c:\windows\system32\.exe这个毒谁能搞定啊！！

kusila

==================================
正在运行的进程
[PID: 736 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 788 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 812 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\klogon.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\WINDOWS\system32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 856 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 868 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1044 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1136 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\WINHTTP.dll]  [Microsoft Corporation, 5.1.2600.1557 (xpsp2_gdr.040517-1325)]
    [C:\WINDOWS\System32\wups.dll]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1344 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1384 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1604 / bao][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Documents and Settings\bao\桌面\Unlocker1.8.5\Unlocker1.8.5\UnlockerCOM.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx]  [, 1, 0, 0, 1]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.1.411]
[PID: 1676 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\Program Files\Apoint2K\EzAuto.dll]  [Alps Electric Co., Ltd., 4.5.1.82]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Apoint2K\EzLaunch.DLL]  [Alps Electric Co., Ltd., 4.5.0.46]
[PID: 1808 / bao][C:\WINDOWS\System32\TFNF5.exe]  [Toshiba Corp., 1. 0. 1. 0]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 1828 / bao][C:\Program Files\TOSHIBA\TouchED\TouchED.Exe]  [东芝公司, 2, 0, 1, 6]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
[PID: 1836 / bao][C:\WINDOWS\System32\TPWRTRAY.EXE]  [东芝公司, 5.07.14]
    [C:\WINDOWS\System32\TPwrReg.dll]  [东芝公司, 5.06.6]
    [C:\WINDOWS\System32\Tdevdetect.dll]  [东芝公司, 5.07.14]
    [C:\WINDOWS\system32\TSCI.DLL]  [Toshiba, 1.0.0.0]
    [C:\WINDOWS\system32\THCI.DLL]  [Toshiba, 1.0.0.0]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 1856 / bao][C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe]  [TOSHIBA Corporation, 2.39]
    [C:\WINDOWS\System32\THCI.dll]  [Toshiba, 1.0.0.0]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 1868 / bao][C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe]  [TOSHIBA CORPORATION, 2, 0, 0, 1]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 1920 / bao][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
[PID: 1928 / bao][C:\Program Files\Logitech\SetPoint\SetPoint.exe]  [Logitech Inc., 3.1.116]
    [C:\WINDOWS\System32\KemUtil.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\SetPointCOM.dll]  [Logitech Inc., 3.1.116]
    [C:\WINDOWS\System32\kemutb.dll]  [Logitech Inc., 3.1.116]
    [C:\WINDOWS\System32\KemWnd.dll]  [Logitech Inc., 3.1.116]
    [C:\WINDOWS\System32\KemXML.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\IMHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Common Files\Logitech\khalshared\KhalApi.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\kgame.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    [C:\Program Files\Logitech\SetPoint\LCabHandler.dll]  [Logitech Inc., 3.1.116]
[PID: 1972 / bao][C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE]  [Logitech Inc., 3.1.82]
    [C:\Program Files\Common Files\Logitech\khalshared\KHALAPI.DLL]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Common Files\Logitech\khalshared\KHALITCH.DLL]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Common Files\Logitech\khalshared\KHALMW.DLL]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Common Files\Logitech\khalshared\KHALHPP.DLL]  [Logitech Inc., 3.1.116]
[PID: 188 / bao][C:\Program Files\Apoint2K\Apntex.exe]  [Alps Electric Co., Ltd., 5.0.1.13]
    [C:\WINDOWS\System32\VXDIF.DLL]  [Alps Electric Co., Ltd., 5.3.1.47]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 212 / bao][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 356 / SYSTEM][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.2846]
[PID: 456 / LOCAL SERVICE][C:\WINDOWS\System32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1176 / bao][C:\Program Files\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 6, 0, 30]
    [C:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 1.0.6.411]
    [C:\WINDOWS\System32\odbcbcp.dll]  [Microsoft Corporation, 2000.081.7713.00]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.1.411]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.1.411]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.1.411]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.1.411]
    [C:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.1.411]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.1.411]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\basegui.ppl]  [Crsky, 6.0.1]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\winreg.ppl]  [Kaspersky Lab, 6.0.1.411]
    [C:\WINDOWS\System32\UNISPIM5.IME]  [北京紫光华宇软件股份有限公司, 5.0.0.5091]
    [C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 1444 / bao][C:\WINDOWS\regedit.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
[PID: 1744 / bao][C:\Documents and Settings\bao\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\Program Files\Logitech\SetPoint\GameHook.dll]  [Logitech Inc., 3.1.116]
    [C:\Program Files\Logitech\SetPoint\lgscroll.dll]  [Logitech Inc., 3.1.116]
    [C:\Documents and Settings\bao\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1792, C:\WINDOWS\SYSTEM32\00THOTKEY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1808, C:\WINDOWS\SYSTEM32\TFNF5.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1828, C:\PROGRAM FILES\TOSHIBA\TOUCHED\TOUCHED.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1836, C:\WINDOWS\SYSTEM32\TPWRTRAY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1856, C:\PROGRAM FILES\TOSHIBA\TOSHIBA CONTROLS\TFNCKY.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1868, C:\PROGRAM FILES\TOSHIBA\WIRELESS HOTKEY\TOSHKCW.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1928, C:\PROGRAM FILES\LOGITECH\SETPOINT\SETPOINT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1176, C:\PROGRAM FILES\MAXTHON\MAXTHON.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\System32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================


[/CODE]

红心王子

楼主先结束那个  .exe的进程，看任务管理器里面有没有它在运行中，
如果有立即结束。

如果在系统目录文件下找到那个文件，手动将它删除掉

promised

1.建议使用XDelBox删除以下文件：(XDelBox1.3下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

; 000stthk.exe
; c:\docume~1\bao\locals~1\temp\iexplorer.exe
; c:\windows\kvsc3.exe
; ?砲? ?砲?        ?砲? ? ? ?


2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[000StTHK]    <; 000StTHK.exe>
[g92y09v]    <; C:\DOCUME~1\bao\LOCALS~1\Temp\iexplorer.exe>
[Kvsc3]    <; C:\WINDOWS\Kvsc3.exe>
[Load]    <; ?矵? ?矵?        ?矵? ? ? ?>

pluto1313

含有Win32保留字和非法字符名称的文件（夹）名是无法通过常规方法删除的

Try to use it:
del "\\?\c:\windows\system32\.exe"

lengxue624

unlocker应该可以干掉

scottxzt

这就是那个女鬼病毒!

lengxue624

1.建议使用XDelBox删除以下文件：(XDelBox1.3下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

c:\docume~1\bao\locals~1\temp\iexplorer.exe
c:\windows\kvsc3.exe
c:\windows\system32\drivers\xcazbi77.sys
c:\windows\system32\drivers\ikcado.sys
c:\windows\system32\drivers\mioke.sys


2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[g92y09v]    <; C:\DOCUME~1\bao\LOCALS~1\Temp\iexplorer.exe>
[Kvsc3]    <; C:\WINDOWS\Kvsc3.exe>
[Load]    <; ?矵? ?矵?        ?矵? ? ? ?>


    启动项目 －－ 服务－－ 驱动程序之如下项删除：
[xcazbi7 / xcazbi77]    <\SystemRoot\System32\DRIVERS\xcazbi77.sys>
[ikcad / ikcado]    <\SystemRoot\System32\DRIVERS\ikcado.sys>
[miok / mioke]    <\SystemRoot\System32\DRIVERS\mioke.sys>