才说裸机狂奔，就中了..（附日志） bbs.ikaka.com

瑞星卡卡安全论坛

飞宇翔子 - 2007-5-10 20:54:00

哎上午我才在坛子里说裸资奔的但是就中了
同学移动硬盘有毒啊！
各位大虾帮帮手啊
先谢谢啦
在线等.....
以下是进程和SREngLOG
进程：

System Idle Process
System
C:\WINDOWS\System32\CMD.EXE
C:\WINDOWS\System32\SMSS.EXE
C:\WINDOWS\System32\CSRSS.EXE
C:\WINDOWS\System32\WINLOGON.EXE
C:\WINDOWS\System32\SERVICES.EXE
C:\WINDOWS\System32\LSASS.EXE
C:\WINDOWS\System32\CMD.EXE
C:\WINDOWS\System32\SVCHOST.EXE
C:\WINDOWS\System32\SVCHOST.EXE
C:\WINDOWS\System32\SVCHOST.EXE
C:\WINDOWS\System32\ALG.EXE
C:\WINDOWS\System32\SVCHOST.EXE
C:\WINDOWS\System32\SVCHOST.EXE
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\SPOOLSV.EXE
D:\安全\IceSword\IceSword.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\System32\CTFMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\System32\NVSVC32.EXE
C:\WINDOWS\System32\CMD.EXE
D:\安全\IceSword\IceSword.exe
C:\WINDOWS\System32\ping.exe
D:\Program Files\QQ\QQ.exe
D:\Program Files\QQ\TIMPlatform.exe
C:\WINDOWS\System32\wscript.exe

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Alcmtr><; ALCMTR.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><C:\WINDOWS\Vista\Logoui\logoblack.exe> [LOGONUI]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\夜光时~1.SCR> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<bgswitch><; C:\WINDOWS\system32\bgswitch.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<DAEMON Tools><; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DAEMON Tools Code Signing Services]
<Flashget><; C:\PROGRA~1\FLASHGET\Flashget.exe /min> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [N/A]
<NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<nwiz><; nwiz.exe /install> []
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [N/A]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [N/A]
<RTHDCPL><; RTHDCPL.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<runeip><; C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<SideBar><; C:\WINDOWS\Vista\设置侧边栏.exe 3> [N/A]
<SkyTel><; SkyTel.EXE> [(Verified)Microsoft Windows Publisher]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<SunJavaUpdateSched><; > [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit Start Button><; C:\Program Files\Super Rabbit\MagicSet\SRSB.EXE /Load> [Super Rabbit Soft]
<Taskbar><; C:\WINDOWS\Vista\Spctool\Taskbar\Taskbar.exe> [i00]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<UberIcon><; "C:\WINDOWS\Vista\Spctool\UberIcon\UberIcon Manager.exe"> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Vistadrv><; C:\WINDOWS\Vista\vip\VistaDrv\vsdrv.exe> []

飞宇翔子 - 2007-5-10 20:54:00

==================================
启动文件夹

<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\u.vbe --> [N/A]><N>

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NetMeeting Remote Desktop Sharing / mnmsrvc][Stopped/Disabled]
<><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>
[Creative SBLive! Gameport / ctljystk][Stopped/Manual Start]
<system32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
[ENTECH / ENTECH][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys><N/A>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HWiNFO32 内核驱动 / HWiNFO32][Running/Auto Start]
<\??\H:\系统测试\HWiNFO32\HWiNFO32.SYS><REALiX(tm)>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
<system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[Ke386IO / Ke386IO][Stopped/Manual Start]
<\??\I:\深山红叶系统维护工具\PROGRAMS\BIOSINFO\Ke386IO.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[TVICHW32 / TVICHW32][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS><N/A>

飞宇翔子 - 2007-5-10 20:55:00

==================================
浏览器加载项
[Java Plug-in 1.5.0]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[Java Plug-in 1.5.0]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0]
{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll, Sun Microsystems, Inc.>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, N/A>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\system\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>

飞宇翔子 - 2007-5-10 20:55:00

==================================
正在运行的进程
[PID: 660][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 732][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 776][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1000][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1096][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1252][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1328][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1524][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1852][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.9147]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.9147]
[C:\WINDOWS\system32\nvapi.dll] [N/A, ]
[C:\WINDOWS\system32\nvshell.dll] [, ]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 2024][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.9147]
[C:\WINDOWS\system32\nvapi.dll] [N/A, ]
[PID: 1228][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1344][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1712][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1416][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[PID: 1920][C:\WINDOWS\System32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 272][C:\WINDOWS\System32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2300][C:\WINDOWS\System32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2352][C:\WINDOWS\System32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3828][C:\WINDOWS\System32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 932][C:\WINDOWS\system32\cmd.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1696][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 3020][C:\WINDOWS\System32\WScript.exe] [Microsoft Corporation, 5.6.0.8820]
[PID: 3052][D:\安全\System Repair Engineer\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[D:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[E:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[F:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[G:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[H:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
[2604] C:\WINDOWS\system32\attrib.exe

==================================

[/CODE]

天月来了 - 2007-5-10 21:16:00

呵呵！！！！！

我上午怎说的啊？？？？

看看结果。

sanjingshou - 2007-5-10 21:16:00

下载ICESWORD
结束进程：C:\WINDOWS\system32\attrib.exe

使用ICESWORD删除
每个硬盘中的Autorun.inf
wscript.exe

在删除前，不要运行CMD，不要打开我的电脑，不要运行查找
用ICESWORD找到病毒文件删除即可
这个写毒的人，考虑的还蛮多的啊

运行SRENG修改注册表：
<UIHost><C:\WINDOWS\Vista\Logoui\logoblack.exe> [LOGONUI
改为：<UIHost><Logoui.exe,>

taylor05771 - 2007-5-10 21:25:00

Autorun.inf
[C:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[D:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[E:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[F:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[G:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
[H:\]
[AutoRun]
open=wscript.exe u.vbe
shell\open\Command=wscript.exe u.vbe
shell\explore\Command=wscript.exe u.vbe
shell\find\Command=wscript.exe u.vbe
启动文件夹

<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\u.vbe --> [N/A]><N>

sanjingshou - 2007-5-10 21:28:00

<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\u.vbe --> [N/A]><N>

这个漏类。。
谢网警。。。

火影忍者 - 2007-5-10 21:35:00

[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>

删除

sanjingshou - 2007-5-10 21:38:00

引用:

【火影忍者的贴子】[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>

删除
………………

你看的真是仔细啊，厉害的。。。
我都眼花了。。。

飞宇翔子 - 2007-5-10 21:58:00

引用:

【sanjingshou的贴子】下载ICESWORD
结束进程：C:\WINDOWS\system32\attrib.exe

使用ICESWORD删除
每个硬盘中的Autorun.inf
wscript.exe

在删除前，不要运行CMD，不要打开我的电脑，不要运行查找
用ICESWORD找到病毒文件删除即可
这个写毒的人，考虑的还蛮多的啊

运行SRENG修改注册表：
<UIHost><C:\WINDOWS\Vista\Logoui\logoblack.exe> [LOGONUI
改为：<UIHost><Logoui.exe,>
………………

应该是logonui.exe吧？

飞宇翔子 - 2007-5-10 22:12:00

引用:

【火影忍者的贴子】[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>

删除
………………

[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><N/A>

删除
???
这个是怎么操作的啊？

天月来了 - 2007-5-10 23:07:00

用SRENG工具删除注册表项，（驱动中）

用冰刃删除文件。

System32\Drivers\bootdrv.sys

飞宇翔子 - 2007-5-11 12:57:00

本人在此谢谢楼上各位高手！
本人机器现在正常了！~
该删的删了该改的改掉了
非常之感谢！
有机会我们还会交流的，...

查看完整版本: 才说裸机狂奔，就中了..（附日志）