一次用IceSword处理复杂病毒的实例

xngnln

中了复杂病毒后，用SRE检测日志如下：

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<HControl><; C:\WINDOWS\ATK0100\HControl.exe> [(Verified)]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<Desktop><"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Run> []
<adx.exe><C:\Program Files\real\adx.exe> [Microsoft Corporation]
<IEBarUp><RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<{08831C2E-063C-2052-0727-060502060056}><"C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\Update.exe" te-110-12-0000049> [N/A]
<zts2><C:\DOCUME~1\zhao\LOCALS~1\Temp\zts2.exe> [N/A]
<rxzs><C:\DOCUME~1\zhao\LOCALS~1\Temp\rxzs.exe> [N/A]
<mhs2><C:\DOCUME~1\zhao\LOCALS~1\Temp\mhs2.exe> [N/A]
<wlzs><C:\DOCUME~1\zhao\LOCALS~1\Temp\wlzs.exe> [N/A]
<><C:\WINDOWS\system32\Systemi.exe> [N/A]
<wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> [N/A]
<System><C:\Program Files\Common Files\System\Updaterun.exe> [N/A]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\Userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070104.dll start> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><136741M.BMP> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><LogonUI.EXE> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ceitmmc]
<WinlogonNotify: ceitmmc><ceitmmc.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\comreplt]
<WinlogonNotify: comreplt><comreplt.dll> [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[3DFDF19A / 3DFDF19A]
<C:\WINDOWS\system32\3DFDF19A.EXE -service><Microsoft Corporation>
[67481948 / 67481948]
<C:\WINDOWS\system32\67481948.EXE -service><Microsoft Corporation>
[COM+ Messages / COM+ Messages]
<"C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000049><N/A>
[kavsvc / kavsvc]
<"F:\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[Windows Installer / MSIServer]
<C:\WINDOWS\system32\msiexec.exe /V><Microsoft Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Remote Registry Protect / Patterns]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\aqxyy.dll><Microsoft Corporation>
[pl.eeewl.com / pl.eeewl.com]
<C:\WINDOWS\system32\nsvce32.exe><N/A>
[RestoreService / RestoreService]
<C:\WINDOWS\system32\Svchost.exe -k RestoreService-->C:\WINDOWS\system32\drivers\restore.dll><Microsoft Corporation All rights reserved>
[Windows DHCP Service / WinDHCPsvc]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[Windows NT Service32 / Windows NT Service32]
<"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Start><Microsoft Corporation>
[Vsn xnyw Service / xnyw]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\dtes\kxlg.dll,Service><Microsoft Corporation>
[Network IPSEC Connections / SHipING]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\BMADY.DLL,Export 1087><N/A>

==================================
驱动程序
[ajifcfbf / ajifcfbf]
<\SystemRoot\system32\drivers\ajifcfbf.sys><N/A>
[CdaC15BA / CdaC15BA]
<\??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS><Macrovision Europe Ltd>
[Microsoft 用于 High Definition Audio 服务的 UAA 功能驱动程序 / HdAudAddService]
<system32\drivers\HdAudio.sys><Windows (R) Server 2003 DDK provider>
[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[Kl1 / Kl1]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc]
<System32\drivers\klmc.sys><Kaspersky Lab>
[msprotect / msprotect]
<system32\DRIVERS\msprotect.sys><Windows (R) 2000 DDK provider>
[ATK0100 ACPI UTILITY / MTsensor]
<system32\DRIVERS\ATKACPI.sys><>
[naqbas2 / naqbas29]
<\SystemRoot\System32\DRIVERS\naqbas29.sys><N/A>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[rimsptsk / rimsptsk]
<system32\DRIVERS\rimsptsk.sys><REDC>
[risdptsk / risdptsk]
<\SystemRoot\system32\DRIVERS\risdptsk.sys><REDC>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp]
<system32\DRIVERS\Rtenicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[smserial / smserial]
<system32\DRIVERS\smserial.sys><Motorola Inc.>
[Synaptics TouchPad Driver / SynTP]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[TCP/IP Protocol Driver / Tcpip]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[TSP / TSP]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>
浏览器加载项
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\pdf\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Ad Engine]
{077FD0C3-1291-4104-A356-41E36B252682} <C:\Program Files\Yayad\AdCore.dll, CDM>
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINDOWS\system32\IESHEL~1.DLL, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush0.dll, N/A>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <F:\BitComet\tools\BitCometBHO.dll, BitComet>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[BHOHelper Class]
{67A90DD5-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\real\atloader.dll, Microsoft Corporation>
[BHOHelper Class]
{67A90DD6-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\real\atloader.dll, Microsoft Corporation>
[实用搜索]
{6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[XBTP07744 Class]
{6F0E8CF5-F8BF-4645-8BA5-B77F8440A2FE} <C:\PROGRA~1\搜阉索鞴工�~1\soso.dll, N/A>
[xkvt]
{8C9AF53D-6EB4-42CA-9E8C-9081C7D615EC} <C:\PROGRA~1\COMMON~1\dtes\hxid.dll, >
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <F:\迅雷\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\SCIntruder.dll, N/A>
[Bar888]
{C1B4DEC2-2623-438e-9CA2-C9043AB28508} <C:\PROGRA~1\COMMON~1\{38831~1\Bar888.dll, N/A>
[]
{E5A7A15F-213F-4FCF-8DE7-D388F9FB09EB} <C:\WINDOWS\system32\cnwin.dll, 深圳市卓众网络有限公司>
[]
{E9020D2E-DEC9-4EBE-B38D-E1E6AE13D13F} <C:\WINDOWS\system32\hzspkvaqspjlp.dll, N/A>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <F:\HFGameOPT\GameClient.exe, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Bar888]
{C1B4DEC2-2623-438e-9CA2-C9043AB28508} <C:\PROGRA~1\COMMON~1\{38831~1\Bar888.dll, N/A>
[搜索工具栏]
{8FD0FCC2-3CBF-4D9D-8515-C48EB7C922F9} <C:\Program Files\搜索工具栏\soso.dll, IE Toolbar>
[实用搜索工具条2.0]
{03465FF5-00AE-411a-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <F:\pdf\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Ad Engine]
{077FD0C3-1291-4104-A356-41E36B252682} <C:\Program Files\Yayad\AdCore.dll, CDM>
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINDOWS\system32\IESHEL~1.DLL, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush0.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <F:\BitComet\tools\BitCometBHO.dll, BitComet>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[BHOHelper Class]
{67A90DD5-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\real\atloader.dll, Microsoft Corporation>
[BHOHelper Class]
{67A90DD6-128D-43AB-B97C-565D2DD42A28} <C:\Program Files\real\atloader.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[实用搜索]
{6CFD436C-7AAD-4E50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[XBTP07744 Class]
{6F0E8CF5-F8BF-4645-8BA5-B77F8440A2FE} <C:\PROGRA~1\搜阉索鞴工�~1\soso.dll, N/A>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[xkvt]
{8C9AF53D-6EB4-42CA-9E8C-9081C7D615EC} <C:\PROGRA~1\COMMON~1\dtes\hxid.dll, >
[ThunderMini Browser Helper]
{8E6C1C49-F9CE-4311-9FB4-D70E8B0AEAEB} <F:\迅雷\ComDlls\XunLeiMiniBHO_001.dll, Thunder Networking Technologies,LTD>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINDOWS\system32\SCIntruder.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Bar888]
{C1B4DEC2-2623-438E-9CA2-C9043AB28508} <C:\PROGRA~1\COMMON~1\{38831~1\Bar888.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[ADXAutoLive]
{E5212436-921F-44a3-8865-11C0B9BA4AF2} <C:\Program Files\real\autolive.dll, Microsoft Corporation>
[ADXAutoLive]
{E5212437-921F-44a3-8865-11C0B9BA4AF2} <C:\PROGRA~1\real\autolive.dll, Microsoft Corporation>
[]
{E5A7A15F-213F-4FCF-8DE7-D388F9FB09EB} <C:\WINDOWS\system32\cnwin.dll, 深圳市卓众网络有限公司>
[]
{E9020D2E-DEC9-4EBE-B38D-E1E6AE13D13F} <C:\WINDOWS\system32\hzspkvaqspjlp.dll, N/A>
[&使用BitComet下载]
<res://F:\BitComet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
<res://F:\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
<res://F:\BitComet\BitComet.exe/AddVideo.htm, N/A>
[&使用迷你迅雷下载]
<F:\迅雷\Program\GetUrl.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://F:\office\Office10\EXCEL.EXE/3000, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
正在运行的进程
[PID: 660][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 720][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\ceitmmc.dll] [N/A, N/A]
[PID: 796][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 808][C:\WINDOWS\system32\savedump.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 816][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 1004][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1092][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1196][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1288][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 1376][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1592][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 176][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\naqbas29.dll] [N/A, N/A]
[C:\Program Files\real\adx.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\Downloaded Program Files\947940\ExDLL.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\webpageparser.dll] [N/A, N/A]
[C:\WINDOWS\system32\Charset.dll] [N/A, N/A]
[C:\WINDOWS\system32\CreateDomTree.dll] [N/A, N/A]
[C:\WINDOWS\Downloaded Program Files\947940\fshook.dll] [, 1, 0, 0, 1]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\Program Files\real\urlcatch.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\Program Files\real\atloader.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\Program Files\real\autolive.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[F:\pdf\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8293]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8293]
[C:\WINDOWS\system32\nvshell.dll] [N/A, N/A]
[F:\pdf\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.7.2006011200]
[C:\WINDOWS\system32\IESHEL~1.DLL] [, 5.1.2600.0]
[F:\BitComet\tools\BitCometBHO.dll] [BitComet, 20061129]
[C:\Program Files\superutilbar\superutilbar.dll] [www.shiyongsousuo.com, 2, 1, 8, 24]
[C:\PROGRA~1\COMMON~1\dtes\hxid.dll] [, 1, 2, 0, 8]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[F:\迅雷\ComDlls\XunLeiMiniBHO_001.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[C:\WINDOWS\system32\SCIntruder.dll] [N/A, N/A]
[C:\PROGRA~1\COMMON~1\{38831~1\Bar888.dll] [N/A, 1, 0, 0, 1]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[F:\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[F:\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[F:\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\system32\macromed\flash\flash.ocx] [Macromedia, Inc., 6,0,79,0]
[PID: 340][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\RichDll.dll] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 448][C:\WINDOWS\uninstall\rundl132.exe] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 476][C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\Update.exe] [N/A, N/A]
[C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\System.dll] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 500][C:\WINDOWS\system32\wdfmgr32.exe] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 512][C:\Program Files\Common Files\System\Updaterun.exe] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 568][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 1340][C:\WINDOWS\system32\Media\services.exe] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1636][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8293]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 1852][C:\WINDOWS\system32\Svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[c:\windows\system32\drivers\restore.dll] [Microsoft Corporation All rights reserved, 1, 0, 0, 1]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 2396][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\winsys32_070104.dll] [N/A, N/A]
[PID: 2620][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 2904][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\PROGRA~1\COMMON~1\dtes\kxlg.dll] [, 1, 2, 0, 8]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 3124][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 3456][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

xngnln

[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 3864][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 3996][C:\WINDOWS\system32\ systemi.exe] [BenQ, 1.00]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 532][F:\Maxthon\Maxthon~.exe] [Maxthon International Ltd., 1, 5, 7, 82]
[F:\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[F:\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[F:\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[F:\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[F:\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[F:\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[F:\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[f:\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\system32\macromed\flash\flash.ocx] [Macromedia, Inc., 6,0,79,0]
[C:\WINDOWS\system32\winsys32_070104.dll] [N/A, N/A]
[PID: 356][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 2264][C:\WINDOWS\system32\sevchost.exe] [Microsoft Corporation, 5, 0, 0, 0]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 2468][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 224][C:\WINDOWS\system32\sevchost.exe] [Microsoft Corporation, 5, 0, 0, 0]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 2788][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 3264][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[PID: 3480][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 3528][C:\Documents and Settings\All Users\Templates\temp.exe] [N/A, N/A]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[PID: 3784][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1188][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 2140][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1180][F:\sreng2\SREng\SREng~.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 3976][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]
[C:\WINDOWS\system32\WSD_SOCK32.dll] [N/A, N/A]
[PID: 1744][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[C:\WINDOWS\136741M.BMP] [N/A, N/A]
[C:\Program Files\real\bhomgr.dll] [Microsoft Corporation, 5, 1, 2606, 1229]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\WSD_SOCK32.dll(N/A, N/A)
MT-TcpFilter
C:\WINDOWS\system32\WSD_SOCK32.dll(N/A, N/A)

==================================
Autorun.inf
[D:\]
[autorun]
open=d:\mplay.com





用IceSword处理。

操作的具体步骤如下：

一、先分门别类，用IceSword 处理下列进程:

第一类：被病毒模块插入的系统核心进程。
这类进程不能结束，否则，系统崩溃。
乱插进程的病毒难以对付，原因在此。
用IecSword，可以这样做：
在IceSword的面板上点击“文件”、“设置”；勾选“禁止进线程创建/禁止协件功能”，点击“确定”。然后，按进程名或PID（进程号）找到下列进程，强制卸除插入的病毒模块C:\WINDOWS\136741M.BMP和C:\WINDOWS\system32\WSD_SOCK32.dll。
[PID: 744][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 808][C:\WINDOWS\system32\savedump.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 816][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1092][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1196][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1288][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1376][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2264][C:\WINDOWS\system32\sevchost.exe] [Microsoft Corporation, 5, 0, 0, 0]
[PID: 224][C:\WINDOWS\system32\sevchost.exe] [Microsoft Corporation, 5, 0, 0, 0]
第二类：病毒进程。
要想删除病毒文件及其注册表加载项，必须先用IceSword结束这些进程：
[PID: 448][C:\WINDOWS\uninstall\rundl132.exe] [N/A, N/A]
[PID: 476][C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\Update.exe] [N/A, N/A]
[PID: 500][C:\WINDOWS\system32\wdfmgr32.exe] [N/A, N/A]
[PID: 512][C:\Program Files\Common Files\System\Updaterun.exe] [N/A, N/A]
[PID: 3996][C:\WINDOWS\system32\ systemi.exe] [BenQ, 1.00]
[PID: 2468][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 2788][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 3480][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 3528][C:\Documents and Settings\All Users\Templates\temp.exe] [N/A, N/A]
[PID: 3784][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 1188][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 2140][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 3976][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
[PID: 1744][C:\WINDOWS\system32\ravmod.exe] [Microsft Corporation, 6, 0, 3790, 1830]
第三类：被病毒插入的普通应用程序进程：
这些进程已经被病毒模块插入。如果不结束这些进程，病毒文件不能删除。可以用IceSword结束这些进程：
[PID: 1592][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 176][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 340][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180
[PID: 568][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180
[PID: 1340][C:\WINDOWS\system32\Media\services.exe] [N/A, N/A]
[PID: 1636][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8293]
[PID: 1852][C:\WINDOWS\system32\Svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2396][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2620][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 2904][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3124][C:\WINDOWS\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3456][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3864][C:\program files\internet explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 532][F:\Maxthon\Maxthon~.exe] [Maxthon International Ltd., 1, 5, 7, 82]
[PID: 356][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3264][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1180][F:\sreng2\SREng\SREng~.exe] [Smallfrogs Studio, 2.2.6.605]

二、用IceSword处理完上述进程后，即可用IceSword删除下列病毒文件：
C:\WINDOWS\system32\NTService32.dll
C:\Program Files\real\adx.exe
C:\WINDOWS\system32\IeBar1.dll
C:\WINDOWS\uninstall\rundl132.exe
C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\Update.exe
C:\DOCUME~1\zhao\LOCALS~1\Temp文件夹中的所有文件
C:\WINDOWS\system32\Systemi.exe
C:\WINDOWS\system32\wdfmgr32.exe
C:\Program Files\Common Files\System\Updaterun.exe
C:\WINDOWS\136741M.BMP
C:\WINDOWS\system32\3DFDF19A.EXE
C:\WINDOWS\system32\67481948.EXE
C:\WINDOWS\system32\aqxyy.dll
C:\WINDOWS\system32\nsvce32.exe
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\NTService32.dll
C:\PROGRA~1\COMMON~1\dtes\kxlg.dll
C:\WINDOWS\SYSTEM32\WBEM\BMADY.DLL
C:\WINDOWS\system32\drivers\ajifcfbf.sys
C:\WINDOWS\system32\DRIVERS\msprotect.sys
C:\WINDOWS\System32\DRIVERS\naqbas29.sys

右击D盘盘符，点击“打开”。删除D盘根目录下的Autorun.inf和mplay.com

C:\WINDOWS\system32\WSD_SOCK32.dll（用WinsockxpFix.exe修复）

三、最后，用IceSword删除注册表中的下列内容：

启动项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Desktop><"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Run> []
<adx.exe><C:\Program Files\real\adx.exe> [Microsoft Corporation]
<IEBarUp><RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<{08831C2E-063C-2052-0727-060502060056}><"C:\Program Files\Common Files\{08831C2E-063C-2052-0727-060502060056}\Update.exe" te-110-12-0000049> [N/A]
<zts2><C:\DOCUME~1\zhao\LOCALS~1\Temp\zts2.exe> [N/A]
<rxzs><C:\DOCUME~1\zhao\LOCALS~1\Temp\rxzs.exe> [N/A]
<mhs2><C:\DOCUME~1\zhao\LOCALS~1\Temp\mhs2.exe> [N/A]
<wlzs><C:\DOCUME~1\zhao\LOCALS~1\Temp\wlzs.exe> [N/A]
<><C:\WINDOWS\system32\Systemi.exe> [N/A]
<wdfmgr32><C:\WINDOWS\system32\wdfmgr32.exe> [N/A]
<System><C:\Program Files\Common Files\System\Updaterun.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><136741M.BMP> [N/A]


服务：
[3DFDF19A / 3DFDF19A]
<C:\WINDOWS\system32\3DFDF19A.EXE -service><Microsoft Corporation>
[67481948 / 67481948]
<C:\WINDOWS\system32\67481948.EXE -service><Microsoft Corporation>
[COM+ Messages / COM+ Messages]
<"C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000049><N/A>
[Remote Registry Protect / Patterns]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\aqxyy.dll><Microsoft Corporation>
[pl.eeewl.com / pl.eeewl.com]
<C:\WINDOWS\system32\nsvce32.exe><N/A>
[Windows DHCP Service / WinDHCPsvc]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[Windows NT Service32 / Windows NT Service32]
<"C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Start><Microsoft Corporation>
[Vsn xnyw Service / xnyw]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\dtes\kxlg.dll,Service><Microsoft Corporation>
[Network IPSEC Connections / SHipING]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\BMADY.DLL,Export 1087><N/A>

驱动程序：
[ajifcfbf / ajifcfbf]
<\SystemRoot\system32\drivers\ajifcfbf.sys><N/A>
[msprotect / msprotect]
<system32\DRIVERS\msprotect.sys><Windows (R) 2000 DDK provider>
[naqbas2 / naqbas29]
<\SystemRoot\System32\DRIVERS\naqbas29.sys><N/A>

处理完毕

jpzy

好复杂，其实可以考虑说的通俗易懂一点～！！

ykz1991

LZ还是红伞骑士团的

fido_lee

中毒不浅啊。是你专门中的吧？