收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 救命啊!!大侠快来救我!!我的电脑中标了!!!!急待解决!!!( ...
12下一页
返回列表 发新帖
查看: 3251|回复: 12
收起左侧

救命啊!!大侠快来救我!!我的电脑中标了!!!!急待解决!!!(问题已解决)

[复制链接]
tsygs
发表于 2007-8-8 19:22:29 | 显示全部楼层 |阅读模式
昨晚上一时兴起进了一个下载电影的论坛,就出现鼠标(USB的鼠标)不听使唤了(是间断性的卡死)电脑也时不时的警报发现新硬件(其实就是鼠标).
用咔吧进行全盘扫描没能查到病毒,今天火大了GHOST了系统,还是一样会卡鼠标,再次冒火全盘格式化重装系统,到现在才装好,可还是会卡鼠标,真是郁闷了.
大侠帮我鉴定下是不是中了最近什么标了,以前可是都发生过这样的事情啊!!若中标了有什么软件可以杀掉.

[ 本帖最后由 tsygs 于 2007-8-10 11:16 编辑 ]
回复

举报

tsygs
 楼主| 发表于 2007-8-8 21:18:08 | 显示全部楼层
怎么没人帮我吗????????? [:02:]
回复

举报

tsygs
 楼主| 发表于 2007-8-8 21:50:03 | 显示全部楼层
换了3个USB插口使用都出现一样的问题!!救命啊!!以下是日志,高手帮我分析一下吧!!!!


  3. 2007-08-08,21:43:11

  5. System Repair Engineer 2.5.16.900
  6. Smallfrogs ([url]http://www.KZTechs.com[/url])

  8. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

  10. 以下内容被选中：
  11.     所有的启动项目（包括注册表、启动文件夹、服务等）
  12.     浏览器加载项
  13.     正在运行的进程（包括进程模块信息）
  14.     文件关联
  15.     Winsock 提供者
  16.     Autorun.inf
  17.     HOSTS 文件
  18.     进程特权扫描


  21. 启动项目
  22. 注册表
  23. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  24.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  25. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  26.     <load><>  [N/A]
  27. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  28.     <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
  29.     <360Safetray><D:\Program Files\360safe\safemon\360Tray.exe /start>  [奇虎网]
  30.     <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe">  [Kaspersky Lab]
  31.     <B0DA784025694A368B584B42C1DC9D56><D:\Program Files\Tencent\QQ\TenyQQ\TenyQQ.exe>  []
  32.     <iparmor><D:\Program Files\Iparmor\Iparmor.exe mini>  [N/A]
  33. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  34.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  35.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Component Publisher]
  36. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  37.     <AppInit_DLLs><APIHookDll.dll>  [N/A]
  38. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  39.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  40. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  41.     <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
  42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  43.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
  45.     <WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Windows Publisher]
  46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  47.     <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]
  48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  49.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  50. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  51.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  52. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  53.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  54. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  55.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  56. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  57.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
  58. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  59.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

  61. ==================================
  62. 启动文件夹
  63. [adsl]
  64.   <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\adsl.lnk -->  [N/A]><N>

  66. ==================================
  67. 服务
  68. [卡巴斯基互联网安全套装6.0个人版 / AVP][Running/Auto Start]
  69.   <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
  70. [Human Interface Device Access / HidServ][Stopped/Disabled]
  71.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  72. [NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  73.   <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
  74. [User Profile Hive Cleanup / UPHClean][Running/Auto Start]
  75.   <C:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>

  77. ==================================
  78. 驱动程序
  79. [Cardex / Cardex][Stopped/Manual Start]
  80.   <\??\C:\WINDOWS\system32\drivers\TBPANEL.SYS><Windows (R) 2000 DDK provider>
  81. [GMSIPCI / GMSIPCI][Stopped/Manual Start]
  82.   <\??\H:\INSTALL\GMSIPCI.SYS><N/A>
  83. [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  84.   <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
  85. [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  86.   <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
  87. [kl1 / kl1][Running/Boot Start]
  88.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  89. [klif / klif][Running/System Start]
  90.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  91. [nv / nv][Running/Manual Start]
  92.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  93. [nVidia WDM Video Capture (universal) / nvcap][Stopped/Auto Start]
  94.   <system32\DRIVERS\nvcap.sys><N/A>
  95. [nVidia WDM A/V Crossbar / NVXBAR][Stopped/Auto Start]
  96.   <system32\DRIVERS\NVxbar.sys><N/A>
  97. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  98.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  99. [Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  100.   <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
  101. [Secdrv / Secdrv][Stopped/Manual Start]
  102.   <system32\DRIVERS\secdrv.sys><N/A>
  103. [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  104.   <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

  106. ==================================
  107. 浏览器加载项
  108. [Thunder Browser Helper]
  109.   {00011267-E188-40DF-A514-835FCD78B1BF} <D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
  110. [IE7pro BHO]
  111.   {00011268-E188-40DF-A514-835FCD78B1BF} <C:\Program Files\IE7Pro\IE7Pro.dll, IE7Pro.com>
  112. [ThunderAtOnce Class]
  113.   {01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
  114. [NavigatMon Class]
  115.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\Program Files\360safe\safemon\safemon.dll, >
  116. [IE7pro ToolsExt]
  117.   {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} <C:\Program Files\IE7Pro\IE7Pro.dll, IE7Pro.com>
  118. [Web反病毒统计]
  119.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
  120. [WUWebControl Class]
  121.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
  122. [Thunder Browser Helper]
  123.   {00011267-E188-40DF-A514-835FCD78B1BF} <D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
  124. [IE7pro BHO]
  125.   {00011268-E188-40DF-A514-835FCD78B1BF} <C:\Program Files\IE7Pro\IE7Pro.dll, IE7Pro.com>
  126. [ThunderAtOnce Class]
  127.   {01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
  128. [Windows Genuine Advantage Validation Tool]
  129.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
  130. [Thunder Agent Class]
  131.   {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <D:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
  132. [WUWebControl Class]
  133.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
  134. [WangWangObj Class]
  135.   {6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\Alisoft\WangWang\WangWangX4.dll, 阿里软件（中国）有限公司>
  136. [360SafeLive]
  137.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\Program Files\360safe\live.dll, 360safe.com>
  138. [NavigatMon Class]
  139.   {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\Program Files\360safe\safemon\safemon.dll, >
  140. [Shockwave Flash Object]
  141.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
  142. [XML HTTP Request]
  143.   {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
  144. [XML DOM Document 3.0]
  145.   {F5078F32-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
  146. [XML HTTP 3.0]
  147.   {F5078F35-C551-11D3-89B9-0000F81FE221} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
  148. [使用迅雷下载]
  149.   <D:\Program Files\Thunder\Program\geturl.htm, N/A>
  150. [使用迅雷下载全部链接]
  151.   <D:\Program Files\Thunder\Program\getallurl.htm, N/A>
  152. [导出到 Microsoft Office Excel(&X)]
  153.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
  154. [添加到反广告黑名单]
  155.   <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm, N/A>

  157. ==================================
  158. 正在运行的进程
  159. [PID: 484 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  160. [PID: 548 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  161. [PID: 572 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  162.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
  163. [PID: 616 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  164. [PID: 628 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  165. [PID: 776 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  166. [PID: 820 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  167. [PID: 900 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  168.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.2.621]
  169. [PID: 1016 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  170. [PID: 1208 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  171. [PID: 1464 / xrb][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  172.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  173.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  174.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.2.621]
  175.     [D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 5, 13]
  176.     [D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.2.9]
  177. [PID: 1564 / xrb][D:\Program Files\360safe\safemon\360Tray.exe]  [奇虎网, 3, 5, 2, 1001]
  178.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  179.     [D:\Program Files\360safe\safemon\SafeKrnl.dll]  [奇虎网, 3, 5, 0, 1001]
  180.     [D:\Program Files\360safe\AntiAdwa.dll]  [360Safe.com, 3, 5, 1, 1001]
  181. [PID: 1616 / xrb][D:\Program Files\Tencent\QQ\TenyQQ\TenyQQ.exe]  [N/A, ]
  182. [PID: 1624 / xrb][D:\Program Files\Iparmor\Iparmor.exe]  [luosoft.com, 2007]
  183.     [D:\Program Files\Iparmor\getportlistxp.dll]  [, 1, 0, 0, 1]
  184.     [D:\Program Files\Iparmor\hookhookdll.dll]  [N/A, ]
  185.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  186. [PID: 1660 / xrb][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  187. [PID: 1952 / SYSTEM][C:\WINDOWS\system32\imapi.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  188. [PID: 1992 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.0102]
  189.     [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.0102]
  190. [PID: 2028 / SYSTEM][C:\Program Files\UPHClean\uphclean.exe]  [Microsoft Corporation, 1.6.30.0]
  191. [PID: 2096 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  192. [PID: 2792 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.374 (winmain(wmbla).070416-2057)]
  193. [PID: 1100 / xrb][E:\TDDOWNLOAD\Software\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
  194.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  195.     [E:\TDDOWNLOAD\Software\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
  196.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.2.621]
  197. [PID: 3888 / xrb][D:\Program Files\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 6, 1, 50]
  198.     [D:\Program Files\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
  199.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  200.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  201.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.2.621]
  202.     [D:\Program Files\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
  203.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
  204.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  205.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  206.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  207.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  208.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
  209.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
  210.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
  211.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
  212. [PID: 1668 / xrb][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 7.00.6000.16473 (vista_gdr.070420-1500)]
  213.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
  214.     [D:\Program Files\360safe\safemon\safemon.dll]  [, 3, 5, 3, 1001]
  215.     [D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 5, 13]
  216.     [C:\Program Files\IE7Pro\IE7Pro.dll]  [IE7Pro.com, 0, 9, 0, 18]
  217.     [D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.2.9]
  218.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.2.621]
  219.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
  220.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
  221.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
  222.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
  223.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
  224.     [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
  225.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
  226.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
  227.     [c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]

  229. ==================================
  230. 文件关联
  231. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  232. .EXE  OK. ["%1" %*]
  233. .COM  OK. ["%1" %*]
  234. .PIF  OK. ["%1" %*]
  235. .REG  OK. [regedit.exe "%1"]
  236. .BAT  OK. ["%1" %*]
  237. .SCR  OK. ["%1" /S]
  238. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  239. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  240. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  241. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  242. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  243. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  244. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  246. ==================================
  247. Winsock 提供者
  248. N/A

  250. ==================================
  251. Autorun.inf
  252. N/A

  254. ==================================
  255. HOSTS 文件
  256. 127.0.0.1       localhost

  258. ==================================
  259. 进程特权扫描
  260. 特殊特权被允许： SeDebugPrivilege [PID = 1564, D:\PROGRAM FILES\360SAFE\SAFEMON\360TRAY.EXE]
  261. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1624, D:\PROGRAM FILES\IPARMOR\IPARMOR.EXE]
  262. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1992, C:\WINDOWS\SYSTEM32\NVSVC32.EXE]
  263. 特殊特权被允许： SeLoadDriverPrivilege [PID = 3888, D:\PROGRAM FILES\MAXTHON\MAXTHON.EXE]

  265. ==================================
  266. API HOOK
  267. RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  268. RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  269. RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  270. RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
  271. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

  273. ==================================
  274. 隐藏进程
  275. N/A

  277. ==================================


复制代码
回复

举报

tsygs
 楼主| 发表于 2007-8-9 18:32:35 | 显示全部楼层
没高人吗????
回复

举报

ryan_213
发表于 2007-8-9 22:51:01 | 显示全部楼层
可能本人水平有限，用SRE分析助手反复查看你的日志，没有发现可疑项目，虽然有几个进程我不熟悉，可上百度上面查了查，不是病毒进程！

之前怀疑过API HOOK中的klif.sys，是卡巴的一个漏洞，攻击者由此可以侵入系统底层，利用这个漏洞以系统内核的权限执行任意代码。攻击者可能利用这个漏洞把病毒和木马的代码“合法”地变成操作系统的最基础的部分，从而顺利地完成攻击。但是网上的说明是，这一漏洞存在于卡巴5，Kaspersky升级到5.0.390以上就不会出现这个漏洞。而楼主的卡巴版本是Kaspersky Lab, 6.0.2.621，也不存在这个漏洞的问题。

百思不得其解！
回复

举报

tsygs
 楼主| 发表于 2007-8-10 11:15:56 | 显示全部楼层
问题解决了,我把所有的分区都给删了,重新分区格式化安装系统!!现在不会了.就是不知道中了什么毒!!!
回复

举报

ztxtaidt
发表于 2007-8-15 17:00:06 | 显示全部楼层
哈哈  楼主自己解决了啊   但到底是什么原因呢
回复

举报

我很臭屁
发表于 2007-8-16 15:51:00 | 显示全部楼层
我也见过类似的，不过是不动鼠标，而它会最近在屏幕上滑动！！
我好像也是没折了就把所有的格式掉了
要是再给我中招了，我可真的要试着去找原因了，不能屈服！！
回复

举报

gamies
发表于 2007-8-16 17:08:54 | 显示全部楼层
见过类似的，就是鼠标会不时被卡没法动，实际操作中好像是整个系统都暂时挂死了，也是找不到处理方法。。。
回复

举报

378719409
发表于 2007-8-16 17:17:34 | 显示全部楼层
奇怪拉！~纳闷
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-24 00:37 , Processed in 0.132766 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表