瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 【求助】中毒了，重做了系统还是提示有病毒！
雯宝贝儿 - 2007-6-12 18:27:00
本人电脑方面特菜，现在请大家帮忙啊，只要告诉我怎么做就可以了，我看了类似的贴子，就下了智能扫描的东东，大家帮我看一下结果如下
[CODE]

2007-06-12,18:11:18

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <SoundMan><SOUNDMAN.EXE>  [N/A]
    <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe>  [sky.net.cn]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Peanut Hull Client><C:\Program Files\PeanutHull\PHNT.exe -sa>  [N/A]
    <SyGateManager><C:\Program Files\Sygate\SON\Sygate.exe>  [Sygate Technologies, Inc.]
    <registry.exe><c:\program files\registry.exe>  [N/A]
    <WlN32><rem regedit -s c:\$ntuninstallq887678$\winsys.cer>  []
    <Microsoft Network Daemon for Win32><netd32.exe>  []
    <MS_NETD_WIN32><netd32.exe>  []
    <load><C:\WINNT\uninstall\rundl132.exe>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <CnxDslTaskBar><"c:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe" "Conexant\AccessRunner ADSL USB">  [N/A]
    <nwnslop><C:\WINNT\SVCHOST.EXE>  []
    <upxdnd><C:\WINNT\upxdnd.exe>  []
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <Microsoft Network Daemon for Win32><netd32.exe>  []
    <MS_NETD_WIN32><netd32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <twin><C:\WINNT\system32\ctfnom.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
[MySql管理客户端]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\MySql管理客户端.lnk --> C:\MySql\BIN\WINMYS~1.EXE [MySQL AB]><N>
[腾讯QQ]
  <C:\Documents and Settings\yuying\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT]><N>

雯宝贝儿 - 2007-6-12 18:28:00
==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[ll_reg / ll_reg][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services][Stopped/Auto Start]
  <NetServices.exe><N/A>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[MySql / MySql][Running/Auto Start]
  <C:/MySql/bin/mysqld-nt.exe><N/A>
[NetMeeting Remote Desktop (RPC) Sharing / NetMeeting Remote Desktop (RPC) Sharing][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[PSEXESVC / PSEXESVC][Stopped/Manual Start]
  <C:\WINNT\System32\PSEXESVC.EXE><Sysinternals>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SyGateService / SaService][Running/Auto Start]
  <C:\Program Files\Sygate\SON\sgserv.exe><Sygate technologies Inc.>
[Smart Card Helper / SCardDrv][Stopped/Auto Start]
  <C:\WINNT\system32\scardsvr32.exe -v><N/A>
[Windows Management Instrumentation Driver Extension / Windows Management Instrumentation Driver Extension][Stopped/Auto Start]
  <C:\WINNT\system32\WinDriver.exe -start_server><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
  <C:\WINNT\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>

==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmeAtmPc / AmeAtmPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeAtmPc.sys><N/A>
[AmeLanPc / AmeLanPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeLanPc.sys><N/A>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Cdsys / Cdsys][Stopped/Manual Start]
  <\??\C:\WINNT\system32\cdcd.sys><N/A>
[Conexant AccessRunner USB ADSL Adapter Filter Driver / CnxEtP][Running/Manual Start]
  <system32\DRIVERS\CnxEtP.sys><Conexant Systems, Inc.>
[Conexant AccessRunner USB ADSL Interface Device Driver / CnxEtU][Running/Manual Start]
  <system32\DRIVERS\CnxEtU.sys><Conexant Systems, Inc.>
[Conexant AccessRunner ADSL WAN PPPoE Adapter Driver / CnxTgNP][Running/Manual Start]
  <system32\DRIVERS\CnxTgNP.sys><Conexant Systems, Inc.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[i81x / i81x][Running/Manual Start]
  <System32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[New0 / New0][Running/Auto Start]
  <\??\C:\WINNT\system32\new.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\SKNFW.sys><N/A>
[SyGate for NT, Wg1n / Wg1n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg1n.sys><Sygate Technologies, Inc.>
[SyGate for NT, Wg2n / Wg2n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg2n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg4n / wg4n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg5n / wg5n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg6n / wg6n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg8n / wg8n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg8n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg9n / wg9n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg9n.sys><Sygate Technologies, Inc.>
[iVasion PoET Adapter / WRSWanDD][Stopped/Manual Start]
  <system32\DRIVERS\WrKPoETNic2000.sys><N/A>
[SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start]
  <\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

雯宝贝儿 - 2007-6-12 18:28:00
==================================
浏览器加载项
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[碧聊]
  {4B87EE01-82ED-4030-A372-B3BEF4829ED5} <http://chat.yinsha.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[V2 Control]
  {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <C:\WINNT\DOWNLO~1\v2.ocx, 碧海银沙>
[BlueskyAudio Class]
  {BA0F088C-72C1-475A-92F8-42391DEF6961} <C:\WINNT\Downloaded Program Files\blueskyvoice.dll, 蓝天工作室(http://www.bluesky.com.cn)>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\qq\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 196][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 160][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 136][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 844][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 908][C:\Program Files\SkyNet\FireWall\PFWmain.exe]  [sky.net.cn, 2.5.0.120]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 928][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 940][C:\Program Files\Sygate\SON\Sygate.exe]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\SaSrvAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\Netport.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\wsman.dll]  [SyberGen Networks, Inc., 2, 3, 3114, 0]
    [C:\Program Files\Sygate\SON\wgman.dll]  [SyberGen Networks, Inc., 1.01.1221]
    [C:\Program Files\Sygate\SON\sasrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\natsrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\salic.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\DhcpSrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\CorpAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\AREdt.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EvtLogUI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EventLog.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\bwmedt.dll]  [Sybergen Networks, Inc., 1, 0, 0, 1]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 920][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3292]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 960][C:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe]  [Conexant Systems, Inc., 040.001.018.000]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 992][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1052][C:\MySql\BIN\winmysqladmin.exe]  [MySQL AB, 1.0.0.0]
    [C:\MySql\BIN\LIBMYSQL.dll]  [N/A, ]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 268][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\WINNT\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINNT\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\system32\msxml3.dll]  [Microsoft Corporation, 8.30.9926.0]
    [C:\WINNT\System32\macromed\flash\Flash.ocx]  [Macromedia, Inc., 7,0,14,0]
[PID: 1584][D:\rising\新建文件夹\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINNT\system32\msdebug.dll]  [N/A, ]
    [C:\WINNT\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINNT\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT  Error. [winrpc.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
雯宝贝儿 - 2007-6-12 18:29:00
高手帮忙告诉我怎么解决啊！！！
雙眼鈹的鯖鮭 - 2007-6-12 18:34:00
头晕！

看看这个http://forum.ikaka.com/topic.asp?board=28&artid=8322787
雯宝贝儿 - 2007-6-12 18:37:00
头晕？看哪个啊？
急死我了呢，这几天QQ就不正常老是有人给我发什么让我去听歌啊之类的病毒我也没点啊，怎么就成这样了呢？
火影忍者 - 2007-6-12 18:55:00
打开SREng-在"启动项目->注册表->删除以下启动项目
<registry.exe><c:\program files\registry.exe> [N/A]
<MS_NETD_WIN32><netd32.exe> []
<load><C:\WINNT\uninstall\rundl132.exe> []
<nwnslop><C:\WINNT\SVCHOST.EXE> []
<upxdnd><C:\WINNT\upxdnd.exe> []
<twin><C:\WINNT\system32\ctfnom.exe> []
<WlN32><rem regedit -s c:\$ntuninstallq887678$\winsys.cer> []
<Microsoft Network Daemon for Win32><netd32.exe> []

打开SREng-在"启动项目->服务->"Win32服务应用程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):

[ll_reg / ll_reg][Stopped/Auto Start]
<Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
<C:\WINNT\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>

打开SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[Cdsys / Cdsys][Stopped/Manual Start]
<\??\C:\WINNT\system32\cdcd.sys><N/A>
[New0 / New0][Running/Auto Start]
<\??\C:\WINNT\system32\new.sys><N/A>
[SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start]
<\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A>

用xdelbox(http://www.i170.com/attach/92EB2ED9-6D11-441D-8A28-2A9B08F0452E 下载)删除以下文件:
使用说明：删除时复制所有要删除文件的路径，选中抑制再生，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
C:\WINNT\system32\msdebug.dll
C:\WINNT\system32\RemoteDbg.dll
C:\WINNT\system32\WMIApiSrv.dll
C:\WINNT\system32\cdcd.sys
C:\WINNT\system32\new.sys
C:\WINNT\system32\Drivers\Wsdrv.sys
C:\WINNT\system32\Task688.dll
c:\program files\registry.exe
C:\WINNT\system32\netd32.exe
C:\WINNT\uninstall\rundl132.exe
C:\WINNT\SVCHOST.EXE
C:\WINNT\upxdnd.exe
C:\WINNT\system32\ctfnom.exe
c:\$ntuninstallq887678$\winsys.cer
C:\WINNT\system32\netd32.exe

下载威金专杀杀下

下载arswp(Windows清理助手)清理下
http://www.arswp.com/download/arswp/arswp.rar

升级杀软，全盘杀毒
天月来了 - 2007-6-12 19:26:00
建议彻底卸载QQ的所有软件，并手工删除QQ安装目录里的所有残余文件。

在重启正常的情况下，再重装QQ
雯宝贝儿 - 2007-6-12 22:57:00
按照火影说的一步一步做下来，用瑞星杀了380多个病毒
我觉得应该没什么问题了吧，现在是杀毒后的扫描日志
[CODE]

2007-06-12,22:44:38

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <SoundMan><SOUNDMAN.EXE>  [N/A]
    <SKYNET Personal FireWall><C:\Program Files\SkyNet\FireWall\PFWmain.exe>  [sky.net.cn]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Peanut Hull Client><C:\Program Files\PeanutHull\PHNT.exe -sa>  [N/A]
    <SyGateManager><C:\Program Files\Sygate\SON\Sygate.exe>  [Sygate Technologies, Inc.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <CnxDslTaskBar><"c:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe" "Conexant\AccessRunner ADSL USB">  [N/A]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <MS_NETD_WIN32><netd32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
[MySql管理客户端]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\MySql管理客户端.lnk --> C:\MySql\BIN\WINMYS~1.EXE [MySQL AB]><N>
[腾讯QQ]
  <C:\Documents and Settings\yuying\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\qq\QQ.exe [TENCENT]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services][Stopped/Auto Start]
  <NetServices.exe><N/A>
[MySql / MySql][Running/Auto Start]
  <C:/MySql/bin/mysqld-nt.exe><N/A>
[NetMeeting Remote Desktop (RPC) Sharing / NetMeeting Remote Desktop (RPC) Sharing][Stopped/Auto Start]
  <Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>
[PSEXESVC / PSEXESVC][Stopped/Manual Start]
  <C:\WINNT\System32\PSEXESVC.EXE><Sysinternals>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SyGateService / SaService][Running/Auto Start]
  <C:\Program Files\Sygate\SON\sgserv.exe><Sygate technologies Inc.>
[Smart Card Helper / SCardDrv][Stopped/Auto Start]
  <C:\WINNT\system32\scardsvr32.exe -v><N/A>
[Windows Management Instrumentation Driver Extension / Windows Management Instrumentation Driver Extension][Stopped/Auto Start]
  <C:\WINNT\system32\WinDriver.exe -start_server><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
雯宝贝儿 - 2007-6-12 22:58:00
==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AmeAtmPc / AmeAtmPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeAtmPc.sys><N/A>
[AmeLanPc / AmeLanPc][Stopped/Manual Start]
  <system32\DRIVERS\AmeLanPc.sys><N/A>
[BaseTDI / BaseTDI][Running/Auto Start]
  <\??\C:\WINNT\system32\drivers\basetdi.sys><Beijing Rising Technology Co., Ltd.>
[Conexant AccessRunner USB ADSL Adapter Filter Driver / CnxEtP][Running/Manual Start]
  <system32\DRIVERS\CnxEtP.sys><Conexant Systems, Inc.>
[Conexant AccessRunner USB ADSL Interface Device Driver / CnxEtU][Running/Manual Start]
  <system32\DRIVERS\CnxEtU.sys><Conexant Systems, Inc.>
[Conexant AccessRunner ADSL WAN PPPoE Adapter Driver / CnxTgNP][Running/Manual Start]
  <system32\DRIVERS\CnxTgNP.sys><Conexant Systems, Inc.>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[i81x / i81x][Running/Manual Start]
  <System32\DRIVERS\i81xnt5.sys><Intel(R) Corporation>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><瑞星软件有限公司>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SKNFW / SKNFW][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\SKNFW.sys><N/A>
[SyGate for NT, Wg1n / Wg1n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg1n.sys><Sygate Technologies, Inc.>
[SyGate for NT, Wg2n / Wg2n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\Wg2n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg4n / wg4n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg5n / wg5n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg6n / wg6n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg8n / wg8n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg8n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg9n / wg9n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg9n.sys><Sygate Technologies, Inc.>
[iVasion PoET Adapter / WRSWanDD][Stopped/Manual Start]
  <system32\DRIVERS\WrKPoETNic2000.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>

==================================
雯宝贝儿 - 2007-6-12 23:04:00
浏览器加载项
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[碧聊]
  {4B87EE01-82ED-4030-A372-B3BEF4829ED5} <http://chat.yinsha.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[V2 Control]
  {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} <C:\WINNT\DOWNLO~1\v2.ocx, 碧海银沙>
[BlueskyAudio Class]
  {BA0F088C-72C1-475A-92F8-42391DEF6961} <C:\WINNT\Downloaded Program Files\blueskyvoice.dll, 蓝天工作室(http://www.bluesky.com.cn)>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[PasswordEditCtrl Class]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <C:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <C:\Program Files\Tencent\qq\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 196][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 160][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 136][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 104][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 900][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\CHENHU4.IME]  [chenhu, 5.4]
[PID: 960][C:\Program Files\SkyNet\FireWall\PFWmain.exe]  [sky.net.cn, 2.5.0.120]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 968][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 984][C:\Program Files\Sygate\SON\Sygate.exe]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\SaSrvAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\Netport.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\wsman.dll]  [SyberGen Networks, Inc., 2, 3, 3114, 0]
    [C:\Program Files\Sygate\SON\wgman.dll]  [SyberGen Networks, Inc., 1.01.1221]
    [C:\Program Files\Sygate\SON\sasrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\natsrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\salic.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\DhcpSrv.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\CorpAd.dll]  [Sygate Technologies, Inc., 4,5,851,1]
    [C:\Program Files\Sygate\SON\AREdt.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EvtLogUI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Sygate\SON\EventLog.dll]  [N/A, ]
    [C:\Program Files\Sygate\SON\bwmedt.dll]  [Sybergen Networks, Inc., 1, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 972][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3292]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 856][C:\program files\conexant\accessrunner adsl usb\CnxDslTb.exe]  [Conexant Systems, Inc., 040.001.018.000]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 988][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1056][C:\MySql\BIN\winmysqladmin.exe]  [MySQL AB, 1.0.0.0]
    [C:\MySql\BIN\LIBMYSQL.dll]  [N/A, ]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1616][C:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 1568][C:\WINNT\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
雯宝贝儿 - 2007-6-12 23:05:00
[C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1500][C:\Program Files\Tencent\qq\QQ.exe]  [TENCENT, 0, 0, 0, 0]
    [C:\Program Files\Tencent\qq\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\BasicCtrlDll.dll]  [Tencent, 7, 0, 101, 80]
    [C:\Program Files\Tencent\qq\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\Tencent\qq\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Tencent\qq\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
    [C:\Program Files\Tencent\qq\QQAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\LoginCtrl.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
    [C:\Program Files\Tencent\qq\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
    [C:\Program Files\Tencent\qq\LoginCtrlRes.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\Program Files\Tencent\qq\QQRes.dll]  [tencent, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQMainFrame.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\CQQApplication.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\NewSkin.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\HostingMgr.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\CameraDll.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\MailSummary.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQAllInOne.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\GroupLive.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
    [C:\Program Files\Tencent\qq\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Tencent\qq\QQSpace.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [C:\WINNT\system32\msdmo.dll]  [, ]
    [C:\Program Files\Tencent\qq\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQSysMsgMng.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\UserDefinedHead.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQPlugin.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [C:\WINNT\System32\macromed\flash\Flash.ocx]  [Macromedia, Inc., 7,0,14,0]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Tencent\qq\QRingMng.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\QQAvatar.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
    [C:\Program Files\Tencent\qq\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [C:\Program Files\Tencent\qq\PhoneAPI.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
    [C:\Program Files\Tencent\qq\QQPet.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\BQQApplication.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\CommercesMng.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
    [C:\Program Files\Tencent\qq\QQCustomFace.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [C:\Program Files\Tencent\qq\QQSceneMng.dll]  [N/A, ]
    [C:\Program Files\Tencent\qq\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
    [C:\WINNT\system32\CHENHU4.IME]  [chenhu, 5.4]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Tencent\qq\QQMagicFace.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Tencent\qq\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 93]
[PID: 996][C:\WINNT\system32\NOTEPAD.EXE]  [Microsoft Corporation, 5.00.2140.1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[PID: 324][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINNT\System32\macromed\flash\Flash.ocx]  [Macromedia, Inc., 7,0,14,0]
[PID: 1668][D:\rising\新建文件夹\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]

==================================
文件关联
.TXT  Error. [winrpc.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
天月来了 - 2007-6-12 23:47:00
用扫日志的SRENG工具删除下面注册表项。
启动项目
注册表

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<MS_NETD_WIN32><netd32.exe> []

[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]
——————————————————————————————————————————
用扫日志的SRENG工具将下面的各项启动类型改为“Disabled”，
==================================
服务
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services][Stopped/Auto Start]
<NetServices.exe><N/A>

[NetMeeting Remote Desktop (RPC) Sharing / NetMeeting Remote Desktop (RPC) Sharing][Stopped/Auto Start]
<Rundll32.exe Task688.dll ondll_server><Microsoft Corporation>

[PSEXESVC / PSEXESVC][Stopped/Manual Start]
<C:\WINNT\System32\PSEXESVC.EXE><Sysinternals>

[Smart Card Helper / SCardDrv][Stopped/Auto Start]
<C:\WINNT\system32\scardsvr32.exe -v><N/A>

[Windows Management Instrumentation Driver Extension / Windows Management Instrumentation Driver Extension][Stopped/Auto Start]
<C:\WINNT\system32\WinDriver.exe -start_server><N/A>
————————————————————————————————————————
重启电脑，不行，就再扫日志。
没异常，就安装并升级杀软至最新版本，全盘杀毒。
火影忍者 - 2007-6-12 23:57:00
应该已经处理了..!
雯宝贝儿 - 2007-6-13 16:08:00
处理是处理了不知道处理的怎么样啊？昨天重装QQ的时候还把QQ密码忘掉，害得我一晚没睡，今天好不容易想起了密码，不知道还会不会有问题啊，我要不要再扫一下日志啊？
火影GG让我找那两个文件删掉我又没找到，是不是太笨了点啊？希望你们几位高手别被我这个笨笨气晕啊.....
天月来了 - 2007-6-14 1:06:00
还把QQ密码忘掉，害得我一晚没睡，今天好不容易想起了密码




好有趣！！！！！！

这也能忘？？？？？？

都平时设置自动登陆了吧？？？？？？

1
查看完整版本: 【求助】中毒了，重做了系统还是提示有病毒！
© 2000 - 2026 Rising Corp. Ltd.