高手帮我看下日记有什么不对劲 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛高手帮我看下日记有什么不对劲

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

高手帮我看下日记有什么不对劲

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-13 22:42 \| 只看楼主短消息资料字号：小中大 1楼高手帮我看下日记有什么不对劲以前经常会弹出网页，后来用卡卡和流氓软件清理大师清理过后，网页倒是不会弹出来，但重启的时候，收藏夹会多处两个网址 Logfile of HijackThis v1.99.1 Scan saved at 22:29:19, on 2006-9-13 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\svchost.exe C:\Program Files\KV2006\KVSrvXP.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\KV2006\KVMonXP.kxp C:\Program Files\DAEMON Tools\daemon.exe C:\WINNT\SOUNDMAN.EXE C:\WINNT\system32\internat.exe C:\Program Files\KVFW\kvfw.exe C:\Program Files\KV2006\TrojDie.kxp C:\Program Files\KV2006\KRegEx.exe C:\Program Files\KV2006\UIHost.exe C:\Program Files\KV2006\KvXP.kxp D:\bt.p2p\BitComet_0.70\BitComet_0.70\BitComet.exe D:\computer\VStart50 051025\VStart.exe D:\chat tool\QQ2005\QQ.exe D:\chat tool\QQ2005\TIMPlatform.exe C:\WINNT\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe D:\computer\HijackThis\HijackThis.exe O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v14.dll O2 - BHO: FiltrateWebObj Class - {42AFACEE-2A77-41EB-9EE2-D9F8AF827F90} - C:\Program Files\KV2006\KVBHO.dll O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\Program Files\KV2006\KvShell.dll O2 - BHO: (no name) - {E730189A-9973-4121-B046-AD1C161EC3AF} - (no file) O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\Program Files\KV2006\KvShell.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KvMonXP] "C:\Program Files\KV2006\KVMonXP.kxp" /auto O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [Internat.exe] internat.exe O4 - HKCU\..\Run: [KvXP] "C:\Program Files\KV2006\KvXP.kxp" /ScanBoot /ScanSys O4 - HKCU\..\Run: [KVFW] C:\Program Files\KVFW\kvfw.exe -silent O8 - Extra context menu item: 使用迅雷下载 - D:\bt.p2p\Thunder\geturl.htm O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\bt.p2p\Thunder\getallurl.htm O8 - Extra context menu item: 用比特精灵下载(&B) - D:\bt.p2p\BitSpirit\bsurl.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{85DB3C8F-7E8D-4888-A9C9-658932D6785A}: NameServer = 61.153.177.200,61.153.177.202 O17 - HKLM\System\CS1\Services\Tcpip\..\{85DB3C8F-7E8D-4888-A9C9-658932D6785A}: NameServer = 61.153.177.200,61.153.177.202 O17 - HKLM\System\CS2\Services\Tcpip\..\{85DB3C8F-7E8D-4888-A9C9-658932D6785A}: NameServer = 61.153.177.200,61.153.177.202 O23 - Service: Windows Management Instrument - Unknown owner - C:\WINNT\svchost.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: GrayPigeo (GrayPigeon) - Unknown owner - C:\WINNT\sysem.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: KVSrvXP - Jiangmin Co. Ltd - C:\Program Files\KV2006\KVSrvXP.exe 2006-09-14 23:07:25
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	分享到：

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-09-13 23:06 \| 短消息资料字号：小中大 2楼开始→运行→输入services.msc，打开“服务”→查找 Windows Management Instrument ,GrayPigeo →双击→启动类型→禁止→停止→应用→确定。禁止Windows Management Instrument ,GrayPigeo 这2个服务（每一个逗号隔开的就是一个病毒的服务，请逐一禁用）重启后删除 C:\WINNT\svchost.exe C:\WINNT\sysem.exe
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-09-13 23:07 \| 短消息资料字号：小中大 3楼修复后重启。请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来下载网址 http://www.kztechs.com/sreng/sreng2.zip http://forum.ikaka.com/topic.asp?board=67&artid=5188931 日志一次粘不完，分次粘完，请不要修改。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-13 23:22 \| 只看楼主短消息资料字号：小中大 4楼太感谢我无邪的回答了，我已经照你的吩咐把SREng.LOG日记贴上去了 2006-09-13,23:10:55 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <Internat.exe><internat.exe> [Microsoft Corporation] <KvXP><"C:\Program Files\KV2006\KvXP.kxp" /ScanBoot /ScanSys> [Jiangmin Co.Ltd] <KVFW><C:\Program Files\KVFW\kvfw.exe -silent> [Beijing Jiangmin.] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KvMonXP><"C:\Program Files\KV2006\KVMonXP.kxp" /auto> [Jiangmin Co.Ltd] <StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [] <DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [DT Soft Ltd.] <SoundMan><SOUNDMAN.EXE> [Realtek Semiconductor Corp.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><(无)> [] ================================== 启动文件夹服务 [Windows Management Instrument / Windows Management Instrument] <C:\WINNT\svchost.exe><N/A> [Ati HotKey Poller / Ati HotKey Poller] <C:\WINNT\system32\Ati2evxx.exe><N/A> [ATI Smart / ATI Smart] <C:\WINNT\system32\ati2sgag.exe><> [Logical Disk Manager Administrative Service / dmadmin] <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.> [GrayPigeo / GrayPigeon] <C:\WINNT\sysem.exe><N/A> [InstallDriver Table Manager / IDriverT] <C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe><Macrovision Corporation> [KVSrvXP / KVSrvXP] <C:\Program Files\KV2006\KVSrvXP.exe /Service><Jiangmin Co. Ltd> ================================== 浏览器加载项 [ThunderIEHelper Class] {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD> [FiltrateWebObj Class] {42AFACEE-2A77-41EB-9EE2-D9F8AF827F90} <C:\Program Files\KV2006\KVBHO.dll, Jiangmin Co.Ltd> [BrowseHelper Class] {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <C:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [@msdxmLC.dll,-1@2052,电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation> [江民杀毒工具栏] {B5A34A93-D538-43A7-8371-864CB6148D12} <C:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd> [] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\Ringz Studio\Storm Codec\QTSYSTEM\QTPLUGI2.OCX, Apple Computer, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [使用迅雷下载] <D:\bt.p2p\Thunder\geturl.htm, N/A> [使用迅雷下载全部链接] <D:\bt.p2p\Thunder\getallurl.htm, N/A> [用比特精灵下载(&B)] <D:\bt.p2p\BitSpirit\bsurl.htm, N/A>
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-13 23:23 \| 只看楼主短消息资料字号：小中大 5楼 ================================== 正在运行的进程 [PID: 204][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 228][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 248][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6898> [PID: 280][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700> [C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3> [PID: 292][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6902> [PID: 404][C:\WINNT\system32\Ati2evxx.exe] <N/A><N/A> [PID: 488][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 512][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659> [PID: 560][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 576][C:\Program Files\KV2006\KVSrvXP.exe] <Jiangmin Co. Ltd><9.2.0.50822> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\SvcSafe.dll] <Jiangmin Co. Ltd><9, 2, 0, 51107> [C:\Program Files\KV2006\lang\SvcSafe0804.lng] <N/A><N/A> [C:\Program Files\KV2006\RegProt.dll] <Jiangmin Co.Ltd><9, 0, 5, 1212> [C:\Program Files\KV2006\Scan.dll] <Jiangmin Co., Ltd.><1.0.6.05190> [C:\Program Files\KV2006\FileGD.dll] <Jiangmin Co.Ltd><9.2.0.50809> [C:\Program Files\KV2006\KvSPI.dll] <Jiangmin Co. Ltd.><1.0.6.06030> [C:\Program Files\KV2006\lang\KvSPI0804.lng] <N/A><N/A> [C:\Program Files\KV2006\ScanHost.dll] <Jiangmin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVWPSet.dll] <Jiangmin Co.Ltd><9, 0, 0, 60220> [C:\Program Files\KV2006\KVEnhS.dll] <Jiangmin Co., Ltd.><9, 2, 6, 02040> [C:\Program Files\KV2006\KVEnhJ.dll] <Jiangmin Co.Ltd><9, 1, 0, 50822> [C:\Program Files\KV2006\KVExtCab.dll] <JiangMin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVExtEml.dll] <Jiangmin Co. Ltd.><9, 2, 0, 51207> [C:\Program Files\KV2006\lang\KVExtEml0804.lng] <N/A><N/A> [C:\Program Files\KV2006\KVExtLZH.dll] <JiangMin Co. Ltd.><9, 2, 6, 0316> [C:\Program Files\KV2006\KvExtRar.dll] <JiangMin Co. Ltd.><9, 2, 6, 04020> [C:\Program Files\KV2006\KvExtZip.dll] <JiangMin Co Ltd.><9, 2, 0, 50822> [C:\Program Files\KV2006\KVExtZ.dll] <Jiangmin Co. Ltd><9.2.0.503> [C:\Program Files\KV2006\KVExtGz.dll] <Jiangmin Co. Ltd><9, 0, 6, 04200> [C:\Program Files\KV2006\KVExtTar.dll] <Jiangmin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVEnhK.dll] <Jiangmin Co.Ltd><9, 1, 0, 51209> [C:\Program Files\KV2006\Fix.dll] <Jiangmin Co.Ltd><9, 2, 0, 51011> [C:\Program Files\KV2006\KVCkMail.dll] <N/A><9, 0, 6, 605> [C:\Program Files\KV2006\lang\KvMailRes0804.lng] <N/A><N/A> [C:\Program Files\KV2006\EngPS.dll] <Jiangmin Co.Ltd><9, 2, 0, 50817> [PID: 620][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701> [PID: 648][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6704> [PID: 744][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100> [PID: 780][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 924][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690> [C:\Program Files\KV2006\KvShell.dll] <Jiangmin Co.Ltd><9, 0, 5, 830> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A> [C:\Program Files\KV2006\APIImpl.dll] <JiangMin Ltd.><9.0.0.500> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62> [C:\Program Files\KV2006\KVBHO.dll] <Jiangmin Co.Ltd><9.0.6.0113> [C:\Program Files\KV2006\KVAddrDb.dll] <Jiangmin Co.Ltd><9, 0, 0, 1018> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [PID: 1052][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3536> [C:\Program Files\KV2006\KVMonXP.kxp] <Jiangmin Co.Ltd><9, 2, 0, 60103> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\Program Files\KV2006\EngFace.dll] <Jiangmin Co.Ltd><9.0.0.50809> [C:\Program Files\KV2006\EngPS.dll] <Jiangmin Co.Ltd><9, 2, 0, 50817> [C:\Program Files\KV2006\KvMemory.dll] <Jiangmin Co. Ltd.><9, 0, 6, 0214> [C:\Program Files\KV2006\KvOffice.dll] <JiangMin New Tech.><9.0.0.1213> [C:\Program Files\KV2006\lang\KVOffice0804.lng] <N/A><N/A> [C:\Program Files\KV2006\VirusUpload.dll] <N/A><2, 0, 0, 0> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\PProtect.dll] <Jiangmin Co. Ltd.><9.0.0.921> [PID: 1132][C:\Program Files\DAEMON Tools\daemon.exe] <DT Soft Ltd.><4.03.0.0> [C:\Program Files\DAEMON Tools\daemon.dll] <DT Soft Ltd.><4.03.0.0> [C:\Program Files\DAEMON Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12> [C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.6.0> [C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.10.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.12.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.11.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0> [PID: 1140][C:\WINNT\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.33> [PID: 1092][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000> [PID: 1184][C:\Program Files\KVFW\kvfw.exe] <Beijing Jiangmin.><9.0.5.1205> [C:\Program Files\KVFW\KVFWUtil.DLL] <><1, 0, 0, 1> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\TrojDie.kxp] <Jiangmin Co.Ltd><9.0.6.0413> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\TrojDie0804.lng] <Jiangmin Co.Ltd><9.0.0.0813> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\Program Files\KV2006\PProtect.dll] <Jiangmin Co. Ltd.><9.0.0.921> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20> [PID: 1244][C:\Program Files\KV2006\KRegEx.exe] <Jiangmin Co.Ltd><9.0.6.210> [C:\Program Files\KV2006\KRegEx.dll] <Jiangmin Co. Ltd.><9.0.6.0119> [C:\Program Files\KV2006\KRegTrust.dll] <Jiangmin Co. Ltd.><9.0.0.825> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [PID: 1288][C:\Program Files\KV2006\UIHost.exe] <Jiangmin Co. Ltd><9.2.0.50822> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\ComUI.dll] <Jiangmin Ltd.><9. 0. 0.509> [C:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20> [PID: 1324][C:\WINNT\system32\NOTEPAD.EXE] <Microsoft Corporation><5.00.2140.1> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [PID: 328][C:\Documents and Settings\Administrator\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINNT\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:

秋日里的蓝天卡卡技术团队帖子:7349 注册: 2004-09-30 来自:	发表于： 2006-09-13 23:46 \| 短消息资料字号：小中大 6楼运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序” 勾选“隐藏微软服务”选中病毒服务[Windows Management Instrument , [GrayPigeo ，选择“删除服务” 点“设置”选择“否” 重启后删除： C:\WINNT\svchost.exe C:\WINNT\sysem.exe 修复后，请重新扫描上来
秋日里的蓝天卡卡技术团队帖子:7349 注册: 2004-09-30 来自:

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-14 22:51 \| 只看楼主短消息资料字号：小中大 7楼 C:\WINNT\svchost.exe C:\WINNT\sysem.exe 这两个文件之前就已经删了
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-14 22:56 \| 只看楼主短消息资料字号：小中大 8楼下面是重新扫描的结果 2006-09-14,22:46:42 System Repair Engineer 2.0.21.505 (2.0 RC 2) Smallfrogs (http://www.KZTechs.com) Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <Internat.exe><internat.exe> [Microsoft Corporation] <KVFW><C:\Program Files\KVFW\kvfw.exe -silent> [Beijing Jiangmin.] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation] <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <KvMonXP><"C:\Program Files\KV2006\KVMonXP.kxp" /auto> [Jiangmin Co.Ltd] <StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [] <DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [DT Soft Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><(无)> [] ================================== 启动文件夹服务 [Ati HotKey Poller / Ati HotKey Poller] <C:\WINNT\system32\Ati2evxx.exe><N/A> [ATI Smart / ATI Smart] <C:\WINNT\system32\ati2sgag.exe><> [Logical Disk Manager Administrative Service / dmadmin] <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.> [InstallDriver Table Manager / IDriverT] <C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe><Macrovision Corporation> [KVSrvXP / KVSrvXP] <C:\Program Files\KV2006\KVSrvXP.exe /Service><Jiangmin Co. Ltd> ================================== 浏览器加载项 [ThunderIEHelper Class] {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD> [FiltrateWebObj Class] {42AFACEE-2A77-41EB-9EE2-D9F8AF827F90} <C:\Program Files\KV2006\KVBHO.dll, Jiangmin Co.Ltd> [BrowseHelper Class] {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <C:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [@msdxmLC.dll,-1@2052,电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation> [江民杀毒工具栏] {B5A34A93-D538-43A7-8371-864CB6148D12} <C:\Program Files\KV2006\KvShell.dll, Jiangmin Co.Ltd> [] {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\Ringz Studio\Storm Codec\QTSYSTEM\QTPLUGI2.OCX, Apple Computer, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.> [使用迅雷下载] <D:\bt.p2p\Thunder\geturl.htm, N/A> [使用迅雷下载全部链接] <D:\bt.p2p\Thunder\getallurl.htm, N/A> [用比特精灵下载(&B)] <D:\bt.p2p\BitSpirit\bsurl.htm, N/A> ==================================
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:

spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:	发表于： 2006-09-14 22:57 \| 只看楼主短消息资料字号：小中大 9楼正在运行的进程 [PID: 204][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 228][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601> [PID: 248][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6898> [PID: 280][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700> [C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3> [PID: 292][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6902> [PID: 408][C:\WINNT\system32\Ati2evxx.exe] <N/A><N/A> [PID: 492][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 516][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659> [PID: 564][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 580][C:\Program Files\KV2006\KVSrvXP.exe] <Jiangmin Co. Ltd><9.2.0.50822> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\SvcSafe.dll] <Jiangmin Co. Ltd><9, 2, 0, 51107> [C:\Program Files\KV2006\lang\SvcSafe0804.lng] <N/A><N/A> [C:\Program Files\KV2006\RegProt.dll] <Jiangmin Co.Ltd><9, 0, 5, 1212> [C:\Program Files\KV2006\Scan.dll] <Jiangmin Co., Ltd.><1.0.6.05190> [C:\Program Files\KV2006\FileGD.dll] <Jiangmin Co.Ltd><9.2.0.50809> [C:\Program Files\KV2006\KvSPI.dll] <Jiangmin Co. Ltd.><1.0.6.06030> [C:\Program Files\KV2006\lang\KvSPI0804.lng] <N/A><N/A> [C:\Program Files\KV2006\ScanHost.dll] <Jiangmin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVWPSet.dll] <Jiangmin Co.Ltd><9, 0, 0, 60220> [C:\Program Files\KV2006\KVEnhS.dll] <Jiangmin Co., Ltd.><9, 2, 6, 02040> [C:\Program Files\KV2006\KVEnhJ.dll] <Jiangmin Co.Ltd><9, 1, 0, 50822> [C:\Program Files\KV2006\KVExtCab.dll] <JiangMin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVExtEml.dll] <Jiangmin Co. Ltd.><9, 2, 0, 51207> [C:\Program Files\KV2006\lang\KVExtEml0804.lng] <N/A><N/A> [C:\Program Files\KV2006\KVExtLZH.dll] <JiangMin Co. Ltd.><9, 2, 6, 0316> [C:\Program Files\KV2006\KvExtRar.dll] <JiangMin Co. Ltd.><9, 2, 6, 04020> [C:\Program Files\KV2006\KvExtZip.dll] <JiangMin Co Ltd.><9, 2, 0, 50822> [C:\Program Files\KV2006\KVExtZ.dll] <Jiangmin Co. Ltd><9.2.0.503> [C:\Program Files\KV2006\KVExtGz.dll] <Jiangmin Co. Ltd><9, 0, 6, 04200> [C:\Program Files\KV2006\KVExtTar.dll] <Jiangmin Co. Ltd><9, 2, 0, 50822> [C:\Program Files\KV2006\KVEnhK.dll] <Jiangmin Co.Ltd><9, 1, 0, 51209> [C:\Program Files\KV2006\Fix.dll] <Jiangmin Co.Ltd><9, 2, 0, 51011> [C:\Program Files\KV2006\KVCkMail.dll] <N/A><9, 0, 6, 605> [C:\Program Files\KV2006\lang\KvMailRes0804.lng] <N/A><N/A> [C:\Program Files\KV2006\EngPS.dll] <Jiangmin Co.Ltd><9, 2, 0, 50817> [PID: 624][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701> [PID: 644][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6704> [PID: 704][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100> [PID: 776][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1> [PID: 996][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690> [C:\Program Files\KV2006\KvShell.dll] <Jiangmin Co.Ltd><9, 0, 5, 830> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A> [C:\Program Files\KV2006\APIImpl.dll] <JiangMin Ltd.><9.0.0.500> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62> [C:\Program Files\KV2006\KVBHO.dll] <Jiangmin Co.Ltd><9.0.6.0113> [C:\Program Files\KV2006\KVAddrDb.dll] <Jiangmin Co.Ltd><9, 0, 0, 1018> [PID: 1108][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3536> [C:\Program Files\KV2006\KVMonXP.kxp] <Jiangmin Co.Ltd><9, 2, 0, 60103> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\Program Files\KV2006\EngFace.dll] <Jiangmin Co.Ltd><9.0.0.50809> [C:\Program Files\KV2006\EngPS.dll] <Jiangmin Co.Ltd><9, 2, 0, 50817> [C:\Program Files\KV2006\KvMemory.dll] <Jiangmin Co. Ltd.><9, 0, 6, 0214> [C:\Program Files\KV2006\KvOffice.dll] <JiangMin New Tech.><9.0.0.1213> [C:\Program Files\KV2006\lang\KVOffice0804.lng] <N/A><N/A> [C:\Program Files\KV2006\VirusUpload.dll] <N/A><2, 0, 0, 0> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\PProtect.dll] <Jiangmin Co. Ltd.><9.0.0.921> [PID: 1168][C:\Program Files\DAEMON Tools\daemon.exe] <DT Soft Ltd.><4.03.0.0> [C:\Program Files\DAEMON Tools\daemon.dll] <DT Soft Ltd.><4.03.0.0> [C:\Program Files\DAEMON Tools\PFCTOC.DLL] <Padus(R), Inc.><1, 0, 0, 12> [C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] <N/A><1.0.6.0> [C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] <GENERIC><1.10.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] <GENERIC><1.12.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] <GENERIC><1.11.0.0> [C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] <GENERIC><1.01.0.0> [PID: 1196][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000> [PID: 1212][C:\Program Files\KVFW\kvfw.exe] <Beijing Jiangmin.><9.0.5.1205> [C:\Program Files\KVFW\KVFWUtil.DLL] <><1, 0, 0, 1> [C:\Program Files\KV2006\TrojDie.kxp] <Jiangmin Co.Ltd><9.0.6.0413> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\TrojDie0804.lng] <Jiangmin Co.Ltd><9.0.0.0813> [C:\Program Files\KV2006\GUIExt.dll] <Jiangmin Co.Ltd><9, 0, 5, 927> [C:\Program Files\KV2006\lang\GUIExt0804.lng] <JiangMin Ltd.><7, 1, 0, 200> [C:\Program Files\KV2006\PProtect.dll] <Jiangmin Co. Ltd.><9.0.0.921> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20> [PID: 1272][C:\Program Files\KV2006\KRegEx.exe] <Jiangmin Co.Ltd><9.0.6.210> [C:\Program Files\KV2006\KRegEx.dll] <Jiangmin Co. Ltd.><9.0.6.0119> [C:\Program Files\KV2006\KRegTrust.dll] <Jiangmin Co. Ltd.><9.0.0.825> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [PID: 1340][C:\Program Files\KV2006\UIHost.exe] <Jiangmin Co. Ltd><9.2.0.50822> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\ComUI.dll] <Jiangmin Ltd.><9. 0. 0.509> [C:\Program Files\KV2006\ComUIPS.dll] <Jiangmin Ltd.><9. 5. 5. 20> [PID: 1364][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> [C:\WINNT\system32\xunleibho_v14.dll] <Thunder Networking Technologies,LTD><4, 6, 0, 62> [C:\Program Files\KV2006\KVBHO.dll] <Jiangmin Co.Ltd><9.0.6.0113> [C:\Program Files\KV2006\KVAddrDb.dll] <Jiangmin Co.Ltd><9, 0, 0, 1018> [C:\Program Files\KV2006\KvShell.dll] <Jiangmin Co.Ltd><9, 0, 5, 830> [C:\Program Files\KV2006\UpdateX.dll] <JiangMin Co.Ltd.><9, 0, 5, 913> [C:\Program Files\KV2006\lang\Kvxp0804.lng] <N/A><N/A> [C:\Program Files\KV2006\APIImpl.dll] <JiangMin Ltd.><9.0.0.500> [C:\WINNT\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINNT\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045> [C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0> [PID: 1088][C:\Documents and Settings\Administrator\桌面\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [C:\Program Files\KV2006\KVHookG.dll] <Jiangmin Co.Ltd><9.0.0.1226> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINNT\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 ==================================
spawm 初生襁褓狮帖子:56 注册: 2006-03-08 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-09-14 23:06 \| 短消息资料字号：小中大 10楼看不出问题了，有异常你描述一下。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT