瑞星卡卡安全论坛

高手进来：兔子不能解决的问题：IE插件smflash.ocx 

有点像彩信通，无法删除，一连到网络或者重启病毒就回来了。中毒症状是打开文件夹特别慢，已经试过各种方法。附病毒样本：http://bbs.pctutu.com/viewFile.asp?BoardID=6&ID=8058

     


Hijackthis扫描结果：O2 - BHO: Shockwave Flash Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\smflash.ocx!!!

1, 感染过程：执行这个下载程序就会中招：http://down.138.org.cn/setup.exe【警告】劫持程序和诺干木马病毒样本下载仅供高手研究，好奇者下载中毒造成电脑瘫痪，后果自负！！！【警告】另外下载后还会感染包括10几种流行恶意网页劫持程序和7、8种木马以及downloader等若干其他病毒程序，但是其他病毒程序都可用超级兔子和正版瑞星清除，唯独smflash.ocx清除不了。









Logfile of HijackThis v1.99.1
Scan saved at 2:15:28 PM, on 8/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINNT\system32\cba\pds.exe
C:\Program Files\iPass\iPassConnect\iPCAgent.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\QCONSVC.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\Suss.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\cba\xfr.exe
C:\WINNT\system32\MsgSys.EXE
C:\winnt\ECM4\Remote\CSIRemoteCSvc.exe
C:\WINNT\system32\MicrosoftLive.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe
C:\Program Files\iPass\iPassConnect\downloader\ipccheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\Explorer.exe
C:\Program Files\Sony Ericsson\GC79 Manager\GC79 Manager.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\zhoum\Desktop\bkp\杀毒软件\Hijackthis\HijackThis.exe


O2 - BHO: Shockwave Flash Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\smflash.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [ATIModeChange] ; Ati2mdxx.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QCWLICON] C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe
O4 - HKLM\..\Run: [Super Rabbit Desktop Set] C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ap.cpchem.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ap.cpchem.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ap.cpchem.net
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Configuresoft ECM Remote Client (CSIRemoteC) - Configuresoft Inc. - C:\winnt\ECM4\Remote\CSIRemoteCSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\system32\ibmpmsvc.exe
O23 - Service: Intel File Transfer - Intel? Corporation - C:\WINNT\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel? Corporation - C:\WINNT\system32\cba\pds.exe
O23 - Service: iPassConnectEngine - iPass - C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe
O23 - Service: iPCAgent - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPCAgent.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: QCONSVC - IBM Corp. - C:\WINNT\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

是不是那个大礼包，什么流氓软件都有的那个

是的

你的日志看不出问题。有异常请描述一下。

就是超级兔子查杀时发现IE插件smflash.ocx，卸载不了。电脑现在打开文件夹速度很慢。hijackthis发现上述O2 - BHO: Shockwave Flash Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\smflash.ocx。雅虎论坛称此为伪装swf的恶意程序。超级兔子论坛尚无法清理这个插件。

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

2006-08-07,07:17:28

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <vptray><C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe>  [Symantec Corporation]
    <ATIModeChange><; Ati2mdxx.exe>  [ATI Technologies, Inc.]
    <EZEJMNAP><C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe>  [Lenovo Group Limited]
    <TPHOTKEY><C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe>  []
    <BMMLREF><C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE>  []
    <PRPCMonitor><PRPCUI.exe>  [Intel Corporation]
    <SynTPLpr><C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>  [Synaptics, Inc.]
    <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [Synaptics, Inc.]
    <QCWLICON><C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe>  [IBM Corp.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\Userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    <WinlogonNotify: NavLogon><C:\WINNT\system32\NavLogon.dll>  []

==================================
Startup Folders
[Acrobat Assistant]
  <C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk><H>

==================================
Services
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINNT\system32\Ati2evxx.exe><N/A>
[Configuresoft ECM Remote Client / CSIRemoteC]
  <C:\winnt\ECM4\Remote\CSIRemoteCSvc.exe><Configuresoft Inc.>
[Cisco Systems, Inc. VPN Service / CVPND]
  <c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe><Cisco Systems, Inc.>
[DefWatch / DefWatch]
  <C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[EvtEng / EvtEng]
  <C:\Program Files\Intel\Wireless\Bin\EvtEng.exe><Intel Corporation>
[ThinkPad PM Service / IBMPMSVC]
  <C:\WINNT\system32\ibmpmsvc.exe><N/A>
[Intel File Transfer / Intel File Transfer]
  <C:\WINNT\system32\cba\xfr.exe><Intel? Corporation>
[Intel PDS / Intel PDS]
  <C:\WINNT\system32\cba\pds.exe><Intel? Corporation>
[iPassConnectEngine / iPassConnectEngine]
  <C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe><iPass>
[iPCAgent / iPCAgent]
  <C:\Program Files\iPass\iPassConnect\iPCAgent.exe><iPass, Inc.>
[Symantec AntiVirus Client / Norton AntiVirus Server]
  <C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe><Symantec Corporation>
[QCONSVC / QCONSVC]
  <System32\QCONSVC.EXE><IBM Corp.>
[RegSrvc / RegSrvc]
  <C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe><Intel Corporation>
[Spectrum24 Event Monitor / S24EventMonitor]
  <C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe><Intel Corporation>
[WLTRYSVC / WLTRYSVC]
  <C:\WINNT\System32\wltrysvc.exe C:\WINNT\System32\bcmwltry.exe><N/A>

==================================
Browser Add-ons
[Shockwave Flash Object]
  {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} <C:\WINNT\system32\smflash.ocx, Macromedia, Inc.>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Shockwave ActiveX Control]
  {166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINNT\system32\macromed\Shockwave 10\Download.dll, Adobe Systems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&Google Search]
  <res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html, N/A>

==================================
Running Processes
[PID: 220][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 244][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 240][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6997>
    [C:\WINNT\system32\NavLogon.dll]  <N/A><N/A>
    [C:\WINNT\system32\igfxsrvc.dll]  <Intel Corporation><3.0.0.3984>
    [C:\WINNT\system32\hccutils.DLL]  <Intel Corporation><3.0.0.3984>
[PID: 292][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.7035>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 304][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.7011>
[PID: 420][C:\WINNT\system32\ibmpmsvc.exe]  <N/A><N/A>
[PID: 472][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 496][C:\Program Files\Intel\Wireless\Bin\EvtEng.exe]  <Intel Corporation><9, 0, 1, 83>
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 1, 83>
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 1, 83>
[PID: 528][C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe]  <Intel Corporation ><9, 0, 1, 83>
    [C:\Program Files\Intel\Wireless\Bin\TraceAPI.DLL]  <Intel Corporation><9, 0, 1, 83>
    [C:\Program Files\Intel\Wireless\Bin\PsRegApi.dll]  <Intel Corporation><9, 0, 1, 83>
[PID: 560][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 640][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
    [C:\WINNT\system32\pdfports.dll]  <Adobe Systems Incorporated.><5.0.000>
    [C:\Program Files\Adobe\Acrobat 5.0\Distillr\adistres.dll]  <N/A><N/A>
[PID: 696][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 712][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 720][c:\Program Files\Cisco Systems\VPN Client\cvpnd.exe]  <Cisco Systems, Inc.><4.0 (Rel)>
    [C:\WINNT\system32\vsdata.dll]  <Zone Labs Inc.><3.7.078.001>
[PID: 776][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe]  <Symantec Corporation><8.00.01.425>
[PID: 688][C:\WINNT\system32\cba\pds.exe]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\loc32vc0.dll]  <Intel><3, 0, 0, 2>
    [C:\WINNT\system32\CSL.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\CSSM32s.dll]  <Intel Corporation><1, 1, 2, 3>
[PID: 856][C:\Program Files\iPass\iPassConnect\iPCAgent.exe]  <iPass, Inc.><3, 35, 0, 0>
[PID: 904][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe]  <Symantec Corporation><8.00.01.425>
    [C:\WINNT\system32\CBA.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVLU.dll]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\i2ldvp3.dll]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPI32.DLL]  <Symantec Corp.><4.1.0.22>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060802.020\NAVEX32a.DLL]  <Symantec Corporation><20061.2.0.26>
    [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060802.020\NAVENG32.DLL]  <Symantec Corporation><20061.2.0.26>

[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL]  <Symantec Corporation><9.0.0.15>
    [C:\WINNT\system32\amslib.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\loc32vc0.dll]  <Intel><3, 0, 0, 2>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NotesExt.dll]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vpmsece.dll]  <Symantec Corporation><8.00.01.425>
[PID: 932][C:\WINNT\System32\QCONSVC.EXE]  <IBM Corp.><3, 7, 1, 0>
[PID: 976][C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe]  <Intel Corporation><9, 0, 1, 83>
[PID: 988][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1008][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6972>
[PID: 1088][C:\WINNT\system32\Suss.exe]  <Microsoft Corporation><5.00.2195.2097>
[PID: 1128][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 1156][C:\WINNT\System32\wltrysvc.exe]  <N/A><N/A>
[PID: 1168][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1184][C:\WINNT\System32\bcmwltry.exe]  <Sony Ericsson Mobile Communications AB><3.31.19.0>
[PID: 1204][C:\winnt\ECM4\Remote\CSIRemoteCSvc.exe]  <Configuresoft Inc.><1.2.0.1020>
    [C:\winnt\ECM4\Remote\CSIRemoteC.dll]  <Configuresoft Inc><1.07.1056>
[PID: 1296][C:\WINNT\system32\cba\xfr.exe]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\loc32vc0.dll]  <Intel><3, 0, 0, 2>
    [C:\WINNT\system32\cbaxfr.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\CSL.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\CSSM32s.dll]  <Intel Corporation><1, 1, 2, 3>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.103 E>
[PID: 1324][C:\WINNT\system32\MsgSys.EXE]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\NTS.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\CBA.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\MsgSys.dll]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\PDS.DLL]  <Intel? Corporation><6.12.0.103 E>
    [C:\WINNT\system32\NTSU2T.DLL]  <Intel Corporation><6.12.0.0000 E>
[PID: 1416][C:\WINNT\system32\WBEM\unsecapp.exe]  <Microsoft Corporation><1.50.1085.0007>
[PID: 1620][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\WINZIP\WZSHLSTB.DLL]  <WinZip Computing, Inc.><4.1 (32-bit)>
    [C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL]  <N/A><N/A>
    [C:\WINNT\system32\smflash.ocx]  <Macromedia, Inc.><9.0.25.0>
    [C:\WINNT\system32\PDFShell.dll]  <Adobe Systems Incorporated><5.0.0.2001031500>
[PID: 1668][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliproxy.dll]  <Symantec Corporation><8.00.01.425>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL]  <Symantec/Peter Norton Group><1, 0, 0, 1>
    [C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll]  <Symantec Corporation><8.00.01.425>
[PID: 1488][C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe]  <Lenovo Group Limited><1, 0, 0, 0>
    [C:\PROGRA~1\ThinkPad\UTILIT~1\SC\EzMApRes.dll]  <N/A><N/A>
[PID: 1680][C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe]  <N/A><N/A>
    [C:\Program Files\Lenovo\PkgMgr\HOTKEY_2\tphk_2k.dll]  <N/A><N/A>
    [C:\WINNT\system32\Oemdspif.dll]  <Intel Corporation><3.0.0.3984>
    [C:\WINNT\system32\igfxdev.dll]  <Intel Corporation><3.0.0.3984>
[PID: 1700][C:\WINNT\system32\PRPCUI.exe]  <Intel Corporation><3.0.0.0>
    [C:\WINNT\system32\PRPCUI.dll]  <Intel Corporation><3.0.0.0>
    [C:\WINNT\system32\PRPCLANG.DLL]  <Intel Corp.><2.0.0.0>
[PID: 1708][C:\Program Files\Synaptics\SynTP\SynTPLpr.exe]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 1720][C:\Program Files\Synaptics\SynTP\SynTPEnh.exe]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINNT\system32\SynCOM.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINNT\system32\SynTPAPI.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 1728][C:\PROGRA~1\ThinkPad\CONNEC~1\QCWLIcon.exe]  <IBM Corp.><3, 7, 1, 0>
    [C:\PROGRA~1\ThinkPad\CONNEC~1\QCON.dll]  <IBM Corp.><3, 7, 1, 0>
    [C:\PROGRA~1\ThinkPad\CONNEC~1\MerlinC201.dll]  <Novatel Wireless Inc.><1, 0, 0, 1>
    [C:\PROGRA~1\ThinkPad\CONNEC~1\Res\SC\IconRes.dll]  <N/A><N/A>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 1736][C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe]  <N/A><N/A>
[PID: 1760][C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe]  <IBM Corporation><1.15>
[PID: 784][C:\Program Files\iPass\iPassConnect\downloader\ipccheck.exe]  <iPass Inc><3.35.0.0>
    [C:\Program Files\iPass\iPassConnect\downloader\LIBEAY32.dll]  <N/A><N/A>
[PID: 1644][C:\Program Files\Sony Ericsson\GC79 Manager\GC79 Manager.exe]  <Sony Ericsson><1, 1, 0, 939>
    [C:\Program Files\Sony Ericsson\GC79 Manager\GC75_RC.DLL]  <Sony Ericsson><1, 1, 0, 939>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
[PID: 596][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><2, 0, 114, 8>
    [C:\WINNT\system32\smflash.ocx]  <Macromedia, Inc.><9.0.25.0>
    [C:\WINNT\system32\PDFShell.dll]  <Adobe Systems Incorporated><5.0.0.2001031500>
    [C:\WINNT\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
[PID: 1840][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><2, 0, 114, 8>
    [C:\WINNT\system32\smflash.ocx]  <Macromedia, Inc.><9.0.25.0>
[PID: 1496][C:\Documents and Settings\zhoum\Desktop\bkp\杀毒软件\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINNT\system32\SynTPFcs.dll]  <Synaptics, Inc.><7.5.17.18 15Sep05>

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  Error. [notepad.exe %1]
.VBS  Error. [wscript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider

==================================

你指的是C:\WINNT\system32\smflash.ocx吧
你这样试试
在安全模式下:
一、删除 WINDOWS\system32 下面的几个文件：sql32.dll，group.dll，smflash.ocx

二、打开注册表Regedit
1.在开始 -- 运行 -- Regedit
2.按 F3 ,打开注册表的查找
3.在查找框中输入 {14A21378-5BB1-4BC4-95D5-5D3F51527F6F}
4.将该键全部删除
5.在查找框中输入 smflash.ocx
6.将该键全部删除
三、重启电脑
运行(双击)System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常

谢谢老大，我之前已经按照上述方法已经在纯DOS下删除了上述三个文件，并且重启后在注册表中删除了跟{14A21378-5BB1-4BC4-95D5-5D3F51527F6F}和smflash.ocx有关的所以东东。
但是，只要一连网，msflash又回来了，估计还有其他后台程序在。

我在兔子论坛上也看到了，兔子那边现在似乎也没有解决
据说它创建了服务，而且不止一个。
兔子应该在思考中，且等等吧

样本以下载，晚上有空玩玩。如果找出解决的方法就给你回悄悄话。
如果你解决了它，也一样给我回个悄悄话吧。