收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 原创工具区 › 大家帮忙看下,这是这个症状是否是病毒引起的
返回列表 发新帖
查看: 3191|回复: 2
收起左侧

[已解决] 大家帮忙看下,这是这个症状是否是病毒引起的

[复制链接]
pnjinhe
发表于 2007-3-17 11:56:16 | 显示全部楼层 |阅读模式
这俩天键盘有7个不能用了,起初以为是坏了,但是各天启机正常了,还以为好了,过了1分钟左右...又坏，重启也没用。
杀毒用咔吧最新病毒库全盘查,没什么发现。各天启机又正常了,又过了1分钟左右...又坏
这7个键是 b，n，alt，空格键，左键，右键，下键。
本人知识实在没办法修了，现在就靠着屏幕键盘软件打字，很，，，，，
如果有解决办法，请给工具名和链接等解决办法。
希望大家帮忙下，我在此现谢！等待中。。。

以确认是键盘问题。
因用了很多杀毒一共杀了几十个危险程序，但我对这几十个危险程序才发现是虚报，哀。。。可能是我对是病毒太敏感了，谢谢楼下的帮助分析

[ 本帖最后由 pnjinhe 于 2007-3-20 15:41 编辑 ]
回复

举报

pnjinhe
 楼主| 发表于 2007-3-17 15:02:32 | 显示全部楼层
System Repair Engineer报告
API HOOK项不能点修复



  3. 2007-03-17,14:54:09

  5. System Repair Engineer 2.4.12.806
  6. Smallfrogs (http://www.KZTechs.com)

  8. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

  10. 以下内容被选中：
  11.     所有的启动项目（包括注册表、启动文件夹、服务等）
  12.     浏览器加载项
  13.     正在运行的进程（包括进程模块信息）
  14.     文件关联
  15.     Winsock 提供者
  16.     Autorun.inf
  17.     HOSTS 文件


  20. 启动项目
  21. 注册表
  22. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  23.     <ctfmon.exe><C:\windows\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  24. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  25.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  26.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  27.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  28. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  29.     <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]
  30. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  31.     <IE7 Uninstall Stub><C:\windows\system32\ieudinit.exe>  [(Verified)Microsoft Windows Publisher]

  33. ==================================
  34. 启动文件夹
  35. N/A

  37. ==================================
  38. 服务
  39. [卡巴斯基互联网安全套装 6.0 / AVP][Running/Manual Start]
  40.   <"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
  41. [Diskeeper / Diskeeper][Stopped/Manual Start]
  42.   <D:\Program Files\绿色小工具\Diskeeper\DkService.exe><Diskeeper Corporation>
  43. [Human Interface Device Access / HidServ][Stopped/Disabled]
  44.   <C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  45. [Shadow System Service / ShadowSystemService][Running/Auto Start]
  46.   <C:\windows\system32\shadow\ShadowService.exe><N/A>
  47. [Windows Media Player Network Sharing Service / WMPNetworkSvc][Stopped/Disabled]
  48.   <><N/A>

  50. ==================================
  51. 驱动程序
  52. [Crystal SoundFusion(tm) Driver / cwcspud][Running/Manual Start]
  53.   <system32\drivers\cwcspud.sys><Crystal Semiconductor Corp.>
  54. [Crystal SoundFusion(tm) WDM Driver / cwcwdm][Running/Manual Start]
  55.   <system32\drivers\cwcwdm.sys><Crystal Semiconductor Corp.>
  56. [IBM Access Support / EGATHDRV][Running/Auto Start]
  57.   <\??\C:\windows\system32\EGATHDRV.SYS><IBM Corporation>
  58. [VMware hcmon / Hcmon][Stopped/Manual Start]
  59.   <SYSTEM32\DRIVERS\HCMON.SYS><VMware, Inc.>
  60. [ISO CD-ROM Device Driver / ISODrive][Stopped/Manual Start]
  61.   <\??\C:\XZ\Program Files\UltraISO\drivers\ISODrive.sys><N/A>
  62. [kl1 / kl1][Running/Boot Start]
  63.   <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
  64. [klif / klif][Running/System Start]
  65.   <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
  66. [Lucent Modem Driver / ltmodem5][Running/Manual Start]
  67.   <system32\DRIVERS\ltmdmxp.sys><LT>
  68. [neo20xx / neo20xx][Running/Manual Start]
  69.   <system32\DRIVERS\neo20xx.sys><NeoMagic Corporation>
  70. [npkcrypt / npkcrypt][Running/Auto Start]
  71.   <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
  72. [NSC Infrared Device Driver / NSCIRDA][Running/Manual Start]
  73.   <system32\DRIVERS\nscirda.sys><National Semiconductor Corporation>
  74. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  75.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  76. [rrSpy / rrSpy][Stopped/Manual Start]
  77.   <\SystemRoot\system32\drivers\rrSpy.sys><Resplendence>
  78. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  79.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
  80. [Secdrv / Secdrv][Stopped/Manual Start]
  81.   <system32\DRIVERS\secdrv.sys><N/A>
  82. [System Restore Filter Driver / Sr][Stopped/Disabled]
  83.   <system32\DRIVERS\sr.sys><N/A>
  84. [IBM PS/2 TrackPoint Filter Driver / TwoTrack][Running/Manual Start]
  85.   <system32\DRIVERS\TwoTrack.sys><IBM Corporation>
  86. [VMware Bridge Protocol / VMnetBridge][Running/Auto Start]
  87.   <system32\DRIVERS\vmnetbridge.sys><VMware, Inc.>
  88. [VMware Network Application Interface / VMnetuserif][Stopped/Manual Start]
  89.   <SYSTEM32\DRIVERS\VMNETUSERIF.SYS><VMware, Inc.>
  90. [VMware VMparport / Vmparport][Stopped/Manual Start]
  91.   <SYSTEM32\DRIVERS\VMPARPORT.SYS><VMware, Inc.>
  92. [VMware vmx86 / vmx86][Running/Auto Start]
  93.   <system32\DRIVERS\vmx86.sys><VMware, Inc.>

  95. ==================================
  96. 浏览器加载项
  97. [Thunder Browser Helper]
  98.   {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
  99. [启动迅雷5]
  100.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
  101. [Web反病毒保护]
  102.   {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
  103. [IBM Access Support]
  104.   {74FFE28D-2378-11D5-990C-006094235084} <C:\windows\Downloaded Program Files\IbmEgath.dll, IBM Corporation>
  105. [acpRunner Class]
  106.   {E598AC61-4C6F-4F4D-877F-FAC49CA91FA3} <C:\windows\Downloaded Program Files\AcpController.dll, >
  107. [Windows Genuine Advantage Validation Tool]
  108.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\windows\system32\LegitCheckControl.dll, Microsoft Corporation>
  109. [InformationCardSigninHelper Class]
  110.   {19916E01-B44E-4E31-94A4-4696DF46157B} <C:\windows\system32\icardie.dll, Microsoft Corporation>
  111. [XML DOM Document]
  112.   {2933BF90-7B36-11D2-B20E-00C04F983E60} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  113. [XSL Template]
  114.   {2933BF94-7B36-11D2-B20E-00C04F983E60} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  115. [HtmlDlgSafeHelper Class]
  116.   {3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\windows\system32\mshtmled.dll, Microsoft Corporation>
  117. [Tabular Data Control]
  118.   {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\windows\system32\tdc.ocx, Microsoft Corporation>
  119. [Thunder Agent Class]
  120.   {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_005.dll, Thunder Networking Technologies,LTD>
  121. [WUWebControl Class]
  122.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\windows\system32\wuweb.dll, Microsoft Corporation>
  123. [Microsoft Shell UI Helper]
  124.   {64AB4BB7-111E-11D1-8F79-00C04FC2FBE1} <C:\windows\system32\ieframe.dll, Microsoft Corporation>
  125. [Windows Media Player]
  126.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\windows\system32\wmp.dll, Microsoft Corporation>
  127. [MUWebControl Class]
  128.   {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\windows\system32\muweb.dll, Microsoft Corporation>
  129. [Thunder Browser Helper]
  130.   {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, Thunder Networking Technologies,LTD>
  131. [RealPlayer G2 Control]
  132.   {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\windows\system32\rmoc3260.dll, RealNetworks, Inc.>
  133. [Shockwave Flash Object]
  134.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\flash.ocx, Adobe Systems, Inc.>
  135. [XML HTTP Request]
  136.   {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  137. [Scripting.Dictionary]
  138.   {EE09B103-97E0-11CF-978F-00A02463E06F} <C:\windows\system32\scrrun.dll, Microsoft Corporation>
  139. [XML DOM Document 3.0]
  140.   {F5078F32-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  141. [Free Threaded XML DOM Document 3.0]
  142.   {F5078F33-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  143. [XML Schema Cache 3.0]
  144.   {F5078F34-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  145. [XML HTTP 3.0]
  146.   {F5078F35-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  147. [XSL Template 3.0]
  148.   {F5078F36-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  149. [XML Data Source Object 3.0]
  150.   {F5078F39-C551-11D3-89B9-0000F81FE221} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  151. [Free Threaded XML DOM Document]
  152.   {F6D90F12-9C73-11D3-B32E-00C04F990BB4} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  153. [XML Data Source Object]
  154.   {F6D90F14-9C73-11D3-B32E-00C04F990BB4} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  155. [XML HTTP]
  156.   {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <C:\windows\system32\msxml3.dll, Microsoft Corporation>
  157. [&使用迅雷下载]
  158.   <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
  159. [&使用迅雷下载全部链接]
  160.   <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
  161. [上传到QQ网络硬盘]
  162.   <, N/A>

  164. ==================================
  165. 正在运行的进程
  166. [PID: 532][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  167. [PID: 648][\??\C:\windows\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  168. [PID: 720][\??\C:\windows\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  169.     [C:\WINDOWS\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
  170.     [C:\windows\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  171. [PID: 804][C:\windows\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  172.     [C:\windows\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.3008 (xpsp.061004-0027)]
  173. [PID: 824][C:\windows\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  174. [PID: 1036][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  175. [PID: 1144][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  176. [PID: 1324][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  177.     [C:\windows\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
  178.     [C:\windows\system32\iertutil.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  179.     [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
  180. [PID: 1388][C:\windows\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  181. [PID: 1684][C:\windows\system32\shadow\ShadowService.exe]  [N/A, ]
  182. [PID: 1764][C:\windows\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  183.     [C:\windows\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
  184.     [C:\windows\system32\iertutil.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  185.     [C:\windows\system32\ieframe.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  186.     [C:\windows\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  187.     [D:\Program Files\Microsoft Office 2003\Office\msohev.dll]  [Microsoft Corporation, 11.0.5510]
  188.     [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
  189. [PID: 248][C:\windows\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  190. [PID: 140][C:\Documents and Settings\Administrator\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
  191.     [C:\windows\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
  192.     [C:\windows\system32\iertutil.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  193.     [C:\Documents and Settings\Administrator\桌面\sreng2\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]
  194. [PID: 1700][D:\Program Files\Tencent\TT\TTraveler.exe]  [腾讯公司, 3.1.0.261]
  195.     [C:\windows\system32\iertutil.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  196.     [C:\windows\system32\ieframe.dll]  [Microsoft Corporation, 7.00.5730.11 (winmain(wmbla).061017-1135)]
  197.     [C:\windows\system32\Normaliz.dll]  [Microsoft Corporation, 6.0.5441.0 (winmain(wmbla).060628-1735)]
  198.     [D:\Program Files\Tencent\TT\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
  199.     [D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

  201. ==================================
  202. 文件关联
  203. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  204. .EXE  OK. ["%1" %*]
  205. .COM  OK. ["%1" %*]
  206. .PIF  OK. ["%1" %*]
  207. .REG  OK. [regedit.exe "%1"]
  208. .BAT  OK. ["%1" %*]
  209. .SCR  OK. ["%1" /S]
  210. .CHM  OK. ["C:\windows\hh.exe" %1]
  211. .HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
  212. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  213. .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  214. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  215. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  216. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  218. ==================================
  219. Winsock 提供者
  220. N/A

  222. ==================================
  223. Autorun.inf
  224. N/A

  226. ==================================
  227. HOSTS 文件
  228. 127.0.0.1       localhost

  230. ==================================
  231. API HOOK
  232. RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF9D8DB25)
  233. RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF9D8DD67)
  234. RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF9D8DF0B)
  235. RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xF9D8DC49)
  236. RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xF9D8DE8F)

  238. ==================================
  239. 隐藏进程
  240. N/A

  242. ==================================


复制代码
回复

举报

wangjay1980
发表于 2007-3-17 23:15:08 | 显示全部楼层
报告没有问题，你可以重装一下键盘的驱动试试
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-12-22 21:51 , Processed in 0.119433 second(s), 17 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表