我的电脑这几天总是有ads[1].c病毒,用金山杀,总是能够杀掉,可是只要一打开网页,就又有这一个种类型的病毒,金山又能够实时监控到,还提示此病毒已彻底删除,可打开下一网页,这病毒又出现了.急呀!快帮帮我?-------
清理专家-->在线操作操作系统诊断-->导出诊断报告-->勾选 隐藏(Hide)所有已知安全的项＋全选-->导出报告贴报告上来看看-------
金山清理专家操作操作系统诊断报告该诊断报告由金山清理专家提供 http://www.duba.net
==============================================================诊断时间: 2008-03-24, 17:59
诊断平台: Windows XP [V.I.2600] Service Pack 2
IE版本: Internet Explorer VVII.0.1III.5730
电脑物理计算机内存: 383(MB)
当前可以用计算机内存: 109(MB)
计算机硬盘(Hard)总大小:103(GB)
计算机硬盘(Hard)可以用空间: 76(GB)
清理专家版本: 2007,12,28,3
恶意软件(soft)库版本: 2008.0III.18.1
漏洞库版本:2008.0III.1I.1
==============================================================
启动操作系统文件夹位置
==============================================================Common Startup:C:\Documents and Settings\All Users\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统
Startup: C:\Documents and Settings\Administrator\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统
Common Startup:%ALLUSERSPROFILE%\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统==============================================================
Host File
==============================================================12VII.0.0.1 localhost
12VII.0.0.1 picon.chinaren.com
12VII.0.0.1 bt.etimes888.com
12VII.0.0.1 www.shaohen667VII.com
12VII.0.0.1 wellbate.com
12VII.0.0.1 www.beiyong111I.cn
12VII.0.0.1 a.topxxxx.cn
12VII.0.0.1 588.star-google.com
12VII.0.0.1 www.dj8910.com
12VII.0.0.1 mm.tt1890.com
12VII.0.0.1 ppp.buyaoni.com
12VII.0.0.1 ppp.74957I.com
12VII.0.0.1 dd.74957I.com
12VII.0.0.1 niu.xinniankl.com
12VII.0.0.1 xxx.haoqq1680.com
12VII.0.0.1 exe.xinniankl.com
12VII.0.0.1 the.microgood.net
12VII.0.0.1 iii.wzxyq.com
12VII.0.0.1 mm.sqmnoopt.com
12VII.0.0.1 ppp.buyaoni.com
12VII.0.0.1 keeppure.cn
12VII.0.0.1 aaa.1l1l1l.com
12VII.0.0.1 www.cfjs119.cn
12VII.0.0.1 cool.e0shop.cn
12VII.0.0.1 yun.yun878.com
12VII.0.0.1 web.4725V.com
12VII.0.0.1 www.cike00VII.cn
12VII.0.0.1 www.exiao0I.com
12VII.0.0.1
qqq.dzydhx.com
12VII.0.0.1
qqq.hao1658.com
12VII.0.0.1 www.33329II.com
12VII.0.0.1 down.18dd.net
12VII.0.0.1 xxx.m11I.biz
12VII.0.0.1 I.jopenqc.com
12VII.0.0.1 xxx.j41m.com
12VII.0.0.1 III.joppnqq.com
12VII.0.0.1 d.93se.com
12VII.0.0.1 I.jopenkk.com
12VII.0.0.1 xxx.vhVII.biz
12VII.0.0.1 new.74957I.com
12VII.0.0.1 xtx.kv8.info
12VII.0.0.1 cao.kv8.info
12VII.0.0.1 I.jopmmqq.com
12VII.0.0.1 yu.8sVII.net
12VII.0.0.1 I.jopanqc.com
12VII.0.0.1 II.joppnqq.com
12VII.0.0.1 www.868wg.com
12VII.0.0.1 xxx.mmma.biz
12VII.0.0.1 ilove.com
12VII.0.0.1 www.22aaa.com
12VII.0.0.1 xx.exiao0I.com
12VII.0.0.1 www.exiao0I.com
12VII.0.0.1 tp.shpzhan.cn
12VII.0.0.1 www.tomwg.com
12VII.0.0.1 wg.4725V.com
12VII.0.0.1 I.joppnqq.com
12VII.0.0.1 17181VII.17181VII.com
12VII.0.0.1 dII.llsging.com
12VII.0.0.1 llboss.com
12VII.0.0.1 nx.51ylb.cn
12VII.0.0.1 my.531jx.cn
12VII.0.0.1 up.22x4IV.com==============================================================
驱动程序(Procedures)(Procedures)
==============================================================该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services [fpids32] [已启用] <\??\C:\WINDOWS\system32\drivers\msosfpids3II.sys> [IntelIde] [已启用]<System32\DRIVERS\intelide.sys> [npkcrypt] [已启用]<\??\C:\WINDOWS\system32\npkcrypt.sys> [npkycryp] [已启用]<\??\C:\WINDOWS\system32\npkycryp.sys> [pop] [已启用] <\??\C:\WINDOWS\system32\DRIVERS\pop.sys>
==============================================================
协议==============================================================该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter <text/html> <c:\vista.dll>
==============================================================
其他安全区域
==============================================================该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [显示摇曳 CPL 扩展] <deskpan.dll> [Microsoft Agent Character Property Sheet Handler] <C:\WINDOWS\msagent\agentpsh.dll>-------
金山清理专家操作操作系统诊断报告该诊断报告由金山清理专家提供 http://www.duba.net
==============================================================诊断时间: 2008-03-24, 17:59
诊断平台: Windows XP [V.I.2600] Service Pack 2
IE版本: Internet Explorer VVII.0.1III.5730
电脑物理计算机内存: 383(MB)
当前可以用计算机内存: 109(MB)
计算机硬盘(Hard)总大小:103(GB)
计算机硬盘(Hard)可以用空间: 76(GB)
清理专家版本: 2007,12,28,3
恶意软件(soft)库版本: 2008.0III.18.1
漏洞库版本:2008.0III.1I.1
==============================================================
启动操作系统文件夹位置
==============================================================Common Startup:C:\Documents and Settings\All Users\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统
Startup: C:\Documents and Settings\Administrator\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统
Common Startup:%ALLUSERSPROFILE%\「开始」菜单\程序(Procedures)(Procedures)\启动操作系统==============================================================
Host File
==============================================================12VII.0.0.1 localhost
12VII.0.0.1 picon.chinaren.com
12VII.0.0.1 bt.etimes888.com
12VII.0.0.1 www.shaohen667VII.com
12VII.0.0.1 wellbate.com
12VII.0.0.1 www.beiyong111I.cn
12VII.0.0.1 a.topxxxx.cn
12VII.0.0.1 588.star-google.com
12VII.0.0.1 www.dj8910.com
12VII.0.0.1 mm.tt1890.com
12VII.0.0.1 ppp.buyaoni.com
12VII.0.0.1 ppp.74957I.com
12VII.0.0.1 dd.74957I.com
12VII.0.0.1 niu.xinniankl.com
12VII.0.0.1 xxx.haoqq1680.com
12VII.0.0.1 exe.xinniankl.com
12VII.0.0.1 the.microgood.net
12VII.0.0.1 iii.wzxyq.com
12VII.0.0.1 mm.sqmnoopt.com
12VII.0.0.1 ppp.buyaoni.com
12VII.0.0.1 keeppure.cn
12VII.0.0.1 aaa.1l1l1l.com
12VII.0.0.1 www.cfjs119.cn
12VII.0.0.1 cool.e0shop.cn
12VII.0.0.1 yun.yun878.com
12VII.0.0.1 web.4725V.com
12VII.0.0.1 www.cike00VII.cn
12VII.0.0.1 www.exiao0I.com
12VII.0.0.1
qqq.dzydhx.com
12VII.0.0.1
qqq.hao1658.com
12VII.0.0.1 www.33329II.com
12VII.0.0.1 down.18dd.net
12VII.0.0.1 xxx.m11I.biz
12VII.0.0.1 I.jopenqc.com
12VII.0.0.1 xxx.j41m.com
12VII.0.0.1 III.joppnqq.com
12VII.0.0.1 d.93se.com
12VII.0.0.1 I.jopenkk.com
12VII.0.0.1 xxx.vhVII.biz
12VII.0.0.1 new.74957I.com
12VII.0.0.1 xtx.kv8.info
12VII.0.0.1 cao.kv8.info
12VII.0.0.1 I.jopmmqq.com
12VII.0.0.1 yu.8sVII.net
12VII.0.0.1 I.jopanqc.com
12VII.0.0.1 II.joppnqq.com
12VII.0.0.1 www.868wg.com
12VII.0.0.1 xxx.mmma.biz
12VII.0.0.1 ilove.com
12VII.0.0.1 www.22aaa.com
12VII.0.0.1 xx.exiao0I.com
12VII.0.0.1 www.exiao0I.com
12VII.0.0.1 tp.shpzhan.cn
12VII.0.0.1 www.tomwg.com
12VII.0.0.1 wg.4725V.com
12VII.0.0.1 I.joppnqq.com
12VII.0.0.1 17181VII.17181VII.com
12VII.0.0.1 dII.llsging.com
12VII.0.0.1 llboss.com
12VII.0.0.1 nx.51ylb.cn
12VII.0.0.1 my.531jx.cn
12VII.0.0.1 up.22x4IV.com==============================================================
驱动程序(Procedures)(Procedures)
==============================================================该项来源: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services [fpids32] [已启用] <\??\C:\WINDOWS\system32\drivers\msosfpids3II.sys> [IntelIde] [已启用]<System32\DRIVERS\intelide.sys> [npkcrypt] [已启用]<\??\C:\WINDOWS\system32\npkcrypt.sys> [npkycryp] [已启用]<\??\C:\WINDOWS\system32\npkycryp.sys> [pop] [已启用] <\??\C:\WINDOWS\system32\DRIVERS\pop.sys>
==============================================================
协议==============================================================该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter <text/html> <c:\vista.dll>
==============================================================
其他安全区域
==============================================================该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [显示摇曳 CPL 扩展] <deskpan.dll> [Microsoft Agent Character Property Sheet Handler] <C:\WINDOWS\msagent\agentpsh.dll>-------
病毒 2008-03-20 14:58:08 C:\Documents and Settings\Administrator\Local Settings\Temp\tmp3B.tmp Win3II.Troj.Agent.tr.1026560 清除成功
病毒 2008-03-20 14:56:48 C:\Documents and Settings\Administrator\Local Settings\Temp\tmp3A.tmp Win3II.Troj.Agent.tr.1026560 清除成功
病毒 2008-03-20 14:56:48 C:\Documents and Settings\Administrator\Local Settings\Temp\jh.exe Win3II.Troj.OnlineGamesT.ty.98304 清除成功
病毒 2008-03-20 14:56:44 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\S34IN3W7\adsCAC7258I.c Win3II.Troj.ExpAni.a.794 清除成功
病毒 2008-03-20 14:56:44 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\S34IN3W7\adsCAIBUQ7IV.c Win3II.Troj.ExpAni.a.794 清除成功
病毒 2008-03-20 14:56:44 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\S34IN3W7\baidu_com[1].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:56:44 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\S34IN3W7\ads[1].c Win3II.Troj.ExpAni.a.794 清除成功
病毒 2008-03-20 14:56:41 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\MHXSO3LN\ads[1].c Win3II.Troj.ExpAni.a.794 清除成功
病毒 2008-03-20 14:56:09 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QSP6UU71\urlhit-mcounter[2].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:56:09 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QSP6UU71\urlhit-mcounter[1].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:56:09 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QSP6UU71\counter[3].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:56:09 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QSP6UU71\counter[2].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:56:08 C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\QSP6UU71\counter[1].htm JS.ArpSrc.m.14286 清除成功
病毒 2008-03-20 14:53:40 C:\WINDOWS\system32\a.exe Win3II.PSWTroj.OnLineGames.90112 清除成功-------
安全模式下卸载
<\??\C:\WINDOWS\system32\DRIVERS\pop.sys>
<\??\C:\WINDOWS\system32\drivers\msosfpids3II.sys
并下载最新金山磁碟机专杀查杀一次并重新启动操作系统操作系统
http://bbs.duba.net/attachment.php?aid=16114147
重新启动操作系统操作系统后使用清理专家修复相关项目
并重置host.清理IE缓存.及临时文件夹.
操作完毕按以下步骤操作
清理专家-->在线操作操作系统诊断-->导出诊断报告-->勾选全选-->导出报告
贴报告上来看看
[ By the end of this article weilinhome 于 2008-3-24 18:18 Editor ]
