【求助】各位高人，帮忙看看我的日志吧，好像中了很多病毒 bbs.ikaka.com

不懂？？ - 2007-6-8 18:26:00

打开什么都说出现错误，Windows即将关闭，下面是日志，各位高人帮帮忙[CODE]

2007-06-08,17:54:59

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<UnlockerAssistant><"D:\Program Files\Unlocker\UnlockerAssistant.exe"> []
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<cdnprh><#E;]XJOOU]Tztufn43]Svoemm43/fyf#!#E;]XJOOU]Tztufn43]deoqsi/emm#-Tubsu> [N/A]
<TkBellExe><"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<powerword 2007><"D:\Program Files\Kingsoft\Powerword 2007\xdict.exe" -s -nosplash> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><D:\WINNT\System32\UserInit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]

==================================
启动文件夹
[Microsoft Office]
<D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>
[QQ游戏启动加速程序]
<D:\Documents and Settings\ly\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> E:\应用软件\QQGame\Accel.exe [N/A]><N>
[腾讯QQ]
<D:\Documents and Settings\ly\「开始」菜单\程序\启动\腾讯QQ.lnk --> E:\应用软件\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[Volume Optimization / AtWork][Running/Auto Start]
<D:\WINNT\System32\svchost.exe -k netsvcs-->D:\WINNT\System32\rctgm.dll><Microsoft Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Madies Sariel Number Services / Madies Sariel Number Services][Stopped/Auto Start]
<D:\WINNT\System32\notaped.exe><N/A>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
<D:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service][Running/Auto Start]
<D:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[FrontLine Drivers Auto Removal (v2) / sfrem02][Stopped/Auto Start]
<D:\WINNT\system32\sfrem02.exe svc><Protection Technology (StarForce)>
[Local Connection Manager / SoSCAR][Running/Auto Start]
<D:\WINNT\SYSTEM32\RUNDLL2KXP.EXE D:\WINNT\SYSTEM32\WBEM\HENPF.DLL,Export 1087><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<D:\WINNT\System32\svchost.exe -k netsvcs-->D:\WINNT\System32\mspmsnsv.dll><Microsoft Corporation>

不懂？？ - 2007-6-8 18:26:00

=================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[cdabeihg / cdabeihg][Stopped/Boot Start]
<\SystemRoot\system32\drivers\cdabeihg.sys><N/A>
[cdnprot / cdnprot][Running/Boot Start]
<\SystemRoot\system32\drivers\cdnprot.sys><中国互联网络信息中心(CNNIC)>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[fayc / faycw][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\faycw.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\D:\WINNT\System32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\F:\我的\QQ2\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[rrsf / rrsf][Stopped/Manual Start]
<\??\D:\WINNT\TEMP\rrsfpld><N/A>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[FrontLine Synchronization Driver (v5) / sfsync05][Running/Boot Start]
<\SystemRoot\system32\drivers\sfsync05.sys><Protection Technology (StarForce)>
[SVKP / SVKP][Running/Auto Start]
<\??\D:\WINNT\System32\SVKP.sys><AntiCracking>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[VIA USB Filter / viafilter][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\viausb.sys><VIA Technologies, Inc.>
[viaide / viaide][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\viaide.sys><VIA Technologies, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\常用软件\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <E:\应用软件\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[]
{669751ED-D558-49AE-B01A-3B374CC7910E} <D:\WINNT\System32\ssup.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <F:\常用软件\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\常用软件\迅雷\Thunder.exe, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\应用软件\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <E:\应用软件\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\常用软件\迅雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[上传到QQ网络硬盘]
<E:\应用软件\QQ\AddToNetDisk.htm, N/A>
[使用迅雷下载]
<F:\常用软件\迅雷\Program\GetUrl.htm, N/A>
[使用迅雷下载全部链接]
<F:\常用软件\迅雷\Program\GetAllUrl.htm, N/A>
[添加到QQ自定义面板]
<E:\应用软件\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\应用软件\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\应用软件\QQ\SendMMS.htm, N/A>

不懂？？ - 2007-6-8 18:27:00

=================================
正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2170.1]
[PID: 184][\??\D:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2137.1]
[PID: 204][\??\D:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2182.1]
[D:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2147.1]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[D:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[PID: 232][D:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2191.1.296.2]
[PID: 940][D:\WINNT\Explorer.exe] [Microsoft Corporation, 5.00.2920.0000]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\WINNT\System32\msimtf.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\WINNT\System32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\WINNT\System32\wdmaud.drv] [Microsoft Corporation, 5.00.2147.1]
[D:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\WINNT\System32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[F:\常用软件\迅雷\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.7]
[D:\WINNT\System32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1]
[D:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\WINNT\System32\ALSNDMGR.CPL] [Realtek Semiconductor Corp., 1.5.38]
[D:\WINNT\System32\INPUT.CPL] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\WINNT\mui\fallback\0804\input.cpl.mui] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\WINNT\System32\powercfg.cpl] [Microsoft Corporation, 5.00.2920.0000]
[D:\WINNT\System32\nvtuicpl.cpl] [NVIDIA Corporation, 6.13.10.4072]
[D:\WINNT\System32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.13.10.4072]
[D:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[F:\常用软件\迅雷\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
[F:\常用软件\迅雷\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[D:\WINNT\System32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[F:\常用软件\迅雷\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[D:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[F:\常用软件\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[D:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\Program Files\Unlocker\UnlockerCOM.dll] [N/A, ]
[D:\WINNT\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[D:\WINNT\SYSTEM32\WBEM\HENPF.DLL] [Microsoft Corporation, 5, 1, 2600, 2709]
[d:\winnt\system32\rctgm.dll] [Microsoft Corporation, 5.1.2600.0]
[PID: 952][D:\Program Files\CNNIC\Cdn\cdnup.exe] [CNNIC, 2, 5, 0, 8]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[D:\Program Files\CNNIC\Cdn\cdnuplib.dll] [CNNIC, 2, 5, 0, 11]
[D:\Program Files\CNNIC\Cdn\cdnprh.dll] [CNNIC, 2, 4, 0, 7]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[PID: 1212][D:\WINNT\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.0.12]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[D:\WINNT\System32\wdmaud.drv] [Microsoft Corporation, 5.00.2147.1]
[D:\WINNT\System32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[PID: 1264][D:\Program Files\Unlocker\UnlockerAssistant.exe] [N/A, ]
[D:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[PID: 1300][D:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3249]
[D:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[PID: 1236][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 5.00.2920.0000]
[D:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\cdnuplib.dll] [CNNIC, 2, 5, 0, 11]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]
[F:\常用软件\迅雷\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.0.7]
[E:\应用软件\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[F:\常用软件\迅雷\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
[F:\常用软件\迅雷\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[D:\WINNT\System32\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[F:\常用软件\迅雷\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[D:\WINNT\System32\msimtf.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\WINNT\System32\MSCTF.dll] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[D:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[D:\Program Files\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[D:\WINNT\System32\wdmaud.drv] [Microsoft Corporation, 5.00.2147.1]
[D:\WINNT\System32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\System32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1]
[D:\WINNT\System32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 1872][F:\常用软件\sreng\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[D:\Program Files\Unlocker\UnlockerHook.dll] [N/A, ]
[D:\Program Files\CNNIC\Cdn\imaoe.dll] [CNNIC, 2, 2, 0, 1]
[D:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 12]
[D:\Program Files\CNNIC\Cdn\cdndet.dll] [CNNIC, 2, 5, 0, 0]
[D:\WINNT\System32\winabc.ime] [Microsoft Corporation, 5.00.2190.1]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=pagefile.pif
[D:\]
[AutoRun]
open=pagefile.pif
[E:\]
[AutoRun]
open=pagefile.pif
[F:\]
[AutoRun]
open=pagefile.pif

==================================
HOSTS 文件
0.0.0.0 www.51pywg.com
0.0.0.0 51pywg.com

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛