昨天刚刚重新装的系统,这台电脑已经成为整个局域网的"毒王"了,重装都没有解决问题,又要被拔网线了

【回复“甛甛圏οo”的帖子】
一、先分门别类，用IceSword 处理下列进程:

第一类：被病毒模块插入的系统核心进程。
用IceSword禁止进程创建/禁止协件功能。然后，强制卸除插入的病毒模块C:\WINDOWS\391231M.BMP

[PID: 516][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 568][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 580][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 748][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 812][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 896][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 952][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1088][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1292][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]


第二类：病毒进程。
用IceSword结束这些进程：
[PID: 1908][C:\WINDOWS\system\5.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 3028][C:\WINDOWS\system\internet.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 1500][C:\WINDOWS\system\logo_1.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1680][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wmbose.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xc7.dll] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\packet.dll] [CACE Technologies, 3, 1, 0, 27]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WanPacket.dll] [CACE Technologies, 3, 1, 0, 27]
[PID: 3960][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhs2.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhs2.dll] [N/A, N/A]
[PID: 1924][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zts2.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zts2.dll] [N/A, N/A]
[PID: 3560][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wlzs.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wlzs.dll] [N/A, N/A]
[PID: 2576][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wincabb.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 2600][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\daler.exe] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\stdwin.dll] [N/A, N/A]
[PID: 2672][C:\WINDOWS\system\logo_1.exe] [N/A, N/A]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]

第三类：被病毒插入的普通应用程序进程：
用IceSword结束这些进程：
[PID: 1292][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 1372][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1576][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 3]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1668][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1708][C:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1840][C:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1952][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 216][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 2108][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 7]
[PID: 1248][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 1224][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[PID: 3036][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\391231M.BMP] [N/A, N/A][PID: 2172][E:\清理病毒工具\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\391231M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]

二、用IceSword完成上述操作后，继续用IceSword删除下列文件：
1/C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp文件夹中的所有文件。
2/C:\WINDOWS\391231M.BMP
3/C:\WINDOWS\system32\windhcp.ocx
4/C:\WINDOWS\system\logo_1.exe
5/C:\WINDOWS\system\5.exe
6/C:\WINDOWS\system\internet.exe
7/各分区根目录下的autorun.inf和go.exe

三、用IceSword删除注册表中的下列内容：

1、Windows DHCP Service / WinDHCPsvc————位于HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES分支。
2、HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run分支下的：
<ntaskldr><C:\WINDOWS\system\logo_1.exe> [N/A]
<mhs2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhs2.exe> [N/A]
<zts2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zts2.exe> [N/A]
<wlzs><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wlzs.exe> [N/A]
3、HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run分支下的：
<ntaskldr><C:\WINDOWS\system\logo_1.exe> [N/A]
4、HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows分支下的：
<AppInit_DLLs><391231M.BMP> [N/A]

注意：C:\WINDOWS\system\logo_1.exe（威金变种）感染系统中的.exe文件。这些被感染文件请用升级病毒库后的杀软处理。
清除染毒.exe文件中的病毒代码之前，为防止误点击被感染的.exe文件导致系统重新染毒，可将下列内容拷贝到记事本窗口，保存为anti_logo_1.reg。双击anti_logo_1.reg，将其导入注册表。等待瑞星升级后，再处理那些染毒的.exe。


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logo_1.exe]
"Debugger"="C:\\Program Files\\Rising\\Rav\\RavMon.exe"

中了几个病毒。我们单位的电脑也中了一样的病毒。用瑞星可以删除！

请教 猫叔 楼主中的是 变种的威金吗???

我用瑞星查出是VIKING.ic

引用:

【xiaoyueIQ的贴子】请教 猫叔 楼主中的是 变种的威金吗??? ………………

是的
瑞星 19。04。40已可查杀此毒；且可清除染毒文件中的病毒代码。

素VIKING的马甲

谢谢大家~~我现在用瑞星软件杀一下~~上次中这个毒的时候  用瑞星的威金专杀试过,没杀出毒