瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 花了好几天,依然无法解决,请高手帮忙!有日志

1   1  /  1  页   跳转

花了好几天,依然无法解决,请高手帮忙!有日志

花了好几天,依然无法解决,请高手帮忙!有日志

一开始中了070116.vbs,卡巴总是报,删了过不了多久又出来了,接着发现进程有两个smss.exe,一个在system32的shellext目录下面,去shellext下面一看,有个yes.bat,wmi.vbs,in.exe还有好几个日至文件,明显是病毒,全部删除以后,重起以后smss.exe又出来了,然后还多出一个服务,对应目录是winnt/media/auto,服务禁用,文件删除,可是问题好像还是没有彻底解决,请大家帮我再看一下啊,下面是日志,我是2000系统
最后编辑2007-03-18 15:30:28
分享到:
gototop
 

Logfile of Kaka v2. 0. 3. 0 Scan Module v1. 0. 6. 1
Scan saved at 19:51:22, on 2007-03-17
Platform: Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
MSIE: Internet Explorer v6.00 SP1;Q837009;Q832894;Q831167;Q823353;Q833989; (6.00.2800.1106)


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://www.google.com/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.google.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - e:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: Thunder Browser Helper - {889D2FEB-5411-4565-8998-1DD2C5261283} - c:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - D:\WINNT\system32\KakaTool.dll
O4 - HKCU\..\Run: [ctfmon.exe] CTFMON.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [kav] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - Startup: QQ游戏启动加速程序.lnk = E:\QQGame\QQGame\Accel.exe
O4 - Global Startup: desktop.ini =
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - E:\Program Files\KuGoo2\KuGoo3DownX.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra Button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINNT\system32\msjava.dll
O9 - Extra Button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - c:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra Button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra Button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\WINNT\system32\shdocvw.dll
O9 - Extra Button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra Button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - e:\Program Files\Tencent\QQ\QQIEHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/windows/ie_intl/cn/start/
O16 - DPF: DirectAnimation Java Classes - file://D:\WINNT\system32\dajava.cab
O16 - DPF: Internet Explorer Classes for Java - file://D:\WINNT\system32\iejava.cab
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E732F341-9519-4A62-A163-441B254B6275}: NameServer = 202.96.209.134 202.96.209.6
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - D:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINNT\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - E:\PROGRA~1\KuGoo2\InExtend\KUGOO3~1.OCX
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - D:\WINNT\system32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - D:\WINNT\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - D:\WINNT\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINNT\system32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - D:\WINNT\system32\msdxm.ocx
O20 - Winlogon Notify: klogon
O20 - Winlogon Notify: System Safety Monitor
O20 - Winlogon Notify: wzcnotif
O23 - Service: AVG Anti-Spyware Guard (AVG Anti-Spyware Guard) - Anti-Malware Development a.s. - e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: 卡巴斯基反病毒软件6.0 (AVP) - Kaspersky Lab - "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\system32\dmadmin.exe /com
O23 - Service: Lotus Domino Server (LotusDominoData) (Lotus Domino Server (LotusDominoData)) -  - j:\Lotus\Domino\nservice.exe =j:\Lotus\Domino\notes.ini
O23 - Service: Macromedia Licensing Service (Macromedia Licensing Service) -  - "D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINNT\system32\nvsvc32.exe
O23 - Service: Network IDE  (Scardsvr IDE      ) - Microsoft Corporation - D:\WINNT\system32\svchost.dll
O23 - Service: User Privilege Service (usprserv) - Microsoft Corporation - D:\WINNT\system32\svchost.exe -k netsvcs
O23 - Service: WinPPPoverEthernet (WinPPPoverEthernet) - iVasion, a Routerware Company - D:\Program Files\WinPoET\WrOS.EXE
gototop
 

用sreng扫吧
http://www.kztechs.com/sreng/download.html
gototop
 

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><CTFMON.EXE>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NvCplDaemon><RUNDLL32.EXE D:\WINNT\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <kav><"E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><D:\Program Files\Rising\KakaToolBar\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><D:\WINNT\SYSTEM32\Userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><D:\WINNT\system32\KVSCRK~1.SCR>  [N/A]

==================================
启动文件夹
[Adobe Gamma Loader.exe]
  <D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.exe.lnk --> D:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Microsoft Office]
  <D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~3\Office10\OSA.EXE [Microsoft Corporation]><N>
[Adobe Reader Speed Launch]
  <D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> D:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[QQ游戏启动加速程序]
  <D:\WINNT\Html\QQ游戏启动加速程序.lnk --> E:\QQGame\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

==================================
服务
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><Anti-Malware Development a.s.>
[卡巴斯基反病毒软件6.0 / AVP][Running/Auto Start]
  <"E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r><Kaspersky Lab>
[DuDu Accelerator o / DDDProxy][Stopped/Disabled]
  <><N/A>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Lotus Domino Server (LotusDominoData) / Lotus Domino Server (LotusDominoData)][Stopped/Manual Start]
  <j:\Lotus\Domino\nservice.exe =j:\Lotus\Domino\notes.ini><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Disabled]
  <"D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[mudtx_mudtx_2003_7_24_mud_MUDOS_EXE / mudtx_mudtx_2003_7_24_mud_MUDOS_EXE][Stopped/Auto Start]
  <><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <D:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[WINS Client / RpcPatch][Stopped/Auto Start]
  <><N/A>
[Network IDE  / Scardsvr IDE      ][Stopped/Disabled]
  <D:\WINNT\system32\svchost.dll><N/A>
[MSIServers / Windows Instaler][Stopped/Disabled]
  <><N/A>
[WinPPPoverEthernet / WinPPPoverEthernet][Stopped/Disabled]
  <D:\Program Files\WinPoET\WrOS.EXE><iVasion, a Routerware Company>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <D:\WINNT\System32\svchost.exe -k netsvcs-->D:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
gototop
 

驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[Standard IDE/ESDI Hard Disk Controller / atapi][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\atapi.sys><N/A>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[d346bus / d346bus][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\d346bus.sys><>
[d346prt / d346prt][Running/Boot Start]
  <\SystemRoot\System32\Drivers\d346prt.sys><>
[D-Link DFE-530TX PCI Fast Ethernet Adapter / DLKFET][Running/Manual Start]
  <System32\DRIVERS\DLKFET.sys><D-Link>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\dmio.sys><VERITAS Software Corp.>
[EagleNT / EagleNT][Stopped/Manual Start]
  <\??\D:\WINNT\system32\drivers\EagleNT.sys><N/A>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\D:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[kmsinput / kmsinput][Stopped/Manual Start]
  <\??\D:\WINNT\system32\drivers\kmsinput.sys><N/A>
[KRegEx / KRegEx][Stopped/System Start]
  <\??\D:\PROGRA~1\JiangMin\ANTIVI~1\KRegEx.sys><N/A>
[KWATCH / KWATCH][Stopped/Manual Start]
  <\??\D:\KAV2003\KWATCH.SYS><N/A>
[KWatch3 / KWatch3][Running/System Start]
  <\??\D:\WINNT\system32\drivers\KWatch3.SYS><Kingsoft Corporation>
[LUMDriver / LUMDriver][Running/System Start]
  <\??\D:\WINNT\system32\drivers\LUMDriver.sys><IBM>
[MEMSWEEP2 / MEMSWEEP2][Stopped/Manual Start]
  <\??\D:\WINNT\system32\6C.tmp><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\E:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\E:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[NPPTNT / NPPTNT][Running/System Start]
  <\??\D:\WINNT\system32\npptNT.sys><INCA Internet Co., Ltd.>
[NPPTNT2 / NPPTNT2][Stopped/Manual Start]
  <\??\D:\WINNT\system32\npptNT2.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[oreans32 / oreans32][Stopped/System Start]
  <\??\D:\WINNT\system32\drivers\oreans32.sys><N/A>
[PNP27825 / PNP27825][Running/Boot Start]
  <\SystemRoot\system32\Drivers\pnp27723.sys><Anti Driver>
[StarForce Protection Environment Driver v6 / prodrv06][Running/System Start]
  <\SystemRoot\System32\drivers\prodrv06.sys><Protection Technology>
[StarForce Protection Helper Driver v2 / prohlp02][Running/Boot Start]
  <\SystemRoot\System32\drivers\prohlp02.sys><Protection Technology>
[StarForce Protection Synchronization Driver v1 / prosync1][Running/Boot Start]
  <\SystemRoot\System32\drivers\prosync1.sys><Protection Technology>
[PSSdk21 / PSSdk21][Stopped/Manual Start]
  <\??\D:\WINNT\system32\Drivers\HNPsSdk.drv><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[WAN 微型端口 (PPP over Ethernet 协议) / RMSPPPOE][Running/Manual Start]
  <system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[Realtek RTL8139(A/B/C/8130) PCI Fast Ethernet NIC NT Driver / rtl8139][Stopped/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[System Safety Monitor 2.0 Core Engine / safemon][Running/Boot Start]
  <\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[SecDrv / SecDrv][Running/Auto Start]
  <\??\D:\WINNT\system32\drivers\SECDRV.SYS><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[StarForce Protection Environment Driver (version 1.x) / sfdrv01][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfdrv01.sys><Protection Technology>
[StarForce Protection Helper Driver / sfhlp01][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfhlp01.sys><Protection Technology>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology>
[StarForce Protection Synchronization Driver (version 2.x) / sfsync02][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfsync02.sys><Protection Technology>
[USB PC Camera (SNPSTD3) / SNPSTD3][Stopped/Manual Start]
  <system32\DRIVERS\snpstd3.sys><>
[SVKP / SVKP][Stopped/Auto Start]
  <\??\D:\WINNT\system32\SVKP.sys><N/A>
[TSP / TSP][Stopped/Manual Start]
  <\??\D:\WINNT\system32\drivers\klif.sys><Kaspersky Lab>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[VIA USB Filter / viafilter][Stopped/Manual Start]
  <\SystemRoot\System32\Drivers\viausb.sys><VIA Technologies, Inc.>
[viaide / viaide][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaide.sys><VIA Technologies, Inc.>
[SyGate for NT, WG1N / WG1N][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\WG1N.sys><Sygate Technologies, Inc.>
[SyGate for NT, WG2N / WG2N][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\WG2N.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg4n / wg4n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg5n / wg5n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.>
[SyGate for NT, wg6n / wg6n][Running/Auto Start]
  <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.>
[WrKPoET2000 / WrKPoET2000][Stopped/Manual Start]
  <\??\D:\Program Files\WinPoET\WrKPoET2000.sys><N/A>
[iVasion PoET Adapter / WRSWanDD][Running/Manual Start]
  <System32\DRIVERS\WrKPoETNic2000.sys><N/A>
[SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start]
  <\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
gototop
 

浏览器加载项
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Thunder Browser Helper]
  {889D2FEB-5411-4565-8998-1DD2C5261283} <c:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <D:\WINNT\system32\msjava.dll, Microsoft Corporation>
[启动迅雷5]
  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <c:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[浩方对战平台]
  {0A155D3C-68E2-4215-A47A-E800A446447A} <E:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Web反病毒保护]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <E:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[卡卡上网安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <D:\WINNT\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[HGPluginJP23 Class]
  {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} <D:\WINNT\Downloaded Program Files\HGPluginJP23.dll, NHN Japan Corp.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
  <E:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
  <E:\Program Files\KuGoo2\KuGoo3DownX.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://D:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <E:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\Program Files\Tencent\qq\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 208][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 148][\??\D:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 252][\??\D:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6997]
    [D:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [D:\WINNT\system32\klogon.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
    [D:\WINNT\system32\SSMWinlogonEx.dll]  [System Safety Limited, 2.2.0.583]
    [D:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 280][D:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.7035]
    [D:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 292][D:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.7011]
[PID: 472][e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe]  [Anti-Malware Development a.s., 7, 5, 0, 47]
    [e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [Anti-Malware Development a.s., 4, 2, 0, 15]
[PID: 516][D:\WINNT\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.7756]
[PID: 540][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 624][D:\WINNT\system32\stisvc.exe]  [Microsoft Corporation, 5.00.2195.6656]
[PID: 652][D:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\System32\unimdm.tsp]  [Microsoft Corporation, 5.00.2195.6601]
    [D:\WINNT\System32\kmddsp.tsp]  [Microsoft Corporation, 5.00.2150.1]
    [D:\WINNT\System32\ndptsp.tsp]  [Microsoft Corporation, 5.00.2143.1]
    [D:\WINNT\System32\ipconf.tsp]  [Microsoft Corporation, 5.00.2143.1]
    [D:\WINNT\System32\h323.tsp]  [Microsoft Corporation, 5.00.2195.6901]
[PID: 840][D:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [D:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
    [D:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [D:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\system32\msimtf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [D:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll]  [Kaspersky Lab, 6.0.0.299]
    [D:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [Anti-Malware Development a.s., 7, 5, 0, 47]
    [D:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\WINNT\system32\ALSNDMGR.CPL]  [Avance Logic, Inc., 1.5.30]
    [D:\WINNT\system32\INPUT.CPL]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\mui\fallback\0804\input.cpl.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\powercfg.cpl]  [Microsoft Corporation, 5.00.3502.6601]
    [D:\WINNT\system32\nvtuicpl.cpl]  [NVIDIA Corporation, 6.14.10.10529]
    [D:\WINNT\system32\NVWRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.10529]
    [e:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [Anti-Malware Development a.s., 7, 5, 0, 49]
[PID: 1240][D:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [D:\WINNT\system32\MSUTB.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\winabc.ime]  [Microsoft Corporation, 5.00.2195.6601]
    [D:\WINNT\mui\fallback\0804\msutb.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
[PID: 544][E:\Program Files\Tencent\TT\TTraveler.exe]  [腾讯公司, 3.2.200.275]
    [D:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [E:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [E:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [E:\Program Files\Tencent\TT\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
    [D:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [D:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [e:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [D:\WINNT\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
[PID: 576][D:\Documents and Settings\sds\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.8 built by: Lab06_N]
    [D:\Documents and Settings\sds\桌面\sreng2\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]
gototop
 

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["D:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
RVA  错误: LoadLibraryA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBE65CB25)
RVA  错误: LoadLibraryExA (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBE65CD67)
RVA  错误: LoadLibraryExW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBE65CF0B)
RVA  错误: LoadLibraryW (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0xBE65CC49)
RVA  错误: GetProcAddress (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0xBE65CE8F)

==================================
隐藏进程
    [1092] D:\WINNT\system32\taskmgr.exe

==================================
gototop
 

还没解决就掉下去了,顶回去!帮帮忙啊!
gototop
 

[Network IDE / Scardsvr IDE ][Stopped/Disabled]
<D:\WINNT\system32\svchost.dll><N/A>
[SVKP / SVKP][Stopped/Auto Start]
<\??\D:\WINNT\system32\SVKP.sys><N/A>(不确认)
gototop
 

[DuDu Accelerator o / DDDProxy][Stopped/Disabled]
<><N/A>
[mudtx_mudtx_2003_7_24_mud_MUDOS_EXE / mudtx_mudtx_2003_7_24_mud_MUDOS_EXE][Stopped/Auto Start]
<><N/A>
[WINS Client / RpcPatch][Stopped/Auto Start]
<><N/A>
[Network IDE / Scardsvr IDE ][Stopped/Disabled]
<D:\WINNT\system32\svchost.dll><N/A>
[MSIServers / Windows Instaler][Stopped/Disabled]
<><N/A>
[MEMSWEEP2 / MEMSWEEP2][Stopped/Manual Start]
<\??\D:\WINNT\system32\6C.tmp><N/A>
[oreans32 / oreans32][Stopped/System Start]
<\??\D:\WINNT\system32\drivers\oreans32.sys><N/A>
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT