收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 求助啊，各位大哥．帮忙看看该怎么办？
返回列表 发新帖
查看: 1902|回复: 4
收起左侧

求助啊，各位大哥．帮忙看看该怎么办？

[复制链接]
蓝色牛仔裤
发表于 2007-7-21 20:58:02 | 显示全部楼层 |阅读模式
牛仔裤不在，他叫我上来找你们各位大哥帮忙，说你们肯定能帮到我的．．
先谢谢拉！
中毒之后打不开硬盘，提示如下：

未命名.PNG


  1. 2007-07-21,20:29:36
  2. System Repair Engineer 2.5.16.900
  3. Smallfrogs (http://www.KZTechs.com)
  4. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
  5. 以下内容被选中：
  6.     所有的启动项目（包括注册表、启动文件夹、服务等）
  7.     浏览器加载项
  8.     正在运行的进程（包括进程模块信息）
  9.     文件关联
  10.     Winsock 提供者
  11.     Autorun.inf
  12.     HOSTS 文件
  13.     进程特权扫描

  15. 启动项目
  16. 注册表
  17. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  18.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  19.     <DrvMon.exe><C:\WINDOWS\system32\DrvMon.exe>  [Alcor Micro, Corp.]
  20.     <ArpSet><D:\江门有线\登陆软件\ArpSet\ArpSet.bat>  []
  21.     <QQDownload><"C:\Program Files\Tencent\QQDownload\QQDownload.exe" autostart>  [N/A]
  22. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  23.     <load><>  [N/A]
  24. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  25.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
  26.     <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
  27.     <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
  28.     <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)Microsoft Windows Publisher]
  29.     <Easy-PrintToolBox><C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon>  [CANON INC.]
  30.     <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
  31.     <kav><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
  32.     <vbe><C:\WINDOWS\u.vbe>  []
  33.     <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
  34.     <stup.exe><Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll,Rundll32 R>  [TENCENT]
  35.     <360Safetray><C:\Program Files\360safe\safemon\360Tray.exe /start>  [奇虎网]
  36. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  37.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  38.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  39. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  40.     <AppInit_DLLs><>  [N/A]
  41. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  42.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  43. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  44.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  45. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  46.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  47. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  48.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  50.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  51. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  52.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  53. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  54.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  55. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
  56.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
  57. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  58.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
  59. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  60.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  61. ==================================
  62. 启动文件夹
  63. [腾讯QQ]
  64.   <C:\Documents and Settings\Admin\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>
  65. [QQ游戏启动加速程序]
  66.   <C:\Documents and Settings\Admin\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> C:\PROGRA~1\Tencent\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>
  67. ==================================
  68. 服务
  69. [卡巴斯基反病毒软件6.0 / AVP][Running/Auto Start]
  70.   <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
  71. [Human Interface Device Access / HidServ][Stopped/Disabled]
  72.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  73. ==================================
  74. 驱动程序
  75. [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  76.   <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
  77. [VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start]
  78.   <system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
  79. [GMSIPCI / GMSIPCI][Stopped/Manual Start]
  80.   <\??\G:\INSTALL\GMSIPCI.SYS><N/A>
  81. [kl1 / kl1][Running/Boot Start]
  82.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  83. [KLIF / KLIF][Running/System Start]
  84.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  85. [New0 / New0][Running/Auto Start]
  86.   <\??\C:\WINDOWS\system32\new.sys><N/A>
  87. [nv / nv][Stopped/Manual Start]
  88.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  89. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  90.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  91. [S3Psddr / S3Psddr][Running/Manual Start]
  92.   <system32\DRIVERS\s3gnbm.sys><S3 Graphics, Inc.>
  93. [S3SavageNB / S3SavageNB][Stopped/Manual Start]
  94.   <system32\DRIVERS\s3gnbm.sys><S3 Graphics, Inc.>
  95. [Secdrv / Secdrv][Stopped/Manual Start]
  96.   <system32\DRIVERS\secdrv.sys><N/A>
  97. [VIA AGP Filter / viaagp1][Running/Boot Start]
  98.   <\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
  99. [ViaIde / ViaIde][Running/Boot Start]
  100.   <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
  101. [VIA AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  102.   <system32\drivers\viaudios.sys><VIA Technologies, Inc.>
  103. [Vsp / Vsp][Stopped/Manual Start]
  104.   <\??\C:\WINDOWS\system32\drivers\Vsp.sys><N/A>
  105. ==================================
  106. 浏览器加载项
  107. [QQCycloneHelper Class]
  108.   {00000000-12C9-4305-82F9-43058F20E8D2} <C:\Program Files\Tencent\QQDownload\QQIEHelper02.dll, 腾讯公司>
  109. [Tencent Browser Helper]
  110.   {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\SSPlus\SAddr.dll, Tencent>
  111. [NavigatMon Class]
  112.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  113. [Web反病毒保护]
  114.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
  115. [CibaCtrl Class]
  116.   {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
  117. [信息检索(&R)]
  118.   {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
  119. [JoyoCtrl Class]
  120.   {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
  121. [QQ]
  122.   {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
  123. [Messenger]
  124.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, N/A>
  125. [金山快译(&K)]
  126.   {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
  127. [Easy-WebPrint]
  128.   {327C2873-E90D-4c37-AA9D-10AC9BABA46C} <C:\Program Files\Canon\Easy-WebPrint\Toolband.dll, >
  129. [Shockwave Flash Object]
  130.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
  131. [Rising Web Scan Object]
  132.   {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
  133. [QQCycloneHelper Class]
  134.   {00000000-12C9-4305-82F9-43058F20E8D2} <C:\Program Files\Tencent\QQDownload\QQIEHelper02.dll, 腾讯公司>
  135. [Tencent Browser Helper]
  136.   {0C7C23EF-A848-485B-873C-0ED954731014} <C:\Program Files\TENCENT\SSPlus\SAddr.dll, Tencent>
  137. [Easy-WebPrint]
  138.   {327C2873-E90D-4C37-AA9D-10AC9BABA46C} <C:\Program Files\Canon\Easy-WebPrint\Toolband.dll, >
  139. [金山快译(&K)]
  140.   {6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
  141. [360SafeLive]
  142.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360safe.com>
  143. [Microsoft Web 浏览器]
  144.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
  145. [CibaCtrl Class]
  146.   {8DE0FCD4-5EB5-11D3-AD25-00002100131B} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
  147. [NavigatMon Class]
  148.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, >
  149. [JoyoCtrl Class]
  150.   {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll, >
  151. [Shockwave Flash Object]
  152.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
  153. [Rising Web Scan Object]
  154.   {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
  155. [&使用超级旋风下载]
  156.   <C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
  157. [&使用超级旋风下载全部链接]
  158.   <C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
  159. [Easy-WebPrint打印]
  160.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html, N/A>
  161. [Easy-WebPrint添加到打印列表]
  162.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html, N/A>
  163. [Easy-WebPrint预览]
  164.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html, N/A>
  165. [Easy-WebPrint高速打印]
  166.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html, N/A>
  167. [上传到QQ网络硬盘]
  168.   <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
  169. [导出到 Microsoft Office Excel(&X)]
  170.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
  171. [添加到QQ自定义面板]
  172.   <C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
  173. [添加到QQ表情]
  174.   <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
  175. [用QQ彩信发送该图片]
  176.   <C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
复制代码

[ 本帖最后由 蓝色牛仔裤 于 2007-7-21 20:59 编辑 ]
回复

举报

蓝色牛仔裤
 楼主| 发表于 2007-7-21 20:58:51 | 显示全部楼层

  2. ==================================
  3. 正在运行的进程
  4. [PID: 584 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  5. [PID: 668 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  6. [PID: 692 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  7.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
  8.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  9.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  10. [PID: 736 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  11. [PID: 748 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  12. [PID: 896 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  13. [PID: 992 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  14. [PID: 1092 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  15.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
  16. [PID: 1172 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  17. [PID: 1292 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  18. [PID: 1612 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  19.     [C:\WINDOWS\system32\CNMLM76.DLL]  [CANON INC., 1.90.2.20]
  20.     [C:\WINDOWS\system32\CNMLM6e.DLL]  [CANON INC., 1.80.2.50]
  21.     [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
  22.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD76.DLL]  [CANON INC., 1.90.2.20]
  23.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL]  [CANON INC., 1.80.2.50]
  24.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
  25. [PID: 1616 / Admin][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  26.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  27.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
  28.     [C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL]  [Adobe Systems, Incorporated, 7.0]
  29.     [C:\Program Files\TENCENT\SSPlus\SAddr.dll]  [Tencent, 5, 0, 1, 17]
  30.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  31. [PID: 1884 / Admin][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3018]
  32.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  33.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  34. [PID: 1892 / Admin][C:\WINDOWS\system32\Rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  35.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  36.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  37. [PID: 1904 / Admin][C:\Program Files\360safe\safemon\360Tray.exe]  [奇虎网, 3, 5, 1, 1001]
  38.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  39.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 0, 1001]
  40.     [C:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 3, 5, 0, 1001]
  41.     [C:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 3, 5, 1, 1001]
  42.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  43.     [C:\Program Files\360safe\live.dll]  [360safe.com, 1, 0, 1, 1016]
  44. [PID: 1912 / Admin][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  45.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  46.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  47. [PID: 1920 / Admin][C:\WINDOWS\system32\DrvMon.exe]  [Alcor Micro, Corp., 1, 0, 0, 9]
  48.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  49.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  50. [PID: 1956 / Admin][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  51.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  52.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  53. [PID: 280 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  54. [PID: 1532 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  55. [PID: 2580 / Admin][D:\江门有线\登陆软件\JMCATVLogin.exe]  [江门有线广电网络中心, 3.0.0.14]
  56.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 0, 1001]
  57.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  58.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  59. [PID: 2716 / Admin][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  60.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 0, 1001]
  61.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  62.     [C:\Program Files\TENCENT\SSPlus\SAddr.dll]  [Tencent, 5, 0, 1, 17]
  63.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  64.     [C:\Program Files\Tencent\QQDownload\QQIEHelper02.dll]  [腾讯公司, 1, 1, 0, 5]
  65.     [C:\PROGRA~1\COMMON~1\MICROS~1\IME\SHARED2.0\MSCAND20.DLL]  [Microsoft Corporation, 9.0.5510.0]
  66.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  67.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
  68.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
  69.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
  70.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
  71.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
  72.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
  73.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
  74.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
  75.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  76.     [C:\WINDOWS\system32\KIme.ime]  [金山软件公司, 1, 0, 0, 1]
  77.     [C:\PROGRA~1\COMMON~1\KingSoft\Extract\KSEngine.dll]  [, 1, 0, 0, 1]
  78.     [C:\PROGRA~1\COMMON~1\KingSoft\Extract\xfile.dll]  [N/A, ]
  79.     [C:\WINDOWS\system32\WINWB86.IME]  [Microsoft Corporation, 4.00.950]
  80.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
  81.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
  82. [PID: 1104 / Admin][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  83.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 0, 1001]
  84.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  85.     [C:\Program Files\TENCENT\SSPlus\SAddr.dll]  [Tencent, 5, 0, 1, 17]
  86.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  87.     [C:\Program Files\Tencent\QQDownload\QQIEHelper02.dll]  [腾讯公司, 1, 1, 0, 5]
  88.     [C:\PROGRA~1\COMMON~1\MICROS~1\IME\SHARED2.0\MSCAND20.DLL]  [Microsoft Corporation, 9.0.5510.0]
  89.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  90.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
  91.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
  92.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
  93.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
  94.     [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
  95.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
  96.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
  97.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
  98.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  99.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
  100.     [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
  101. [PID: 3180 / Admin][C:\Documents and Settings\Admin\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
  102.     [C:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 0, 1001]
  103.     [C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll]  [TENCENT, 5, 0, 1, 19]
  104.     [C:\WINDOWS\system32\IMSC40A.IME]  [Microsoft Corporation, 6.0.0.2527]
  105.     [C:\Documents and Settings\Admin\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

  107. ==================================
  108. 文件关联
  109. .TXT  Error. [C:\WINDOWS\notepad.exe %1]
  110. .EXE  OK. ["%1" %*]
  111. .COM  OK. ["%1" %*]
  112. .PIF  OK. ["%1" %*]
  113. .REG  OK. [regedit.exe "%1"]
  114. .BAT  OK. ["%1" %*]
  115. .SCR  OK. ["%1" /S]
  116. .CHM  Error. ["hh.exe" %1]
  117. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  118. .INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
  119. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  120. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  121. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  122. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  124. ==================================
  125. Winsock 提供者
  126. N/A

  128. ==================================
  129. Autorun.inf
  130. [C:\]
  131. [AutoRun]
  132. open=wscript.exe u.vbe
  133. shell\open\Command=wscript.exe u.vbe
  134. shell\explore\Command=wscript.exe u.vbe
  135. shell\find\Command=wscript.exe u.vbe
  136. [D:\]
  137. [AutoRun]
  138. open=wscript.exe u.vbe
  139. shell\open\Command=wscript.exe u.vbe
  140. shell\explore\Command=wscript.exe u.vbe
  141. shell\find\Command=wscript.exe u.vbe
  142. [E:\]
  143. [AutoRun]
  144. open=wscript.exe u.vbe
  145. shell\open\Command=wscript.exe u.vbe
  146. shell\explore\Command=wscript.exe u.vbe
  147. shell\find\Command=wscript.exe u.vbe
  148. [F:\]
  149. [AutoRun]
  150. open=wscript.exe u.vbe
  151. shell\open\Command=wscript.exe u.vbe
  152. shell\explore\Command=wscript.exe u.vbe
  153. shell\find\Command=wscript.exe u.vbe

  155. ==================================
  156. HOSTS 文件
  157. 127.0.0.1       localhost

  159. ==================================
  160. 进程特权扫描
  161. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1884, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
  162. 特殊特权被允许： SeDebugPrivilege [PID = 1904, C:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE]
  163. 特殊特权被允许： SeLoadDriverPrivilege [PID = 2580, D:\江门有线\登陆软件\JMCATVLOGIN.EXE]

  165. ==================================
  166. API HOOK
  167. RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  168. RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  169. RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  170. RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  171. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

  173. ==================================
  174. 隐藏进程
  175. N/A

  177. ==================================


复制代码
回复

举报

solcroft
发表于 2007-7-22 00:24:23 | 显示全部楼层
典型的中了优盘病毒，杀毒后没清除autorun.inf文件的情况
把根目录下的autorun.inf删掉便行了，有很多方法，可以用windows explorer，cmd.exe，icesword...
回复

举报

蓝色牛仔裤
 楼主| 发表于 2007-7-22 16:30:17 | 显示全部楼层
清除autorun、清除autorun修改的有关注册表，已搞定，谢谢solcroft 了～
PS：我是牛仔裤。
回复

举报

微点卫士
发表于 2007-7-22 17:19:42 | 显示全部楼层

回复 #4 蓝色牛仔裤 的帖子

LZ玩无间道啊，我晕
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-24 00:26 , Processed in 0.149810 second(s), 20 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表