病毒名称                        处理结果    扫描方式路径文件
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\IRI2TT3Xc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinB0.exe
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\OBIIPF4Hc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinB2.exe
Trojan.PSW.LMir.atb            重新启动计算机后删除文件文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\IRI2TT3Xc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinB4.exe
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\IRI2TT3Xc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\J6RRCQZJc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\J6RRCQZJc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinB7.exe
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\IRI2TT3Xc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinB9.exe
Trojan.PSW.LMir.atb            重新启动计算机后删除文件文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\J6RRCQZJc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinBA.exe
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\J6RRCQZJc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\Documents and Settings\swear.MY-TOMATO\Local Settings\Temporary Internet Files\Content.IE5\J6RRCQZJc[1].gif
Trojan.PSW.LMir.atb            删除成功    文件监控C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\TempWinBC.exe

HijackThis_815汉化版扫描日志 V1.99.1
保存于      3:09:24, 日期 2006-7-23
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\ZGRPlay.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Antiy Labs\Alive\AliveCenter_.exe
C:\Program Files\Antiy Labs\AGuard\AGuard_.exe
C:\WINDOWS\system32\winmer.exe
D:\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yassist.dll
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - 启动项HKLM\\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - 启动项HKLM\\Run: [Antiy Auto Update] C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O4 - 启动项HKLM\\Run: [AGB5Monitor] C:\Program Files\Antiy Labs\AGuard\AGuard.exe /AutoRun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/203
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{9173AB90-B1F8-4E12-86C9-846B85BFADFF}: NameServer = 218.6.200.139 61.139.2.69
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - NT 服务: Online Play Control (ZGRPlay) - Unknown owner - C:\WINDOWS\system32\ZGRPlay.exe

兄弟 我的情况和你一样 你现在有解决的办法没
这个 今天上网看了 好象是个新病毒 还每人解决
要是你解决了 告诉我下方法 我的帖子在上面

C:\DOCUME~1\SWEAR~1.MY-\LOCALS~1\Temp\  安全模式清空...

修复
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

结束
C:\WINDOWS\system32\winmer.exe  这进程...
然后删除
C:\WINDOWS\system32\winmer.exe

清空IE临时文件夹..