【求助】急救！！！！在线等，附日志！！ bbs.ikaka.com

小小三儿 - 2007-6-21 23:38:00

朋友机器中毒了。开始网页都打不开，后来他告诉我本地磁盘也打不开。他说他快哭了。。。
[CODE]

2007-06-21,23:14:35

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows Publisher]
<Super Rabbit IEPro><D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> [ATI Technologies, Inc.]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<CmUCRRun><C:\WINDOWS\system32\CmUCReye.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Thunder><"D:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s> [N/A]
<CameraFixer><C:\WINDOWS\CameraFixer.exe> []
<tsnp2std><C:\WINDOWS\tsnp2std.exe> []
<BigDogPath><C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera> [N/A]
<NTdhcp><C:\WINDOWS\system32\NTdhcp.exe> [N/A]
<QuickTime Task><"D:\mv\qttask.exe" -atboottime> [N/A]
<Alert><C:\Program Files\Starsoftcomm\StarCenter\alert.exe> []
<StarCenter><C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe> [starsoftcomm]
<AutoUpd><C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe> []
<KvMonXP><C:\Program Files\KV2005\KVMonXP.kxp /auto> [JiangMin Ltd.]
<qphotux><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<ymmpucn><C:\Program Files\Common Files\System\fbiytty.exe> []
<AVP><"D:\卡巴\avp.exe"> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<KernelFaultCheck><C:\WINDOWS\system32\msime.exe> [N/A]
<KernelCheck><C:\WINDOWS\system32\winmer.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB919331M.LOG> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================

小小三儿 - 2007-6-21 23:39:00

启动文件夹
[腾讯QQ]
<C:\Documents and Settings\ytaps\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[GrayPigeonServer / GrayPigeonServer][Stopped/Auto Start]
<C:\WINDOWS\G_Server2006.exe><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[KVSrvXP / KVSrvXP][Stopped/Disabled]
<C:\PROGRA~1\KV2005\KVSrvXP.exe -Service><JiangMin New Tech Ltd.>
[KVWSC / KVWSC][Stopped/Disabled]
<"C:\Program Files\KV2005\kvwsc.exe"><Jiangmin Co.Ltd>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Kaspersky Anti-Virus 6.0 / AVP][Stopped/Auto Start]
<D:\卡巴\avp.exe -r><Kaspersky Lab>
[VMware Virtual Mount Manager Extended / vmount2][Stopped/Auto Start]
<"C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe"><VMware, Inc.>
[VMware NAT Service / VMware NAT Service][Running/Auto Start]
<C:\WINDOWS\system32\vmnat.exe><VMware, Inc.>
[VMware DHCP Service / VMnetDHCP][Running/Auto Start]
<C:\WINDOWS\system32\vmnetdhcp.exe><VMware, Inc.>
[VMware Authorization Service / VMAuthdService][Running/Auto Start]
<D:\虚拟世界\vmware-authd.exe><VMware, Inc.>

==================================

小小三儿 - 2007-6-21 23:44:00

驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[ati2mtag / ati2mtag][Running/Manual Start]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CMIUCR.SYS CM220 Card Reader Driver / CMISTOR][Running/Manual Start]
<system32\DRIVERS\cmiucr.SYS><C-Media Corporation>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[KVDriver for NT (KVDP) / KVDP][Stopped/Manual Start]
<\??\C:\PROGRA~1\KV2005\KVDP.sys><Beijing Jiangmin New Sci.&Tec. Co.Ltd.>
[MidiSyn / MidiSyn][Stopped/Manual Start]
<system32\drivers\MidiSyn.sys><Analog Devices, Inc.>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Stopped/Auto Start]
<\??\D:\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\QQ\npkycryp.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SCBACK / SCBACK][Running/Boot Start]
<\SystemRoot\System32\drivers\SCBACK.SYS><StarSoftComm>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt][Running/Manual Start]
<system32\drivers\senfilt.sys><Sensaura>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Running/Manual Start]
<system32\DRIVERS\sisnic.sys><SiS Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[squell / squell][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\vook.sys><N/A>
[SSCFLTXP / SSCFLTXP][Running/Boot Start]
<\SystemRoot\System32\drivers\SSCFLTXP.SYS><Windows (R) 2000 DDK provider>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[VIMICRO USB PC Camera / ZSMC301b][Stopped/Manual Start]
<System32\Drivers\usbVM31b.sys><VM>
[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[kl1 / kl1][Stopped/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[Vstor2 Virtual Storage Driver / vstor2][Running/Auto Start]
<\??\C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys><VMware, Inc.>
[VMware Bridge Protocol / VMnetBridge][Running/Auto Start]
<system32\DRIVERS\vmnetbridge.sys><VMware, Inc.>
[VMware Network Application Interface / VMnetuserif][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\vmnetuserif.sys><VMware, Inc.>
[VMware Virtual Ethernet Adapter Driver / VMnetAdapter][Running/Manual Start]
<system32\DRIVERS\vmnetadapter.sys><VMware, Inc.>
[VMware vmx86 / vmx86][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\vmx86.sys><VMware, Inc.>
[VMware hcmon / hcmon][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\hcmon.sys><VMware, Inc.>
[VMware VMparport / VMparport][Running/Auto Start]
<\??\C:\WINDOWS\system32\Drivers\VMparport.sys><VMware, Inc.>

==================================

小小三儿 - 2007-6-21 23:45:00

浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[]
{45A26E38-F931-4C6F-8106-FBB8534FB0AF} <C:\WINDOWS\trunk_16.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ\QQIEHelper.dll, N/A>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[BrowseHelper Class]
{80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <C:\Program Files\KV2005\KvShell.dll, JiangMin Lmt>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\卡巴\scieplugin.dll, Kaspersky Lab>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\QQ\QQIEHelper.dll, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <C:\Program Files\KV2005\KvShell.dll, JiangMin Lmt>
[NeffyClient Class]
{0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} <C:\WINDOWS\Downloaded Program Files\Neffy.dll, CDNetworks Co., Ltd.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[BugsGameStarts Class]
{E1CE4482-98E9-48F8-8D0D-EF03BC9E26F3} <C:\WINDOWS\Downloaded Program Files\BugsGameStart.dll, (?)???>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[NeffyClient Class]
{0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} <C:\WINDOWS\Downloaded Program Files\Neffy.dll, CDNetworks Co., Ltd.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[]
{45A26E38-F931-4C6F-8106-FBB8534FB0AF} <C:\WINDOWS\trunk_16.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\QQ\QQIEHelper.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[BrowseHelper Class]
{80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <C:\Program Files\KV2005\KvShell.dll, JiangMin Lmt>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>

小小三儿 - 2007-6-21 23:46:00

[江民杀毒工具栏]
{B5A34A93-D538-43A7-8371-864CB6148D12} <C:\Program Files\KV2005\KvShell.dll, JiangMin Lmt>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[BugsGameStarts Class]
{E1CE4482-98E9-48F8-8D0D-EF03BC9E26F3} <C:\WINDOWS\Downloaded Program Files\BugsGameStart.dll, (?)???>
[Windows Script Host Shell Object]
{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} <C:\WINDOWS\system32\wshom.ocx, Microsoft Corporation>
[&使用迅雷下载]
<d:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<d:\Program Files\Thunder Network\Thunder\getAllurl.htm, N/A>
[上传到QQ网络硬盘]
<D:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\QQ\SendMMS.htm, N/A>

==================================

小小三儿 - 2007-6-21 23:46:00

正在运行的进程
[PID: 432][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 492][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 516][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\Ati2evxx.dll] [ATI Technologies Inc., 6.14.10.4107]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1260][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\KV2005\KvShell.dll] [JiangMin Lmt, 9, 0, 0, 503]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\Kvxp0804.lng] [N/A, ]
[C:\Program Files\KV2005\APIImpl.dll] [JiangMin Ltd., 9.0.0.500]
[C:\Program Files\KV2005\GUIExt.dll] [JiangMin Ltd., 9.0.0.501]
[C:\Program Files\KV2005\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] [, 1, 0, 0, 169]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[D:\木马清道夫\FTCCommenu.dll] [Fygsoft and Microsoft, 3.0.0.71]
[D:\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\卡巴\shellex.dll] [Kaspersky Lab, 6.0.2.621]
[D:\卡巴\MSVCR80.dll] [Microsoft Corporation, 8.00.50727.42]
[D:\卡巴\MSVCP80.dll] [Microsoft Corporation, 8.00.50727.42]
[PID: 356][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] [ATI Technologies, Inc., 6.14.10.5125]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] [ATI Technologies, Inc., 6.14.10.5125]
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] [ATI Technologies, Inc., 6.14.10.5125]
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] [ATI Technologies, Inc., 6.14.10.5125]
[PID: 396][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] [Analog Devices, Inc., 5, 0, 2, 2]
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] [Analog Devices, Inc., 5, 0, 3, 001]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1980][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe] [Analog Devices, Inc., 5, 0, 2, 6]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 924][C:\WINDOWS\system32\CmUCReye.exe] [, 1, 0, 0, 36]
[PID: 1984][C:\WINDOWS\CameraFixer.exe] [, 1, 0, 0, 2]
[PID: 1976][C:\WINDOWS\tsnp2std.exe] [, 1, 0, 2, 0]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[PID: 908][C:\Program Files\Starsoftcomm\StarCenter\alert.exe] [, 1, 0, 0, 182]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[PID: 864][C:\Program Files\Starsoftcomm\StarCenter\StarCenter.exe] [starsoftcomm, 1, 0, 0, 189]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[C:\Program Files\Starsoftcomm\StarCenter\SmartBackup.dll] [SSC, 1, 0, 1, 201]
[C:\Program Files\Starsoftcomm\StarCenter\drvKernel.dll] [, 1, 0, 0, 176]
[C:\Program Files\Starsoftcomm\StarCenter\SC_SystemProtect.DLL] [N/A, ]
[C:\Program Files\Starsoftcomm\StarCenter\Asset.DLL] [, 1, 0, 0, 170]
[C:\Program Files\Starsoftcomm\StarCenter\DiskMonitor.DLL] [, 1, 0, 0, 168]
[C:\Program Files\Starsoftcomm\StarCenter\DrvMonitor.DLL] [, 1, 0, 0, 171]
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] [, 1, 0, 0, 169]
[C:\Program Files\Starsoftcomm\StarCenter\SSCRegAc.dll] [, 1, 0, 0, 168]
[C:\Program Files\Starsoftcomm\StarCenter\SoftFunc.dll] [, 1, 0, 0, 167]
[C:\Program Files\Starsoftcomm\StarCenter\Encrypt.dll] [N/A, ]
[C:\Program Files\Starsoftcomm\StarCenter\sscac.dll] [N/A, ]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]
[PID: 1928][C:\Program Files\Starsoftcomm\StarCenter\UpdTray.exe] [, 1, 0, 0, 2]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[PID: 1900][C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe] [N/A, ]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]
[PID: 260][C:\Program Files\Common Files\System\fbiytty.exe] [N/A, ]
[PID: 1248][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1256][C:\Program Files\Messenger\msmsgs.exe] [Microsoft Corporation, 4.7.3000]
[PID: 1672][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2884][D:\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]

小小三儿 - 2007-6-21 23:47:00

[D:\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\QQ\BasicCtrlDll.dll] [Tencent, 6, 0, 200, 320]
[D:\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[D:\QQ\RICHED32.DLL] [Microsoft Corporation, 5.00.2134.1]
[D:\QQ\RICHED20.dll] [Microsoft Corporation, 5.31.23.1218]
[D:\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[D:\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] [, 1, 0, 0, 169]
[D:\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\QQ\WizardCtrl.dll] [, 1, 0, 0, 1]
[D:\QQ\QQMainFrame.dll] [N/A, ]
[C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] [Macromedia, Inc., 8,0,24,0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]
[D:\QQ\CQQApplication.dll] [N/A, ]
[D:\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\QQ\QQKnowledgeSearch.dll] [, 1, 0, 0, 1]
[D:\QQ\QQAllInOne.dll] [N/A, ]
[D:\QQ\GroupLive.dll] [N/A, ]
[D:\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\QQ\gdiplus.dll] [Microsoft Corporation, 5.1.3102.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[D:\QQ\vbscript.dll] [Microsoft Corporation, 5.6.0.7426]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[D:\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\QQ\QQPlugin.dll] [N/A, ]
[D:\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\QQ\QQSysMsgMng.dll] [N/A, ]
[D:\QQ\QRingMng.dll] [N/A, ]
[D:\QQ\QQAvatar.dll] [N/A, ]
[D:\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\QQ\QQPet.dll] [, 1, 0, 0, 1]
[D:\QQ\BQQApplication.dll] [N/A, ]
[D:\QQ\QQSettingCtrl.dll] [, 1, 0, 0, 1]
[D:\QQ\QQCustomFace.dll] [N/A, ]
[C:\WINDOWS\system32\msadp32.acm] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 271]
[D:\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\QQ\QQSceneMng.dll] [N/A, ]
[D:\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 9, 93]
[D:\QQ\QQMagicFace.dll] [, 1, 0, 0, 1]
[D:\QQ\QQFileTransfer.dll] [Tencent, 0, 3, 3, 5]
[D:\QQ\QQNetDisk.dll] [深圳腾讯科技, 8, 0, 102, 20]

小小三儿 - 2007-6-21 23:47:00

[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[PID: 2924][D:\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[D:\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[PID: 4032][D:\TTPlayer\TTPlayer.exe] [Alen Soft, 4, 6, 9, 0]
[D:\TTPlayer\ttpcomm.dll] [N/A, ]
[D:\TTPlayer\ttpres.dll] [Alen Soft, 4, 6, 9, 0]
[D:\TTPlayer\msdmo.dll] [Microsoft Corporation, 6.03.01.0400]
[D:\TTPlayer\AddIn\ttp_asf.dll] [N/A, ]
[D:\TTPlayer\AddIn\ttp_aac.dll] [N/A, ]
[D:\TTPlayer\AddIn\ttp_ac3dts.dll] [N/A, ]
[D:\TTPlayer\wmadmod.dll] [Microsoft Corporation, 10.00.00.3646]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\TTPlayer\AddIn\ttp_lrcsh.dll] [N/A, ]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]
[PID: 3392][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\Program Files\WinRAR\Formats\7z.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\ace.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\arj.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\bz2.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\cab.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\gz.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\iso.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\lzh.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\tar.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\uue.fmt] [N/A, ]
[C:\Program Files\WinRAR\Formats\z.fmt] [N/A, ]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[D:\卡巴\scrchpg.dll] [Kaspersky Lab, 6.0.2.621]
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] [, 1, 0, 0, 169]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[PID: 2368][C:\DOCUME~1\ytaps\LOCALS~1\Temp\Rar$EX00.797\VMware55\Cncode.com\VMware-workstation-5.5.1-19175.exe] [VMware, Inc., 5.5.1 build-19175]
[C:\Program Files\Starsoftcomm\StarCenter\HookMgr.dll] [, 1, 0, 0, 169]
[C:\Program Files\Starsoftcomm\StarCenter\MFC42.DLL] [Microsoft Corporation, 6.00.9586.0]
[PID: 1608][C:\WINDOWS\system32\MsiExec.exe] [Microsoft Corporation, 3.0.3790.2180]
[C:\DOCUME~1\ytaps\LOCALS~1\Temp\MSI111.tmp] [VMware, Inc., ]
[C:\DOCUME~1\ytaps\LOCALS~1\Temp\Rar$DI01.735\SREng.COM] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\KvWspXp.dll] [JiangMin Ltd., 9.0.0.502]

==================================

小小三儿 - 2007-6-21 23:47:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\system32\KvWspXp.dll(JiangMin Ltd., KVWspXP)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\system32\KvWspXp.dll(JiangMin Ltd., KVWspXP)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\system32\KvWspXp.dll(JiangMin Ltd., KVWspXP)

==================================
Autorun.inf
[D:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe
[E:\]
[AutoRun]
open=qphotux.exe
shell\open=打开(&O)
shell\open\Command=qphotux.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=qphotux.exe

==================================
HOSTS 文件
N/A

==================================
API HOOK
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEDB3AAF0)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEDB3ACD0)
RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEDB3AE30)
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xEDB3ABE0)
RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xEDB3ADE0)

==================================
隐藏进程
N/A

==================================

[/CODE]

天月来了 - 2007-6-22 0:11:00

汗死了

毒入膏肓了。

很费劲的。

agee - 2007-6-22 0:38:00

删除如下启动项
<qphotux><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<ymmpucn><C:\Program Files\Common Files\System\fbiytty.exe> []
<KernelFaultCheck><C:\WINDOWS\system32\msime.exe> [N/A]
<KernelCheck><C:\WINDOWS\system32\winmer.exe> [N/A]
<AppInit_DLLs><KB919331M.LOG> [N/A]
删除以下服务
[GrayPigeonServer / GrayPigeonServer][Stopped/Auto Start]
<C:\WINDOWS\G_Server2006.exe><N/A>
删除以下驱动
[squell / squell][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\vook.sys><N/A>
删除autorun.inf
重启后进入安全模式再删除相应文件

天月来了 - 2007-6-22 0:44:00

勉强试试吧，别抱太大希望。
这里下载冰刃（1.2版本）：http://forum.ikaka.com/topic.asp?board=67&artid=8283060

能进安全模式，就进安全模式操作。

断网，关闭一切能关闭的东西，包括防火墙，杀软，网页，QQ，已断网了，所有加入内存的软件，都尽量退出。

用扫日志的SRENG工具删除下面注册表项。

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NTdhcp><C:\WINDOWS\system32\NTdhcp.exe> [N/A]
<qphotux><C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe> []
<ymmpucn><C:\Program Files\Common Files\System\fbiytty.exe> []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<KernelFaultCheck><C:\WINDOWS\system32\msime.exe> [N/A]
<KernelCheck><C:\WINDOWS\system32\winmer.exe> [N/A]
——————————————————————————————————————————
用扫日志的SRENG工具修改下面注册表项。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB919331M.LOG> [N/A]
将
<AppInit_DLLs> 修改为置空
——————————————————————————————————————————
用扫日志的SRENG工具将下面项启动类型改为“Disabled”。

服务
[GrayPigeonServer / GrayPigeonServer][Stopped/Auto Start]
<C:\WINDOWS\G_Server2006.exe><N/A>

驱动程序
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\QQ\npkycryp.sys><N/A>

[squell / squell][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\vook.sys><N/A>

[bootdrv / bootdrv][Stopped/Boot Start]
<\SystemRoot\System32\Drivers\bootdrv.sys><>
——————————————————————————————————————————
用扫日志的SRENG工具删除下面项

浏览器加载项
[]
{45A26E38-F931-4C6F-8106-FBB8534FB0AF} <C:\WINDOWS\trunk_16.dll, N/A>
[NeffyClient Class]
{0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} <C:\WINDOWS\Downloaded Program Files\Neffy.dll, CDNetworks Co., Ltd.>
[BugsGameStarts Class]
{E1CE4482-98E9-48F8-8D0D-EF03BC9E26F3} <C:\WINDOWS\Downloaded Program Files\BugsGameStart.dll, (?)???>
[NeffyClient Class]
{0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} <C:\WINDOWS\Downloaded Program Files\Neffy.dll, CDNetworks Co., Ltd.>
[]
{45A26E38-F931-4C6F-8106-FBB8534FB0AF} <C:\WINDOWS\trunk_16.dll, N/A>
[BugsGameStarts Class]
{E1CE4482-98E9-48F8-8D0D-EF03BC9E26F3} <C:\WINDOWS\Downloaded Program Files\BugsGameStart.dll, (?)???>
————————————————————————————————————————————
下面这个，你捣鼓它干嘛呢？呵呵！！！！！！
正在运行的进程
[PID: 2368][C:\DOCUME~1\ytaps\LOCALS~1\Temp\Rar$EX00.797\VMware55\Cncode.com\VMware-workstation-5.5.1-19175.exe] [VMware, Inc., 5.5.1 build-19175]
————————————————————————————————————————————
用冰刃强行删除下面文件：
C:\WINDOWS\system32\NTdhcp.exe
C:\Program Files\Common Files\Microsoft Shared\vcxlcph.exe
C:\Program Files\Common Files\System\fbiytty.exe
C:\WINDOWS\system32\msime.exe
C:\WINDOWS\system32\winmer.exe
C:\WINDOWS\G_Server2006.exe
D:\QQ\npkycryp.sys
C:\WINDOWS\system32\vook.sys
System32\Drivers\bootdrv.sys

包括各盘根目录下的这些文件：
Autorun.inf
qphotux.exe
————————————————————————————————————————————
显示隐藏文件和系统文件，一定得搜索下面这个文件，找到删除。
KB919331M.LOG
————————————————————————————————————————————
重启电脑，不行，就再扫日志。
没异常，就安装并升级杀软至最新版本，全盘杀毒。

瑞星卡卡安全论坛