瑞星卡卡安全论坛

【回复“shenshizi”的帖子】

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载System Repair Engineer 2.0.12.350
导出全部日志

估计是有病毒，而且病毒插入系统进程，有可能是灰鸽子啊

引用:

【阿杜QQ的贴子】估计是有病毒，而且病毒插入系统进程，有可能是灰鸽子啊 ...........................

灰鸽子倒不是
倒是一个恶意木马

C:\WINDOWS\csrss.exe
问题恐怕比较严重，还是赶快导出日志吧。

像传奇木马

可能中了大毒了

是木马啦~
试试看用雅虎助手的在线杀毒~

为之奈何？

这大概是日志吧？俺也不懂，却似看天书一般

2006-05-16,16:16:48

System Repair Engineer 2.0.12.350 (2.0 RC 1)
    Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><; C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ScanRegistry><C:\Program Files\Common Files\update\update.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <csrss><C:\WINDOWS\csrss.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <Kugoo><; >
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <KvXP><; D:\KV2005\KvXP.kxp /ScanBoot>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <MsnMsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <csrss><C:\WINDOWS\csrss.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <run><C:\WINDOWS\csrss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SKYNET Personal FireWall><D:\Program Files\FireWall\PFW.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <CnsMin><Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KvMonXP><D:\KV2005\KVMonXP.kxp /auto>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ScanRegistry><C:\WINDOWS\update.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <csrss><C:\WINDOWS\csrss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <bdmsmsn><D:\pa.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <bdmsmsger><; C:\WINDOWS\System32\bdmsmsger>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <DAEMON Tools-1033><; "C:\Program Files\D-Tools\daemon.exe"  -lang 1033>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KVCENTER><; D:\KV2005\KVCenter.kxp>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SysExplr><; D:\Program Files\SYSEXPLR.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <WinampAgent><; >
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <windos><; C:\WINDOWS\windon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
  <csrss><C:\WINDOWS\csrss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  <KernelFaultCheck><C:\WINDOWS\System32\msime.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\System32\Userinit.exe,>

==================================
启动文件夹
服务
[Gray_Pigeon_Server / GrayPigeonServer]
  <C:\WINDOWS\qqmm.exe><N/A>
[Internet Explorer Work / Internet Explorer Work]
  <C:\WINDOWS\loveyou.exe><N/A>
[Windows Install Helper / lDOMANE]
  <C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[MazeServer / MazeServer]
  <D:\Maze\MazeSvr.exe><N/A>
[PsShutdown / PsShutdownSvc]
  <C:\WINDOWS\System32\PSSDNSVC.EXE><N/A>
[Smart Card Helper / SCardDrv]
  <C:\WINDOWS\system32\SCardSer.exe ><N/A>
[SmartLinkService / SLService]
  <slserv.exe>< >

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[BrowseHelper Class]
  {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <D:\KV2005\KvShell.dll, JiangMin Lmt>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[上网助手]
  {BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[CnsHook Class]
  {D157330A-9EF3-49F8-9A67-4141AC41ADD4} <C:\WINDOWS\downlo~1\CnsHook.dll, 北京三七二一科技有限公司>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[江民杀毒工具栏]
  {B5A34A93-D538-43A7-8371-864CB6148D12} <D:\KV2005\KvShell.dll, JiangMin Lmt>
[金山快译(&K)]
  {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <, N/A>
[上网助手]
  {BB936323-19FA-4521-BA29-ECA6A121BC78} <C:\PROGRA~1\3721\Assist\asbar.dll, 3721>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[SysMonOCX Control]
  {9BDBC41E-C335-4263-83C0-ECE78EE28A33} <C:\WINDOWS\DOWNLO~1\SYSMON~1.OCX, AhnLab>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <D:\Program Files\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\PROGRA~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\SendMMS.htm, N/A>

用3721“强力修复”没？ 如果没有建议使用，如果使用后仍旧不能解决问题，你可以将“瑞星”升级到最新版本进行查杀！如果还是不行你可以进入“安全模式”重复上述操作。如果还是不行，还有办法------重新安装系统啦~！！

正在运行的进程
[PID: 528][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 592][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\TEMP\rcepj28t.dll]  <N/A><N/A>
[PID: 616][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 660][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 672][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\TEMP\rcepj28t.dll]  <N/A><N/A>
[PID: 848][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 916][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 1132][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1152][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1284][C:\WINDOWS\Explorer.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\qqmm.DLL]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\TEMP\rcepj28t.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [D:\KV2005\KvShell.dll]  <JiangMin Lmt><9.0.0.500>
    [D:\KV2005\UpdateX.dll]  <JiangMin Ltd.><8, 0, 0, 0>
    [D:\KV2005\lang\Kvxp0804.lng]  <N/A><N/A>
    [D:\KV2005\APIImpl.dll]  <JiangMin Ltd.><9.0.0.500>
    [C:\PROGRA~1\3721\assist\asnoad.dll]  <><1, 0, 0, 9>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\PROGRA~1\3721\assist\asfsks.dll]  <3721.com><2, 1, 1, 87>
    [C:\PROGRA~1\3721\assist\repair.dll]  <北京三七二一科技有限公司><1, 0, 4, 1001>
    [C:\PROGRA~1\3721\assist\asctrlh.dll]  <3721><1, 0, 0, 4>
    [C:\PROGRA~1\3721\assist\optimum.dll]  <N/A><N/A>
    [c:\progra~1\3721\assist\adfilter.dll]  < ><1, 0, 1, 6>
    [C:\PROGRA~1\3721\assist\assecblk.dll]  <3721><1, 0, 0, 9>
    [C:\PROGRA~1\3721\Assist\XPStyle.dll]  <N/A><N/A>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [C:\PROGRA~1\3721\Assist\asbar.dll]  <3721><1, 0, 1, 1001>
    [C:\PROGRA~1\3721\assist\tbwrap.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\3721\assist\aswiper.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\3721\assist\asiesec.dll]  <yahoo><1, 0, 0, 9>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [D:\Program Files\Cuteshell.dll]  <GlobalSCAPE, Inc.><50, 6, 3, 2>
[PID: 1448][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 1564][C:\WINDOWS\System32\Rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\downlo~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\WINDOWS\downlo~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1760][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1832][C:\WINDOWS\csrss.exe]  <DRAGON128><1.00>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1848][C:\WINDOWS\System32\csrss32.exe]  <Microsoft Corporation><5.01.2600>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1860][C:\WINDOWS\System32\winmer.exe]  <Microsoft Corporation><5.1.2600.0>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1868][C:\WINDOWS\System32\msime.exe]  <Microsoft Corporation><5.1.2600.2180>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1936][C:\WINDOWS\services.exe]  <1><8.13.0257>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1988][D:\pa.exe]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 272][C:\WINDOWS\System32\rundll.exe]  <N/A><N/A>
[PID: 308][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3208>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 560][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\TEMP\rcepj28t.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 572][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 992][D:\Maze\MazeSvr.exe]  <N/A><N/A>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
[PID: 1224][C:\WINDOWS\system32\slserv.exe]  < ><2.80.00(24Apr2000)>
[PID: 1312][C:\WINDOWS\System32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
    [D:\KV2005\KVMonXP.kxp]  <JiangMin Ltd.><9.0.0.500>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\KV2005\UpdateX.dll]  <JiangMin Ltd.><8, 0, 0, 0>
    [D:\KV2005\lang\Kvxp0804.lng]  <N/A><N/A>
    [D:\KV2005\KVWPSet.dll]  <N/A><9.0.0.500>
    [D:\KV2005\GUIExt.dll]  <JiangMin Ltd.><9.0.0.500>
    [D:\KV2005\lang\GUIExt0804.lng]  <JiangMin Ltd.><7, 1, 0, 200>
    [D:\KV2005\VirusUpload.dll]  <N/A><9.0.0.500>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [D:\KV2005\ComUIPS.dll]  <N/A><9.0.0.500>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1088][C:\Program Files\Internet Explorer\syssmss.exe]  <asdfasdf><asdfasdf>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1184][C:\Program Files\CNNIC\Cdn\cdnup.exe]  <><2, 3, 0, 7>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\cdntdns.dll]  <CNNIC><2, 2, 0, 3>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 1212][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 2080][C:\Program Files\Common Files\update\update.exe]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 2236][C:\WINDOWS\System32\conime.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>

[C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 3896][C:\DOCUME~1\wzm\LOCALS~1\Temp\svchost.exe]  <N/A><N/A>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\DOCUME~1\wzm\LOCALS~1\Temp\packet.dll]  <CACE Technologies><3, 1, 0, 27>
    [C:\DOCUME~1\wzm\LOCALS~1\Temp\WanPacket.dll]  <CACE Technologies><3, 1, 0, 27>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 4012][C:\WINDOWS\System32\conime.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 2432][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [C:\PROGRA~1\3721\Assist\asbar.dll]  <3721><1, 0, 1, 1001>
    [C:\PROGRA~1\3721\assist\tbwrap.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\3721\assist\asnoad.dll]  <><1, 0, 0, 9>
    [C:\PROGRA~1\3721\assist\aswiper.dll]  <3721><1, 0, 0, 2>
    [C:\PROGRA~1\3721\assist\asiesec.dll]  <yahoo><1, 0, 0, 9>
    [D:\Program Files\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [D:\KV2005\KvShell.dll]  <JiangMin Lmt><9.0.0.500>
    [D:\KV2005\UpdateX.dll]  <JiangMin Ltd.><8, 0, 0, 0>
    [D:\KV2005\lang\Kvxp0804.lng]  <N/A><N/A>
    [D:\KV2005\APIImpl.dll]  <JiangMin Ltd.><9.0.0.500>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [C:\PROGRA~1\3721\assist\repair.dll]  <北京三七二一科技有限公司><1, 0, 4, 1001>
    [C:\PROGRA~1\3721\assist\asfsks.dll]  <3721.com><2, 1, 1, 87>
    [C:\PROGRA~1\3721\assist\optimum.dll]  <N/A><N/A>
    [c:\progra~1\3721\assist\adfilter.dll]  < ><1, 0, 1, 6>
    [C:\PROGRA~1\3721\assist\assecblk.dll]  <3721><1, 0, 0, 9>
    [C:\PROGRA~1\3721\Assist\XPStyle.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
[PID: 4048][D:\Program Files\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\Program Files\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 14>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [D:\Program Files\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\Program Files\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\Program Files\npkcntc.dll]  <INCA Internet Co., Ltd.><2005, 9, 1, 1>
    [D:\Program Files\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\Program Files\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\Program Files\QQMainFrame.dll]  <N/A><N/A>
    [D:\Program Files\CQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\Program Files\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\MailSummary.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [D:\Program Files\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [D:\Program Files\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\Program Files\LongConnection.dll]  <tencent><0, 3, 3, 8>
    [D:\Program Files\QQPet.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QRingMng.dll]  <N/A><N/A>
    [D:\Program Files\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\Program Files\QQAvatar.dll]  <N/A><N/A>
    [D:\Program Files\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\Program Files\BQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\QQPlugin.dll]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [D:\Program Files\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\Program Files\QQUdpGetFileLib.dll]  <tencent><0, 2, 2, 3>
    [D:\Program Files\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
    [D:\Program Files\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\Program Files\QQPhoneHelper.dll]  <腾讯科技（深圳）有限公司><2, 0, 2, 21>

[D:\Program Files\QQSceneMng.dll]  <N/A><N/A>
    [D:\Program Files\QQAllInOne.dll]  <N/A><N/A>
    [D:\Program Files\SCCore.dll]  <N/A><N/A>
    [D:\Program Files\ShareFiles.dll]  <N/A><N/A>
    [D:\Program Files\QQCustomFace.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [D:\Program Files\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [D:\Program Files\QQMagicFace.dll]  <><1, 0, 0, 1>
    [D:\Program Files\GroupConnection.dll]  <Tencent><0, 3, 3, 5>
[PID: 2544][D:\Program Files\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [D:\Program Files\TIMProxy.dll]  <tencent><0, 3, 2, 4>
[PID: 464][D:\Program Files\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [D:\Program Files\QQBaseClassInDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQHelperDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\BasicCtrlDll.dll]  <Tencent><5, 0, 200, 14>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [D:\Program Files\QQAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\TIMProxy.dll]  <tencent><0, 3, 2, 4>
    [D:\Program Files\LoginCtrl.dll]  <><1, 0, 0, 1>
    [D:\Program Files\npkcntc.dll]  <INCA Internet Co., Ltd.><2005, 9, 1, 1>
    [D:\Program Files\npkpdb.dll]  <INCA Internet Co., Ltd.><2003, 10, 1, 1>
    [D:\Program Files\QQRes.dll]  <tencent><1, 0, 0, 1>
    [D:\Program Files\QQMainFrame.dll]  <N/A><N/A>
    [D:\Program Files\CQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\NewSkin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\HostingMgr.dll]  <><1, 0, 0, 1>
    [D:\Program Files\CameraDll.dll]  <><1, 0, 0, 1>
    [D:\Program Files\MailSummary.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
    [D:\Program Files\QQSpace.dll]  <><1, 0, 0, 1>
    [C:\WINDOWS\System32\msdmo.dll]  <N/A><N/A>
    [D:\Program Files\QQGroupMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QQConfigPlugin.dll]  <><1, 0, 0, 1>
    [D:\Program Files\UserDefinedHead.dll]  <><1, 0, 0, 1>
    [D:\Program Files\QRingMng.dll]  <N/A><N/A>
    [D:\Program Files\PhoneAPI.dll]  <><1, 0, 0, 1>
    [D:\Program Files\DialerAllinOne.dll]  <tencent><1, 4, 0, 0>
    [D:\Program Files\QQPet.dll]  <><1, 0, 0, 1>
    [D:\Program Files\LongConnection.dll]  <tencent><0, 3, 3, 8>
    [D:\Program Files\QQAvatar.dll]  <N/A><N/A>
    [D:\Program Files\FlashAvatarDll.dll]  <><1, 4, 0, 1>
    [D:\Program Files\QQSysMsgMng.dll]  <N/A><N/A>
    [D:\Program Files\BQQApplication.dll]  <N/A><N/A>
    [D:\Program Files\QQPlugin.dll]  <N/A><N/A>
    [C:\WINDOWS\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [D:\Program Files\CommercesMng.dll]  <><1, 0, 0, 1>
    [D:\Program Files\PersonalDesktop.dll]  <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
    [D:\Program Files\QQAddr.dll]  <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [D:\Program Files\QQSceneMng.dll]  <N/A><N/A>
    [D:\Program Files\QQAllInOne.dll]  <N/A><N/A>
    [D:\Program Files\SCCore.dll]  <N/A><N/A>
    [D:\Program Files\QQCustomFace.dll]  <N/A><N/A>
    [D:\Program Files\ImageOle.dll]  <TODO: <Company name>><1.0.0.1>
    [D:\Program Files\GroupConnection.dll]  <Tencent><0, 3, 3, 5>
[PID: 3488][D:\工具2\sreng2\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\Program Files\CNNIC\Cdn\cdnspie.dll]  <><2, 1, 0, 4>
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  <CNNIC><2, 2, 0, 1>
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  <CNNIC><1, 0, 0, 10>
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  <CNNIC><2, 2, 0, 3>
    [C:\WINDOWS\downlo~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 3, 1>
    [D:\Program Files\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [C:\WINDOWS\System32\cdnns.dll]  <CNNIC><2, 0, 0, 0>
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

不言放弃，我说对了吧，是鸽子，而且很多啊

【回复“shenshizi”的帖子】
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ScanRegistry><C:\Program Files\Common Files\update\update.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<csrss><C:\WINDOWS\csrss.exe>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
<csrss><C:\WINDOWS\csrss.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><C:\WINDOWS\csrss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<windos><; C:\WINDOWS\windon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<csrss><C:\WINDOWS\csrss.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<KernelFaultCheck><C:\WINDOWS\System32\msime.exe>
启动文件夹
服务
[Gray_Pigeon_Server / GrayPigeonServer]
<C:\WINDOWS\qqmm.exe><N/A>
[Internet Explorer Work / Internet Explorer Work]
<C:\WINDOWS\loveyou.exe><N/A>
[Windows Install Helper / lDOMANE]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[MazeServer / MazeServer]
<D:\Maze\MazeSvr.exe><N/A>
[PsShutdown / PsShutdownSvc]
<C:\WINDOWS\System32\PSSDNSVC.EXE><N/A>
[Smart Card Helper / SCardDrv]
<C:\WINDOWS\system32\SCardSer.exe ><N/A>
[SmartLinkService / SLService]
<slserv.exe>< >
[PID: 992][D:\Maze\MazeSvr.exe] <N/A><N/A>


楼主啊，您的电脑很严重了，楼主以前就感染鸽子，没有注意，现在您电脑至少不是1个版本的鸽子，如果方便的话，全部重做系统（建议）
如果不能的话，下载SSM 不要手动删除了◎◎◎，详细情况参考精华SSM应用

引用:

【阿杜QQ的贴子】不言放弃，我说对了吧，是鸽子，而且很多啊 ...........................

的确有鸽子，不过不是最重要的，还有Rootkit木马，看来又要动用SSM了。

建议重做系统，实在不行用SSM，不要手动删除了，问题很多。。