Ynqbxg.dll
Ynqbxg.sys
这2个是什么病毒杀不掉，杀了又产生,有为什么?向高手求救.

请下载并使用HijackThis1.99.1,把HijackThis
                  1.99.1生成的log日志文件的内容贴上来，方便大家分析。

                  有关操作方法可参考：
                  【推荐】反浏览器劫持的一些常用操作
                  http://forum.ikaka.com/topic.asp?board=67&artid=6490491

请参考:
http://forum.ikaka.com/topic.asp?board=28&artid=6800672
       

            主题： 零距离接触rootkit.

http://forum.ikaka.com/topic.asp?board=28&artid=6909965
       

            主题： Backdoor.PcShare.5.s的查杀方法

HijackThis_815汉化版扫描日志 V1.99.1
保存于      17:09:21, 日期 2005-10-16
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Unable to get Internet Explorer version!

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\SuperRam\SuperRam.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\装机必备绿色软件\音速启动VStart50_0815\VStart.exe
C:\Challenger\hwshell.exe
D:\装机必备绿色软件\音速启动VStart50_0815\vsLoadIcon.exe
C:\Program Files\Maxthon\Maxthon.exe
e:\My Documents\桌面快捷键\霏凡抓图.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\FlashGet\flashget.exe
C:\Documents and Settings\user\桌面\4483172005817224059\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v5.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL
O3 - IE工具栏增项: (no name) - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} - (no file)
O3 - IE工具栏增项: (no name) - {AB6BEAD2-325B-4729-BB13-DB24509EFA54} - (no file)
O3 - IE工具栏增项: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - (no file)
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - 启动项HKLM\\Run: [SuperRam] "C:\Program Files\SuperRam\SuperRam.exe" /start
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [Super Rabbit SRRestore] C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave
O4 - 启动项HKLM\\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - 启动项HKLM\\Run: [XDeskWeather] ; D:\装机必备绿色软件\桌面天气秀\桌面天气秀\桌面天气秀 XDeskWeather\XDeskWeather.exe
O4 - 启动项HKLM\\Run: [VStart5.0] D:\装机必备绿色软件\音速启动VStart50_0815\VStart.exe
O4 - 启动项HKLM\\RunOnce: [RavStub] "C:\PROGRAM FILES\RISING\RAV\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Startup: TurboLaunch.lnk = ?
O4 - Global Startup: HwPen Shell.lnk = C:\Challenger\hwshell.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://E:\Program Files\自动填写网上表格\RoboFormComFillForms.html (file missing)
O9 - 浏览器额外的“工具”菜单项: 填写表单 - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://E:\Program Files\自动填写网上表格\RoboFormComFillForms.html (file missing)
O9 - 浏览器额外的按钮: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://E:\Program Files\自动填写网上表格\RoboFormComSavePass.html (file missing)
O9 - 浏览器额外的“工具”菜单项: 保存 - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://E:\Program Files\自动填写网上表格\RoboFormComSavePass.html (file missing)
O9 - 浏览器额外的按钮: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://E:\Program Files\自动填写网上表格\RoboFormComShowToolbar.html (file missing)
O9 - 浏览器额外的“工具”菜单项: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://E:\Program Files\自动填写网上表格\RoboFormComShowToolbar.html (file missing)
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129265490937
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CDA6FF3-D94E-4AE2-941F-20947F769AE0}: NameServer = 202.100.192.68 202.100.199.8
O23 - NT 服务: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O23 - NT 服务: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - NT 服务: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - NT 服务: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - NT 服务: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - NT 服务: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\Ynqbxg.exe
O23 - NT 服务: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

O23 - NT 服务: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\Ynqbxg.exe
修复这个服务。

有条件的话把这个服务恢复原值。

注册表编辑器里如果存在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ynqbxg项，则删除它。

重启后尝试删除：
C:\WINDOWS\system32\Ynqbxg.exe
C:\WINDOWS\system32\Ynqbxg.dll
C:\WINDOWS\system32\Ynqbxg.*（可能存在，记录信息的文件）
C:\WINDOWS\system32\drivers\Ynqbxg.sys