[求助]请问有没有人遇到过这种情况，杀不干净啊！！

显示全部楼层 · 发表于 2007-9-27 13:19:34

这是我用icesword导出的进程列表：

System Idle Process
System
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program\IceSword122en\IceSword122en\IceSword.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\System32\csrss.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Program\firefox\firefox.exe
D:\Program\Kaspersky\Kaspersky\kav.exe
D:\Program\Kaspersky\Kaspersky\kavsvc.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\System32\wscntfy.exe

显示全部楼层 · 发表于 2007-9-27 13:25:16

都是正常的进程啊。。。你想说什么

显示全部楼层 · 发表于 2007-9-27 13:27:04

扫个SREng日志上来~

显示全部楼层 · 发表于 2007-9-27 13:29:11

症状在于，iexplore这个进程怎么结束都结束不了（我没开IE）

在安全模式下杀毒，第一次查杀干净了，重启，再进安全模式，再也查不到了
ok，进正常模式，刚看到桌面，无故重启
此时如果再进正常模式，则卡巴查找到病毒；如果进安全模式，则如前所叙
如此循环

还有，我用icesword不能结束任何进程，一结束icesword就死

困扰我好多天了，杀不干净啊！

[ 本帖最后由 LandyVanRoy 于 2007-9-27 13:32 编辑 ]

显示全部楼层 · 发表于 2007-9-27 13:39:40

[CODE]

2007-09-27,13:39:05

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
<msnmsgr><"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>  [N/A]
<run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
<Windows木马防火墙><D:\Program\troyKiller\Trojanwall.exe>  [风云谷]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<CPushSetup><"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\CPUSH\cpush.dll">  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<Aqua Dock><c:\program files\aqua dock\xjos32.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Apache2 / Apache2][Stopped/Auto Start]
  <"D:\Program\apache\Apache2\bin\Apache.exe" -k runservice><Apache Software Foundation>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Running/Auto Start]
  <d:\Program\Kaspersky\Kaspersky\kavsvc.exe><Kaspersky Lab>
[MySQL / MySQL][Stopped/Auto Start]
  <"D:\Program\MySQL\bin\mysqld-nt" --defaults-file="D:\Program\MySQL\my.ini" MySQL><N/A>
[Pml Driver HPZ12 / Pml Driver HPZ12][Stopped/Auto Start]
  <C:\WINDOWS\system32\HPZipm12.exe><HP>
[postgre / postgre][Stopped/Auto Start]
  <d:/program/postgre/bin/pg_ctl.exe runservice -N "postgre" -D "d:/program/postgre/data"><PostgreSQL Global Development Group>
[System Event loader / sysloader][Stopped/Auto Start]
  <"C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe"><Microsoft>
[Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start]
  <D:\Program\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation>
[Windows Live Setup Service / WLSetupSvc][Stopped/Manual Start]
  <"C:\Program Files\Windows Live\installer\WLSetupSvc.exe"><>

==================================
驱动程序
[AFW / AFW][Stopped/System Start]
  <2 - 系统找不到指定的文件。
><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/Disabled]
  <\??\d:\Program\avg\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/Disabled]
  <System32\DRIVERS\AvgAsCln.sys><N/A>
[Belcarra USBLAN / Belcarra USBLAN][Stopped/Manual Start]
  <system32\DRIVERS\btblan.sys><Belcarra Technologies>
[bootdrv / bootdrv][Running/Boot Start]
  <\SystemRoot\System32\Drivers\bootdrv.sys><>
[HPMobileDisk / HPMobileDisk][Running/Auto Start]
  <\??\C:\WINDOWS\system32\Drivers\hpmobiledisk.sys><HP>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Klif / Klif][Running/System Start]
  <System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
  <System32\drivers\klmc.sys><Kaspersky Lab>
[knny / knny2][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\knny2.sys><N/A>
[mmd8s3h / mmd8s3h7][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\mmd8s3h7.sys><N/A>
[mxdispdr / mxdispdr][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\mxdispdr.sys><N/A>
[Motorola USB Device / P2k][Stopped/Manual Start]
  <system32\DRIVERS\P2k.sys><Motorola Inc>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>

显示全部楼层 · 发表于 2007-9-27 13:40:05

==================================
浏览器加载项
[Thunder Browser Helper]
  {0005A87C-D626-4B3A-84F9-1D9571695F55} <D:\Program\thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
[CAdLogic Object]
  {11F09AFD-75AD-4E51-AB43-E09E9351CE16} <, N/A>
[AddTask Class]
  {24F06550-65E3-4D1C-8CFE-839C296B5530} <D:\Program\EReader\eREAD6.0\IEeREAD.dll, >
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[腾讯QQ]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <, N/A>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[browser Class]
  {C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\Office\USERDATA\3gX1CFUe52.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_02]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\Program\thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[联想]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[金山词霸]
  {9A687CA6-D585-4947-9ED9-BE96071F5CD9} <, N/A>
[易趣购物]
  {EE60714F-AC17-427e-861A-FD60CBDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=824, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Kwyshell MidpX]
  {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} <d:\Program\javaSimulator\JadInvoker\MidpInvoker.dll, Kwyshell G.Corp>
[全能助手广告拦截专家]
  {ED51E9A3-16C5-4236-99E0-9F093B021433} <d:\Program\TweakAssist\AssistIEBar.dll, 全能助手工作室>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Java Plug-in 1.6.0_02]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.4.1_01]
  {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_12]
  {CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
  {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_02]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[Thunder Browser Helper]
  {0005A87C-D626-4B3A-84F9-1D9571695F55} <D:\Program\thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx, >
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[CAdLogic Object]
  {11F09AFD-75AD-4E51-AB43-E09E9351CE16} <, N/A>
[AddTask Class]
  {24F06550-65E3-4D1C-8CFE-839C296B5530} <D:\Program\EReader\eREAD6.0\IEeREAD.dll, >
[Info cache]
  {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
[腾讯QQ]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <, N/A>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll, Sun Microsystems, Inc.>
[browser Class]
  {C86488AF-13D5-4FEF-9DDF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\Office\USERDATA\3gX1CFUe52.dll, Microsoft Corporation>
[Kwyshell MidpX]
  {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} <d:\Program\javaSimulator\JadInvoker\MidpInvoker.dll, Kwyshell G.Corp>
[&Download using ??????à×]
  <F1910-F110-11D2-BB9E-00C04F795683}, N/A>
[&使用迅雷下载]
  <D:\Program\thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program\thunder\Program\getallurl.htm, N/A>
[&使用迷你迅雷下载]
  <D:\Program\Maxthon\Thundermini\geturl.htm, N/A>
[Link to &MidpX]
  <d:\Program\javaSimulator\JadInvoker\Extent\jad_wrap.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[易趣购物]
  <C:\Program Files\AD4All\link1\eachlink.htm, N/A>
[添加到广告杀手]
  <d:\Program\TweakAssist\AdKiller.htm, N/A>

==================================
正在运行的进程
[PID: 500 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 568 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 592 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\msplrct.dll]  [N/A, ]
[C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\loader.dll]  [Microsoft, 3.0.2]
[PID: 636 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 656 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 824 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 872 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1040 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1120 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1228 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\HpTcpMon.dll]  [Hewlett Packard, 5.01.01.01]
[C:\WINDOWS\system32\hpzjrd01.dll]  [Hewlett Packard, 2.01.00.003]
[C:\WINDOWS\system32\HPTcpMUI.dll]  [Microsoft Corporation, 5.01.01.01]
[C:\WINDOWS\system32\hptcpmib.dll]  [Hewlett Packard, 5.01.01.01]
[C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
[C:\WINDOWS\system32\hpz3l43a.dll]  [Hewlett-Packard Company, 60.053.243.00]
[C:\WINDOWS\system32\pdfports.dll]  [Adobe Systems Incorporated., 5.0.000]
[C:\Program Files\Adobe\Acrobat 5.0\Distillr\ADistRes.CHS]  [Adobe Systems Incorporated., 5.0.0.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp43a.dll]  [Hewlett-Packard Corporation, 60.053.243.00]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1624 / Administrator][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\Program\Tortoise\bin\tortoisesvn.dll]  [www.tortoisesvn.org, 1, 4, 4, 9706]
[D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
[D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
[D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
[D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
[D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
[c:\program files\aqua dock\xjos32.dll]  [N/A, ]
[d:\program\coolpro2\cysdc32.dll]  [N/A, ]
[c:\program files\360safe\winvwfjuw4.dll]  [N/A, ]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[D:\Program\thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx]  [, 1, 0, 0, 1]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[d:\Program\Kaspersky\Kaspersky\shellex.dll]  [Kaspersky Lab, 5.0.156.1]
[d:\Program\TROYKI~1\FTCCOM~1.DLL]  [Fygsoft and Microsoft, 3.0.0.71]
[d:\Program\Beyond Compare 2\BCShellEx.dll]  [Scooter Software, 2.4.2.0]
[C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4497]
[C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.4497]
[C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4497]
[C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4497]
[C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.4497]
[d:\Program\avg\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[d:\Program\avg\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[PID: 2028 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
[C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
[PID: 3440 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2824 / Administrator][D:\Program\firefox\firefox.exe]  [Mozilla Corporation, 1.8.1.4: 2007051502]
[D:\Program\firefox\js3250.dll]  [Netscape Communications Corporation, 4.0]
[D:\Program\firefox\nspr4.dll]  [Netscape Communications Corporation, 4.6.7]
[D:\Program\firefox\xpcom_core.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[D:\Program\firefox\plc4.dll]  [Netscape Communications Corporation, 4.6.7]
[D:\Program\firefox\plds4.dll]  [Netscape Communications Corporation, 4.6.7]
[D:\Program\firefox\smime3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program\firefox\nss3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program\firefox\softokn3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
[D:\Program\firefox\ssl3.dll]  [Mozilla Foundation, 3.11.5 Basic ECC]
[D:\Program\firefox\xpcom_compat.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[D:\Program\firefox\components\myspell.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[D:\Program\firefox\components\jar50.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[D:\Program\firefox\components\jsd3250.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[D:\Program\firefox\freebl3.dll]  [Mozilla Foundation, 3.11.4 Basic ECC]
[D:\Program\firefox\nssckbi.dll]  [Mozilla Foundation, 1.62]
[D:\Program\firefox\components\spellchk.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mr32v592.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll]  [ietab.mozdev.org, 1, 3, 0, 0]
[D:\Program\firefox\xpcom.dll]  [Mozilla Foundation, 1.8.1.4: 2007051502]
[C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL]  [Microsoft Corporation, 1.0.1038.0]
[C:\PROGRA~1\COMMON~1\MICROS~1\Speech\sapi.dll]  [Microsoft Corporation, 5.1.4111.00  (xpsp_sp2_rtm.040803-2158)]
[D:\Program\Tortoise\bin\tortoisesvn.dll]  [www.tortoisesvn.org, 1, 4, 4, 9706]
[D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
[D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
[D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
[D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
[D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Common Files\Microsoft Shared\INK\SKCHUI.DLL]  [Microsoft Corporation, 1.0.1038.0]
[C:\WINDOWS\system32\SOGOUPY.IME]  [Sohu.com Inc., 2, 0, 0, 1]
[C:\WINDOWS\system32\dllMergeDict.dll]  [N/A, ]
[d:\Program\SogouInput\Plugin\SgImeWord.dll]  [, 1, 0, 0, 31]
[C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 4176 / Administrator][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[PID: 3572 / Administrator][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[PID: 5352 / Administrator][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2296 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[PID: 736 / Administrator][D:\Program\Tortoise\bin\TSVNCache.exe]  [www.tortoisesvn.org, 1, 4, 4, 9706]
[D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
[D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
[D:\Program\Tortoise\bin\CrashRpt.dll]  [, 3.1.2.3]
[D:\Program\Tortoise\bin\dbghelp.dll]  [Microsoft Corporation, 6.3.0017.0 (DbgBuild.040415-1850)]
[D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
[D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
[D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[PID: 5876 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmjyj32.dll]  [N/A, ]
[C:\Documents and Settings\Administrator\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
[C:\Documents and Settings\Administrator\桌面\sreng2\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]
[D:\Program\Tortoise\bin\tortoisesvn.dll]  [www.tortoisesvn.org, 1, 4, 4, 9706]
[D:\Program\Tortoise\bin\libapr_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libaprutil_tsvn.dll]  [Apache Software Foundation, 0.9.12]
[D:\Program\Tortoise\bin\libapriconv_tsvn.dll]  [Apache Software Foundation, 0.9.7]
[D:\Program\Tortoise\bin\intl3_svn.dll]  [Free Software Foundation, 0.14.5]
[D:\Program\Tortoise\iconv\_tbl_simple.so]  [N/A, ]
[D:\Program\Tortoise\iconv\cp936.so]  [N/A, ]
[D:\Program\Tortoise\iconv\utf-8.so]  [N/A, ]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [UltraEdit.ini]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. []
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1    localhost
211.166.155.2 www.1.com

==================================
进程特权扫描
特殊特权被允许： SeSystemtimePrivilege [PID = 736, D:\PROGRAM\TORTOISE\BIN\TSVNCACHE.EXE]
特殊特权被允许： SeDebugPrivilege [PID = 736, D:\PROGRAM\TORTOISE\BIN\TSVNCACHE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 736, D:\PROGRAM\TORTOISE\BIN\TSVNCACHE.EXE]

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExA (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryExW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
RVA  错误： LoadLibraryW (危险等级: 高,  被下面模块所HOOK: \SystemRoot\System32\drivers\klif.sys)
入口点错误：FreeLibrary (危险等级: 高,  被下面模块所HOOK: 0x7170002D)

==================================
隐藏进程
[1773] D:\Program\Kaspersky\Kaspersky\kav.exe
[1953] d:\Program\Kaspersky\Kaspersky\kavsvc.exe

==================================

[/CODE]

显示全部楼层 · 发表于 2007-9-27 13:51:13

先谢了,各位

这是sreng报告
貌似挺复杂

RVA错误： LoadLibraryA
RVA错误： LoadLibraryExA
RVA错误： LoadLibraryExW
RVA错误： LoadLibraryW
入口点错误：FreeLibrary

用sreng修复后，立马又弹出同样的提示

[ 本帖最后由 LandyVanRoy 于 2007-9-27 13:59 编辑 ]

显示全部楼层 · 发表于 2007-9-27 17:25:06

klif.sys
我查看它的属性
居然是kaspersky的产品

显示全部楼层 · 发表于 2007-9-27 17:44:20

楼主你的IE是不是被病毒劫持了啊?网上有挺多IE被劫持的相关解决办法,建议楼主去搜下看看

显示全部楼层 · 发表于 2007-9-27 19:19:27

**************以下分析报告由SREngLog分析助手提供******************

根据SREng扫描日志请按照如下步骤，尝试删除和修复

1.建议使用XDelBox删除以下文件：(XDelBox1.5下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。

c:\documents and settings\all users\application data\microsoft\office\system\loader.dll
c:\windows\system32\msplrct.dll
c:\docume~1\admini~1\locals~1\temp\winmjyj32.dll
c:\program files\360safe\winvwfjuw4.dll
c:\program files\common files\cpush\cpush.dll
c:\windows\system32\drivers\mxdispdr.sys
c:\windows\system32\drivers\mmd8s3h7.sys
c:\windows\system32\drivers\knny2.sys
c:\windows\system32\drivers\bootdrv.sys
c:\documents and settings\all users\application data\microsoft\office\userdata\3gx1cfue52.dll
c:\documents and settings\all users\application data\microsoft\pctools\pctools.dll

以下这2个你自己查看下是否你自己安装的，如果是就不用管了，而且第二步中的相应项目也不用修复。
c:\program files\aqua dock\xjos32.dll
d:\program\coolpro2\cysdc32.dll

2.删除重启后使用SREng修复下面各项：

启动项目－－注册表之如下项删除：
[CPushSetup] <"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\CPUSH\cpush.dll">
[Aqua Dock] <c:\program files\aqua dock\xjos32.dll>

启动项目－－服务－－驱动程序之如下项删除：
[mxdispdr / mxdispdr] <\??\C:\WINDOWS\system32\drivers\mxdispdr.sys>
[mmd8s3h / mmd8s3h7] <\SystemRoot\System32\DRIVERS\mmd8s3h7.sys>
[knny / knny2] <\SystemRoot\System32\DRIVERS\knny2.sys>
[bootdrv / bootdrv] <\SystemRoot\System32\Drivers\bootdrv.sys>

系统修复－－　浏览器加载项之如下项删除：
[&Download using ??????à×] <F1910-F110-11D2-BB9E-00C04F795683}>
[browser Class] <C:\Documents and Settings\All Users\Application Data\Microsoft\Office\USERDATA\3gX1CFUe52.dll>
[Info cache] <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll>

3.下载windows清理助手清理恶意软件
http://www.arswp.com/download/arswp2/arswp2.zip

下载临时文件清理工具
http://hzqedison.mm9mm.com/hanhua/ATF-Cleaner-cn.exe
http://www.dodudou.com/down/ATF-Cleaner-cn.exe

**************以上分析报告由SREngLog分析助手提供******************
分析：shuipao
时间：2007-9-27
SREngLog分析助手 1.2 (20070420 更新 BY 草莽书生)

[已解决] [求助]请问有没有人遇到过这种情况，杀不干净啊！！

回复 6楼 LandyVanRoy 的帖子

评分