高手急救，QQ登入不了 bbs.ikaka.com

999999999999 - 2007-5-11 17:51:00

昨天上网下东西，后来就查出
木马程序 Trojan-PSW.Win32.QQPass.wp 文件: C:\Program Files\Common Files\System\isignup.sys/NSPack

木马程序 Trojan-Downloader.Win32.QQHelper.fu 文件: C:\WINDOWS\system32\lataq.dll/PE_Patch

木马程序 Trojan-Downloader.Win32.QQHelper.fu 文件: C:\WINDOWS\system32\tqdjb.dll/PE_Patch

木马程序 Trojan-Downloader.Win32.QQHelper.vd 文件: C:\WINDOWS\system32\wbem\oeqci.dll

木马程序 Trojan-Downloader.Win32.QQHelper.vd 文件: C:\WINDOWS\system32\wbem\ypwiy.dll

木马程序 Trojan-PSW.Win32.QQPass.wp 文件: C:\WINDOWS\Temp\PRFF.tmp

清除不了的，为什么啊
该怎么杀

过客2007 - 2007-5-11 18:03:00

日志扫描工具:

3.System Repair Engineer 2.4.12.806
System Repair Engineer (SREng) 是一款计算机安全辅助和系统维护辅助软件。主要用于发现、发掘潜在的系统故障和大多数由于计算机病毒造成的破坏，并提供一系列的修改建议和自动修复方法。该软件是由 KZTechs.COM 网站站长 Smallfrogs 开发的，能够运行在所有主流的 Windows 操作系统上。
System Repair Engineer (SREng) 2.4 版本在以往版本的基础上，继续增强了危险性检测和扩展功能，增加了Win32 API HOOK详细信息显示功能、Win32 API HOOK入口点修复功能、可疑文件自动提取功能、增加隐藏进程扫描功能等20余项修改和增强，在安全判断方面和自动处理方面继续完善，提供了一套全新的系统扫描、配置功能，并提供了对第三方插件支持，同时继续提供对 Windows Vista 操作系统的支持。
在 System Repair Engineer (SREng) 的帮助下，您可以自己诊断您操作系统可能存在的普遍性问题，即使您是计算机的初学者，您也可以使用 System Repair Engineer (SREng) 的智能扫描功能将您系统的概况生成一份简要的日志，然后将该日志传送给对操作系统熟悉的朋友或网友，在他们的帮助下解决您系统可能存在的问题。
在 System Repair Engineer (SREng) 2.4 版本里面，主要发生的变化有以下一些方面：

API HOOK相关类别
1.增加API HOOK详细信息显示功能：能够智能显示被HOOK的API是由哪个模块进行HOOK的。
2.增加入口点修复功能：能够自动修复System Repair Engineer (SREng) 进程中被HOOK的所有受支持的API入口点，解决由于API HOOK带来的文件、注册表等关键信息被隐藏的问题。
3.增加API 安全等级显示：能够显示被HOOK的API是否属于高危API，如果属于高危API，则会以红色高亮显示。
4.增加受信任HOOK模式：对于系统进行的HOOK，自动添加到受信任模式列表里面，同时自动降低被HOOK API 安全等级。
5.扩展API HOOK检测范围：在 System Repair Engineer (SREng) 2.4 版本里面，扩大了API HOOK检测范围。
6.提高API HOOK检测精确性：在 System Repair Engineer (SREng) 2.4 版本里面，采用了新的检测方法，提高了API HOOK的检测精确性和稳定性。

智能处理相关类别
7.增加可疑文件自动提取功能：能够根据扫描结果自动的将日志里面的可疑文件自动提取到指定目录。支持注册表启动项、启动文件夹项目、服务应用程序、进程模块、API HOOK模块、可疑进程、Autorun.inf等20个种类。
8.增加可疑文件自动分类功能：能够根据扫描类别自动分类，并且支持同一份内容文件只保留一份，能够自动删除冗余文件。
9.增加数字签名发行者信息显示功能：能够直接显示被数字签名签署的文件是具体的签署者，能够更准确的判定被检测的文件是否安全。

智能扫描相关类别
10.增加隐藏进程扫描功能：对于无法通过正常途径检测到的进程，能够自动发出警告提示信息。
11.扩大扫描范围：增加对Installed Components等新的启动类型的扫描功能。
12.增加对Userinit和Shell两个启动键值的自动修复功能。

框架相关
13.优化泡泡窗口显示模式：对于高危紧急通知，显示橘红色背景，否则以显示蓝色背景。
14.调整插件管理器工作模式：增加插件不全时引导下载功能。
15.增强System Repair Engineer (SREng)自身抗修改能力，当发现System Repair Engineer (SREng)进程空间里面有可疑数据时，能够自动警示用户。以缓解System Repair Engineer (SREng)被恶意修改导致无法正常工作的现象。
16.优化在线版本检测方式：新的方式优化了检测方法，能够更有效的检测线上新版本。同时增加了紧急更新模式。

插件相关
17.增加网络活动监视器：能够监视TCP/UDP协议的连接情况。

其他
18.修正以往版本里面存在的几个BUG。
19.提高了软件的稳定性
20.调整插件用导出函数定义。System Repair Engineer (SREng) 2.4版本导出函数只提供ANSI接口。

KZTechs.COM网站页面已加入google广告，大家可以点击页面上的google广告来支持System Repair Engineer。

System Repair Engineer下载链接（597KB）：
本地下载1：http://download.kztechs.com/files/sreng2.zip
本地下载2：http://www.kztechs.com/sreng/sreng2.zip
镜像下载（华军软件园）：http://www.newhua.com/soft/25562.htm

扫描之后帖上来,高手们会替楼主解决的.

阿门~

999999999999 - 2007-5-11 19:01:00

好的，谢谢

999999999999 - 2007-5-11 19:05:00

[CODE]

2007-05-11,18:51:06

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Q-MediaBar><; "C:\Program Files\BenQ\Q-MediaBar\QBar.exe" /stop> [ ]
<QMusic2><; "C:\Program Files\BenQ\QMusic2\QMAgent.exe"> []
<MSPY2002><; C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)Microsoft Windows Publisher]
<IMEKRMIG6.1><; C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [(Verified)Microsoft Windows Publisher]
<kav><"E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"> [Kaspersky Lab]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [(Verified)"RealNetworks, Inc."]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\JOYBOOK.SCR> [Axialis Software]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<EOUApp><; "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"> [Intel Corporation]
<High Definition Audio Property Page Shortcut><; CHDAudPropShortcut.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<IntelWireless><; "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless> [Intel Corporation]
<IntelZeroConfig><; "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"> [Intel Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<nwiz><; nwiz.exe /install> []
<PCSuiteTrayApplication><; E:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup> [Nokia]
<RemoteControl><; "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"> [Cyberlink Corp.]
<runeip><; E:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<StormCodec_Helper><; "e:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [(Verified)"RealNetworks, Inc."]
<Ulead AutoDetector><; C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe> [Ulead Systems, Inc.]

999999999999 - 2007-5-11 19:06:00

启动文件夹
N/A

==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Application Management / AppMgmt][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[卡巴斯基反病毒6.0 / AVP][Running/Auto Start]
<"E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[Bluetooth Service / btwdins][Running/Auto Start]
<C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe><Broadcom Corporation.>
[Intel(R) PROSet/Wireless Event Log / EvtEng][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Intel(R) PROSet/Wireless Registry Service / RegSrvc][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Intel(R) PROSet/Wireless Service / S24EventMonitor][Running/Auto Start]
<C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[ServiceLayer / ServiceLayer][Stopped/Manual Start]
<"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>

==================================
驱动程序
[AEGIS Protocol (IEEE 802.1x) v3.4.9.0 / AegisP][Running/Auto Start]
<system32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[蓝牙音频设备 / btaudio][Running/Manual Start]
<system32\drivers\btaudio.sys><Broadcom Corporation.>
[蓝牙虚拟通信驱动程序 / BTDriver][Stopped/Manual Start]
<system32\DRIVERS\btport.sys><Broadcom Corporation.>
[蓝牙总线枚举器 / BTKRNL][Running/Manual Start]
<system32\DRIVERS\btkrnl.sys><Broadcom Corporation.>
[蓝牙局域网接入服务器 / BTWDNDIS][Stopped/Manual Start]
<system32\DRIVERS\btwdndis.sys><Broadcom Corporation.>
[btwhid / btwhid][Stopped/Manual Start]
<system32\DRIVERS\btwhid.sys><Broadcom Corporation.>
[Microsoft UAA Function Driver for High Definition Audio Service / HdAudAddService][Running/Manual Start]
<system32\drivers\CHDAud.sys><Conexant Systems Inc.>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HSF_DPV / HSF_DPV][Running/Manual Start]
<system32\DRIVERS\HSX_DPV.sys><Conexant Systems, Inc.>
[HSXHWAZL / HSXHWAZL][Running/Manual Start]
<system32\DRIVERS\HSXHWAZL.sys><Conexant Systems, Inc.>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[mdmxsdk / mdmxsdk][Running/Auto Start]
<system32\DRIVERS\mdmxsdk.sys><Conexant>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
<system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
<system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
<system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\e:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[WLAN 传输 / s24trans][Running/Auto Start]
<system32\DRIVERS\s24trans.sys><Intel Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
<system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tifm21 / tifm21][Running/Manual Start]
<system32\drivers\tifm21.sys><Texas Instruments>
[Intel(R) PRO/Wireless 3945ABG Adapter Driver / w39n51][Stopped/Manual Start]
<system32\DRIVERS\w39n51.sys><Intel? Corporation>
[winachsf / winachsf][Running/Manual Start]
<system32\DRIVERS\HSX_CNXT.sys><Conexant Systems, Inc.>
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Running/Manual Start]
<system32\DRIVERS\yk51x86.sys><Marvell>

999999999999 - 2007-5-11 19:07:00

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <e:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <e:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <e:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <e:\Program Files\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[PortalCom AAA 1.0]
{414E7D87-8073-4EFB-9E4B-C8DF04C979EE} <C:\WINDOWS\DOWNLO~1\PORTAL~1.OCX, Huawei Co. Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[ThunderAtOnce Class]
{01443AEC-0FD1-40FD-9C87-E93D1494C233} <e:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <e:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IeHelper Class]
{0D42E1BD-09DD-4873-A826-9C7E793EB7B6} <e:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll, Thunder Networking Technologies,LTD>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[PortalCom AAA 1.0]
{414E7D87-8073-4EFB-9E4B-C8DF04C979EE} <C:\WINDOWS\DOWNLO~1\PORTAL~1.OCX, Huawei Co. Ltd.>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <e:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用迅雷下载]
<e:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<e:\Program Files\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://E:\office\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

999999999999 - 2007-5-11 19:09:00

正在运行的进程
[PID: 632][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 688][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 712][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 756][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 768][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 936][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1024][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[PID: 964][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.8320]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8320]
[C:\WINDOWS\system32\nvshell.dll] [, ]
[e:\Program Files\WinRAR\rarext.dll] [N/A, ]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll] [Kaspersky Lab, 6.0.0.299]
[e:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[e:\Program Files\Thunder\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\system32\btncopy.dll] [Broadcom Corporation., 5.1.0.1700]
[E:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll] [Nokia, 6, 81, 46, 1]
[E:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll] [Nokia, 6, 81, 68, 0]
[C:\WINDOWS\system32\ConnAPI.DLL] [Nokia., 6, 81, 62, 0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[E:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] [Nokia, 6, 81, 29, 0]
[E:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] [Nokia, 6, 81, 11, 0]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1756][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe] [Synaptics, Inc., 8.1.12 30Sep05]
[C:\WINDOWS\system32\SynCOM.dll] [Synaptics, Inc., 8.1.12 30Sep05]
[C:\WINDOWS\system32\SynTPAPI.dll] [Synaptics, Inc., 8.1.12 30Sep05]
[PID: 1864][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2944][E:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe] [N/A, ]
[E:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\cw3220.DLL] [Borland International, 2.0]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]

999999999999 - 2007-5-11 19:09:00

[PID: 3760][e:\Program Files\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5, 6, 1, 292]
[e:\Program Files\Thunder\Program\TaskManager.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 20]
[e:\Program Files\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 77]
[e:\Program Files\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[e:\Program Files\Thunder\Program\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 14, 2, 77]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[e:\Program Files\Thunder\Program\BHOStub.dll] [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
[e:\Program Files\Thunder\Components\DownAndPlay\DownAndPlay.dll] [, 1, 0, 0, 2]
[e:\Program Files\Thunder\Program\iTargetAD.dll] [Thunder Networking Technologies,LTD, 1, 0, 2, 26]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[e:\Program Files\Thunder\Components\InMedia\iEmbedShell.dll] [　, 1, 0, 0, 17]
[e:\Program Files\Thunder\Components\Community\XLCommunity.dll] [Thunder Networking Technologies,LTD, 1, 0, 6, 26]
[e:\Program Files\Thunder\Program\LiveUpdate.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 20]
[e:\Program Files\Thunder\Components\Search\XLSearch.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 10]
[e:\Program Files\Thunder\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 2, 2, 1, 46]
[e:\Program Files\Thunder\Components\DiagnoseHelper\DiagnoseHelper.dll] [Thunder Networking Technologies,LTD, 1, 1, 1, 16]
[e:\Program Files\Thunder\Components\ExplorerHelper\ExplorerHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
[e:\Program Files\Thunder\Components\Tips\TipsClient.dll] [Thunder Networking Technologies,LTD, 2, 1, 3, 58]
[e:\Program Files\Thunder\Components\VPSHELL\VPSHELL.dll] [XunLei, 1, 2, 0, 8]
[e:\Program Files\Thunder\Components\UserExperience\UserExperience.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[e:\Program Files\Thunder\Components\ResWorker\DsXlCom.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 4]
[e:\Program Files\Thunder\Components\InMedia\iEmbed09.dll] [　, 3, 3, 0, 80]
[e:\Program Files\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 13, 2, 61]
[e:\Program Files\Thunder\Plugins\BhoAdv\bho_adv.dll] [深圳市迅雷网络技术有限公司, 1.0.1.0]
[e:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[e:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[e:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.4]
[e:\Program Files\Thunder\Components\VPSHELL\VideoPicture.dll] [XunLei, 1, 2, 0, 9]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[e:\Program Files\Thunder\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[e:\Program Files\Thunder\Program\XLNet.Dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[e:\Program Files\Thunder\Components\ResWorker\MediaWorker.dll] [Thunder Networking Technologies,LTD, 1, 2, 0, 8]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\Program Files\Thunder\Program\FloatBar.dll] [Giganology Inc., 1, 0, 0, 2]
[PID: 4892][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[e:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.4]
[e:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 6.0.0.2003051500]
[e:\Program Files\Thunder\Components\ResWorker\DSIeHelper.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[e:\Program Files\Thunder\Components\ResWorker\DataProcessor.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[E:\office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\UNISPIM6.IME] [北京紫光华宇软件股份有限公司, 6.0.0.6077]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[e:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\xpsp3res.dll] [Microsoft Corporation, 5.1.2600.3100 (xpsp_sp2_gdr.070309-0025)]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx] [Adobe Systems, Inc., 9,0,45,0]
[C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL] [Microsoft Corporation, 11.0.5510]
[e:\Program Files\Thunder\ComDlls\ThunderAgent_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 17]
[PID: 4544][e:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[E:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll] [Nokia, 6, 81, 46, 1]
[E:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll] [Nokia, 6, 81, 68, 0]
[C:\WINDOWS\system32\ConnAPI.DLL] [Nokia., 6, 81, 62, 0]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[E:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] [Nokia, 6, 81, 29, 0]
[E:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] [Nokia, 6, 81, 11, 0]
[PID: 4064][C:\DOCUME~1\bkt\LOCALS~1\Temp\Rar$EX00.000\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\TcpIpDog0.dll] [N/A, ]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\system32\TcpIpDog0.dll(, N/A)
RSVP UDP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)
RSVP TCP Service Provider
C:\WINDOWS\system32\TcpIpDogR0.dll(, N/A)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF4792B25)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF4792D67)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF4792F0B)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF4792C49)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF4792E8F)

==================================
隐藏进程
N/A

==================================

[/CODE]

过客2007 - 2007-5-11 19:28:00

以偶的功力,没有任何发现,请楼主期待高手的降临~~~

阿门~~

可以试着用瑞星卡卡助手的系统启动项管理,找到下面三项,把前面的勾去掉,重启,看看还能删除不?

<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Q-MediaBar><; "C:\Program Files\BenQ\Q-MediaBar\QBar.exe" /stop> [ ]
<QMusic2><; "C:\Program Files\BenQ\QMusic2\QMAgent.exe"> []

以上有风险,不到万不得已,请勿.....

清风弃月 - 2007-5-11 19:38:00

楼主怎么发现那些文件的呢？

又是怎么发现删除不了的呢？？？？？？？？？？？？？？

999999999999 - 2007-5-11 19:44:00

是卡巴查出来的。。。
也是卡巴说清除不了的。。。
哎。。。前几天就弹出来的，在上网的时候弹出来说恶意HTTP访问，就是那个QQhelper
我都把qq卸了

█ikaka█ - 2007-5-11 19:44:00

进安全模式删,删不掉就直接把自己的权限全关掉.
右击文件属性-安全-将自己用的用户全选拒绝,它还能动就算那病毒牛.

清风弃月 - 2007-5-11 19:51:00

日志里没见耶！！！！！

怎删除不了呢？？？？？？？？？？？？

那你自己去那位置看看那些文件在吗？？？？？？？？

清风弃月 - 2007-5-11 19:52:00

如果在，就下载冰刃，自己强制删除吧。

999999999999 - 2007-5-11 20:08:00

冰刃是什么东东啊
很奇怪找不到文件
qq不知道还能不能用。。。

瑞星卡卡安全论坛