我也乱弹网页,这是日志---麻烦帮忙看看. bbs.ikaka.com

LD105 - 2006-7-25 15:14:00

我在安全模式下: LSPfix 单击finish. LSPfix就关闭了, 但好象这个wmpcd32.dll 还在, 也删不掉.WinsockXPfix 也在安全模式下用过了,没用.

2006-07-24,22:16:44

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; ; ; ; ; ; C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
<MSMSGS><; ; ; ; "C:\Program Files\Messenger\msmsgs.exe" /background> []
<H/PC Connection Agent><; ; ; ; ; ; ; ; ; "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [Microsoft Corporation]
<vptray><C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe> [Symantec Corporation]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> []
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\System32\NavLogon.dll> []

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\System32\Ati2evxx.exe><ATI Technologies Inc.>
[DefWatch / DefWatch]
<C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe><Symantec Corporation>
[IBM PM Service / IBMPMSVC]
<C:\WINDOWS\System32\ibmpmsvc.exe><N/A>
[Symantec AntiVirus Client / Norton AntiVirus Server]
<C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe><Symantec Corporation>
[QCONSVC / QCONSVC]
<System32\QCONSVC.EXE><IBM Corp.>
[RegSrvc / RegSrvc]
<C:\WINDOWS\System32\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor]
<C:\WINDOWS\System32\S24EvMon.exe><Intel Corporation>
[Task Scheduler / Schedule]
<><N/A>
[IBM KCU Service / TpKmpSVC]
<C:\WINDOWS\system32\TpKmpSVC.exe><N/A>
[WinceDiskServer / WinceDiskServer]
<C:\WINDOWS\Wince.exe><N/A>

LD105 - 2006-7-25 15:15:00

浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, >
[ShowBarObject Class]
{850B69E4-90DB-4F45-8621-891BF35A5B53} <C:\WINDOWS\System32\alitb2\__new\bar.dll, Alibaba>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHG~1.5\jccatch.dll, Amaze Soft>
[SSBandLoader Class]
{D3A3C954-41C2-4AA1-B011-9D9B0306AC23} <C:\Program Files\RichSpark\StockStar4Standard\SSBand\StockstarBand.dll, StockStar>
[AlibabaButton Class]
{13b0c05c-ef05-4bf6-b0ea-f6111af25544} <C:\WINDOWS\System32\alitb2\__new\bar.dll, Alibaba>
[Create Mobile Favorite]
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} <C:\Program Files\Microsoft ActiveSync\INETREPL.DLL, Microsoft Corporation>
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHG~1.5\flashget.exe, Amaze Soft>
[Shockwave ActiveX Control]
{166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINDOWS\System32\macromed\Shockwave 10\Download.dll, Macromedia, Inc.>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\System32\aliedit\AliEdit.dll, www.alipay.com>
[InfoSecNetSign Class]
{62B938C4-4190-4F37-8CF0-A92B0A91CC77} <C:\WINDOWS\System32\NetSign.dll, Infosec Technologies Co., Ltd.>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\System32\INPUTC~1.DLL, >
[Java Plug-in 1.4.1]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll, IBM.>
[Java Plug-in 1.4.1 <applet> redirector]
{CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} <C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll, IBM.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[AxUSBKey Class]
{DA215190-98B2-47DE-AE24-DA95481DFFBA} <C:\WINDOWS\System32\USBKey.dll, >
[使用网际快车下载]
<C:\Program Files\FlashGet1.5\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet1.5\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 828][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 892][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 924][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4110>
[C:\WINDOWS\System32\NavLogon.dll] <N/A><N/A>
[PID: 968][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 980][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1216][C:\WINDOWS\System32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4110>
[C:\WINDOWS\System32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2495>
[PID: 1264][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 1432][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 1836][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1964][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 2008][C:\WINDOWS\system32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4110>
[C:\WINDOWS\system32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2495>
[PID: 236][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] <><1, 0, 0, 1>
[C:\PROGRA~1\FLASHG~1.5\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\Program Files\RichSpark\StockStar4Standard\SCCtxMenu.dll] <><1, 4, 0, 0>
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] <Symantec Corporation><8.1.0.821>
[PID: 584][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1232][C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe] <Symantec Corporation><8.1.0.821>
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll] <Symantec Corporation><8.1.0.821>
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVNTUTL.DLL] <Symantec/Peter Norton Group><1, 0, 0, 1>
[PID: 1536][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 1604][C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe] <Symantec Corporation><8.1.0.821>
[PID: 1708][C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe] <Symantec Corporation><8.1.0.821>
[C:\WINDOWS\System32\CBA.DLL] <Intel? Corporation><6.12.0.105 E>
[C:\WINDOWS\System32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[C:\WINDOWS\System32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[C:\WINDOWS\System32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVLU.dll] <Symantec Corporation><8.1.0.821>
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVNTUTL.DLL] <Symantec/Peter Norton Group><1, 0, 0, 1>
[C:\PROGRA~1\SYMANT~1\SYMANT~1\i2ldvp3.dll] <Symantec Corporation><8.1.0.821>
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVAPI32.DLL] <Symantec Corp.><4.2.0.7>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060719.024\NAVEX32a.DLL] <Symantec Corporation><20061.1.0.14>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060719.024\NAVENG32.DLL] <Symantec Corporation><20061.1.0.14>
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL] <Symantec Corporation><9.1.0.26>
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vpmsece.dll] <Symantec Corporation><8.1.0.821>
[PID: 232][C:\WINDOWS\System32\RegSrvc.exe] <Intel Corporation><4, 1, 0, 0>
[PID: 416][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 3184][C:\Program Files\MYIE2\MyIE.exe] <MY Soft Technology><0, 9, 27, 68>
[C:\Program Files\MYIE2\Plugin\ViewSource\ViewSrc.dll] <><1, 0, 0, 1>
[C:\Program Files\MYIE2\Plugin\uc\uc.dll] <><1, 0, 0, 1>
[C:\Program Files\MYIE2\Services\RealTime\real_time.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[C:\WINDOWS\System32\NpOpenStore.dll] <N/A><N/A>
[C:\WINDOWS\System32\NPCard.dll] <N/A><N/A>
[C:\WINDOWS\System32\RsaFun.dll] <N/A><N/A>
[C:\WINDOWS\System32\GPKPCSC.dll] <N/A><N/A>
[PID: 2788][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.0041>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>
[PID: 868][C:\WINDOWS\NOTEPAD.EXE] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 3156][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[PID: 3200][C:\DOCUME~1\Eric\LOCALS~1\Temp\Rar$EX08.775\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\System32\wmpcd32.dll] <><4, 0, 0, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

瑞星卡卡安全论坛