瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 太厉害了！连瑞星都被破坏了！连病毒名称都不知道！
yuelihu - 2007-8-17 14:13:00
太厉害了！连瑞星都被破坏了！连病毒名称都不知道！

所有杀毒软件都用不了了！sreng2也是该了名字才能运行！
请高手看看报告，开一个处方吧！救命啊！工作还有一大堆 啊！在线等…………

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
yuelihu - 2007-8-17 14:14:00
[CODE]

2007-08-17,13:44:31

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <updateMgr><; D:\安装应用程序\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcPro7_0_0>  [N/A]
    <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background>  [(Verified)Microsoft Corporation]
    <MSetup><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\install.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <igfxtray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Intel Corporation]
    <igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Intel Corporation]
    <igfxpers><C:\WINDOWS\system32\igfxpers.exe>  [(Verified)Intel Corporation]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <Acrobat Assistant 7.0><; "D:\安装应用程序\Acrobat 7.0\Distillr\Acrotray.exe">  [Adobe Systems Inc.]
    <nobltvm><C:\Program Files\Common Files\System\gaptrwx.exe>  [N/A]
    <RAVDHMON><C:\Program Files\Internet Explorer\RAVDHMON.exe>  [N/A]
    <mppds><C:\WINDOWS\mppds.exe>  [N/A]
    <adqjpfw><; C:\Program Files\Common Files\Microsoft Shared\qlocysr.exe>  [N/A]
    <load><; C:\WINDOWS\uninstall\rundl132.exe>  []
    <runner1><; C:\WINDOWS\retadpu26.exe 61A847B5BBF72810348B2B27128065E9C084320161C4661227A755E9C2933154389A>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <MSDEG32><LYLoader.exe>  [N/A]
    <MSDWG32><LYLoadbr.exe>  [N/A]
    <MSDCG32    ><LYLeador.exe>  [N/A]
    <MSDOG32><LYLoador.exe>  [N/A]
    <MSDSG32><LYLoadar.exe>  [N/A]
    <MSDMG32><LYLoadmr.exe>  [N/A]
    <MSDHG32><LYLoadhr.exe>  [N/A]
    <MSDQG32><LYLoadqr.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Corporation]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Intel Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Corporation]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[954E0C8C / 954E0C8C][Stopped/Auto Start]
  <C:\WINDOWS\system32\815A6D27.EXE -p><Microsoft Corporation>
[A2D3EEFB / A2D3EEFB][Stopped/Auto Start]
  <C:\WINDOWS\system32\CCCD64E4.EXE -A2D3EEFB><Microsoft Corporation>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[BDFDFE6B / BDFDFE6B][Stopped/Auto Start]
  <C:\WINDOWS\system32\A574A1CA.EXE -d><Microsoft Corporation>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
  <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[DE9AA5AB / DE9AA5AB][Stopped/Auto Start]
  <C:\WINDOWS\system32\F5BC55AF.EXE -k><Microsoft Corporation>
[E218330E / E218330E][Stopped/Auto Start]
  <C:\WINDOWS\system32\E315E3FB.EXE -a><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[ASP.NET FrameWork Service / LocalServices][Running/Auto Start]
  <C:\WINDOWS\system32\Svchost.exe -k LocalServices-->C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Local.dll><Microsoft Corporation>
[Server.NET / netserver][Stopped/Auto Start]
  <C:\WINDOWS\system32\netserver32.exe><N/A>
[Remote Procedure Call System(RPCS) / RpcS][Stopped/Auto Start]
  <C:\WINDOWS\system32\RpcS.exe><N/A>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
  <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[svchost / svchost][Stopped/Auto Start]
  <C:\WINDOWS\system32\dllcache\svchost.exe -g><N/A>
[Windows weqr RunThem / weqr][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\rzlm\bjvw.dll><>
[Windows Accounts Driver / windows_0][Stopped/Auto Start]
  <C:\WINDOWS\system32\888.exe><N/A>
[Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
  <C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mspmsnsv.dll><Microsoft Corporation>
[Automatic Updates / wuauserv][Running/Auto Start]
  <C:\WINDOWS\system32\drivers\svchost.exe><N/A>

==================================
驱动程序
[acpidisk / acpidisk][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CdaC15BA / CdaC15BA][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[giveio / giveio][Running/Boot Start]
  <\SystemRoot\system32\giveio.sys><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[ls3h4 / ls3h4][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\ls3h4.sys><N/A>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
  <\??\C:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\D:\安装应用程序\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[speedfan / speedfan][Running/Boot Start]
  <\SystemRoot\system32\speedfan.sys><Windows (R) 2000 DDK provider>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
  <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[uxmvdr / uxmvdr0][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\uxmvdr0.sys><N/A>
newcenturymoon - 2007-8-17 14:18:00
不知道你什么配置 这么多病毒 电脑还能运行么？
MSDEG32><LYLoader.exe> [N/A]
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
<nobltvm><C:\Program Files\Common Files\System\gaptrwx.exe> [N/A]
<RAVDHMON><C:\Program Files\Internet Explorer\RAVDHMON.exe> [N/A]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<adqjpfw><; C:\Program Files\Common Files\Microsoft Shared\qlocysr.exe> [N/A]
<load><; C:\WINDOWS\uninstall\rundl132.exe> []
<runner1><; C:\WINDOWS\retadpu26.exe 61A847B5BBF72810348B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A]
954E0C8C / 954E0C8C][Stopped/Auto Start]
<C:\WINDOWS\system32\815A6D27.EXE -p><Microsoft Corporation>
[A2D3EEFB / A2D3EEFB][Stopped/Auto Start]
<C:\WINDOWS\system32\CCCD64E4.EXE -A2D3EEFB><Microsoft Corporation>
[BDFDFE6B / BDFDFE6B][Stopped/Auto Start]
<C:\WINDOWS\system32\A574A1CA.EXE -d><Microsoft Corporation>
[DE9AA5AB / DE9AA5AB][Stopped/Auto Start]
<C:\WINDOWS\system32\F5BC55AF.EXE -k><Microsoft Corporation>
[E218330E / E218330E][Stopped/Auto Start]
<C:\WINDOWS\system32\E315E3FB.EXE -a><Microsoft Corporation>
[ASP.NET FrameWork Service / LocalServices][Running/Auto Start]
<C:\WINDOWS\system32\Svchost.exe -k LocalServices-->C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Local.dll><Microsoft Corporation>
[Server.NET / netserver][Stopped/Auto Start]
<C:\WINDOWS\system32\netserver32.exe><N/A>
Remote Procedure Call System(RPCS) / RpcS][Stopped/Auto Start]
<C:\WINDOWS\system32\RpcS.exe><N/A>
[svchost / svchost][Stopped/Auto Start]
<C:\WINDOWS\system32\dllcache\svchost.exe -g><N/A>
[Windows weqr RunThem / weqr][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\rzlm\bjvw.dll><>
[Windows Accounts Driver / windows_0][Stopped/Auto Start]
<C:\WINDOWS\system32\888.exe><N/A>
[Automatic Updates / wuauserv][Running/Auto Start]
<C:\WINDOWS\system32\drivers\svchost.exe><N/A>...
yuelihu - 2007-8-17 14:25:00
==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\安装应用程序\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[]
  {A1626E66-B26B-C628-A1DF-BDACCFA26EE1} <C:\Program Files\Common Files\Relive.dll, N/A>
[AcroIEToolbarHelper Class]
  {AE7CD045-E861-484f-8273-0445EE161910} <D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[]
  {D3626E66-B13B-C628-ACDF-BDABCFA265E1} <C:\Program Files\Common Files\Relive.dll, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Java Plug-in]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in]
  {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_06]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll, Sun Microsystems, Inc.>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\安装应用程序\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll, Sun Microsystems, Inc.>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[]
  {A1626E66-B26B-C628-A1DF-BDACCFA26EE1} <C:\Program Files\Common Files\Relive.dll, N/A>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[AcroIEToolbarHelper Class]
  {AE7CD045-E861-484F-8273-0445EE161910} <D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\MSADC\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[]
  {D3626E66-B13B-C628-ACDF-BDABCFA265E1} <C:\Program Files\Common Files\Relive.dll, N/A>
[上传到QQ网络硬盘]
  <D:\安装应用程序\QQ胡达达\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\安装应用程序\QQ胡达达\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\安装应用程序\QQ胡达达\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\安装应用程序\QQ胡达达\SendMMS.htm, N/A>
[转换为 Adobe PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换为现有 PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换选定的链接为 Adobe PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[转换选定的链接为现有 PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[转换选项为 Adobe PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换选项为现有 PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换链接目标为 Adobe PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换链接目标为现有 PDF]
  <res://D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

==================================
正在运行的进程
[PID: 448][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 532][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\99C94ADC.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\winlib .dll]  [N/A, N/A]
    [C:\WINDOWS\system32\862013EF.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\5E72E749.DLL]  [Microsoft Corporation, N/A]
[PID: 576][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\LYMANGR.DLL]  [N/A, N/A]
[PID: 588][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 756][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 844][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 884][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
yuelihu - 2007-8-17 14:25:00
[PID: 944][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 1040][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\AdobePDF.dll]  [Adobe Systems Incorporated., 7.0.0.00]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [D:\安装应用程序\Acrobat 7.0\Distillr\AdistRes.CHS]  [N/A, N/A]
    [C:\WINDOWS\system32\OLFMNT40.DLL]  [Microsoft Corporation, 9.0.98.0105]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\olfpnt40.dll]  [Microsoft Corporation, 9.0.98.0105]
[PID: 1164][C:\WINDOWS\system32\drivers\CDAC11BA.EXE]  [Macrovision, 4.20.020]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 1276][C:\WINDOWS\system32\Svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\documents and settings\localservice\local settings\application data\microsoft\windows\local.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 1488][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
[PID: 1628][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1652][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\bjvw.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\goab.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\xfrs.dll]  [, 5, 0, 0, 9]
[PID: 200][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\5E72E749.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\7364379B.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\862013EF.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\2A179E7C.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\99C94ADC.DLL]  [Microsoft Corporation, N/A]
    [C:\WINDOWS\system32\kuy0qqe.dll]  [N/A, N/A]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Internet Explorer\RAVDHMON.DAT]  [N/A, N/A]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
    [D:\安装应用程序\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\安装应用程序\Acrobat 7.0\ActiveX\PDFShell.CHS]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\安装应用程序\Acrobat 7.0\Acrobat Elements\ContextMenu.dll]  [Adobe Systems Inc., 7.0.0.2004121400\0]
    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [D:\安装应用程序\Acrobat 7.0\Acrobat Elements\ContextMenu.chs]  [Adobe Systems Inc., 7.0.0.2004121400\0]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [D:\安装应用程序\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
[PID: 1704][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2008][C:\WINDOWS\system32\igfxpers.exe]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4396]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2020][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.39]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2164][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2196][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2236][C:\Program Files\Messenger\msmsgs.exe]  [Microsoft Corporation, 4.7.3001]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\RAVDHMON.DAT]  [N/A, N/A]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2432][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.dll]  [Adobe Systems Incorporated, 7.0.0.0]
    [C:\WINDOWS\system32\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [D:\安装应用程序\Acrobat 7.0\Acrobat\AcroIEFavClient.CHS]  [Adobe Systems Incorporated, 7.0.0.0]
    [D:\安装应用程序\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll]  [Sun Microsystems, Inc., 5.0.60.5]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\011980.com]  [江民公司, 1, 1, 0, 0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\RAVDHMON.DAT]  [N/A, N/A]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
[PID: 2864][D:\安装应用程序\世界之窗绿色版\TheWorldFull\TheWorld.exe]  [Phoenix Studio, 1, 2, 3, 5]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\RAVDHMON.DAT]  [N/A, N/A]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [D:\安装应~1\世界之~1\THEWOR~1\Plugin\SysState\SysState.dll]  [Phoenix Stdio, 1, 0, 0, 4]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\Documents and Settings\Administrator\桌面\专杀\sreng2\abcSREng.com]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\RAVDHMON.DAT]  [N/A, N/A]
    [c:\progra~1\rzlm\emyz.dll]  [, 5, 0, 0, 9]
    [c:\progra~1\rzlm\jrde.dll]  [, 5, 0, 0, 9]
    [C:\WINDOWS\system32\mppds.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
yuelihu - 2007-8-17 14:26:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]
yuelihu - 2007-8-17 14:32:00
习惯性死机，传上来真不容易！

大哥帮帮忙啊！
yuelihu - 2007-8-17 14:33:00
怎么解决啊？
刚才没有上传完！
现在完成！
nkevin - 2007-8-17 14:37:00
佩服佩服。。。。。楼主机子是够强的。。。。。。。根据报告，总结如下：

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\install.exe>
<nobltvm><C:\Program Files\Common Files\System\gaptrwx.exe> [N/A]
<RAVDHMON><C:\Program Files\Internet Explorer\RAVDHMON.exe> [N/A]
<mppds><C:\WINDOWS\mppds.exe> [N/A]
<adqjpfw><; C:\Program Files\Common Files\Microsoft Shared\qlocysr.exe> [N/A]
<load><; C:\WINDOWS\uninstall\rundl132.exe> []
<runner1><; C:\WINDOWS\retadpu26.exe 61A847B5BBF72810348B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> [N/A]
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]

服务：

[954E0C8C / 954E0C8C][Stopped/Auto Start]
<C:\WINDOWS\system32\815A6D27.EXE -p><Microsoft Corporation>
[A2D3EEFB / A2D3EEFB][Stopped/Auto Start]
<C:\WINDOWS\system32\CCCD64E4.EXE -A2D3EEFB><Microsoft Corporation>
[BDFDFE6B / BDFDFE6B][Stopped/Auto Start]
<C:\WINDOWS\system32\A574A1CA.EXE -d><Microsoft Corporation>
[DE9AA5AB / DE9AA5AB][Stopped/Auto Start]
<C:\WINDOWS\system32\F5BC55AF.EXE -k><Microsoft Corporation>
[E218330E / E218330E][Stopped/Auto Start]
<C:\WINDOWS\system32\E315E3FB.EXE -a><Microsoft Corporation>
[Server.NET / netserver][Stopped/Auto Start]
<C:\WINDOWS\system32\netserver32.exe><N/A>
[Remote Procedure Call System(RPCS) / RpcS][Stopped/Auto Start]
<C:\WINDOWS\system32\RpcS.exe><N/A>
[svchost / svchost][Stopped/Auto Start]
<C:\WINDOWS\system32\dllcache\svchost.exe -g><N/A>
[Windows Accounts Driver / windows_0][Stopped/Auto Start]
<C:\WINDOWS\system32\888.exe><N/A>

驱动：

giveio / giveio][Running/Boot Start]
<\SystemRoot\system32\giveio.sys><N/A>
[ls3h4 / ls3h4][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\ls3h4.sys><N/A>

还有各个分区根目录下面的 autorun.inf和auto.exe


PS：貌似发现了传说的维金？？？？？？？c:\windows\uninstall\rundl132.exe？？？？？

楼主根据2楼版主的总结，清理吧。。。。。顺便也可以参考一下我这个。嘿嘿
newcenturymoon - 2007-8-17 14:39:00

加我qq 用你不怕丢的加 qq号通过悄悄话发给你
奇缘の随风 - 2007-8-17 14:51:00
[C:\WINDOWS\system32\UxTheme.dll]
[C:\WINDOWS\system32\7364379B.DLL]
[C:\WINDOWS\system32\2A179E7C.DLL]

[c:\progra~1\rzlm\bjvw.dll]
[c:\progra~1\rzlm\emyz.dll]
[c:\progra~1\rzlm\jrde.dll]
[c:\progra~1\rzlm\goab.dll]
[c:\progra~1\rzlm\xfrs.dll]
[C:\WINDOWS\system32\5E72E749.DLL]
[C:\WINDOWS\system32\7364379B.DLL]
[C:\WINDOWS\system32\862013EF.DLL]
[C:\WINDOWS\system32\2A179E7C.DLL]
[C:\WINDOWS\system32\99C94ADC.DLL]
[C:\WINDOWS\system32\kuy0qqe.dll]
日不懂啊 - 2007-8-17 15:34:00
一场浩大的工程...
AUTO。EXE
维金
雅虎流氓
一堆木马...
阳光斑竹，别忙了一大堆搞定的时候，突然忘记叫他把U盘中的AUTO。EXE  AUTORUN。INF 干掉哈，要不...
kakajingying - 2007-8-17 17:57:00
该用户帖子内容已被屏蔽
秦王朝 - 2007-8-17 19:36:00
你中的应该是AV终结者。我想你应该用U盘在别的电脑中下载专杀工具，到你的电脑上用！
哦只为你 - 2007-8-20 7:35:00
呵呵平常事儿,我也用瑞星的,现在的病毒确实太猖獗了
跑起来吧 - 2007-8-21 10:03:00
那是什么鬼病毒呀，瑞星那么强悍也敌不过它？
害怕不 - 2007-8-21 23:04:00
中毒了吧,这么厉害的病毒还是第一次看见,楼主等卡卡社区的高手来解决吧~~
1
查看完整版本: 太厉害了！连瑞星都被破坏了！连病毒名称都不知道！
© 2000 - 2026 Rising Corp. Ltd.