求救.我的日志.高手们来帮忙分析下 bbs.ikaka.com

简单蛋蛋 - 2007-7-31 19:04:00

[CODE]

2007-07-31,18:49:57

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<nwiz><nwiz.exe /install> []
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\pfw.exe> [N/A]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<CertificateRegistration><SafeSignCertReg.exe> [A.E.T. Europe B.V.]
<checkinstall><C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\CheckInstall.exe> [N/A]
<MenuOrder><C:\Program Files\ICBCPe~1\ICBC\BHDC(Personal)\MenuOrder\MenuOrder.exe> [N/A]
<Windows木马防火墙><C:\Program Files\ftc\Trojanwall.exe> [风云谷]
<WinForm><C:\WINDOWS\WinForm.exe> []
<TIMHost><C:\WINDOWS\TIMHost.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><Kvsc32.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{014A26F5-FBAD-4549-9CA1-C38210704BD1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins> []
<{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys> []
<{B1351752-5628-1547-FFAB-BADC13512AFB}><C:\WINDOWS\System32\ztkpri.dll> []
<{54123FF1-8371-9834-9021-184518451FA5}><C:\WINDOWS\System32\Kvsc32.dll> []
<{13BC17B6-1BB0-1F6D-235D-27672B312F10}><C:\WINDOWS\System32\014qso.dll> []
<{659AFD5B-159F-ACD8-954C-ACD545FA6586}><C:\WINDOWS\System32\jzfpri.dll> []

==================================
启动文件夹
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[腾讯QQ]
<C:\Documents and Settings\fx\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[ForceWare Intelligent Application Manager (IAM) / ForceWare Intelligent Application Manager (IAM)][Running/Auto Start]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe><>
[Forceware Web Interface / ForcewareWebInterface][Running/Auto Start]
<"C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice><Apache Software Foundation>
[kavsvc / kavsvc][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>
[ForceWare IP service / nSvcIp][Running/Auto Start]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe><NVIDIA Corporation>
[ForceWare user log service / nSvcLog][Running/Auto Start]
<C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe><NVIDIA Corporation>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
驱动程序
[ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
<system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
[AE Audio Service / AEAudio][Running/Manual Start]
<system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
[AntiARP NDIS Protocol Driver / AntiArpNdisProt][Running/Auto Start]
<System32\DRIVERS\AntiArpNdisProt.sys><Windows (R) 2000 DDK provider>
[usb Card Device / ft2kEnum][Running/Manual Start]
<System32\DRIVERS\ic2kenum.sys><OEM Corporation>
[USB Chip Holder Service / GDBaseSmc][Running/Manual Start]
<System32\DRIVERS\Chip_smc.sys><OEM>
[USB Chip Service / GD_USB][Stopped/Manual Start]
<System32\DRIVERS\Chip_usb.sys><>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
<System32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[JMicron Hot-Plug Driver / JGOGO][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\JGOGO.sys><JMicron>
[JRAID / JRAID][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\jraid.sys><JMicron Technology Corp.>
[Kl1 / Kl1][Running/Boot Start]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif][Running/System Start]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc][Running/System Start]
<System32\drivers\klmc.sys><Kaspersky Lab>
[ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
<System32\DRIVERS\ASACPI.sys><>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkcusb / npkcusb][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcusb.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\nvata.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
<System32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
<System32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[NVIDIA TCP/IP Protocol Driver / NVTCP][Running/System Start]
<System32\DRIVERS\NVTcp.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SmartCard Reader Device / Reader_Device][Running/Manual Start]
<System32\DRIVERS\usbic2k.sys><OEM>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SenFilt Service / SenFiltService][Running/Manual Start]
<system32\drivers\Senfilt.sys><Sensaura>
[TSP / TSP][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs>
[WINIO / WINIO][Stopped/Manual Start]
<\??\G:\winio.sys><N/A>
[xAntiArpSpoof Service / xAntiArp][Running/Manual Start]
<System32\DRIVERS\xAntiArp.sys><Windows (R) 2000 DDK provider>

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

简单蛋蛋 - 2007-7-31 19:05:00

浏览器加载项
[ThunderAtOnce Class]
{01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[InfoSecNetSign Class]
{62B938C4-4190-4F37-8CF0-A92B0A91CC77} <C:\WINDOWS\System32\NetSign.dll, Infosec Technologies Co., Ltd.>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\System32\INPUTC~1.DLL, >
[KVFileUpdate Class]
{CA234A53-E68D-44D5-A07C-481C051D0C7A} <C:\WINDOWS\Downloaded Program Files\OLDown.dll, Jiangmin Co.,Ltd>
[Thunder Agent Class]
{485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
[360SafeLive]
{87515F61-A66C-4319-A0E0-D416CB8059E3} <D:\360safe\live.dll, 360safe.com>
[Vod Class]
{EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <C:\Program Files\Thunder Network\Thunder\Components\DownAndPlay\DapPlayer1.0.0.41.dll, XunLei>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 524][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 580][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 604][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 652][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\LYMANGR.DLL] [N/A, ]
[PID: 664][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 844][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 928][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 456][C:\Program Files\Analog Devices\Core\smax4pnp.exe] [Analog Devices, Inc., 6,0,6000,81]
[C:\Program Files\Analog Devices\Core\SMWDMIF.dll] [Analog Devices, Inc., 6, 0, 6000, 003]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[PID: 464][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe] [Analog Devices, Inc., 5, 2, 0, 30]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[PID: 792][C:\WINDOWS\System32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\NvMcTray.dll] [NVIDIA Corporation, 6.14.11.5819]
[C:\WINDOWS\System32\nvapi.dll] [NVIDIA Corporation, 6.14.11.5819]
[C:\WINDOWS\System32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.5819]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[PID: 836][C:\WINDOWS\System32\SafeSignCertReg.exe] [A.E.T. Europe B.V., 2.0.0.2]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[PID: 884][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[PID: 1120][C:\Program Files\Tencent\QQ\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\Program Files\Tencent\QQ\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[RsHide] [N/A, ]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\WINDOWS\System32\jzfpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[PID: 3112][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]

简单蛋蛋 - 2007-7-31 19:05:00

[PID: 376][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 11]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[C:\WINDOWS\System32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\WINDOWS\System32\jzfpri.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[PID: 2644][C:\DOCUME~1\fx\LOCALS~1\Temp\dh.exe] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[RsHide] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[D:\360safe\AntiAdwa.dll] [360Safe.com, 3, 5, 1, 1001]
[D:\360safe\AntiEng.dll] [360Safe.com, 3, 5, 2, 1002]
[D:\360safe\Antispy.dll] [奇虎网, 3, 5, 2, 1001]
[D:\360safe\LeakCheck.dll] [360Safe.com, 3, 5, 1, 1001]
[D:\360safe\CleanHis.dll] [奇虎网, 3, 0, 2, 1000]
[D:\360safe\AntiActi.dll] [360Safe.com, 2, 0, 0, 3000]
[D:\360safe\live.dll] [360safe.com, 1, 0, 1, 1018]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\WINDOWS\System32\jzfpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[PID: 3496][C:\Program Files\Tencent\QQ\QQexternal.exe] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 370]
[C:\Program Files\Tencent\QQ\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\DOCUME~1\fx\LOCALS~1\Temp\rsv20.tmp] [Beijing Rising Tech. Co., Ltd., 1, 3, 0, 0]
[C:\Program Files\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[PID: 668][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\System32\nvcpl.dll] [NVIDIA Corporation, 6.14.11.5819]
[C:\WINDOWS\System32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.11.5819]
[C:\WINDOWS\System32\nvapi.dll] [NVIDIA Corporation, 6.14.11.5819]
[C:\WINDOWS\System32\nvshell.dll] [, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\WINDOWS\System32\jzfpri.dll] [N/A, ]
[PID: 3100][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\jzfpri.dll] [N/A, ]
[C:\WINDOWS\System32\014qso.dll] [N/A, ]
[C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll] [Thunder Networking Technologies,LTD, 1.0.2.9]
[C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll] [Thunder Networking Technologies,LTD, 5, 0, 3, 11]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DsBho_00.dll] [, 1, 0, 0, 4]
[C:\Program Files\Thunder Network\Thunder\Components\ResWorker\DataProcessor_00.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 6]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[C:\WINDOWS\System32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Tencent\QQ\QQIEHelper.dll] [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
[C:\WINDOWS\System32\ztkpri.dll] [N/A, ]
[C:\WINDOWS\System32\Kvsc32.dll] [N/A, ]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys] [N/A, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[E:\]
[AutoRun]
open=AutoRun.exe
shellexecute=AutoRun.exe
shell\打开(&O)\command=AutoRun.exe

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
入口点错误：RegCreateKeyExA (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0x013F37C5)
入口点错误：RegCreateKeyExW (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0x013F3895)
RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB711A6E0)
RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB711A820)
LoadLibraryExW (危险等级: , 被下面模块所HOOK: )
RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xB711A780)
入口点错误：Process32NextW (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0x013F3B05)
入口点错误：Module32FirstW (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0x013F3BD5)
入口点错误：TerminateProcess (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0x013F4325)
入口点错误：CreateProcessA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0x013F3965)
入口点错误：CreateProcessW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0x013F3A35)
入口点错误：FreeLibrary (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0x71700031)

==================================
隐藏进程
[405] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe
[1285] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

==================================

[/CODE]

新版小欧 - 2007-7-31 19:36:00

没有人整天无聊帮你看日志，有问题就先把问题说出来，说清楚。

你的日志我没看过，留个字，路过

有毒必问 - 2007-7-31 19:49:00

在安全模式下
删除
C:\WINDOWS\WinForm.exe
C:\WINDOWS\TIMHost.exe
LYLeador.exe
C:\WINDOWS\System32\ztkpri.dll
C:\WINDOWS\System32\Kvsc32.dll
C:\WINDOWS\System32\014qso.dll
C:\WINDOWS\System32\jzfpri.dll
C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
C:\DOCUME~1\fx\LOCALS~1\Temp\dh.exe
AutoRun.exe
E:\Autorun.inf

修复文件关联

有毒必问 - 2007-7-31 19:50:00

重新启动后到安全模式全盘杀毒

Enao2005 - 2007-7-31 19:55:00

删除注册表项目
<WinForm><C:\WINDOWS\WinForm.exe> []
<TIMHost><C:\WINDOWS\TIMHost.exe> []
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
<{014A26F5-FBAD-4549-9CA1-C38210704BD1}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins> []
<{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys> []

用XDelBox1.3一次性删除下面这些文件(enao.ys168.com 下载)
打开XDelBox1.3==>在文件路径填上文件具体路径==>点添加==>勾选上抑制再生==>选中列表中的文件点右键(若要一次性删除多个文件，可以按住键盘的Ctrl,进行多选)==>立刻重启执行删除
C:\WINDOWS\System32\ztkpri.dll
C:\WINDOWS\System32\Kvsc32.dll
C:\WINDOWS\System32\014qso.dll
C:\WINDOWS\System32\jzfpri.dll

重启安全模式下删除
C:\WINDOWS\System32\014qso.dll] [N/A, ]
C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
C:\Program Files\Common Files\Microsoft Shared\MSINFO\System16.ins
C:\WINDOWS\WinForm.exe> []
C:\WINDOWS\TIMHost.exe> []
LYLoader.exe> []
LYLoadbr.exe> [N/A]
LYLeador.exe> [N/A]
LYLoador.exe> [N/A]
LYLoadmr.exe> [N/A]
LYLoadhr.exe> [N/A]
LYLoadqr.exe> [N/A]

编辑<AppInit_DLLs>内容为空即删除Kvsc32.dll

删除注册表项目
<{B1351752-5628-1547-FFAB-BADC13512AFB}><C:\WINDOWS\System32\ztkpri.dll> []
<{54123FF1-8371-9834-9021-184518451FA5}><C:\WINDOWS\System32\Kvsc32.dll> []
<{13BC17B6-1BB0-1F6D-235D-27672B312F10}><C:\WINDOWS\System32\014qso.dll> []
<{659AFD5B-159F-ACD8-954C-ACD545FA6586}><C:\WINDOWS\System32\jzfpri.dll> []

右盘打开删除各盘根目录下的AutoRun.exe和Autorun.inf(存在这2个文件时)

有毒必问 - 2007-7-31 19:58:00

建议楼主打XP SP2补丁

简单蛋蛋 - 2007-8-1 9:32:00

谢谢大家
`

瑞星卡卡安全论坛