看了坛子里关于“Trojan.DL.Agent.aoz”的清楚方法，但不好使，因为不论是在HijackThis.exe或任务管理器里根本就找不到1.exe和wdfmgr32.exe
我的中毒表现是：开机正常，但打开ie瑞星就提示发现并删除“Trojan.DL.Agent.aoz”，c：盘根目录下有名为1的文件,但这两天“1。exe”没了。
日志如下：
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
E:\rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
E:\rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
E:\rising\Rav\RavStub.exe
E:\tools\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\oodag.exe
C:\WINDOWS\System32\alg.exe
E:\rising\Rav\RavTask.exe
C:\WINDOWS\system32\ctfmon.exe
E:\rising\Rav\Ravmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HijackThis.exe
O4 - HKLM\..\Run: [RavTask] "E:\rising\Rav\RavTask.exe" -system
O4 - HKLM\..\RunOnce: [RavStub] "E:\rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\ultra32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ultra32.dll
O12 - Plugin for .amr: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114438806850
O17 - HKLM\System\CCS\Services\Tcpip\..\{67E710BC-3187-4280-8D68-B003FA69C4B8}: NameServer = 211.161.46.84 202.106.0.20
O18 - Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - e:\tools\YAMAHA\MidRadio Player\midradio.ocx
O23 - Service: BlueSoleil Hid Service - Unknown owner - E:\tools\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\rising\Rav\Ravmond.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
谢了！
