这是什么木马？怎么解决？

显示全部楼层 · 发表于 2007-9-4 13:17:55

明白了，LZ估计没有打上MS的补丁把
ANI漏洞网上很多，但是打上补丁后就不会中毒了

显示全部楼层 · 发表于 2007-9-4 13:19:57

装了AVG，杀了几十个，开机还是卡巴报警，
木马程序 Ttojan.Win32.Agent.ben...文件:C:\Program Files\NetMeeting\ravzxmon.dat
木马程序 Ttojan-PSW.Win32.OnLineGames.bgk...文件:C:\WINDOWS\system32\DiskMan32.dll
木马程序 Ttojan-Downloader.Win32.Agent.cse
文件:C:\ProgramFiles\NetMeeting\ravzxmon.dat

显示全部楼层 · 发表于 2007-9-4 13:28:32

请教斑斑，现在来说还有什么办法补救。。。

显示全部楼层 · 发表于 2007-9-4 13:56:29

你能把你中毒的那个页面PM给我么/？
我到虚拟机里试验一下，看看是那些东西

显示全部楼层 · 发表于 2007-9-4 13:57:25

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background>  [(Verified)Microsoft Corporation]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<AVP><"D:\Kaspersky\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log>  [Microsoft Corporation]
<Microsoft Pinyin IME Migration><C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL>  [(Verified)Microsoft Corporation]
<GrooveMonitor><"D:\soft\office 2007\Office12\GrooveMonitor.exe">  [(Verified)Microsoft Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
<RegNetPass><C:\WINDOWS\system32\regcsp.exe>  []
<gemstrmw><C:\WINDOWS\system32\gemstrmw.exe /r>  [Gemplus]
<WinForm><C:\WINDOWS\WinForm.exe>  []
<ravgjmon><C:\Program Files\NetMeeting\ravgjmon.exe>  []
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe>  []
<ravwlmon><C:\Program Files\NetMeeting\ravwlmon.exe>  []
<NVDispDrv><C:\WINDOWS\rucmjq.exe>  []
<!AVG Anti-Spyware><"F:\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [(Verified)GRISOFT LTD]
<ravqjmon><C:\Program Files\NetMeeting\ravqjmon.exe>  []
<ravztmon><C:\Program Files\NetMeeting\ravztmon.exe>  []
<ravzxmon><C:\Program Files\NetMeeting\ravzxmon.exe>  []
<DiskMan32><C:\WINDOWS\DiskMan32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{B5A7F190-DDA6-4420-B3BA-52453494E6CD}><D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL>  [(Verified)Microsoft Corporation]
<{ACADABAF-0000-0010-8000-10AA006D2EA4}><C:\WINDOWS\system32\system.dat>  []
<{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys>  []
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><F:\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [N/A]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [N/A]
<SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
==================================
启动文件夹
[EPSON Online Register]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\EPSON Online Register.lnk --> C:\PROGRA~1\EPSON\ONLINE~1\ONLINE~1.EXE []><N>
==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <F:\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[卡巴斯基反病毒6.0个人版 / AVP][Running/Auto Start]
  <"D:\Kaspersky\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[EPSON Printer Status Agent2 / EPSONStatusAgent2][Running/Auto Start]
  <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start]
  <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><>
==================================
驱动程序
[a320raid / a320raid][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>
[AAC / AAC][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AAC.SYS><Adaptec, Inc.>
[aar1210 / aar1210][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aar1210.sys><Adaptec, Inc.>
[abp480n5 / abp480n5][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\abp480n5.sys><Microsoft Corporation>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[adpu160m / adpu160m][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[adpu320 / adpu320][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[ACARD AEC6210UF UltraDMA33 Controller / aec6210][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>
[ACARD AEC6260 UltraDMA-66 Controller / aec6260][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>
[aec6280 / aec6280][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>
[AEC6290 / AEC6290][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6290.SYS><ACARD Technology Corp.>
[AEC67160 / AEC67160][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC67160.SYS><ACARD Technology Corp.>
[AEC671X / AEC671X][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC671X.SYS><ACARD Technology Corp.>
[AEC6880 / AEC6880][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6880.SYS><ACARD Technology Corp.>
[AEC6890 / AEC6890][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6890.sys><ACARD Technology Corp.>
[aec68x5 / aec68x5][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>
[Aha154x / Aha154x][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aic78xx.sys><Microsoft Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  <System32\DRIVERS\amdk8.sys><Microsoft Corporation>
[arc / arc][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>
[asc / asc][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\asc.sys><Advanced System Products, Inc.>
[asc3550 / asc3550][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\F:\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[CmdIde / CmdIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[dac2w2k / dac2w2k][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[dpti2o / dpti2o][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\dpti2o.sys><Microsoft Corporation>
[elxstor / elxstor][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\elxstor.sys><Emulex>
[FASTSX / FASTSX][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\FASTSX.SYS><Promise Technology, Inc.>
[fasttrak / fasttrak][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\fasttrak.sys><Promise Technology, Inc.>
[fasttx2k / fasttx2k][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\fasttx2k.sys><Promise Technology, Inc.>
[fasttx2k2 / fasttx2k2][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\fasttx2k2.sys><Promise Technology, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HpCISSs / HpCISSs][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\hpcisss.sys><Hewlett-Packard Company>
[Hpt366 / Hpt366][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\Hpt366.sys><Microsoft Corporation>
[HPT371 / HPT371][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\HPT371.sys><HighPoint Technologies, Inc.>
[hpt374 / hpt374][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\hpt374.sys><HighPoint Technologies, Inc.>
[hpt3xx / hpt3xx][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\hpt3xx.sys><HighPoint Technologies, Inc.>
[hptmv / hptmv][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\hptmv.sys><HighPoint Technologies, Inc.>
[hptpro / hptpro][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>
[Intel Integrated RAID / iaStor][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\iaStor.sys><Intel Corporation>
[iirsp / iirsp][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
[ini910u / ini910u][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ini910u.sys><Microsoft Corporation>
[ITERAID_Service_Install / iteraid][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\iteraid.sys><Integrated Technology Express, Inc.>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[LSI_SAS / LSI_SAS][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\lsi_sas.sys><LSI Logic>
[LSI_SCSI / LSI_SCSI][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Logic>
[m5228 / m5228][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\m5228.sys><ALi Corporation.>
[m5281 / m5281][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\m5281.sys><ALi Corporation>
[MegaIDE / MegaIDE][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[megasas / megasas][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\megasas.sys><LSI Logic Corporation>
[mraid2k / mraid2k][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\mraid2k.sys><American Megatrends, Inc.>
[mraid35x / mraid35x][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\mraid35x.sys><American Megatrends Inc.>
[nfrd960 / nfrd960][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\nfrd960.sys><IBM Corporation>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\C:\Program Files\QQ2005\npkcrypt.sys><N/A>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Intel SCSI Controller / NvAtaBus][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\NVATABUS.SYS><NVIDIA Corporation>
[NVIDIA nForce(tm) RAID Class Driver / nvraid][Stopped/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvraid.sys><NVIDIA Corporation>
[PNP649R / PNP649R][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\PNP649R.SYS><CMD Technology, Inc.>
[SiI 680 ATA Controller / Pnp680][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\pnp680.sys><Silicon Image, Inc.>
[Silicon Image SiI 0680 Medley Raid Controller / Pnp680r][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\pnp680r.sys><Silicon Image, Inc>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[ql1080 / ql1080][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql1080.sys><QLogic Corporation>
[Ql10wnt / Ql10wnt][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql10wnt.sys><Microsoft Corporation>
[ql12160 / ql12160][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql12160.sys><QLogic Corporation>
[ql1280 / ql1280][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ql1280.sys><QLogic Corporation>
[QLogic Fibre Channel SCSI Miniport Driver / ql2300][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\ql2300.sys><QLogic Corporation>
[RAIDSRC / RAIDSRC][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\RAIDSRC.SYS><Intel/ICP>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[S150SX8 / S150SX8][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\S150SX8.SYS><Promise Technology, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SiI-3512 SATALink Controller / SI3112][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SI3112.sys><Silicon Image, Inc.>
[Silicon Image SiI 3512 SATARaid Controller / SI3112r][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\SI3112r.sys><Silicon Image, Inc>
[SiI-3114 SATALink Controller / SI3114][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SI3114.sys><Silicon Image, Inc.>
[SiI-3114 SATARaid Controller / SI3114r][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SI3114R.sys><Silicon Image, Inc>
[SiI-3124 SATALink Controller / SI3124][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SI3124.sys><Silicon Image, Inc.>
[SiI-3124 SATARaid Controller / SI3124r][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SI3124R.sys><Silicon Image, Inc>
[SATALink driver accelerator / SiFilter][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SiWinAcc.sys><Silicon Image, Inc.>
[SiS315 / SiS315][Running/Manual Start]
  <system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation>
[SISIDE / SISIDE][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\SISIDE.SYS><Silicon Integrated Systems Corp.>
[SiSkp / SiSkp][Running/System Start]
  <system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation>
[SiSRaid / SiSRaid][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\SiSRaid.sys><Silicon Integrated Systems>
[SiSRaid1 / SiSRaid1][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SiSRaid1.sys><Silicon Integrated Systems>
[SISRAIDS / SISRAIDS][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SISRAIDS.SYS><Silicon Integrated Systems Corp>
[SNIFFER Protocol Driver / Sniffer][Running/Auto Start]
  <system32\DRIVERS\sniffer.sys><N/A>
[Sparrow / Sparrow][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\sparrow.sys><Adaptec, Inc.>
[sptrak / sptrak][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\sptrak.sys><Promise Technology, Inc.>
[symc810 / symc810][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\symc810.sys><Symbios Logic Inc.>
[symc8xx / symc8xx][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\symc8xx.sys><LSI Logic>
[SYMMPI / SYMMPI][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\SYMMPI.SYS><LSI Logic>
[sym_hi / sym_hi][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\sym_hi.sys><LSI Logic>
[sym_u3 / sym_u3][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\sym_u3.sys><LSI Logic>
[TosIde / TosIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\toside.sys><Microsoft Corporation>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[UlSata / UlSata][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ulsata.sys><Promise Technology, Inc.>
[ULSATAS / ULSATAS][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ULSATAS.SYS><Promise Technology, Inc.>
[ultra / ultra][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\ultra.sys><Promise Technology, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaide.sys><Microsoft Corporation>
[viamraid / viamraid][Stopped/Boot Start]
  <\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[VIA ATA/ATAPI Host Controller / viapdsk][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\viapdsk.sys><VIA Technologies, Inc.>
[viaraid / viaraid][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaraid.sys><VIA Technologies inc,.ltd>
[viasraid / viasraid][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\viasraid.sys><VIA Technologies inc,.ltd>
[vmscsi / vmscsi][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\vmscsi.sys><VMware, Inc.>
==================================
浏览器加载项
[Groove GFS Browser Helper]
  {72853161-30C5-4D22-B7F9-0BBC1D38A37E} <D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL, Microsoft Corporation>
[Windows Live Sign-in Helper]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[NTIECatcher Class]
  {C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi>
[Web反病毒统计]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Kaspersky\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[Send to OneNote from Internet Explorer button]
  {2670000A-7350-4f3c-8081-5663EE0C6C49} <D:\soft\OFFICE~1\Office12\ONBttnIE.dll, Microsoft Corporation>
[微软]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.microsoft.com/china/index.htm, N/A>

显示全部楼层 · 发表于 2007-9-4 13:59:26

[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\soft\OFFICE~1\Office12\REFIEBAR.DLL, Microsoft Corporation>
[Groove GFS Browser Helper]
  {72853161-30C5-4D22-B7F9-0BBC1D38A37E} <D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Windows Live Sign-in Helper]
  {9030D464-4C02-4ABF-8ECC-5164760863C6} <C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll, Microsoft Corporation>
[NTIECatcher Class]
  {C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll, Xi>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[&使用BitComet下载]
  <res://D:\soft\BitComet_0.91_PConline\BitComet_Win9x.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
  <res://D:\soft\BitComet_0.91_PConline\BitComet_Win9x.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
  <res://D:\soft\BitComet_0.91_PConline\BitComet_Win9x.exe/AddVideo.htm, N/A>
[使用影音传送带下载]
  <C:\Program Files\Xi\NetTransport 2\NTAddLink.html, N/A>
[使用影音传送带下载全部链接]
  <C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A>
[导出到 Microsoft Excel(&X)]
  <res://D:\soft\OFFICE~1\Office12\EXCEL.EXE/3000, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
  <C:\Program Files\QQ2005\AddEmotion.htm, N/A>

==================================
正在运行的进程
[PID: 408 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 476 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 544 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 752 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[PID: 856 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[C:\olite\bin\oci.dll]  [Oracle Corporation, 8.0.5.0.1]
[C:\olite\bin\ORA805.dll]  [Oracle Corporation, 8.0.5.0.0]
[C:\olite\bin\CORE40.dll]  [Oracle Corporation, 4.0.5.0.0]
[C:\olite\bin\NLSRTL33.dll]  [Oracle Corporation, 3.3.2.0.0]
[C:\olite\bin\NL80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\OTRACE80.dll]  [Oracle Corporation, 8.0.4.0.0]
[C:\olite\bin\NS80.dll]  [Oracle Corporation, 8.0.4.0.2 Production]
[C:\olite\bin\nasns80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\nz80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NNFG80.dll]  [Oracle Corporation, 8.0.4.0.1 Production]
[C:\olite\bin\NNCI80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NNG80.dll]  [Oracle Corporation, 8.0.4.0.2 Production]
[C:\olite\bin\NMP80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NPL80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NR80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NT80.dll]  [Oracle Corporation, 8.0.4.0.1 Production]
[C:\olite\bin\NCR80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NMS80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NNFD80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NNFN80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\NI80.dll]  [Oracle Corporation, 8.0.4.0.0 Production]
[C:\olite\bin\PLS805.dll]  [Oracle Corporation, 8.0.5.0.0]
[C:\olite\bin\NDWSI80.DLL]  [N/A, ]
[C:\olite\bin\SQLLib80.dll]  [Oracle Corporation, 8.0.5.0.0]
[C:\olite\bin\xa80.dll]  [Oracle Corporation, 8.0.5.0.0]
[C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 952 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1056 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1160 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\EBPMON2.DLL]  [SEIKO EPSON CORPORATION, 2, 39, 0, 0]
[C:\WINDOWS\system32\msonpmon.dll]  [Microsoft Corporation, 12.3.4518.1014]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\msonpppr.dll]  [Microsoft Corporation, 12.3.4518.1014]
[PID: 1208 / LOCAL SERVICE][C:\WINDOWS\System32\SCardSvr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1336 / SYSTEM][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe]  [SEIKO EPSON CORPORATION, 2, 3, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL]  [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL]  [SEIKO EPSON CORPORATION, 2, 26, 0, 0]
[PID: 1424 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1468 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 332 / new][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveUtil.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveNew.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\soft\OFFICE~1\Office12\GR99D3~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\WINDOWS\system32\system.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[D:\soft\OFFICE~1\Office12\GR326C~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\office 2007\Office12\1033\GrooveIntlResource.dll]  [Microsoft Corporation, 12.0.4518.1014]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravzxmon.dat]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[F:\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll]  [Xi, 1.91.12]
[D:\soft\office 2007\Office12\msohevi.dll]  [Microsoft Corporation, 12.0.4518.1014]
[PID: 464 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[PID: 1240 / new][D:\soft\office 2007\Office12\GrooveMonitor.exe]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\office 2007\Office12\GrooveUtil.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\office 2007\Office12\GrooveNew.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\office 2007\Office12\USP10.dll]  [Microsoft Corporation, 1.0626.5756.0 (vista_rtm.061008-1400)]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GR99D3~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 1404 / new][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 2700 / new][F:\AVG Anti-Spyware 7.5\avgas.exe]  [GRISOFT s.r.o., 7, 5, 1, 43]
[F:\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveUtil.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveNew.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 2940 / new][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 3336 / new][C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe]  [Microsoft Corporation, 8.5.1235.0517]
[C:\Program Files\Windows Live\Messenger\MSNCore.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\Program Files\Windows Live\Messenger\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
[C:\Program Files\Windows Live\Messenger\ContactsUX.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\Program Files\Windows Live\Messenger\msgslang.8.5.1235.0517.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\Program Files\Windows Live\Messenger\msgsres.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\Program Files\Windows Live\Messenger\custsat.dll]  [Microsoft Corporation, 9.0.3790.2428 (srv03_sp1_qfe.050422-1043)]
[C:\WINDOWS\system32\NpOpenStore.dll]  [N/A, ]
[C:\WINDOWS\system32\NPCard.dll]  [N/A, ]
[C:\WINDOWS\system32\RsaFun.dll]  [N/A, ]
[C:\WINDOWS\system32\GPKPCSC.dll]  [N/A, ]
[C:\Program Files\Windows Live\Messenger\MSGSWCAM.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\WINDOWS\system32\sirenacm.dll]  [Microsoft Corporation, 8.5.1235.0517]
[C:\WINDOWS\system32\msdmo.dll]  [, ]
[C:\Program Files\NetMeeting\ravzxmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 3376 / new][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[PID: 4032 / new][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[C:\Program Files\NetMeeting\ravzxmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[C:\WINDOWS\system32\mucltui.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

显示全部楼层 · 发表于 2007-9-4 14:00:20

[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 1924 / new][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\NetMeeting\ravzxmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\scrchpg.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\soft\OFFICE~1\Office12\GRA8E1~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveUtil.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GrooveNew.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\office 2007\Office12\1033\GrooveIntlResource.dll]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GR99D3~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[D:\soft\OFFICE~1\Office12\GR326C~1.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll]  [Microsoft Corporation, 4.100.313.1]
[C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll]  [Xi, 1.91.12]
[C:\Program Files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
[C:\WINDOWS\system32\NpOpenStore.dll]  [N/A, ]
[C:\WINDOWS\system32\NPCard.dll]  [N/A, ]
[C:\WINDOWS\system32\RsaFun.dll]  [N/A, ]
[C:\WINDOWS\system32\GPKPCSC.dll]  [N/A, ]
[D:\soft\office 2007\Office12\msohevi.dll]  [Microsoft Corporation, 12.0.4518.1014]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\prremote.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.2.621]
[D:\Kaspersky\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\basegui.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\thpimpl.ppl]  [Kaspersky Lab, 6.0.2.621]
[d:\kaspersky\kaspersky anti-virus 6.0\FSSync.dll]  [Kaspersky Lab, 6.0.5.621]
[d:\kaspersky\kaspersky anti-virus 6.0\winreg.ppl]  [Kaspersky Lab, 6.0.2.621]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCTIP.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\SHARED\IMETIP.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\SHARED\IMECFM.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCCORE.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCCFG.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\SHARED\IMELM.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\PROGRA~1\COMMON~1\MICROS~1\IME12\SHARED\MSCAND20.DLL]  [Microsoft Corporation, 12.0.4518.1014]
[C:\WINDOWS\system32\xpsp3res.dll]  [Microsoft Corporation, 5.1.2600.3121 (xpsp_sp2_gdr.070418-0032)]
[PID: 2112 / new][C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe]  [Microsoft Corporation, 4.100.313.1]
[C:\Program Files\NetMeeting\ravzxmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
[C:\WINDOWS\system32\NpOpenStore.dll]  [N/A, ]
[C:\WINDOWS\system32\NPCard.dll]  [N/A, ]
[C:\WINDOWS\system32\RsaFun.dll]  [N/A, ]
[C:\WINDOWS\system32\GPKPCSC.dll]  [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[PID: 1976 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
[PID: 728 / new][F:\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[C:\Program Files\NetMeeting\ravwlmon.dat]  [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
[C:\WINDOWS\system32\WinForm.dll]  [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll]  [N/A, ]
[F:\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\system32\mscomm.dll]  [N/A, ]
[C:\WINDOWS\system32\NpOpenStore.dll]  [N/A, ]
[C:\WINDOWS\system32\NPCard.dll]  [N/A, ]
[C:\WINDOWS\system32\RsaFun.dll]  [N/A, ]
[C:\WINDOWS\system32\GPKPCSC.dll]  [N/A, ]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAPI Tcpip [TCP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
C:\WINDOWS\system32\mscomm.dll(, N/A)

==================================
Autorun.inf
[E:\]
[AutoRun]
open=AutoRun.exe
shellexecute=AutoRun.exe
shell\打开(&O)\command=AutoRun.exe

==================================
HOSTS 文件
127.0.0.1    localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1404, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: \??\C:\WINDOWS\system32\drivers\klif.sys)

==================================
隐藏进程
N/A

==================================

[/CODE]

显示全部楼层 · 发表于 2007-9-4 14:04:02

phxvbom.exe病毒和acvspdk.exe病毒是比较顽固的一种病毒。本人花了很长时间手动删除干净。现在介绍下病毒特点：在所有磁盘根目录下生成tvtptwk.exe和autorun.ini病毒。不管你是双击磁盘还是选择右键打开磁盘都触发病毒发作，PE系统光盘下也删除不了，自动关闭所有与病毒有关的信息程序和窗口，自动关闭进程管理器，屏闭杀毒软件。F8安全模式下蓝屏。反正只要是与病毒体有关的信息都会自动关闭。
现在说下杀毒的经验，，用XDelBox1.3工具进行查杀。使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。
在XDelBox1.3列表中删除
c:\program files\common files\system\acvspdk.exe
c:\program files\common files\microsoft shared\acvspdk.exe
c:\program files\common files\microsoft shared\phxvbom.exe
c:\windows\system32\winforma5.exe
c:\windows\system32\winforma5.dll
c:\windows\mppds.exe
d:\tptvtwk.exe
d:\autorun.inf
e:\tptvtwk.exe
e:\autorun.inf
c:\windows\system32\wlfins.exe
c:\windows\system32\xyiins.exe
c:\windows\system32\dhdins.exe
c:\windows\system32\winforma5.dll
c:\progra~1\3721\helper.dll
c:\program files\common files\microsoft shared\msinfo\syswfgqq2.dll
c:\windows\system32\dhdpri.dll
c:\windows\system32\wlfpri.dll
c:\windows\system32\xyipri.dll
c:\windows\downlo~1\cnsmin.dll
c:\progra~1\3721\alliveex.dll
c:\progra~1\3721\autolive.dll
c:\progra~1\3721\notifier.dll
c:\windows\system32\winforma5.exe
c:\progra~1\3721\alrex.dll
c:\windows\downlo~1\cnshint.dll
c:\windows\system32\mssql.dll
c:\program files\internet explorer\ravgjmon.dat
c:\windows\system32\msdmo.dll
c:\progra~1\yahoo!\assist~1\assist\yasbar.dll
c:\windows\downlo~1\cnshook.dll
c:\windows\downlo~1\cnsio.dll
c:\windows\downlo~1\cnsminio.dll
c:\windows\system32\windhcp.ocx
c:\windows\system32\winforma5.dll
c:\windows\mppds.exe
c:\program files\internet explorer\ravzxmon.exe
c:\program files\internet explorer\ravgjmon.exe
c:\program files\internet explorer\ravqqhxmon.exe
c:\windows\fonts\ravmhmon.exe
c:\windows\msimms32.exe
c:\program files\internet explorer\ravdhmon.exe
c:\program files\internet explorer\ravztmon.exe
c:\program files\common files\system\acvspdk.exe
c:\progra~1\3721\helper.dll
c:\windows\downlo~1\cnsmin.dll
c:\windows\system32\wmiapisrv.dll
c:\windows\system32\windhcp.ocx
c:\windows\system32\wudfsvc.dll
c:\windows\system32\drivers\qjpfng.sys
c:\WINDOWS\system32\mssql.dll
在注册表里删除所有和acvspdk.exe phxvbom.exe tptvtwk.exe相关的信息，然后用unlock工具把C:\WINDOWS\system32\drivers\klif.sys删掉删除重启后使用SREng 启动项目－－注册表之如下项删除：
[{42311A42-AC1B-158F-FD32-5674345F23A4}]
[{3182C1EB-375C-573D-1F5E-234552345213}]
[{A13AF41A-21B1-131B-1BFC-D2A90DF4A2BA}]
[{A12BC423-3713-224D-3F55-32B35C62B11A}]
[{91B1E846-2BEF-4345-8848-7699C7C9935F}]
[color=red]注意该项[AppInit_DLLs]修改直接把删除
[mppds]
[RAVZXMON]
[RAVGJMON]
[RAVQQHXMON]
[RAVMHMON]
[MsIMMs32]
[RAVDHMON]
[RAVZTMON]
[tptvtwk]
[rxwpgwc]
[helper.dll]
[CnsMin]
[{D157330A-9EF3-49F8-9A67-4141AC41ADD4}]
启动项目－－服务－－ Win32服务应用程序之如下项删除：
[WMI Performance API / WMIApiSrv]
[Windows DHCP Service / WinDHCPsvc]
[Windows Driver Foundation - User-mode Driver Framework / WudfSvc] %SystemRoot%\System32\WUDFSvc.dll>
启动项目－－服务－－驱动程序之如下项删除：
[qjpfng / qjpfng] <\SystemRoot\\SystemRoot\System32\drivers\qjpfng.sys>
那么还有个mxman.dll在注册表里会反复自动生成，名字会随即改变，也就7八个名字，把所有名字找出来用xDeBox1.3删除，删除C:\Program Files\Common Files\Microsoft Shared\phxvbom.exe文件夹（注意是phxvbom.exe文件夹）差不多就搞定了启动项目－－服务－－ Win32服务应用程序里把杀毒软件的服务重新设置为自动就不用重装杀毒软件了。

复制代码

显示全部楼层 · 发表于 2007-9-4 14:12:03

清理以下的启动选项

[]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RegNetPass><C:\WINDOWS\system32\regcsp.exe> []
<gemstrmw><C:\WINDOWS\system32\gemstrmw.exe /r> [Gemplus]
<WinForm><C:\WINDOWS\WinForm.exe> []
<ravgjmon><C:\Program Files\NetMeeting\ravgjmon.exe> []
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe> []
<ravwlmon><C:\Program Files\NetMeeting\ravwlmon.exe> []
<NVDispDrv><C:\WINDOWS\rucmjq.exe> []
<ravqjmon><C:\Program Files\NetMeeting\ravqjmon.exe> []
<ravztmon><C:\Program Files\NetMeeting\ravztmon.exe> []
<ravzxmon><C:\Program Files\NetMeeting\ravzxmon.exe> []
<DiskMan32><C:\WINDOWS\DiskMan32.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{ACADABAF-0000-0010-8000-10AA006D2EA4}> []

复制代码

备份后删除下列文件

[C:\Program Files\NetMeeting\ravwlmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\system32\WinForm.dll] [N/A, ]
[C:\WINDOWS\system32\NVDispDrv.dll] [N/A, ]
[C:\WINDOWS\system32\DiskMan32.dll] [N/A, ]
[C:\Program Files\NetMeeting\ravzxmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravztmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravqjmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravwlmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravmsmon.dat] [N/A, ]
[C:\Program Files\NetMeeting\ravgjmon.dat] [N/A, ]

复制代码

[ 本帖最后由 ALEXBLAIR 于 2007-9-4 14:13 编辑 ]

[已解决] 这是什么木马？怎么解决？

其中一个木马的手工杀毒方式（还有待续……）

继续，木马僵尸清理（未完待续……）

浏览过的版块