【求助】发现病毒,但删除不了,高手帮忙!附日志 bbs.ikaka.com

50003008 - 2007-4-26 19:24:00

[CODE]

2007-04-26,19:07:03

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
<x3ykq4><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<wm><C:\WINDOWS\Syswm7\svchost.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<CnxDslTaskBar><C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe> [Conexant Systems Inc.]
<kav><"D:\巴卡杀毒\avp.exe"> [Kaspersky Lab]
<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe"> []
<C-Media Mixer><Mixer.exe /startup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<pxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win1.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
<D:\巴卡杀毒\avp.exe -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[WinWLServiceNow / WinWLServiceNow][Stopped/Auto Start]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE><N/A>

==================================
驱动程序
[C-Media PCI Audio Driver (WDM) / cmpci][Running/Manual Start]
<system32\drivers\cmaudio.sys><C-Media Inc>
[Conexant AccessRunner PCI ADSL WAN Adapter Driver / CnxTgN][Running/Manual Start]
<system32\DRIVERS\CnxTgN.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL WAN Adapter Filter Driver / CnxTgP][Running/Manual Start]
<system32\DRIVERS\CnxTgP.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL Interface Device Driver / CnxTgR][Running/Manual Start]
<system32\DRIVERS\CnxTgR.sys><Conexant Systems Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\迅雷(Thunder)\Thunder.exe, Thunder Networking Technologies,LTD>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\巴卡杀毒\scieplugin.dll, Kaspersky Lab>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Thunder Browser Helper]
{406F94EF-504F-4A40-8DFD-58B0666ABEBD} <D:\迅雷(Thunder)\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[使用迅雷下载]
<D:\迅雷(Thunder)\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<D:\迅雷(Thunder)\Program\GetAllUrl.htm, N/A>

50003008 - 2007-4-26 19:25:00

==================================
正在运行的进程
[PID: 520][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 792][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 836][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 848][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RAVWL425.dll] [N/A, ]
[PID: 1000][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1220][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1292][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1532][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[d:\WinRAR\rarext.dll] [N/A, ]
[D:\巴卡杀毒\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1984][C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslWz.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\CnxHwIo.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2016][C:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 2036][C:\WINDOWS\Mixer.exe] [C-Media Electronic Inc. (www.cmedia.com.tw), 1.58]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\System32\cmnprop.dll] [C-Media Corporation, 5.00.2195.12]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 148][C:\WINDOWS\Syswm7\svchost.exe] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 188][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 2380][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.4]
[D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0]
[D:\巴卡杀毒\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\巴卡杀毒\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\巴卡杀毒\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll] [N/A, ]
[PID: 3668][C:\Documents and Settings\Administrator\桌面\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll] [N/A, ]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF7E58E8F)

==================================
隐藏进程
N/A

==================================

[/CODE]

50003008 - 2007-4-26 19:26:00

==================================
正在运行的进程
[PID: 520][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 792][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 836][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 848][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RAVWL425.dll] [N/A, ]
[PID: 1000][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1068][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1220][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1292][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1532][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[d:\WinRAR\rarext.dll] [N/A, ]
[D:\巴卡杀毒\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1984][C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslWz.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\CnxHwIo.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2016][C:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 2036][C:\WINDOWS\Mixer.exe] [C-Media Electronic Inc. (www.cmedia.com.tw), 1.58]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\System32\cmnprop.dll] [C-Media Corporation, 5.00.2195.12]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 148][C:\WINDOWS\Syswm7\svchost.exe] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 188][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[PID: 2380][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.4]
[D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx] [Macromedia, Inc., 8,0,22,0]
[D:\巴卡杀毒\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\巴卡杀毒\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\巴卡杀毒\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\巴卡杀毒\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\巴卡杀毒\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll] [N/A, ]
[PID: 3668][C:\Documents and Settings\Administrator\桌面\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\Syswm7\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll] [N/A, ]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF7E58E8F)

==================================
隐藏进程
N/A

==================================

[/CODE]

50003008 - 2007-4-26 19:31:00

发现病毒:
木马程序:Trojan-Downloader.Win32.Small.czl

我该怎么杀这木马,有些文件我删了/怎么重起电脑后，过一段时间有出现?

紫墨蓝尘 - 2007-4-26 19:33:00

[CODE]

在桌面建立一个文件夹，再用WinRAR工具(即开始-->所有程序里的WinRAR)打开WinRAR-->点“查找”在磁盘和文件夹选 C: 。找到文件（或文件相关的程序），然后按解压到，选桌面刚建的文件夹，然后确定，然后等所有操作做完后再将那个文件夹压缩加密码123(即高级-->设置密码）给我，我的QQ是397005089或者油箱也行wuduyouli@yahoo.com.cn要找的文件如下:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win1.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\Syswm7\svchost.exe
==============================================================================
关闭所有正在使用的应用程序包括QQ等等
然后关闭系统还原(WIN2000可以忽略）：按我的电脑右键的属性点系统还原，在所有驱动器上关闭系统还原打勾。[等所有操作完成后再去打开]
用ATF清理工具点这里下载http://hzqedison.mm9mm.com/hanhua/ATF-Cleaner-cn.exe,在全选那打勾，然后点立即清理
然后按照我以下的方法做：
==============================================================================
PowerRMV 下载地址:
http://ishare.sina.com.cn/cgi-bin/fileid.cgi?fileid=1020456
使用方法：
分别填入下面的文件（包括完整的路径），勾选“抑止杀灭对象再次生成”，点杀灭【如果其实目标不存在，那就忽略继续】
使用PowerRMV删除如下文件：
C:\WINDOWS\system32\RAVWL425.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxdnd.dll
C:\WINDOWS\Syswm7\Ghook.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll
C:\WINDOWS\system32\mppds.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win1.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\Syswm7\svchost.exe
==============================================================================
等XDelBox杀完后去安全模式进行如下操作（重启电脑不断按F8 然后选安全模式）进不了安全模式,可以在SREng中点系统修复 --> 点高级修复，再点修复安全模式
==============================================================================
用工具 SREng 删除如下各项
在SREng中点启动项目 --> 注册表进入后用鼠标左键在对应要修复的项上单击然后点击"删除"
删除如下项目：
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
<x3ykq4><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
<wm><C:\WINDOWS\Syswm7\svchost.exe> []
<run><> [N/A]有就删除没有就忽略
<pxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win1.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> []
==============================================================================
在SERng中点启动项目 --> 服务 --> Win32服务应用程序进入后（勾选隐藏已认证的微软项目），用鼠标左键在对应要修复的项上单击然后点“删除服务”，再点“设置”按钮即可（注意到最后弹出的窗口中要点 “NO 否”才是确认删除服务。）
删除如下项目：
[WinWLServiceNow / WinWLServiceNow][Stopped/Auto Start]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE><N/A>

==============================================================================
在SREng中点系统修复 --> 点Windows Shell/IE ,勾全选，点“修复”
==============================================================================
以上步骤做完就重启电脑,然后重装QQ(先卸载了，再安装),再用WINDOWS 清理助手点这里下载http://www.arswp.com/download/arswp/arswp.rar和恶意软件清理助手点这里下载http://www.crsky.com/soft/6251.html杀恶意软件,再升级杀毒软件全盘杀毒

分析：無毒侑禮
时间：2007-4-26
QQ：397005089
E-mail：wuduyouli@yahoo.com.cn

50003008 - 2007-4-26 19:37:00

希望能行.我现在还没装QQ.

我现在装.我现在把病毒保留,一会给你传!

紫墨蓝尘 - 2007-4-26 19:43:00

晕``没有QQ就发去油箱就OK了``不用为我走去装QQ 我过意不去

水树雨下 - 2007-4-26 19:48:00

运行sreng2启动项目，注册表删除
<wm><C:\WINDOWS\Syswm7\svchost.exe> []
<pxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win1.exe> []
<x3ykq4><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>
<mppds><C:\WINDOWS\mppds.exe> []
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> []
启动项目，服务,win32服务应用程序，勾选隐藏微软服务后删除
[WinWLServiceNow / WinWLServiceNow][Stopped/Auto Start]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RAVWL.EXE><N/A>
重启后打开我的电脑，工具，文件夹选项，查看，显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉删除
C:\WINDOWS\mppds.exe
C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp
这个文件夹C:\WINDOWS\Syswm7
这个文件夹里的所有文件C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp

RAVWL425.dll插入系统进程
[PID: 848][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\RAVWL425.dll] [N/A, ]
参考这个帖子用冰刃卸除
http://forum.ikaka.com/topic.asp?board=28&artid=8291976

紫墨蓝尘 - 2007-4-26 20:07:00

全部操作做完重新扫一次日志上来吧```我不知道PowerRMV是否可以删除C:\WINDOWS\system32\RAVWL425.dll``

天月来了 - 2007-4-26 21:20:00

估计得用冰刃禁止进程创建，卸除那些插入进程的，才可以彻底删除。

同时楼主的其他文件可能已感染，尽量别再用了，等杀毒软件升级到能清除了再用吧。

当然了，只是估计。

火影忍者 - 2007-4-26 21:33:00

我的网盘里下载xdelbox1删

紫墨蓝尘 - 2007-4-26 21:39:00

全服务全驱动才用xdelbox1和Unlocker比较好```一般的用PowerRMV或者冰刃杀比较好``

50003008 - 2007-4-26 23:49:00

运行sreng2启动项目:出现了一个红色
AppIint_DLLs 215366M.BMP

现在打开网页没发现了.但不知道.杀清了没~

紫墨蓝尘 - 2007-4-26 23:51:00

重新SRE日志上来

50003008 - 2007-4-26 23:53:00

还是不行.我御载了QQ,再准备重新安装QQ

卡巴检测到风险文件 :Hidden install 运行进程(PID:3084)C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.275\QQ2007BETA1PY391.EXE

50003008 - 2007-4-26 23:54:00

还是不行.我御载了QQ,再准备重新安装QQ

卡巴检测到风险文件 :Hidden install 运行进程(PID:3084)C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.275\QQ2007BETA1PY391.EXE

50003008 - 2007-4-26 23:58:00

[复制到剪贴板]

CODE:

2007-04-26,23:44:20

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<CnxDslTaskBar><C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe> [Conexant Systems Inc.]
<kav><"D:\巴卡杀毒\avp.exe"> [Kaspersky Lab]
<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe"> []
<C-Media Mixer><Mixer.exe /startup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><215366M.BMP> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
<D:\巴卡杀毒\avp.exe -r><Kaspersky Lab>

==================================
驱动程序
[C-Media PCI Audio Driver (WDM) / cmpci][Running/Manual Start]
<system32\drivers\cmaudio.sys><C-Media Inc>
[Conexant AccessRunner PCI ADSL WAN Adapter Driver / CnxTgN][Running/Manual Start]
<system32\DRIVERS\CnxTgN.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL WAN Adapter Filter Driver / CnxTgP][Running/Manual Start]
<system32\DRIVERS\CnxTgP.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL Interface Device Driver / CnxTgR][Running/Manual Start]
<system32\DRIVERS\CnxTgR.sys><Conexant Systems Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\QQ\npkcrypt.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\迅雷(Thunder)\Thunder.exe, Thunder Networking Technologies,LTD>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\巴卡杀毒\scieplugin.dll, Kaspersky Lab>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Thunder Browser Helper]
{406F94EF-504F-4A40-8DFD-58B0666ABEBD} <D:\迅雷(Thunder)\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[使用迅雷下载]
<D:\迅雷(Thunder)\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<D:\迅雷(Thunder)\Program\GetAllUrl.htm, N/A>

==================================
正在运行的进程
[PID: 520][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 772][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 848][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 860][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1020][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1112][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1180][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1680][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[d:\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[D:\巴卡杀毒\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[PID: 148][C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslWz.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\CnxHwIo.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 196][C:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[PID: 216][C:\WINDOWS\Mixer.exe] [C-Media Electronic Inc. (www.cmedia.com.tw), 1.58]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\System32\cmnprop.dll] [C-Media Corporation, 5.00.2195.12]
[PID: 240][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[PID: 3592][C:\Documents and Settings\Administrator\桌面\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF7E58E8F)

==================================
隐藏进程
N/A

==================================

紫墨蓝尘 - 2007-4-26 23:58:00

QQ的用TM2006好``如果要装QQ的用2006比较稳定`` 你发去我油箱就可以了不用装QQ 日志快上来我要睡了

50003008 - 2007-4-26 23:59:00

[复制到剪贴板]

CODE:

2007-04-26,23:44:20

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<CnxDslTaskBar><C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe> [Conexant Systems Inc.]
<kav><"D:\巴卡杀毒\avp.exe"> [Kaspersky Lab]
<UnlockerAssistant><"C:\Program Files\Unlocker\UnlockerAssistant.exe"> []
<C-Media Mixer><Mixer.exe /startup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><215366M.BMP> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
<D:\巴卡杀毒\avp.exe -r><Kaspersky Lab>

==================================
驱动程序
[C-Media PCI Audio Driver (WDM) / cmpci][Running/Manual Start]
<system32\drivers\cmaudio.sys><C-Media Inc>
[Conexant AccessRunner PCI ADSL WAN Adapter Driver / CnxTgN][Running/Manual Start]
<system32\DRIVERS\CnxTgN.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL WAN Adapter Filter Driver / CnxTgP][Running/Manual Start]
<system32\DRIVERS\CnxTgP.sys><Conexant Systems Inc.>
[Conexant AccessRunner PCI ADSL Interface Device Driver / CnxTgR][Running/Manual Start]
<system32\DRIVERS\CnxTgR.sys><Conexant Systems Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\E:\QQ\npkcrypt.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\迅雷(Thunder)\Thunder.exe, Thunder Networking Technologies,LTD>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\巴卡杀毒\scieplugin.dll, Kaspersky Lab>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <D:\迅雷(Thunder)\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Thunder Browser Helper]
{406F94EF-504F-4A40-8DFD-58B0666ABEBD} <D:\迅雷(Thunder)\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\迅雷(Thunder)\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[使用迅雷下载]
<D:\迅雷(Thunder)\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<D:\迅雷(Thunder)\Program\GetAllUrl.htm, N/A>

==================================
正在运行的进程
[PID: 520][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 772][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 796][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 848][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 860][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1020][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1112][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1180][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[PID: 1680][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[d:\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[D:\巴卡杀毒\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[D:\迅雷(Thunder)\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[D:\迅雷(Thunder)\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[PID: 148][C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslTb.exe] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\A360-1\A360-1 PCI Modem\CnxDslWz.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\system32\CnxHwIo.dll] [Conexant Systems Inc., 2.099.040.000]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 196][C:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[PID: 216][C:\WINDOWS\Mixer.exe] [C-Media Electronic Inc. (www.cmedia.com.tw), 1.58]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[C:\WINDOWS\System32\cmnprop.dll] [C-Media Corporation, 5.00.2195.12]
[PID: 240][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[PID: 3592][C:\Documents and Settings\Administrator\桌面\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\215366M.BMP] [N/A, ]
[C:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF7E58C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF7E58E8F)

==================================
隐藏进程
N/A

==================================

紫墨蓝尘 - 2007-4-27 0:10:00

用IceSword（中文名字叫冰刃）霏凡下载地址：http://www.crsky.com/soft/6947.html
打开IceSword.exe然后按上面的 “文件”然后点 “设置” 然后勾选“禁止进线程创建”和“禁止协件功能”然后点确定。
点文件找到以下项目删除：
C:\WINDOWS\system32\215366M.BMP
==============================================================================
杀完后去安全模式进行如下操作（重启电脑不断按F8 然后选安全模式）进不了安全模式,可以在SREng中点系统修复 --> 点高级修复，再点修复安全模式
==============================================================================
用工具 SREng 删除如下各项
在SREng中点启动项目 --> 注册表进入后用鼠标左键在对应要修复的项上单击然后点击"删除"
删除如下项目：
编辑<AppInit_DLLs><215366M.BMP> []为<AppInit_DLLs><> []

紫墨蓝尘 - 2007-4-27 0:11:00

今天卡卡半日游到此结束````希望各位高手有病毒的话就发去我的油箱 wuduyouli@yahoo.com.cn 记得要压缩加密码123 谢谢大家

瑞星卡卡安全论坛