MM 美女美景-EXE文件全被吃了，这是什么病毒？ -中华网博客

首页

爱秒爱日 - 个人首页┆控制面板┆搜索┆帮助┆退出

爱秒爱日

活力地带

个人首页

给我留言

控制面板

我的文章

我的相册

最近更新的BLOG列表

最新更新的文章列表

发表文章

EXE文件全被吃了，这是什么病毒？

2007-12-19 23:53:24.0

EXE文件全被吃了，这是什么病毒？

[ 本帖最后由风源使者于 2007-6-6 00:19 编辑 ]

什么意思？EXE文件全被删除了？

下载执行System Repair Engineer (SREng)

按「智能扫描」，再按「扫描」
最后，按「保存报告」，保存到桌面
将 SREngLOG.log 中内容完整的复制粘贴上来，不要做任何修改。
如出现无法运行，请重命名或修改扩展名，如xic.exe/xic.com/xic.bat/xic.scr等

好了，麻烦你看看

复制内容到剪贴板

代码:

2007-06-06,00:26:10



System Repair Engineer 2.4.12.806

Smallfrogs ([url]http://www.KZTechs.com[/url])



Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]

    <Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <load><>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]

    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]

    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]

    <load><C:\WINDOWS\uninstall\rundl132.exe>  []

    <MsIMMs32><C:\WINDOWS\MsIMMs32.exe>  []

    <dasa><C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso.exe>  []

    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

    <MSDEG32><LYLoader.exe>  []

    <MSDWG32><LYLoadbr.exe>  [N/A]

    <MSDCG32    ><LYLeador.exe>  [N/A]

    <MSDOG32><LYLoador.exe>  [N/A]

    <MSDSG32><LYLoadar.exe>  [N/A]

    <MSDMG32><LYLoadmr.exe>  []

    <MSDHG32><LYLoadhr.exe>  [N/A]

    <MSDQG32><LYLoadqr.exe>  [N/A]

    <twin><C:\WINDOWS\system32\ctfnom.exe>  [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

    <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll>  []



==================================

启动文件夹

N/A



==================================

服务

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>

[Remote Help Session Manager / Rasautol][Stopped/Auto Start]

  <C:\WINDOWS\system32\ntsokele.exe><N/A>

[Win32 Display Driver / Win32DDS][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe windds32.dll,input><Microsoft Corporation>

[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input><Microsoft Corporation>

[WinZXServiceNow / WinZXServiceNow][Stopped/Auto Start]

  <C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\RAVZX.EXE><N/A>

[WMI Performance API / WMIApiSrv][Stopped/Auto Start]

  <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>



==================================

驱动程序

[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]

  <system32\drivers\ac97intc.sys><Intel Corporation>

[Netgroup Packet Filter / NPF][Stopped/Manual Start]

  <system32\drivers\npf.sys><CACE Technologies>

[npkcrypt / npkcrypt][Running/Auto Start]

  <\??\F:\Tencent\qq\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[PxHelp20 / PxHelp20][Running/Boot Start]

  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>

[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]

  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><N/A>



==================================

浏览器加载项

[超级兔子上网精灵]

  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>

[Messenger]

  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>

[超级兔子上网精灵]

  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>

[Windows Media Player]

  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>

[超级兔子上网精灵]

  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>

[Shell Name Space]

  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>

[超级兔子上网精灵]

  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology>

[Microsoft Web 浏览器]

  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>

[VIDEO__X_MS_ASF Moniker Class]

  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>



==================================

正在运行的进程

[PID: 420][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 480][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 504][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 548][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\LYMANGR.DLL]  [N/A, ]

[PID: 560][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\RAVZX531.dll]  [N/A, ]

[PID: 724][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 772][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[PID: 836][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]

[PID: 1356][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\wscsv.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\SHQMANGR.DLL]  [N/A, ]

    [C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]

    [C:\Program Files\Real\RealPlayer\rpshell.dll]  [RealNetworks, Inc., 1.0.1.1946]

    [C:\WINDOWS\system32\PNCRT.dll]  [Real Networks, Inc, 6.0.0.0]

    [C:\Program Files\Real\RealPlayer\lang\rpext_cn.dll]  [RealNetworks, Inc., 6.0.12.298]

[PID: 1672][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3208]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1680][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1688][C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE]  [Super Rabbit Soft, 7.98]

    [C:\WINDOWS\system32\msvbvm60.dll]  [Microsoft Corporation, 6.00.9690]

    [C:\WINDOWS\system32\vb6chs.dll]  [Microsoft Corporation, 6.00.8988]

    [C:\PROGRA~1\SUPERR~1\MagicSet\shlobj71.ocx]  [Sky Software ([url]http://www.ssware.com[/url]), 7, 1, 0, 0]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1744][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1232][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 2016][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

[PID: 1432][C:\WINDOWS\system32\cmd.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

[PID: 404][F:\Tencent\qq\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]

    [F:\Tencent\qq\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\BasicCtrlDll.dll]  [Tencent, 7, 0, 101, 80]

    [F:\Tencent\qq\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]

    [F:\Tencent\qq\QQ\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]

    [F:\Tencent\qq\QQ\PYKer.dll]  [飘云 [url]http://www.pyqq.cn[/url], 飘云]

    [F:\Tencent\qq\QQ\ipsearcher.dll]  [, 1.0.0.3]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]

    [F:\Tencent\qq\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]

    [F:\Tencent\qq\QQ\QQAPI.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\LoginCtrl.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]

    [F:\Tencent\qq\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]

    [F:\Tencent\qq\QQ\LoginCtrlRes.dll]  [, 1, 0, 0, 1]

    [C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]

    [C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQMainFrame.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\CQQApplication.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\NewSkin.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\CameraDll.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\MailSummary.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQAllInOne.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\GroupLive.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\SCCore.dll]  [TENCENT, 2, 0, 0, 1]

    [F:\Tencent\qq\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]

    [F:\Tencent\qq\QQ\QQSpace.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [F:\Tencent\qq\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [F:\Tencent\qq\QQ\QQAvatar.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQPlugin.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]

    [F:\Tencent\qq\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQCustomFace.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\QRingMng.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]

    [F:\Tencent\qq\QQ\QQPet.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\QQSysMsgMng.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\BQQApplication.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]

    [F:\Tencent\qq\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]

    [F:\Tencent\qq\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]

    [F:\Tencent\qq\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]

    [F:\Tencent\qq\QQ\QQSceneMng.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]

    [F:\Tencent\qq\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 92]

    [F:\Tencent\qq\QQ\QQZip.dll]  [tencent, 0, 3, 2, 4]

    [F:\Tencent\qq\QQ\QQMagicFace.dll]  [, 1, 0, 0, 1]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]

[PID: 1108][F:\Tencent\qq\QQ\TIMPlatfrom.exe]  [tencent, 0, 3, 1, 8]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [F:\Tencent\qq\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]

[PID: 1764][C:\Program Files\PPStream\PPStream.exe]  [PPStream.com, 1, 0, 4, 701]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\PROGRA~1\PPStream\POWERP~1.DLL]  [PPStream Inc., 1,0,0,3000]

    [C:\PROGRA~1\PPStream\PSNetwork.dll]  [PPStream, inc., 1, 0, 0, 2442]

    [C:\PROGRA~1\PPStream\POWERL~1.OCX]  [PPStream.com, 1, 0, 0, 1982]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]

    [C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]

    [C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx]  [Macromedia, Inc., 6,0,88,0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

[PID: 228][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]

    [C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]

[PID: 1196][C:\Documents and Settings\richweiwei\桌面\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]

    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]

    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]

    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]

    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]

    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]

    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]

    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]

    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]

    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]

    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]

    [C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]

    [C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]



==================================

文件关联

.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  OK. ["C:\WINDOWS\hh.exe" %1]

.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]

.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

API HOOK

N/A



==================================

隐藏进程

N/A



==================================

在「我的电脑」上按右键，选择「属性」
进入「系统还原」，勾选「在所有驱动器上关闭系统还原」，按下「应用」，出现提示对话框时按「是」（病毒清理后请自己决定是否打开系统还原）

点此下载ATF Cleaner
执行后，勾选「全选」，按下「立刻清理」

根据SREng扫描日志请按照如下步骤，尝试删除和修复

1.建议使用XDelBox删除以下文件：(XDelBox下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
(如XDelBox提示文件不存在的，忽略即可)

c:\windows\system32\lymangr.dll
c:\windows\system32\ravzx531.dll
c:\windows\system32\fksdy.dll
c:\windows\system32\hreax.dll
c:\windows\system32\wfdrd.dll
c:\windows\system32\wgptl.dll
c:\windows\system32\wtrmm.dll
c:\windows\system32\zkjjx.dll
c:\docume~1\richwe~1\locals~1\temp\daso0.dll
c:\windows\system32\msimms32.dll
c:\windows\system32\shqmangr.dll
c:\windows\system32\wscsv.dll
c:\windows\system32\msdebug.dll
c:\windows\system32\windds32.dll
c:\windows\system32\windhcp.ocx
c:\windows\system32\wmiapisrv.dll
c:\windows\system32\msacn.dll
c:\windows\system32\lyloadqr.exe
c:\docume~1\richwe~1\locals~1\temp\daso.exe
c:\windows\msimms32.exe
c:\windows\uninstall\rundl132.exe
c:\windows\system32\ctfnom.exe
c:\windows\system32\ntsokele.exe
c:\docume~1\richwe~1\locals~1\temp\ravzx.exe
c:\windows\system32\drivers\npf.sys

2.删除重启后使用SREng修复下面各项：

启动项目－－注册表之如下项删除：
[{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}] <C:\WINDOWS\system32\msacn.dll>
[MSDQG32] <LYLoadqr.exe>
[MSDHG32] <LYLoadhr.exe>
[MSDMG32] <LYLoadmr.exe>
[MSDSG32] <LYLoadar.exe>
[MSDOG32] <LYLoador.exe>
[MSDCG32 ] <LYLeador.exe>
[MSDWG32] <LYLoadbr.exe>
[MSDEG32] <LYLoader.exe>
[dasa] <C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso.exe>
[MsIMMs32] <C:\WINDOWS\MsIMMs32.exe>
[load] <C:\WINDOWS\uninstall\rundl132.exe>
[twin] <C:\WINDOWS\system32\ctfnom.exe>

启动项目－－服务－－ Win32服务应用程序之如下项删除：
[Win32 Debug Service / MSDebugsvc] <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input>
[Remote Help Session Manager / Rasautol] <C:\WINDOWS\system32\ntsokele.exe>
[Win32 Display Driver / Win32DDS] <C:\WINDOWS\system32\rundll32.exe windds32.dll,input>
[Windows DHCP Service / WinDHCPsvc] <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input>
[WinZXServiceNow / WinZXServiceNow] <C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\RAVZX.EXE>
[WMI Performance API / WMIApiSrv] <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input>

启动项目－－服务－－驱动程序之如下项删除：
[Netgroup Packet Filter / NPF] <system32\drivers\npf.sys>

最后下载windows清理助手清理恶意软件以及自身杀软升级至最新，进行全盘杀毒
http://www.arswp.com/download/arswp/arswp.rar

谢谢风源　　　　

问题解决请修改标题已解决。

标签：
证券/理财股票收盘点评空方多方下跌 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
相关文章:

文章评论

[以下网友留言只代表其个人观点，不代表中华网的观点或立场]

发表评论

昵称：

主页：

内容：

表情：

> [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[PID: 404][F:\Tencent\qq\QQ\QQ.exe]  [TENCENT, 0, 0, 0, 0]
[F:\Tencent\qq\QQ\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQHelperDll.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\BasicCtrlDll.dll]  [Tencent, 7, 0, 101, 80]
[F:\Tencent\qq\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
[F:\Tencent\qq\QQ\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]
[F:\Tencent\qq\QQ\PYKer.dll]  [飘云 [url]http://www.pyqq.cn[/url], 飘云]
[F:\Tencent\qq\QQ\ipsearcher.dll]  [, 1.0.0.3]
[C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
[C:\WINDOWS\system32\windds32.dll]  [N/A, ]
[C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[F:\Tencent\qq\QQ\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
[F:\Tencent\qq\QQ\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
[F:\Tencent\qq\QQ\QQAPI.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
[C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
[C:\WINDOWS\system32\hreax.dll]  [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
[C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
[C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[F:\Tencent\qq\QQ\LoginCtrl.dll]  [N/A, ]
[F:\Tencent\qq\QQ\npkcntc.dll]  [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[F:\Tencent\qq\QQ\npkpdb.dll]  [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[F:\Tencent\qq\QQ\LoginCtrlRes.dll]  [, 1, 0, 0, 1]
[C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]
[C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]
[F:\Tencent\qq\QQ\QQRes.dll]  [tencent, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQMainFrame.dll]  [N/A, ]
[F:\Tencent\qq\QQ\CQQApplication.dll]  [N/A, ]
[F:\Tencent\qq\QQ\NewSkin.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\HostingMgr.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\CameraDll.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\MailSummary.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQKnowledgeSearch.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQAllInOne.dll]  [N/A, ]
[F:\Tencent\qq\QQ\GroupLive.dll]  [N/A, ]
[F:\Tencent\qq\QQ\SCCore.dll]  [TENCENT, 2, 0, 0, 1]
[F:\Tencent\qq\QQ\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\Tencent\qq\QQ\QQSpace.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[F:\Tencent\qq\QQ\QQGroupMng.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\FlashAvatarDll.dll]  [, 1, 4, 0, 1]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[F:\Tencent\qq\QQ\QQAvatar.dll]  [N/A, ]
[F:\Tencent\qq\QQ\UserDefinedHead.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQPlugin.dll]  [N/A, ]
[F:\Tencent\qq\QQ\LongConnection.dll]  [tencent, 5, 0, 200, 160]
[F:\Tencent\qq\QQ\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQCustomFace.dll]  [N/A, ]
[F:\Tencent\qq\QQ\QRingMng.dll]  [N/A, ]
[F:\Tencent\qq\QQ\PhoneAPI.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\DialerAllinOne.dll]  [tencent, 1, 4, 0, 0]
[F:\Tencent\qq\QQ\QQPet.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\QQSysMsgMng.dll]  [N/A, ]
[F:\Tencent\qq\QQ\BQQApplication.dll]  [N/A, ]
[F:\Tencent\qq\QQ\CommercesMng.dll]  [, 1, 0, 0, 1]
[F:\Tencent\qq\QQ\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[F:\Tencent\qq\QQ\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 5, 0, 101, 280]
[F:\Tencent\qq\QQ\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
[F:\Tencent\qq\QQ\QQSceneMng.dll]  [N/A, ]
[F:\Tencent\qq\QQ\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
[F:\Tencent\qq\QQ\QQPhoneHelper.dll]  [腾讯科技（深圳）有限公司, 2, 1, 9, 92]
[F:\Tencent\qq\QQ\QQZip.dll]  [tencent, 0, 3, 2, 4]
[F:\Tencent\qq\QQ\QQMagicFace.dll]  [, 1, 0, 0, 1]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[PID: 1108][F:\Tencent\qq\QQ\TIMPlatfrom.exe]  [tencent, 0, 3, 1, 8]
[C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
[C:\WINDOWS\system32\windds32.dll]  [N/A, ]
[C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
[C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
[C:\WINDOWS\system32\hreax.dll]  [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
[C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
[C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[F:\Tencent\qq\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 1764][C:\Program Files\PPStream\PPStream.exe]  [PPStream.com, 1, 0, 4, 701]
[C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
[C:\WINDOWS\system32\windds32.dll]  [N/A, ]
[C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[C:\PROGRA~1\PPStream\POWERP~1.DLL]  [PPStream Inc., 1,0,0,3000]
[C:\PROGRA~1\PPStream\PSNetwork.dll]  [PPStream, inc., 1, 0, 0, 2442]
[C:\PROGRA~1\PPStream\POWERL~1.OCX]  [PPStream.com, 1, 0, 0, 1982]
[C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
[C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
[C:\WINDOWS\system32\hreax.dll]  [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
[C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
[C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]
[C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash6.ocx]  [Macromedia, Inc., 6,0,88,0]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 228][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
[C:\WINDOWS\system32\windds32.dll]  [N/A, ]
[C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]
[C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
[C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
[C:\WINDOWS\system32\hreax.dll]  [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
[C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
[C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]
[C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[PID: 1196][C:\Documents and Settings\richweiwei\桌面\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
[C:\WINDOWS\system32\windds32.dll]  [N/A, ]
[C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
[C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
[C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
[C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
[C:\WINDOWS\system32\hreax.dll]  [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
[C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
[C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[C:\WINDOWS\system32\MsIMMs32.dll]  [N/A, ]
[C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\daso0.dll]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

在「我的电脑」上按右键，选择「属性」
进入「系统还原」，勾选「在所有驱动器上关闭系统还診lymangr.dll
c:\windows\system32\ravzx531.dll
c:\windows\syste�」，按下「应用」，出现提示对话框时按「是」（病毒清理后请自己决定是否打开系统还原）

点此下载ATF Cleaner
执行后，勾选「全选」，按下「立刻清理」

根据SREng扫描日志请按照如下步骤，尝试删除和修复

1.建议使用XDelBox删除以下文件：(XDelBox下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
(如XDelBox提示文件不存在的，忽略即可)

c:\windows\system32\lymangr.dll
c:\windows\system32\ravzx531.dll
c:\windows\system32\fksdy.dll
c:\windows\system32\hreax.dll
c:\windows\system32\wfdrd.dll
c:\windows\system32\wgptl.dll
c:\windows\system32\wtrmm.dll
c:\windows\system32\zkjjx.dll
c:\docume~1\richwe~1\locals~1\temp\daso0.dll
c:\windows\system32\msimms32.dll
c:\windows\system32\shqmangr.dll
c:\windows\system32\wscsv.dll
c:\windows\system32\msdebug.dll
c:\windows\system32\windds32.dll
c:\windows\system32\windhcp.ocx
c:\windows\system32\wmiapisrv.dll
c:\windows\system32\msacn.dll
c:\windows\system32\lyloadqr.exe
c:\docume~1\richwe~1\locals~1\temp\daso.exe
c:\windows\msimms32.exe
c:\windows\uninstall\rundl132.exe
c:\windows\system32\ctfnom.exe
c:\windows\system32\ntsokele.exe
c:\docume~1\richwe~1\locals~1\temp\ravzx.exe
c:\windows\system32\drivers\npf.sys

2.删除重启后使用SREng修复下面各项：

启动项目－－注册表之如下项删除：
[{1496D5ED; <C:\WINDOWS\system32\ntsokele.exe>
[Win32 Display Driver / Win32DDS] <C:\WINDOWS\system32\rundll32.exe windds32.dll,input>
[Windows DHCP Service / WinDHCPsvc] <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input>
[WinZXServiceNow / WinZXServiceNow] <C:\DOCUME~1\RICHWE~1\LOCALS~1\Temp\RAVZX.EXE>
[WMI Performance API / WMIApiSrv] <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input>

启动项目－－服务－－驱动程序之如下项删除：
[Netgroup Packet Filter / NPF] <system32\drivers\npf.sys>

最后下载windows清理助手清理恶意软件以及自身杀软升级至最新，进行全盘杀毒
http://www.arswp.com/download/arswp/arswp.rar

谢谢风源　　　　

问题解决请修改标题已解决。

标签：
证券/理财股票收盘点评空方多方下跌 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
相关文章: