1   1  /  1  页   跳转页

高手啊，救救我吧~~~~~~~~~~

收藏
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-09 10:06 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

高手啊，救救我吧~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 9:54:09, on 2006-10-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\winasse.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
E:\HijackThis.exe

O1 - Hosts: 125.91.1.20 localhost
O1 - Hosts: 125.91.1.20 www.7322.com
O1 - Hosts: 125.91.1.20 www.5566.net
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 125.91.1.20 www.hao123.com
O1 - Hosts: 125.91.1.20 hao123.com
O1 - Hosts: 125.91.1.20 www.265.com
O1 - Hosts: 125.91.1.20 265.com
O1 - Hosts: 125.91.1.20 www.9991.com
O1 - Hosts: 125.91.1.20 9991.com
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 61.162.230.31 www.7939.com
O1 - Hosts: 61.162.230.31 7939.com
O1 - Hosts: 61.162.230.31 59.34.148.98
O1 - Hosts: 61.162.230.31 about:blank
O1 - Hosts: 61.141.31.11 down.Virussky.com
O1 - Hosts: 61.141.31.11 60.191.60.108
O1 - Hosts: 61.141.31.11 219.153.20.209
O1 - Hosts: 61.141.31.11 forum.ikaka.com
O1 - Hosts: 61.141.31.11 bbs.360safe.com
O1 - Hosts: 61.141.31.11 www.360safe.com
O1 - Hosts: 61.141.31.11 www.piaoxue.com
O1 - Hosts: 61.141.31.11 61.129.58.12
O1 - Hosts: 61.141.31.11 forum.jiangmin.com
O1 - Hosts: 61.141.31.11 luosoft.com
O1 - Hosts: 125.91.1.20 post.baidu.com
O1 - Hosts: 61.141.31.11 60.191.60.107
O1 - Hosts: 61.141.31.11 219.139.58.97
O1 - Hosts: 61.141.31.11 59.34.148.81
O1 - Hosts: 125.91.1.20 60.191.60.114
O1 - Hosts: 125.91.1.20 www.ycdy.com
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - d:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YOK超级搜索 - {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} - C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll
O3 - Toolbar: YOK超级搜索 - {F869BB38-FFEF-4589-B986-610B7AD0ADA2} - C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll
O4 - HKLM\..\Run: [SoundMan] ; SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccenter] ; C:\Program Files\rising\Rav\CCenter.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe
O4 - HKLM\..\Run: [run] C:\WINDOWS\system32\rundll32.exe rsrc.dll s
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [RavMon] ; C:\Program Files\rising\rav\RavMon.exe /AUTO
O4 - HKLM\..\RunServices: [ccenter] ; C:\Program Files\rising\Rav\CCenter.exe
O4 - HKCU\..\Run: [msnmsgr] ; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - d:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: YOK超级搜索 - {F869BB38-FFEF-4589-B986-610B7AD0ADA2} - http://www.yok.com (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PopWinIe - Unknown owner - C:\WINDOWS\system32\PopWin.exe (file missing)
O23 - Service: Portable Media Serial Numbe - Unknown owner - C:\WINDOWS\msn.exe

最后编辑2006-10-12 13:32:54
分享到：
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-10-09 11:52 | 短消息 资料
字号： 小 中 大 2楼

开始→运行→输入services.msc，打开“服务”→查找 Portable Media Serial Numbe→双击→启动类型→禁止→停止→应用→确定。禁止Portable Media Serial Numbe这个服务

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows

运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [Desktop] C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll
O4 - HKLM\..\Run: [xy] C:\WINDOWS\Download\svhost32.exe
O4 - HKLM\..\Run: [run] C:\WINDOWS\system32\rundll32.exe rsrc.dll s
O1 - Hosts: 125.91.1.20 localhost
O1 - Hosts: 125.91.1.20 www.7322.com
O1 - Hosts: 125.91.1.20 www.5566.net
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 125.91.1.20 www.hao123.com
O1 - Hosts: 125.91.1.20 hao123.com
O1 - Hosts: 125.91.1.20 www.265.com
O1 - Hosts: 125.91.1.20 265.com
O1 - Hosts: 125.91.1.20 www.9991.com
O1 - Hosts: 125.91.1.20 9991.com
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 61.162.230.31 www.7939.com
O1 - Hosts: 61.162.230.31 7939.com
O1 - Hosts: 61.162.230.31 59.34.148.98
O1 - Hosts: 61.162.230.31 about:blank
O1 - Hosts: 61.141.31.11 down.Virussky.com
O1 - Hosts: 61.141.31.11 60.191.60.108
O1 - Hosts: 61.141.31.11 219.153.20.209
O1 - Hosts: 61.141.31.11 forum.ikaka.com
O1 - Hosts: 61.141.31.11 bbs.360safe.com
O1 - Hosts: 61.141.31.11 www.360safe.com
O1 - Hosts: 61.141.31.11 www.piaoxue.com
O1 - Hosts: 61.141.31.11 61.129.58.12
O1 - Hosts: 61.141.31.11 forum.jiangmin.com
O1 - Hosts: 61.141.31.11 luosoft.com
O1 - Hosts: 125.91.1.20 post.baidu.com
O1 - Hosts: 61.141.31.11 60.191.60.107
O1 - Hosts: 61.141.31.11 219.139.58.97
O1 - Hosts: 61.141.31.11 59.34.148.81
O1 - Hosts: 125.91.1.20 60.191.60.114
O1 - Hosts: 125.91.1.20 www.ycdy.com
删除
C:\Program Files\DeskAdTop
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\Domino.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\msn.exe

完后重启。
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-10 13:20 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

006-10-10,13:05:01

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <msnmsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SoundMan><; SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <ccenter><; C:\Program Files\rising\Rav\CCenter.exe>  []
    <nod32kui><"C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE>  [Eset ]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <RavMon><; C:\Program Files\rising\rav\RavMon.exe /AUTO>  []
    <ccenter><; C:\Program Files\rising\Rav\CCenter.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <9><C:\WINDOWS\system32\Ravdm.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\SYSTEM32\Userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{55C46005-6005-5C4E-055C-005C40055C4E}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll>  []
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-10 13:21 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

启动文件夹
服务
[KSD2Service / KSD2Service]
  <C:\WINDOWS\system32\SVCH0ST.exe><N/A>
[NOD32 Kernel Service / NOD32krn]
  <"C:\Program Files\Eset\nod32krn.exe"><Eset>
[PopWinIe / PopWinIe]
  <C:\WINDOWS\system32\PopWin.exe -service><N/A>
[Portable Media Serial Numbe / Portable Media Serial Numbe]
  <C:\WINDOWS\msn.exe><N/A>
[Windows Firewall/Internet Connection Sharing (SIC) / Service33224]
  <c:\windows\system32\winloger.exe><N/A>

==================================
浏览器加载项
[IEMonitor Class]
  {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, N/A>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[YOK超级搜索]
  {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <d:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[YOK超级搜索]
  {F869BB38-FFEF-4589-B986-610B7AD0ADA2} <http://www.yok.com, N/A>
[YOK超级搜索]
  {F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>
[IEMonitor Class]
  {08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, N/A>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[CMCBooter Object]
  {53AF6E02-F18F-4228-AC13-3E79773FBE50} <C:\WINDOWS\system32\Booter.ocx, 北京高维视讯科技有限公司>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[YOK超级搜索]
  {75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>
[CMCLoader Object]
  {779769CA-82F1-4973-BBA7-515E6C7BFD0E} <C:\Program Files\GAOV\Mysee2\MycLive.dll, 北京高维视讯科技有限公司>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[YOK超级搜索]
  {F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>
[&使用迅雷下载]
  <d:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <d:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-10 13:21 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

正在运行的进程
[PID: 316][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 364][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 388][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 432][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 444][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 600][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
[PID: 648][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 712][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 776][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 852][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 1020][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
    [C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll]  <www.YOK.com><2.0.1.8>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\Program Files\Eset\nodshex.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_nod32.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\pu_nod32.dll]  <Eset ><2, 50, 19 >
[PID: 1084][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1296][C:\WINDOWS\system32\winasse.exe]  <Microsoft Corporation><5.1.2600.0>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
[PID: 1328][C:\Program Files\Eset\nod32kui.exe]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\nod32rui.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
    [C:\Program Files\Eset\pu_amon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_amon.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\pu_dmon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_dmon.dll]  <N/A><N/A>
    [C:\Program Files\Eset\pu_emon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_emon.dll]  <N/A><N/A>
    [C:\Program Files\Eset\pu_imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
    [C:\Program Files\Eset\pu_nod32.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_nod32.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\pu_upd.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_upd.dll]  <N/A><N/A>
[PID: 1424][C:\Program Files\Eset\nod32krn.exe]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\nod32krr.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\ps_amon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_amon.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\ps_dmon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_dmon.dll]  <N/A><N/A>
    [C:\Program Files\Eset\ps_emon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_emon.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
    [C:\Program Files\Eset\ps_nod32.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_nod32.dll]  <Eset ><2, 50, 25 >
    [C:\Program Files\Eset\ps_upd.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_upd.dll]  <N/A><N/A>
[PID: 1556][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2012][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWS\System32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>
[PID: 1196][C:\Program Files\Eset\nod32.exe]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\nod32r.dll]  <N/A><N/A>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
[PID: 788][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.4.3790.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2140][E:\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\imon.dll]  <Eset ><2, 50, 19 >
    [C:\Program Files\Eset\pr_imon.dll]  <N/A><N/A>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-11 08:18 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

无邪帮偶再看看啊，谢谢了~~~~~~~~~
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-11 14:19 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

up!
gototop
 
老高123
头像
初生襁褓狮
  • 帖子:25
  • 注册: 2006-03-23
  • 来自:
发表于： 2006-10-12 12:52 | 只看楼主 短消息 资料
字号： 小 中 大 8楼

up!
gototop
 
不言放弃
头像
社区嘉宾
  • 帖子:30678
  • 注册: 2004-09-17
  • 来自:蓝色星球
发表于： 2006-10-12 13:41 | 短消息 资料
字号： 小 中 大 9楼

【回复“老高123”的帖子】
修复如下自启动项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\system32\Ravdm.exe> [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{55C46005-6005-5C4E-055C-005C40055C4E}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll> []

＝＝＝＝＝＝＝＝＝＝＝＝

修复如下服务项：
[KSD2Service / KSD2Service]
<C:\WINDOWS\system32\SVCH0ST.exe><N/A>

[PopWinIe / PopWinIe]
<C:\WINDOWS\system32\PopWin.exe -service><N/A>

[Portable Media Serial Numbe / Portable Media Serial Numbe]
<C:\WINDOWS\msn.exe><N/A>

[Windows Firewall/Internet Connection Sharing (SIC) / Service33224]
<c:\windows\system32\winloger.exe><N/A>

＝＝＝＝＝＝＝＝＝＝＝＝

修复如下浏览器加载项：
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, N/A>

[YOK超级搜索]
{75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>

[YOK超级搜索]
{F869BB38-FFEF-4589-B986-610B7AD0ADA2} <http://www.yok.com, N/A>

[YOK超级搜索]
{F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>

[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, N/A>


[YOK超级搜索]
{75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>

[YOK超级搜索]
{F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.YOK.com>

＝＝＝＝＝＝＝＝＝＝＝＝

卸载
C:\Program Files\DeskAdTop\
C:\Program Files\YOK.com\

＝＝＝＝＝＝

开始－－运行
输入regedit
确定
进入注册表
依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services](X代表1,2,3,4....)
找到后删除如下文件夹：
KSD2Service文件夹
PopWinIe文件夹
Portable Media Serial Numbe文件夹
Service33224文件夹

依次展开
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Enum\Root\](X代表1,2,3,4....)
删除如下文件夹：
LEGACY_KSD2Service文件夹
LEGACY_PopWinIe文件夹
LEGACY_Portable Media Serial Numbe文件夹
LEGACY_Service33224文件夹

＝＝＝＝＝＝＝＝＝＝

删除
C:\Program Files\DeskAdTop\
C:\Program Files\YOK.com\
C:\WINDOWS\system32\Ravdm.exe
C:\WINDOWS\system32\SVCH0ST.exe（注意：该SVCH0ST.exe中的0是数字0）
C:\WINDOWS\system32\PopWin.exe
C:\WINDOWS\system32\PopWin.dll
C:\WINDOWS\msn.exe
c:\windows\system32\winloger.exe
C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll


若无法删除C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll
请按下面步骤操作：
先关闭C:\Program Files\Eset\nod32.exe监控及其进程
然后删除C:\Program Files\Common Files\Microsoft Shared\MSINFO\60055C4E.dll
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT