中了Rootkit.Win32.Vanti.dd ，求助，谢谢 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛中了Rootkit.Win32.Vanti.dd ，求助，谢谢

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

中了Rootkit.Win32.Vanti.dd ，求助，谢谢

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 18:13 \| 显示全部短消息资料字号：小中大 1楼中了Rootkit.Win32.Vanti.dd ，求助，谢谢这是SREngLOG，帮忙分析一下，谢谢各位了启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><D:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation] <MSMSGS><"D:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation] <Xplus_spy><"D:\Program Files\Xplus\xvcclip.exe" /min> [] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <IMJPMIG8.1><"D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation] <PHIME2002ASync><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation] <PHIME2002A><D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation] <IMSCMig><D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation] <TkBellExe><"D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <QuickTime Task><"D:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.] <SKYNET Personal FireWall><D:\Program Files\SkyNet\FireWall\PFW.exe> [] <NvCplDaemon><RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation] <nwiz><nwiz.exe /install> [NVIDIA Corporation] <NvMediaCenter><RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [NVIDIA Corporation] <KAVPersonal50><D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize> [Kaspersky Lab] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <CheckFaultKernel><D:\WINDOWS\system32\mswdm.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [Microsoft Corporation] <Userinit><D:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{54D9498B-CF93-414F-8984-8CE7FDE0D391}><D:\Program Files\ewido\security suite\shellhook.dll> [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WB] <WinlogonNotify: WB><D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll> [Stardock] ================================== 2006-07-22 17:53:07
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	分享到：

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 18:15 \| 显示全部短消息资料字号：小中大 2楼 ================================== 启动文件夹 [Adobe Gamma Loader] <D:\Documents and Settings\All Users.WINDOWS\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N> ================================== 服务 [ewido security suite control / ewido security suite control] <D:\Program Files\ewido\security suite\ewidoctrl.exe><ewido networks> [ewido security suite guard / ewido security suite guard] <D:\Program Files\ewido\security suite\ewidoguard.exe><ewido networks> [kavsvc / kavsvc] <D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe><Kaspersky Lab> [NVIDIA Display Driver Service / NVSvc] <D:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation> [PDEngine / PDEngine] <"D:\Program Files\Raxco\PerfectDisk\PDEngine.exe"><> [PDScheduler / PDSched] <"D:\Program Files\Raxco\PerfectDisk\PDSched.exe"><>
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 18:15 \| 显示全部短消息资料字号：小中大 3楼 ================================== 正在运行的进程 [PID: 752][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 832][\??\D:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 872][\??\D:\WINDOWS\SYSTEM32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll] <Stardock><1, 0, 0, 1> [PID: 916][D:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 928][D:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1084][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1164][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1304][D:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1352][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1476][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1740][D:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)> [D:\WINDOWS\system32\AdobePDF.dll] <Adobe Systems Incorporated.><6.0.000> [D:\Program Files\Adobe\Acrobat 6.0\Distillr\AdistRes.CHS] <N/A><N/A> [D:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620> [PID: 2028][D:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [D:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.6693> [D:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.6693> [D:\WINDOWS\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.6693> [D:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0> [D:\Program Files\ewido\security suite\shellhook.dll] <N/A><N/A> [D:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.chs] <Adobe Systems Inc.><1.0.0.2003051500> [PID: 268][D:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3208> [PID: 324][D:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 332][D:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001> [PID: 684][D:\Program Files\ewido\security suite\ewidoctrl.exe] <ewido networks><3, 0, 0, 1> [D:\Program Files\ewido\security suite\lang.dll] <privat><1, 0, 0, 1> [PID: 732][D:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><6.14.10.6693> [D:\WINDOWS\system32\NVRSZHC.DLL] <NVIDIA Corporation><6.14.10.6693> [PID: 1212][D:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)> [PID: 1368][D:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 1872][D:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 3264][D:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)> [PID: 3532][D:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)> [D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll] <TechSmith Corporation><1.0.1> [D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500> [D:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5> [D:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0> [D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A> [D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll] <N/A><N/A> [D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.CHS] <N/A><N/A> [D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll] <Xi><1.91.12> [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] <Kaspersky Lab><1.0.142.342> [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] <Kaspersky Lab><1.0.142.3> [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.0.0> [D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] <Kaspersky Lab><5.0.142.0> [D:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045> [D:\WINDOWS\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045> [D:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [PID: 2124][D:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 18:32 \| 显示全部短消息资料字号：小中大 4楼大虾快现身啊……
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 23:17 \| 显示全部短消息资料字号：小中大 5楼 Log 还有这一部分 [PID: 2140][D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> [D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.406\SREng2\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["D:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] 病毒路径在的d:\Documents and Settings\aaa~\local settings\temp 每次杀了开机会重新生成，文件名都叫7gcs.dll，杀毒软件报rootkit.win32.vanti.dd 有时候会提示感染windows\services,然后自动关机
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 23:22 \| 显示全部短消息资料字号：小中大 6楼【回复“不言放弃”的帖子】我都找了一天了，要不要开机把杀毒软件关了再弄一次日志……
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-20 23:32 \| 显示全部短消息资料字号：小中大 7楼【回复“不言放弃”的帖子】能，每次开机都冒出来大型网游已经大半年没碰了啊，就昨天在QQ上玩了会麻将……
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-21 00:13 \| 显示全部短消息资料字号：小中大 8楼 HijackThis的日志 HijackThis_815汉化版扫描日志 V1.99.1 保存于 0:02:46, 日期 2006-7-21 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程： D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\Program Files\ewido\security suite\ewidoctrl.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Messenger\msmsgs.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\svchost.exe D:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\FlashGet\flashget.exe D:\Program Files\WinRAR\WinRAR.exe D:\DOCUME~1\aaa~1.DAI\LOCALS~1\Temp\Rar$EX00.313\HijackThis1991zww.exe O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - D:\PROGRA~1\KuGoo3\KUGOO3~1.OCX O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Program Files\Xi\NetTransport 2\NTIEHelper.dll O3 - IE工具栏增项: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - IE工具栏增项: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll O3 - IE工具栏增项: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - IE工具栏增项: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - D:\Program Files\BitComet\BitCometBar\BitCometBar0.1.dll O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - 启动项HKLM\\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - 启动项HKLM\\Run: [SKYNET Personal FireWall] D:\Program Files\SkyNet\FireWall\PFW.exe O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - 启动项HKLM\\Run: [KAVPersonal50] D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Xplus_spy] "D:\Program Files\Xplus\xvcclip.exe" /min O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - D:\Program Files\KuGoo3\KuGoo3DownX.htm O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - D:\Program Files\Xi\NetTransport 2\NTAddLink.html O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - D:\Program Files\Xi\NetTransport 2\NTAddList.html O8 - IE右键菜单中的新增项目: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - IE右键菜单中的新增项目: 添加到 Windows Live Favorites(W) - http://favorites.live.com/quickadd.aspx O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\haofang\HFGame3\GameClient.exe O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O10 - 未知的文件在 Winsock LSP: d:\windows\system32\tcpipdogr0.dll O10 - 未知的文件在 Winsock LSP: d:\windows\system32\tcpipdogr0.dll O15 - 添加的受信任的 IP 地址范围: http://219.235.231.22 O15 - 添加的受信任的 IP 地址范围: http://192.168.100.2 O15 - 添加的受信任的 IP 地址范围: http://219.235.231.228 O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {15803D41-4851-11D2-B5CE-00A0C991E1E3} (PostFile Class) - http://219.235.231.228/webaccess/Bin/NewsWebPost.dll O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {30CADB40-6FD7-433F-BF0D-4827CA7B5BDF} (FavImport Class) - https://favorites.live.com/cab/ImportAx.cab O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab O16 - DPF: {8BB4EE5B-5919-11D1-A01A-0060971932BC} (Editor Control) - http://219.235.231.228/webaccess/Bin/Editor.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {CC51C20A-CD54-4FC9-AAF6-2E76207FE733} (NewsAddon.NewsCtrl) - http://219.235.231.228/webaccess/Bin/NewsAddOn.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WB - D:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll O23 - NT 服务: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe O23 - NT 服务: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - NT 服务: PDEngine - Unknown owner - D:\Program Files\Raxco\PerfectDisk\PDEngine.exe O23 - NT 服务: PDScheduler (PDSched) - Unknown owner - D:\Program Files\Raxco\PerfectDisk\PDSched.exe
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-21 16:18 \| 显示全部短消息资料字号：小中大 9楼【回复“sanjingshou”的帖子】不行啊，昨天试过，刚刚又试过，这个病毒开机就自动生成
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:	发表于： 2006-07-21 17:15 \| 显示全部短消息资料字号：小中大 10楼【回复“baohe”的帖子】确实有一个pyj...exe，但是删除后重启，依然报\temp里有7gcs.dll 晕了
solostone 初生襁褓狮帖子:12 注册: 2006-07-20 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT