计算机开机时显示：Windows找不到文件driver.exe，怎么办修复？ bbs.ikaka.com

gemeter - 2007-5-1 11:36:00

求助

姑苏残月 - 2007-5-1 11:46:00

这说明你是安全的,如果有那文件你就中毒了
处理方法:
开始->运行->REGEDIT
这样子打开了注册表
然后在注册表中搜索driver.exe
查找到的所有注册表键值全部删除,就好了

gemeter - 2007-5-1 11:51:00

谢了，我的计算机是中过毒，所有的exe文件都无法运行，自己修复后，出现这个问题的。

GHRH - 2007-5-1 12:04:00

ＲＵＮ里面吧

附件: 431896200751115425.bmp

火影忍者 - 2007-5-1 12:05:00

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
日志一次发不完，请分次发上来

GHRH - 2007-5-1 12:07:00

看一下就知道了　然后删除即可！

附件: 431896200751115800.bmp

gemeter - 2007-5-1 12:36:00

[CODE]

2007-05-01,12:16:49

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
<swg><C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe> [(Verified)Google Inc]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<igfxtray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<igfxhkcmd><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<igfxpers><C:\WINDOWS\System32\igfxpers.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows XP Publisher]
<BigDog303><C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)> [N/A]
<KAVPersonal50><"D:\Program Files\Kaspersky Anti-Virus\kav.exe" /minimize> [Kaspersky Lab]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [(Verified)"beijing yahoo consulting and service co., ltd."]
<WebThunder><d:\Program Files\Thunder Network\WebThunder\WebThunder.exe> [(Verified)ShenZhen Thunder Networking Technologies Ltd.]
<CnsM.dll><Rundll32.exe C:\PROGRA~1\3721\CnsM.dll,Rundll32> [北京三七二一科技有限公司]
<helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
<CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32> [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<usrinit><C:\WINDOWS\system32\usrinit.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe driver.exe> [N/A]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\CnsHook.dll> [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]

==================================
启动文件夹
[Acrobat Assistant]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Acrobat Assistant.lnk --> D:\PROGRA~1\Acrobat\Distillr\AcroTray.exe [Adobe Systems Inc.]><N>
[卡巴斯基反黑客]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\卡巴斯基反黑客.lnk --> D:\PROGRA~1\KASPER~2\KAVPF.exe [Kaspersky Lab]><N>

==================================
服务
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[kavsvc / kavsvc][Running/Auto Start]
<"D:\Program Files\Kaspersky Anti-Virus\kavsvc.exe"><Kaspersky Lab>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[CnsMinKP / CnsMinKP][Running/Boot Start]
<\SystemRoot\System32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\H:\INSTALL\GMSIPCI.SYS><N/A>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kdlijgrh / kdlijgrh][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kdlijgrh.sys><N/A>
[Kl1 / Kl1][Running/Boot Start]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif][Running/System Start]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
<System32\drivers\klmc.sys><Kaspersky Lab>
[Klpf / Klpf][Running/Boot Start]
<\SystemRoot\System32\drivers\Klpf.sys><KL>
[Klpid / Klpid][Running/Boot Start]
<\SystemRoot\System32\drivers\Klpid.sys><KL>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\Tencent QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[tscwevzf / tscwevzf][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\tscwevzf.sys><Yahoo! China Corporation>
[vmfilter303 / vmfilter303][Stopped/Manual Start]
<system32\drivers\vmfilter303.sys><Vimicro Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Teclast 303 PC Camera (Vimicro301 Neptune) / ZSMC303][Stopped/Manual Start]
<System32\Drivers\usbVM303.sys><Vimicro Corporation>
[R2A / R2A][Stopped/Disabled]
<\??\C:\WINDOWS\System32a2.sys><N/A>

gemeter - 2007-5-1 12:37:00

==================================
浏览器加载项
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <d:\Program Files\Acrobat\Acrobat\ActiveX\AcroIEHelper.ocx, >
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <d:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Yahoo!Photo]
{33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll, yahoo! china>
[IEInit Class]
{5B02EBA1-EFDD-477D-A37F-05383165C9C0} <C:\WINDOWS\System32\drivers\usrinit.dll, >
[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, yahoo! china>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[CnsHook Class]
{D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\DOWNLO~1\CnsHook.dll, 北京三七二一科技有限公司>
[yFlashDl Class]
{F166BC04-3C84-44cc-A6E9-2315EC4844B9} <C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll, Yahoo! China>
[assist]
{FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll, Yahoo! China>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <d:\Program Files\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[解霸]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Program Files\HEROSOFT\Hero3000\MPLAYER.EXE, N/A>
[Yahoo 3.5G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[名品折扣]
{59BC54A2-56B3-44a0-93E5-432D58746E26} <http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816, N/A>
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[雅虎WIDGET]
{6354ABE6-05F1-49ed-B850-E423120EC338} <http://cn.widget.yahoo.com/index.htm?source=Cns, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent QQ\QQ.EXE, TENCENT>
[情景聊天]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[易趣购物]
{EE60714F-AC17-427e-861A-FD60CBDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=159, N/A>
[精彩图铃]
{EE60714F-AC27-427e-861A-FD60CBDF119A} <http://click2.ad4all.net/url2/urlmanage/url.asp?id=162, N/A>
[]
{FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[雅虎助手]
{406F94F0-504F-4A40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, yahoo! china>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\DOWNLO~1\TSOBase.ocx, Tencent Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WebThunder Class]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
[AutoLive]
{7CA83CF1-3AEA-42D0-A4E3-1594FC6E48B2} <C:\PROGRA~1\3721\autolive.dll, >
[上传到QQ网络硬盘]
<D:\Program Files\Tencent QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<d:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<d:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
[使用迅雷下载]
<D:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<D:\Program Files\Thunder\Program\getallurl.htm, N/A>
[在Foxmail中添加该RSS频道/频道组]
<res://C:\WINDOWS\System32\fmrsslink.dll/201, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[易趣购物]
<C:\Program Files\AD4All\link1\ebaylink.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent QQ\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
<res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent QQ\SendMMS.htm, N/A>
[精彩图铃]
<C:\Program Files\AD4All\link2\phone.htm, N/A>
[解霸实时播放]
<C:\Program Files\HEROSOFT\Hero3000\MPURLGET.HTM, N/A>
[雅虎搜索]
<res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/203, N/A>

gemeter - 2007-5-1 12:39:00

==================================
正在运行的进程
[PID: 512][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 560][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 584][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 628][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 640][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 820][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 872][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\wups.dll] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 956][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1016][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1168][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.2175.0]
[C:\WINDOWS\System32\pdfports.dll] [Adobe Systems Incorporated., 5.0.000]
[d:\Program Files\Acrobat\Distillr\ADistRes.CHS] [Adobe Systems Incorporated., 5.0.0.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.2175.0]
[PID: 1452][C:\WINDOWS\Explorer.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [北京三七二一科技有限公司, 2.5.1.4]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] [yahoo! china, 3, 6, 7, 1122]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] [Yahoo! China, 3, 0, 2, 1011]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[d:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[d:\Program Files\Thunder\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\WINDOWS\System32\drivers\usrinit.dll] [, 1, 0, 0, 1]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\alrex.dll] [, 2.5.0.1002]
[d:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\Program Files\Kaspersky Anti-Virus\shellex.dll] [Kaspersky Lab, 5.0.388.1]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 2, 1005]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[C:\WINDOWS\System32\tssoft32.acm] [DSP GROUP, INC., 1.01]
[C:\WINDOWS\System32\tsd32.dll] [, ]
[d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[d:\Program Files\Acrobat\Acrobat\ActiveX\AcroIEHelper.ocx] [, 1, 0, 0, 1]
[C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] [Yahoo! China, 3, 0, 8, 1010]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] [yahoo! china, 3, 0, 6, 1008]
[C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll] [Yahoo! China, 3, 0, 1, 1013]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll] [Yahoo! China, 3, 1, 8, 1023]
[D:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] [Yahoo! China, 3, 0, 5, 1009]
[PID: 1576][C:\WINDOWS\system32\usrinit.exe] [, 1, 0, 0, 1]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[PID: 1616][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.4543]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[PID: 1624][C:\WINDOWS\System32\igfxpers.exe] [Intel Corporation, 3.0.0.4543]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4543]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[PID: 1632][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 56]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[PID: 1640][C:\WINDOWS\VM303_STI.EXE] [Vimicro, 3, 6, 227, 13]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\System32\msdmo.dll] [, ]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[PID: 1664][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.1622]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[PID: 392][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 2, 1005]
[C:\PROGRA~1\3721\notifier.dll] [, 2.5.0.1002]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[PID: 408][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[PID: 416][C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe] [Google Inc., 1, 2, 1128, 5462]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\res_zh-CN.dll] [Google Inc., 1, 2, 1128, 5462]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\swg.dll] [Google Inc., 1, 2, 1128, 5462]
[PID: 452][D:\Program Files\Acrobat\Distillr\AcroTray.exe] [Adobe Systems Inc., 5, 0, 0, 0]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[PID: 492][D:\Program Files\Kaspersky Anti-Hacker\KAVPF.exe] [Kaspersky Lab, 1.8.0.180]
[D:\Program Files\Kaspersky Anti-Hacker\BCGCB59.dll] [BCGSoft Ltd, 5, 84, 0, 0]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[D:\Program Files\Kaspersky Anti-Hacker\perfiloc.dll] [Kaspersky Lab, 1.5.0.0]
[D:\Program Files\Kaspersky Anti-Hacker\BCGCBRes.dll] [BCGSoft Ltd, 5, 84, 0, 0]
[PID: 2324][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\3721\scrblock.dll] [3721, 2.5.0.1002]
[C:\PROGRA~1\3721\alrex.dll] [, 2.5.0.1002]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] [Yahoo! China, 3, 0, 3, 1004]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[C:\WINDOWS\DOWNLO~1\CnsHint.dll] [3721, 2, 5, 0, 2]
[C:\PROGRA~1\3721\autolive.dll] [, 2, 5, 2, 1005]
[C:\PROGRA~1\3721\alLiveEx.dll] [ , 1, 0, 3, 1006]
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] [yahoo! china, 3, 6, 7, 1122]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] [Yahoo! China, 3, 0, 2, 1011]
[C:\WINDOWS\DOWNLO~1\cnsplus.dll] [3721, 2, 5, 0, 2]

gemeter - 2007-5-1 12:39:00

[d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.4]
[C:\WINDOWS\DOWNLO~1\CnsHook.dll] [北京三七二一科技有限公司, 2.5.1.4]
[D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[d:\Program Files\Acrobat\Acrobat\ActiveX\AcroIEHelper.ocx] [, 1, 0, 0, 1]
[d:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[d:\Program Files\Thunder\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll] [Yahoo! China, 3, 0, 8, 1010]
[C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll] [yahoo! china, 3, 0, 5, 1007]
[C:\WINDOWS\System32\drivers\usrinit.dll] [, 1, 0, 0, 1]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL] [yahoo! china, 3, 0, 6, 1008]
[c:\program files\google\googletoolbar2.dll] [Google Inc., 4, 0, 1601, 4978]
[C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll] [Yahoo! China, 3, 0, 1, 1013]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yassist.dll] [Yahoo! China, 3, 1, 8, 1023]
[D:\Program Files\Kaspersky Anti-Virus\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[D:\Program Files\Kaspersky Anti-Virus\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[D:\Program Files\Kaspersky Anti-Virus\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\DOWNLO~1\CnsMinIO.dll] [北京三七二一科技有限公司, 2, 5, 0, 4]
[C:\WINDOWS\DOWNLO~1\cnsio.dll] [北京三七二一科技有限公司, 2, 5, 0, 3]
[C:\WINDOWS\System32\UNISPIM5.IME] [北京紫光华宇软件股份有限公司, 5.0.0.5091]
[C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[PID: 2540][d:\Program Files\Thunder Network\WebThunder\WebThunder.exe] [深圳市迅雷网络技术有限公司, 1, 7, 2, 107]
[d:\Program Files\Thunder Network\WebThunder\taskmanage.dll] [Thunder Networking Technologies,LTD, 1, 7, 2, 107]
[d:\Program Files\Thunder Network\WebThunder\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 79]
[d:\Program Files\Thunder Network\WebThunder\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[d:\Program Files\Thunder Network\WebThunder\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 79]
[d:\Program Files\Thunder Network\WebThunder\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 13, 4, 58]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]
[d:\Program Files\Thunder Network\WebThunder\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 3, 0, 228]
[d:\Program Files\Thunder Network\WebThunder\iEmbedShell.dll] [　, 1, 0, 0, 17]
[d:\Program Files\Thunder\Components\InMedia\iEmbed09.dll] [　, 3, 3, 0, 80]
[D:\Program Files\Kaspersky Anti-Virus\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[D:\Program Files\Kaspersky Anti-Virus\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[D:\Program Files\Kaspersky Anti-Virus\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[D:\Program Files\Kaspersky Anti-Virus\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[D:\Program Files\Kaspersky Anti-Virus\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[d:\program files\kaspersky anti-virus\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2984][G:\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\PROGRA~1\3721\CnsM.dll] [北京三七二一科技有限公司, 2.5.3.1005]
[C:\PROGRA~1\3721\helper.dll] [, 2, 5, 0, 1003]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [Yahoo! China, 3, 0, 8, 1026]
[C:\WINDOWS\DOWNLO~1\CnsMin.dll] [北京三七二一科技有限公司, 1, 5, 2, 4]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS Error. [超级解霸3000]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xAAE426E0)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xAAE42820)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xAAE428E0)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xAAE42780)

==================================
隐藏进程
[1649] D:\Program Files\Kaspersky Anti-Virus\kav.exe
[1672] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
[1873] D:\Program Files\Kaspersky Anti-Virus\kavsvc.exe

==================================

[/CODE]

GHRH - 2007-5-1 12:40:00

WA K
这么多好东东! 呵呵
这里:
<shell><Explorer.exe driver.exe> [N/A]

gemeter - 2007-5-1 12:54:00

具体怎么操作？
在SReng里面直接删除这个选项即可？
还有一开机后老是自动跳出两个窗口，自动打开，怎么删除？
谢谢了。

我修改注册表，删除driver.exe，开机还是不行。

GHRH - 2007-5-1 12:59:00

啊我也是菜鸟请高手来帮你吧! 呵呵不好意思

火影忍者 - 2007-5-1 13:27:00

运行SREng-在"启动项目->注册表->编辑
<usrinit><C:\WINDOWS\system32\usrinit.exe> []
为：
<usrinit><C:\WINDOWS\system32\usrinit.exe，> []（逗号不可省略）

编辑：
<shell><Explorer.exe driver.exe> [N/A]
为
<shell><Explorer.exe> [N/A]

运行SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[kdlijgrh / kdlijgrh][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kdlijgrh.sys><N/A>
[R2A / R2A][Stopped/Disabled]
<\??\C:\WINDOWS\System32a2.sys><N/A>

重启删除以下文件:
C:\WINDOWS\System32a2.sys
C:\WINDOWS\System32\drivers\kdlijgrh.sys
C:\WINDOWS\System32\driver.exe
打开SRE--系统修复--文件关联--修复

下载超级兔子清理下流氓软件。。

gemeter - 2007-5-1 13:28:00

多谢楼上，我马上就去试试。

瑞星卡卡安全论坛