7 12:48:00

==================================
正在运行的进程
[PID: 1260][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1308][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1332][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1376][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1388][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 1580][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1660][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 1816][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 3596][C:\WINDOWS\system32\WgaTray.exe] [Microsoft Corporation, 1.7.0018.5]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[PID: 2180][C:\Program Files\Common Files\Microsoft Shared\pumthsg.exe] [N/A, ]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 2692][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[PID: 3092][C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe] [Broadcom Corporation., 5.0.1.1500]
[C:\WINDOWS\system32\wbtapi.dll] [Broadcom Corporation., 5.0.1.1500]
[C:\WINDOWS\system32\btosif.dll] [Broadcom Corporation., 5.0.1.1500]
[C:\WINDOWS\system32\btwhidcs.DLL] [Broadcom Corporation., 5.0.1.1500]
[C:\Program Files\WIDCOMM\Bluetooth Software\BtBalloon.dll] [Broadcom Corporation., 5.0.1.1500]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\btrez.dll] [Broadcom Corporation., 5.0.1.1500]
[C:\WINDOWS\system32\CSH.dll] [Blue Sky Software Corporation, 2.00.039]
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] [N/A, ]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[PID: 2548][E:\软件\Dr.COM 宽带登录客户端\ishare_user.exe] [N/A, ]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[PID: 4020][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[PID: 3044][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[E:\软件\webxunlei\WebThunderBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
[E:\软件\Tuotu\TuotuHelper_v8.dll] [Tuotu.com, 2.0.0.6]
[C:\PROGRA~1\baidu\bar\baidubar.dll] [Baidu.com, Inc., 2, 0, 2, 141]
[C:\Program Files\Trend Micro\Internet Security 2007\Tmdshell.dll] [Trend Micro Inc., 15.30.0.1185]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\ACDSee\picaview.dll] [ACD Systems, Ltd., 2, 0, 0, 78]
[C:\Program Files\ACDSee\PlugIns\IDE_ACDStd.apl] [ACD Systems, Ltd., 1, 3, 4, 22]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\system32\moyu103.dll] [N/A, ]
[C:\WINDOWS\system32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\system32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\system32\nwizAsktao.dll] [N/A, ]
[C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll] [N/A, ]
[PID: 2976][C:\Program Files\Common Files\System\rujrmue.exe] [N/A, ]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[C:\SREng.com] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll] [Logitech, 9.4.4.1082]
[C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll] [N/A, ]
[C:\Program Files\SogouInput\Plugin\SgImeWord.dll] [, 1, 0, 0, 31]
[C:\WINDOWS\system32\20.dll] [N/A, ]
[C:\WINDOWS\system32\18.dll] [N/A, ]
[C:\WINDOWS\system32\Kvsc3.dll] [N/A, ]
[C:\WINDOWS\system32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\system32\cmdbcs.dll] [N/A, ]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
RSVP UDP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)
RSVP TCP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)

==================================
Autorun.inf
[D:\]
[AutoRun]
open=yeyinhi.exe
shell\open=打开(&O)
shell\open\Command=yeyinhi.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=yeyinhi.exe
[E:\]
[AutoRun]
open=yeyinhi.exe
shell\open=打开(&O)
shell\open\Command=yeyinhi.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=yeyinhi.exe
[F:\]
[AutoRun]
open=yeyinhi.exe
shell\open=打开(&O)
shell\open\Command=yeyinhi.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=yeyinhi.exe
[G:\]
[AutoRun]
open=yeyinhi.exe
shell\open=打开(&O)
shell\open\Command=yeyinhi.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=yeyinhi.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

孙建风月 - 2007-6-7 12:49:00

尊敬的客户，您好！
您的邮件已经收到，感谢您对瑞星的支持。

我们已经详细分析过您的问题和文件，以下是您上传的文件的分析结果：
1.文件名：autorun.inf
不是病毒

2.文件名：yeyinhi.exe
病毒名：Trojan.DL.Agent.ode

我们将在较新的19.26.21版本(瑞星2006的18.82.21版本)中处理解决，请您届时将您的瑞星软件升级到19.26.21(瑞星2006的18.82.21版本)版本并且打开监控中心全盘杀毒。如果我们在测试过程中发现问题的话，我们会推迟一到两版本后升级。

注意：如果您上报的文件损坏或者压缩包有密码保护，会导致我们无法正确分析，请您确认文件正常且压缩包中无密码后再提交。
如有问题，您可以通过电话或者邮件服务中心与我们联系，详细描述您的问题，并且提供此封邮件主题中的流水单号以及上报所用的电子邮件地址。
提醒：为保证收到您的来信，请勿直接回复本邮件!!!
-------------------------------------------------------------
服务单位：瑞星·客户服务中心
工程师：YFB001
电话服务：（010）82678800
发送邮件：请用IE等浏览器访问网址 http://csc.rising.com.cn

FCOME - 2007-6-7 12:57:00

我们将在较新的19.26.21版本(瑞星2006的18.82.21版本)中处理解决，请您届时将您的瑞星软件升级到19.26.21(瑞星2006的18.82.21版本)

FCOME - 2007-6-7 12:58:00

lz 给个yeyinhi.exe的样本，压缩样本密码 123
发到wdt3385@yahoo.com.cn
谢谢

FCOME - 2007-6-7 13:07:00

用sreng2删除以下东东
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ykubdte><C:\Program Files\Common Files\System\rujrmue.exe> []
<yeyinhi><C:\Program Files\Common Files\Microsoft Shared\pumthsg.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellE

xecuteHooks]
<{91B1E846-2BEF-4345-8848-7699C7C9935F}><C:\Program Files\Common

Files\Microsoft Shared\MSINFO\SysWFGQQ2.dll> []
<{C54C4AFB-8A2A-6C1E-BA41-C20F02940401}><C:\WINDOWS\system32\18.dll> []
<{C51C4AFB-8A3A-6C1E-BA41-C20F02940603}><C:\WINDOWS\system32\20.dll> []

删除以上东东，还有病毒文件
还有这个
C:\WINDOWS\system32\nwizAsktao.dll
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]

然后用sreng2修复你的winsock

俺是新手，看不懂您那么多的驱动！
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
请高手指出不对的地方

大灰狼L - 2007-6-7 18:07:00

我也是中过这个毒,刚刚搞定的。二话不说，就马上进吧来帮大家解决这个问题。
这个毒很烦人。我是通过U盘被感染的。有“pumthsg.exe”和“rujrmue.exe” 2个进程，在电脑的每个硬盘上都有，当你重装后，只要双击打开电脑C盘以外的盘，又会马上感染到C盘，系统又白装了。
主要症状如下：
1、2个进程怎么也结束不了，一结束又会自动生成。
2、杀毒软件都被屏蔽了，不管怎么都打不开。我试过“AVG Anti-Spyware 7.5”不会被屏蔽，但是杀不了这个毒。
3、进不了安全模式，在读取安全模式进程的时候会重启。
4、病毒所在的文件夹"C:\Program Files\Common Files\System"一打开马上就被强制关闭。在互联网上搜索有关这个的关键词时IE被强制关闭，就连搜索“杀毒”两个字也会被关闭。
5、系统会变卡，QQ登录界面出现异样，

差不多就上面这些症状了。下面我来说一下刚才我解决这个毒的方法。

1、重装系统，
2、重装完之后，请不要双击打开除系统盘外的任何硬盘（这个关键，如果你不注意的话，系统就白装了）。
3、重装好进入windows后，点击“开始菜单”——“运行”。然后输入“D:\autorun.inf”运行，然后弹出一个“自动运行配置文件”窗口，里面的东西就是病毒自动运行文本。你把里面的文本全选删除，删除后保存，关闭。然后再打开“开始菜单”——“运行”，然后输入“E:\autorun.inf”。按照这个方法依次把你所在硬盘上的“autorun.inf”内容都删了。删除的时候要小心，千万不要双击打开病毒，否则前功尽弃！
4、删完这个之后，病毒就不会自动运行了。这样就可以开始删除病毒了。打开“文件夹选项”，把里面“显示系统文件夹内容”和“显示所有文件和文件夹”的勾打上，把“隐藏受保护的操作系统文件”的勾去掉。然后“确定”。
5、依次打开每个硬盘，一打开就可以看到“autorun.inf”和“yeyinhi.exe”两个文件，把这两个文件用“shift + Del”彻底删除（系统盘刚刚装完，没有这两个文件）。所有硬盘分区都依次删除这两个文件后，完全了。

经过这些步骤就可以完全删除病毒，虽然有些麻烦，不过可以解决问题。

dong933 - 2007-6-8 1:45:00

解决方案：首先在wimdows管理器中看是否有这两个进程：pumthsg和rujrme。如果有就按下面做应该能解决
第一步：开始—运行--msconfig打开“系统配置实用程序”——启动将pumthsg 和rujrme禁用（即在前面的框中打钩然后应用）

第二步：进入注册表：开始--运行——regedit 打开注册表步骤是：HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run中找到相对应的有关pumthsg和rujrme相关的启动项（好象是倒数第二第三个，如果不是可以双击右面的“名称”下面的东西，比如双击RfwMain可以看到"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup，这里有你所有启动项的东西，一个一个的找，一定能找到与pumthsg和rujrme有关的项）将其删除。

第三步：根据第一步打开的“系统配置实用程序”找到pumthsg.exe和rujrme.exe,分别在C:\Program Files\Common Files和C:\Program Files\Common Files\System 将它们删除（C:\Program Files\Common Files\System 在隐藏文件夹中），同时打开其他的盘将yeyinhi.exe 和相应的.inf隐藏文件删除，记住要将每个盘的这两个文件都删除。到这里基本就结束了。但是当我们重新启动系统后。能上网，所有的网业都能打开，但是打开相应的杀毒软件的时候系统却弹出windows找不到杀毒软件之类的东西。比如瑞星，360Safe，都会提示。这是由于我们的系统仍存留病毒的注册项，那么就要进行第四步。

第四步：下“超级兔子”清理注册项。再重启就可以解决了。（可我却重新安装了瑞星杀毒软件，有点傻了，现在正在升级呢）

我的qq:297266661，我的已经解决了，要是不清楚的或没有解决可以共同探讨。邮箱：cxdwxd@126.

hengfeng - 2007-6-10 15:26:00

总算,搞定了.感谢FCOME
我把这次解决经历写在我BLOG里了.
有朋友不知道怎么解决可以随便看看哦.
http://blog.sina.com.cn/hengfeng12345

瑞星卡卡安全论坛