Trojan.PSW.WoWar.za            删除成功    2007-03-12 11:22      文件监控            C:\DOCUME~1\kaka\LOCALS~1\Temp                                                                                          wos0.dll                                                                                                               
Trojan.PSW.Roc.ar              删除成功    2007-03-16 03:23      文件监控            C:\WINDOWS\system32                                                                                                    systeminis.dll                                                                                                         
Trojan.PSW.WoWar.aaz            删除成功    2007-03-16 03:23      文件监控            C:\WINDOWS\system32                                                                                                    mppds.dll                                                                                                             
Trojan.PSW.OnLineGames.kj      删除成功    2007-03-16 03:23      文件监控            C:\WINDOWS\system32                                                                                                    wsvbs.dll                                                                                                             
Trojan.PSW.WLOnLine.jdr        删除成功    2007-03-16 03:23      文件监控            C:\SysAd5B                                                                                                              Ghook.dll                                                                                                             
Trojan.PSW.CABALOnline.f        删除成功    2007-03-16 12:53      文件监控            C:\SYSDAYN3                                                                                                            GHOOK.DL
L         
#15我受不了，昨天电脑不知道怎么的，又中病毒了，气死我了，虽然瑞醒杀掉了，可是一开电脑就有了。而且还更严重                                                                                                   

谁来帮我啊，我网上查，发现这些是盗号木吗，5555555555我玩梦幻西游的，会不会影响到啊
每次瑞醒能杀掉，但是过一会又自动有了

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

扫描前关闭所有手工打开的软件和窗口，扫描后将日志发上来。但请不要用附件形式贴。
注意在没有进一步提示前，勿要胡乱修复，否则系统可能变的情况更糟。

如果发现SREng.exe运行无反应或者不能运行或者扫描出错,你可以将SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行.

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <66><C:\SysDayN3\svchost.exe>  []
    <50><C:\SysAd5B\svchost.exe>  []
    <4><C:\SysWsj3\svchost.exe>  []
    <333><C:\Syswm1C\svchost.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <RfwMain><"D:\杀毒软件\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"D:\杀毒软件\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <runeip><F:\Program Files\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <RavStub><"D:\杀毒软件\Rav\ravstub.exe" /RUNONCE>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

==================================
启动文件夹
[星空极速]
  <C:\Documents and Settings\kaka\「开始」菜单\程序\启动\星空极速.lnk --> C:\PROGRA~1\Chinanet\VNETCL~1.EXE []><N>

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[FF0CB67C / FF0CB67C][Stopped/Auto Start]
  <C:\WINDOWS\system32\FF0CB67C.EXE -service><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <D:\杀毒软件\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"D:\杀毒软件\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"D:\杀毒软件\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================

正在运行的进程
[PID: 420][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 484][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 508][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\FF0CB67C.DLL]  [Microsoft Corporation, 5.2.3790.1830]
[PID: 552][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 564][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 724][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 780][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 852][D:\杀毒软件\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 872][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2144 (xpsp.040601-1829)]
[PID: 1008][D:\杀毒软件\Rav\Ravmond.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 43]
    [D:\杀毒软件\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [D:\杀毒软件\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [D:\杀毒软件\Rav\rfwctrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [D:\杀毒软件\Rav\RsPPsys.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
    [D:\杀毒软件\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\杀毒软件\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\杀毒软件\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\杀毒软件\Rav\RsLog.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [D:\杀毒软件\Rav\HOOKSYS.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
    [D:\杀毒软件\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [D:\杀毒软件\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [D:\杀毒软件\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [D:\杀毒软件\Rav\regmon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [D:\杀毒软件\Rav\psapi.dll]  [Microsoft Corporation, 4.00]
    [D:\杀毒软件\Rav\HookWeb.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
    [D:\杀毒软件\Rav\MemMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
    [D:\杀毒软件\Rav\expscan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [D:\杀毒软件\Rav\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [D:\杀毒软件\Rav\HookCont.dll]  [Rising, 19, 0, 0, 0]
    [D:\杀毒软件\Rav\SpamEng.dll]  [, 18, 0, 0, 6]
    [D:\杀毒软件\Rav\engine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 26]
    [D:\杀毒软件\Rav\PostTrt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
    [D:\杀毒软件\Rav\UnExe.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [D:\杀毒软件\Rav\ScanExec.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [D:\杀毒软件\Rav\ScanEx.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 41]
    [D:\杀毒软件\Rav\ExtFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 25]
    [D:\杀毒软件\Rav\NvFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
    [D:\杀毒软件\Rav\ScanMac.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 13]
    [D:\杀毒软件\Rav\ScanSct.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [D:\杀毒软件\Rav\Unpacker.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [D:\杀毒软件\Rav\ScanPack.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 21]
    [D:\杀毒软件\Rav\RsVM.dll]  [, 19, 0, 0, 16]
    [D:\杀毒软件\Rav\Uroutine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 24]
    [D:\杀毒软件\Rav\RsStore.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [D:\杀毒软件\Rav\Uscript.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 18]
    [D:\杀毒软件\Rav\ExtOLE.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[PID: 1356][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2144 (xpsp.040601-1829)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [F:\Program Files\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\SysWsj3\Ghook.dll]  [N/A, ]
    [C:\WINDOWS\system32\FF0CB67C.DLL]  [Microsoft Corporation, 5.2.3790.1830]
    [C:\WINDOWS\system32\cmdbcs.dll]  [N/A, ]
    [C:\DOCUME~1\kaka\LOCALS~1\Temp\upxdnd.dll]  [N/A, ]
[PID: 1692][D:\杀毒软件\Rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
    [D:\杀毒软件\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [D:\杀毒软件\Rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\杀毒软件\Rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [D:\杀毒软件\Rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [D:\杀毒软件\Rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [F:\Program Files\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\SysWsj3\Ghook.dll]  [N/A, ]
    [D:\杀毒软件\Rfw\PSAPI.DLL]  [Microsoft Corporation, 4.00]
    [D:\杀毒软件\Rfw\mvengine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
    [D:\杀毒软件\Rfw\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 16]
    [D:\杀毒软件\Rfw\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[PID: 1924][D:\杀毒软件\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [D:\杀毒软件\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\杀毒软件\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\杀毒软件\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\杀毒软件\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [F:\Program Files\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [C:\SysWsj3\Ghook.dll]  [N/A, ]
[PID: 2020][D:\杀毒软件\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [D:\杀毒软件\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [D:\杀毒软件\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [D:\杀毒软件\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [D:\杀毒软件\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [D:\杀毒软件\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\杀毒软件\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [D:\杀毒软件\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [D:\杀毒软件\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]

执行以下操作时先清空IE缓存和关闭系统还原:

清空IE缓存:打开IE主界面-工具-Internet选项-Internet临时文件-点删除文件-然后确定~

系统还原:我的电脑-属性-系统还原一栏里-勾选所有驱动器上关闭系统还原,然后确定(后面如有需要再自行开启)

执行上面操作后,往下..

强制删除工具 PowerRMV
下载地址: http://free.ys168.com/?gudugengkekao
(其他工具-PowerRMV.com 大小101.4KB)

填入下面文件的完整路径，例如：C:\Windows\system32\XXX.exe

选上抑止杀灭对象再次生成,然后杀灭,然后有个提示,选确定就可以了~如果提示找不到的话,则忽略~
C:\SysDayN3\svchost.exe
C:\SysAd5B\svchost.exe
C:\SysWsj3\svchost.exe
C:\Syswm1C\svchost.exe
C:\WINDOWS\system32\FF0CB67C.EXE
C:\WINDOWS\system32\drivers\gegdhdhd.sys
C:\WINDOWS\system32\new.sys
C:\WINDOWS\system32\FF0CB67C.DLL
C:\SysWsj3\Ghook.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\DOCUME~1\kaka\LOCALS~1\Temp\upxdnd.dll

SRENG操作方法:
http://hi.baidu.com/%B9%C2%B6%C0%B8%FC%BF%C9%BF%BF/blog/item/9025a818a7592ab44aedbc05.html
(先看懂了再执行下面操作,否则造成其他后果,本人不承担!)


用SREng 删除如下各项:

启动项目--注册表 --
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <66><C:\SysDayN3\svchost.exe>  []
    <50><C:\SysAd5B\svchost.exe>  []
    <4><C:\SysWsj3\svchost.exe>  []
    <333><C:\Syswm1C\svchost.exe>  [N/A]




启动项目--服务--Win32服务应用程序--(下面的删除,可疑的话设置为disabled观察一段时间~)
[FF0CB67C / FF0CB67C][Stopped/Auto Start]
  <C:\WINDOWS\system32\FF0CB67C.EXE -service><Microsoft Corporation>




启动项目 --服务--驱动程序--(下面的删除,可疑设置为disabled观察一段时间~)

[gegdhdhd / gegdhdhd][Stopped/System Start]
  <\??\C:\WINDOWS\system32\drivers\gegdhdhd.sys><N/A>

[New0 / New0][Stopped/Auto Start]
  <\??\C:\WINDOWS\system32\new.sys><N/A>
我朋友给我分析的扫描结果

，我发来给大家看看，正确的话也希望能给那些和我一样中这样病毒的人一个处理结果。