电脑中毒，高手帮忙啊！

soddy157

sre 扫描：
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47B25)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47D67)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47F0B)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47C49)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xBFA47E8F)

这些是什么东西呀？怎么修复呀？我第一次用这个sre什么都不懂，请高手教我啊！

还有个问题 就是每次开机都出现加载模块错误，在这之前找到那个文件 ，卡巴提示有毒杀掉之后，才出现这种情况

注册表里 自己也按照网上的方法清理干净了  也没用 每次开机还是会出现啊  求救呀！

[ 本帖最后由 soddy157 于 2007-4-8 17:01 编辑 ]

idey

其它的扫描怎么没有贴上来？

soddy157

注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <CountrySelection><pctptt.exe>  [PCtel, Inc.]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <360Safetray><D:\Program\360safe\safemon\360Tray.exe /start>  [奇虎网]
    <RealTray><; C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINNT\system32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <D:\Program\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>
[卡巴斯基互联网安全套装 6.0 / AVP][Running/Manual Start]
  <D:\Program\kab\avp.exe -r><Kaspersky Lab>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[McAfee Framework Service / McAfeeFramework][Stopped/Auto Start]
  <><N/A>
[Outpost Firewall Service / OutpostFirewall][Stopped/Disabled]
  <><N/A>
[W2K PCtel speaker phone / Pctspk][Running/Auto Start]
  <C:\WINNT\system32\pctspk.exe><PCtel, Inc.>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[Outpost Firewall PlugIn (ADBLOCK.DLL) / ADBLOCK.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\ADBLOCK.DLL><N/A>
[Outpost Firewall PlugIn (ARP.DLL) / ARP.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\ARP.DLL><N/A>
[atirage3 / atirage3][Running/Manual Start]
  <system32\DRIVERS\atimpab.sys><ATI Technologies Inc.>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\D:\Program\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[HelloNet PPPoE 虚拟网卡 / BRPPPOE][Stopped/Manual Start]
  <system32\DRIVERS\brpppoe.sys><N/A>
[Outpost Firewall PlugIn (CONTENT.DLL) / CONTENT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\CONTENT.DLL><N/A>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Outpost Firewall PlugIn (DNSCACHE.DLL) / DNSCACHE.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\DNSCACHE.DLL><N/A>
[SB AudioPCI Audio Driver (WDM) / ev19x8mp][Running/Manual Start]
  <system32\drivers\ev19x8mp.sys><Creative Technology Ltd.>
[Outpost Firewall PlugIn (FTPFILT.DLL) / FTPFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\FTPFILT.DLL><N/A>
[Outpost Firewall PlugIn (HTMLFILT.DLL) / HTMLFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\HTMLFILT.DLL><N/A>
[Outpost Firewall PlugIn (HTTPFILT.DLL) / HTTPFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\HTTPFILT.DLL><N/A>
[Outpost Firewall PlugIn (IMAPFILT.DLL) / IMAPFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\IMAPFILT.DLL><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[Outpost Firewall PlugIn (MAILFILT.DLL) / MAILFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\MAILFILT.DLL><N/A>
[VSCore mferkdk / mferkdk][Stopped/System Start]
  <\??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys><N/A>
[Outpost Firewall PlugIn (NNTPFILT.DLL) / NNTPFILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\NNTPFILT.DLL><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\program\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkcusb / npkcusb][Running/Auto Start]
  <\??\D:\Program\QQ\npkcusb.sys><INCA Internet Co., Ltd.>
[Outpost Firewall PlugIn (POP3FILT.DLL) / POP3FILT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\POP3FILT.DLL><N/A>
[Outpost Firewall PlugIn (PROTECT.DLL) / PROTECT.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\PROTECT.DLL><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[W2K Pctel Serial Device Driver / ptserial][Running/Manual Start]
  <system32\DRIVERS\ptserial.sys><PCTEL, INC.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Outpost Firewall Sandbox Driver / SandBox][Stopped/System Start]
  <\??\d:\Program\Outpost Firewall\kernel\Sandbox.SYS><N/A>
[Outpost Firewall PlugIn (SECRET.DLL) / SECRET.DLL][Stopped/Manual Start]
  <\??\d:\Program\Outpost Firewall\kernel\SECRET.DLL><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\C:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[Scientific-Atlanta USB Cable Modem Driver / USBCM][Stopped/Manual Start]
  <system32\DRIVERS\Sacm2A.sys><>
[Outpost Firewall Kernel Driver / VFILT][Stopped/System Start]
  <\??\d:\Program\Outpost Firewall\kernel\FILTNT.SYS><N/A>
[W2K Vmodem / Vmodem][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\vmodem.sys><PCTEL, INC.>
[W2K Vpctcom / Vpctcom][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\vpctcom.sys><PCTEL,  INC.>
[W2K Vvoice / Vvoice][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\vvoice.sys><PCtel, Inc.>
[xFileMgr / xFileMgr][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\xFileMgr.sys><MS User>

==================================
浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program\webThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[NavigatMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <D:\Program\360safe\safemon\safemon.dll, >
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program\kab\scieplugin.dll, Kaspersky Lab>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[PowerPlr Control]
  {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINNT\DOWNLO~1\PowerPlr.ocx, Powerise Digital>
[WebActivater Control]
  {C661F36D-DF85-4EF4-83C7-E107B83D04B1} <C:\WINNT\system32\3DShowVM.ocx, QQ>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[CPasswordEditCtrl Object]
  {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINNT\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>
[&使用迅雷下载]
  <D:\Program\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program\Thunder\Program\GetAllUrl.htm, N/A>
[使用Web迅雷下载]
  <D:\Program\webThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <D:\Program\webThunder\GetAllUrl.htm, N/A>

==================================
正在运行的进程
[PID: 180][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 212][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6970]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 260][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 272][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6902]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 424][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 456][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\unimdm.tsp]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\kmddsp.tsp]  [Microsoft Corporation, 5.00.2150.1]
    [C:\WINNT\system32\ndptsp.tsp]  [Microsoft Corporation, 5.00.2143.1]
    [C:\WINNT\system32\ipconf.tsp]  [Microsoft Corporation, 5.00.2143.1]
    [C:\WINNT\system32\h323.tsp]  [Microsoft Corporation, 5.00.2195.6901]
[PID: 512][C:\WINNT\system32\msdtc.exe]  [Microsoft Corporation, 1999.9.3421.3]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 656][C:\WINNT\system32\hidserv.exe]  [Microsoft Corporation, 5.00.2195.6655]
[PID: 688][C:\WINNT\system32\pctspk.exe]  [PCtel, Inc., 4.00]
[PID: 824][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6920]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
[PID: 1336][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [D:\Program\Unlocker\UnlockerCOM.dll]  [N/A, ]
    [D:\Program\kab\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program\kab\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program\kab\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program\kab\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program\kab\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\wmp.dll]  [Microsoft Corporation, 9.00.00.3349]
    [C:\WINNT\system32\wmploc.dll]  [Microsoft Corporation, 9.00.00.2980]
    [d:\program\kab\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program\kab\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\wmvcore.dll]  [Microsoft Corporation, 9.00.00.3265 (xpsp_sp2_qfe.061206-2330)]
    [C:\WINNT\system32\wmidx.dll]  [Microsoft Corporation, 9.00.00.2980]
    [C:\WINNT\system32\WMASF.DLL]  [Microsoft Corporation, 9.00.00.2980 built by: lab03_dev(bld4act)]
    [C:\WINNT\system32\msdmo.dll]  [Microsoft Corporation, 4.90.2490.1]
    [C:\WINNT\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
    [D:\Program\webThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [D:\Program\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [D:\Program\360safe\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [D:\Program\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [D:\Program\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]
[PID: 1348][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
[PID: 1372][C:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [C:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 1640][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\Program\webThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [D:\Program\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [D:\Program\360safe\safemon\safemon.dll]  [, 3, 2, 0, 1001]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
    [D:\Program\kab\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [D:\Program\kab\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program\kab\prkernel.ppl]  [Kaspersky Lab, 6.0.0.304]
    [d:\program\kab\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program\kab\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [d:\program\kab\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [d:\program\kab\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [d:\program\kab\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINNT\system32\inetcpl.cpl]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\WINNT\system32\wmp.dll]  [Microsoft Corporation, 9.00.00.3349]
    [C:\WINNT\system32\wmploc.dll]  [Microsoft Corporation, 9.00.00.2980]
    [C:\WINNT\system32\wmvcore.dll]  [Microsoft Corporation, 9.00.00.3265 (xpsp_sp2_qfe.061206-2330)]
    [C:\WINNT\system32\wmidx.dll]  [Microsoft Corporation, 9.00.00.2980]
    [C:\WINNT\system32\WMASF.DLL]  [Microsoft Corporation, 9.00.00.2980 built by: lab03_dev(bld4act)]
    [C:\WINNT\system32\msdmo.dll]  [Microsoft Corporation, 4.90.2490.1]
    [C:\WINNT\system32\msxml3.dll]  [Microsoft Corporation, 8.50.2162.0]
    [C:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\msratelc.dll]  [Microsoft Corporation, 6.00.2800.1106]
[PID: 1832][D:\Program\资源\sreng2杀crs\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [D:\Program\kab\adialhk.dll]  [Kaspersky Lab, 6.0.0.299]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
API HOOK
RVA  错误： LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47B25)
RVA  错误： LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47D67)
RVA  错误： LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47F0B)
RVA  错误： LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBFA47C49)
RVA  错误： GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xBFA47E8F)

==================================
隐藏进程
N/A

==================================


[/CODE]
帮我看看

wangjay1980

你用卡巴威尔这个软件吗？

wangjay1980

提示那个模块

wangjay1980

那些API错误是卡巴引起的，没事

soddy157

你用卡巴威尔这个软件吗？ 有运行过绿色版的

之后删除了    那提示的错误该怎么弄掉呀？

谢谢呀

soddy157

该怎么解决呀?

wangjay1980

那就删除这个驱动，然后用WINDOWS清理助手清理一下
[xFileMgr / xFileMgr][Running/System Start]
  <\??\C:\WINNT\system32\Drivers\xFileMgr.sys><MS User>