高手进,系统有问题2.

zmhuaxia

开机后,音频和本地连接.在任务拦中都没显示
但是我只要从控制面版中的音频打上钩即可出现音频和本地.本地连接已经打上钩,但是不显示
再开机后,还是不显示.要重新在打上钩

不知道什么问题.系统是否有毒或可疑.给予说明,谢谢


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <AVP><"D:\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe">  [(Verified)Kaspersky Lab]
    <KuGoo3><D:\KUGOO2~1\KUGOO.EXE>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
==================================
驱动程序
[AliIde / AliIde][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[KLIF / KLIF][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
  <system32\DRIVERS\klim5.sys><Kaspersky Lab>
[npkcrypt / npkcrypt][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\npkcrypt.sys><N/A>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\npkycryp.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  <system32\drivers\viaudios.sys><VIA Technologies, Inc.>
==================================
浏览器加载项
[ThunderAtOnce Class]
  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[ThunderAtOnce Class]
  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <F:\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Agent Class]
  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
  <F:\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <F:\Thunder\Program\getallurl.htm, N/A>
[添加到QQ表情]
  <E:\abcd\AddEmotion.htm, N/A>
[添加到反广告横幅]
  <D:\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm, N/A>

zmhuaxia

==================================
正在运行的进程
[PID: 696 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 800 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 844 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 856 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1076 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1212 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1280 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1512 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 204 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 736 / zbtckj][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx]  [Adobe Systems, Inc., 9,0,47,0]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [D:\KUGOO2~1\msdmo.dll]  [Microsoft Corporation, 6.03.01.0400]
    [D:\KuGoo2007\wmadmod.dll]  [Microsoft Corporation, 10.00.00.3646]
[PID: 1128 / zbtckj][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3544 / zbtckj][E:\abcd\tm\TMDlls\TM.exe]  [腾讯公司, 0, 0, 0, 0]
    [E:\abcd\tm\TMDlls\BasicCtrlDll.dll]  [Tencent, 6, 0, 200, 320]
    [E:\abcd\tm\TMDlls\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [E:\abcd\tm\TMDlls\QQHelperDll.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\BaseUIClass.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\BaseCtrlClass.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQBaseClassInDll.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\gdiplus.dll]  [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\abcd\tm\TMDlls\QQZip.dll]  [tencent, 0, 3, 2, 4]
    [E:\abcd\tm\TMDlls\ImageOle.dll]  [TODO: <Company name>, 1.0.0.1]
    [E:\abcd\tm\TMDlls\RICHED20.DLL]  [Microsoft Corporation, 5.31.23.1218]
    [E:\abcd\tm\TMDlls\RICHED32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [E:\abcd\tm\TMDlls\QQAPI.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [E:\abcd\tm\TMDlls\CQQApplication.dll]  [N/A, ]
    [E:\abcd\tm\TMDlls\QQRes.dll]  [N/A, ]
    [E:\abcd\tm\TMDlls\LoginCtrl.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\HostingMgr.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\WizardCtrl.dll]  [Tencent, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQMainFrame.dll]  [TENCENT, 1, 0, 0, 1]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
    [E:\abcd\tm\TMDlls\NewSkin.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\MailSummary.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\FrameBar.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQConfigPlugin.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\CameraDll.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\UserRelationWeight.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\vbscript.dll]  [Microsoft Corporation, 5.6.0.7426]
    [E:\abcd\tm\TMDlls\CommercesMng.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\LongConnection.dll]  [tencent, 5, 0, 200, 160]
    [E:\abcd\tm\TMDlls\InstantSession.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\CustomFace.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQGroupMng.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\GroupConnection.dll]  [Tencent, 0, 3, 3, 5]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\msadp32.acm]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\abcd\tm\TMDlls\MiscCtrl.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQSpace.dll]  [, 1, 0, 0, 1]
    [E:\abcd\tm\TMDlls\QQAddr.dll]  [深圳市腾讯计算机系统有限公司, 0, 3, 0, 44]
    [E:\abcd\tm\TMDlls\QQMMSender.dll]  [N/A, ]
    [E:\abcd\tm\TMDlls\QQPlugin.dll]  [N/A, ]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [E:\abcd\tm\TMDlls\UserFinger.dll]  [, 1, 0, 0, 1]
[PID: 3616 / zbtckj][E:\abcd\tm\TMDlls\TIMPlatform.exe]  [tencent, 0, 3, 1, 8]
    [E:\abcd\tm\TMDlls\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
[PID: 4072 / zbtckj][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.125]
    [F:\Thunder\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.2.9]
    [F:\Thunder\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 3, 11]
    [F:\Thunder\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 4]
    [F:\Thunder\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\klscav.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCR80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\MSVCP80.dll]  [Microsoft Corporation, 8.00.50727.42]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.0.125]
    [D:\Kaspersky Lab\Kaspersky Internet Security 7.0\prkernel.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\params.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\pxstub.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\tempfile.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\nfio.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\fsdrvplg.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\basegui.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\thpimpl.ppl]  [Kaspersky Lab, 7.0.0.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\FSSync.dll]  [Kaspersky Lab, 7.0.5.125]
    [d:\kaspersky lab\kaspersky internet security 7.0\winreg.ppl]  [Kaspersky Lab, 7.0.0.125]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1120, D:\KUGOO2~1\KUGOO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3544, E:\ABCD\TM\TMDLLS\TM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3616, E:\ABCD\TM\TMDLLS\TIMPLATFORM.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

zmhuaxia

错误应该如何处理啊?
可疑的怎么办

xffsfy

开机登陆后再注销一遍试试

zmhuaxia

ding shang