孤独更可靠 - 2007-5-24 9:39:00
| 引用: |
| 【天月来了的贴子】 用冰刃（1.2版本）禁止进程创建，强行卸除插入以下进程里的模块。 ================================== 正在运行的进程 [PID: 168][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601] [PID: 948][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690] [PID: 1308][C:\WINNT\system32\rundll32.exe] [Microsoft Corporation, 5.00.2134.1] [PID: 1332][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2607 built by: dnsrv(wmbla)] [PID: 272][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106] [PID: 1348][E:\郑旭峰\ppo\app\EnterNet.exe] [N/A, ] [PID: 800][E:\郑旭峰\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] 插入的模块 [C:\WINNT\system32\1ECDD84E.DLL] [Microsoft Corporation, ] [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp] [N/A, ] [C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ] [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ] [C:\WINNT\system32\LYMANGR.DLL] [N/A, ] [C:\WINNT\system32\bmxlar.dll] [N/A, ] [C:\WINNT\system32\ikgemw.dll] [N/A, ] [C:\WINNT\system32\f161.dll] [TODO: <公司名>, 1.0.0.1] [C:\WINNT\system32\df1.dll] [ , 1, 0, 0, 3] 用冰刃删除文件 C:\WINNT\system32\1ECDD84E.DLL C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp C:\Program Files\Internet Explorer\PLUGINS\System64.sys C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll C:\WINNT\system32\LYMANGR.DLL C:\WINNT\system32\bmxlar.dll C:\WINNT\system32\ikgemw.dll C:\WINNT\system32\f161.dll C:\WINNT\system32\df1.dll 用冰刃删除各磁盘根目录下的文件文件 Autorun.inf rising.exe —————————————————————————————————————————————— 因为用冰刃找注册表有点烦。 如果有耐心就再用冰刃继续删除以下注册表项和对应文件。 如果没耐心，就取消冰刃（1.2版本）的禁止进程创建，然后用扫日志的SRENG工具删除注册表项。 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <3dtbc0evz><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [] <8kb0sgzsqkdimv0><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <mdac_runonce><; C:\WINDOWS\SYSTEM\runonce.exe> [N/A] <AVPSrv><; C:\WINNT\AVPSrv.exe> [] <cmdbcs><; C:\WINNT\cmdbcs.exe> [] <WSVBRS><; C:\WINNT\WSVBRS.exe> [] <runner1><; C:\WINNT\retadpu22.exe 61A847B5BBF72810308B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A] <mppds><C:\WINNT\mppds.exe> [] <upxdnd><C:\WINNT\upxdnd.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDEG32><LYLoader.exe> [] <MSDWG32><LYLoadbr.exe> [N/A] <MSDCG32 ><LYLeador.exe> [N/A] <MSDOG32><LYLoador.exe> [N/A] <MSDSG32><LYLoadar.exe> [N/A] <MSDMG32><LYLoadmr.exe> [N/A] <MSDHG32><LYLoadhr.exe> [N/A] <MSDQG32><LYLoadqr.exe> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> [] <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys> [] ================================= 服务 [17B3AA5D / 17B3AA5D][Stopped/Auto Start] <C:\WINNT\system32\DAF5BEB7.EXE -k><Microsoft Corporation> [Fax 2Client / ms_2fax][Running/Auto Start] <C:\WINNT\system32\16861.exe><N/A> [Windows InstallService / Sever][Stopped/Auto Start] <C:\WINNT\system32\Sever.exe><N/A> [Remote Acces / WindowsDown][Stopped/Auto Start] <C:\WINNT\system32\servet.exe><N/A> ================================== 驱动程序 [CelInDrv / CelInDrv][Stopped/Disabled] <\??\C:\WINNT\system32\Drivers\CelInDriver.sys><N/A> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\DRIVERS\npf.sys><CACE Technologies> ================================== 浏览器加载项 Incorporated> [ff Class] {FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINNT\system32\f161.dll, TODO: <公司名>> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [WebBasedClientInstall Class] {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} <C:\WINNT\Downloaded Program Files\WebInst.Dll, Symantec Corporation> 用冰刃删除文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe C:\WINDOWS\SYSTEM\runonce.exe C:\WINNT\AVPSrv.exe C:\WINNT\cmdbcs.exe C:\WINNT\WSVBRS.exe C:\WINNT\retadpu22.exe C:\WINNT\mppds.exe C:\WINNT\upxdnd.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp C:\Program Files\Internet Explorer\PLUGINS\System64.sys C:\WINNT\system32\DAF5BEB7.EXE C:\WINNT\system32\16861.exe C:\WINNT\system32\Sever.exe C:\WINNT\system32\servet.exe C:\WINNT\system32\Drivers\CelInDriver.sys C:\WINNT\system32\DRIVERS\npf.sys C:\WINNT\system32\f161.dll C:\WINNT\Downloaded Program Files\WebInst.Dll ———————————————————————————— 搜索以下文件，找到用冰刃删除文件 LYLoader.exe LYLoadbr.exe LYLeador.exe LYLoador.exe LYLoadar.exe LYLoadmr.exe LYLoadhr.exe LYLoadqr.exe —————————————————————————————— 呵呵！！！ 重启看看吧！！ 还有异常，再扫日志。 ……………… |
太专业了,偶D偶像啊
