瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 有好多病毒，杀不干净，有日志，高手来帮忙，非常感谢！
redcindy1 - 2006-9-1 13:28:00
HijackThis_815汉化版扫描日志 V1.99.1
保存于      13:21:42, 日期 2006-9-1
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
d:\Winfgate\winntfgate.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ZETRONIC\ZEUPDATE\zeupdsvr.exe
C:\WINNT\Explorer.EXE
d:\Winfgate\ServerGuard.exe
D:\Program Files\Hintsoft\PubwinServer\version\bin\ServiceManager.exe
D:\Program Files\Hintsoft\SyncAgent\SyncAgent.exe
D:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe
D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\java.exe
D:\Program Files\Hintsoft\PubwinServer\appServ\bin\FasterSnake.exe
D:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\PW_Manager.exe
D:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\GARec.exe
d:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\RecLog.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\conime.exe
C:\Documents and Settings\yh\My Documents\PubwinEPzs\f8.exe
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\cmd.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Hintsoft\PubwinConsole\PubwinConsole.exe
D:\Program Files\Thunder Network\Thunder\Thunder.exe
D:\新建文件夹\Hijackthis1991zww\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINNT\system32\xunleibho_v8.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O3 - IE工具栏增项: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - d:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: Pubwin EP服务控制器.lnk = D:\Program Files\Hintsoft\PubwinServer\version\bin\ServiceManager.exe
O4 - Startup: SyncAgent.lnk = D:\Program Files\Hintsoft\SyncAgent\SyncAgent.exe
O4 - Startup: 网吧服务器.lnk = C:\Program Files\cnk\BarServer.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 反向链接 - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 类似网页 - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: 缓存的网页快照 - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - IE右键菜单中的新增项目: 翻译英文字词(&T) - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/246
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - 浏览器额外的按钮: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 浏览器额外的按钮: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O16 - DPF: {32D72994-45B9-42B5-8980-FB561D1BE2D0} (nEdit Control) - https://ekey.163.com/nEdit.cab
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {5EC7C511-CD0F-42E6-830C-1BD9882F3458} (PowerPlayer Control) - http://download.ppstream.com/bin/powerplayer.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O16 - DPF: {E4F500BF-C1A3-11D6-9697-0090961B771E} (VCR.Scan) - http://58.63.46.26:9999/Vcrscan.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD853BB9-36F7-46D8-A15B-F025AC1D7D29}: NameServer = 218.74.122.74,218.74.122.75
O23 - NT 服务: Pubwin Application Server (AppServer) - Unknown owner - D:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe" -s "D:\Program Files\Hintsoft\PubwinServer\appServ\conf\wrapper.conf (file missing)
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: FG3000 Server (FG3000Server) - Zhuhai Zetronic Ltd. - d:\Winfgate\winntfgate.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - NT 服务: Pubwin Update (PubwinUpdate) - Unknown owner - D:\Program Files\Hintsoft\PubwinServer\version\bin\wrapper.exe" -s "D:\Program Files\Hintsoft\PubwinServer\version\conf\wrapper.conf (file missing)
O23 - NT 服务: ray_Pigeon_s (rayPigeon) - Unknown owner - C:\WINNT\fitrs.exe (file missing)
O23 - NT 服务: Zetronic Update Service (ZeupdServer) - Zhuhai Zetronic Ltd. - C:\Program Files\ZETRONIC\ZEUPDATE\zeupdsvr.exe

mopery - 2006-9-1 13:39:00
O23 - NT 服务: ray_Pigeon_s (rayPigeon) - Unknown owner - C:\WINNT\fitrs.exe (file missing)
打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索rayPigeon 删除..

网吧主机?

http://forum.ikaka.com/topic.asp?board=28&artid=6979213  ⒊楼下载System Repair Engineer
解压-运行SREng.exe-智能扫描-扫描-保存日志
然后把日志内容复制上来
redcindy1 - 2006-9-1 13:39:00
我瑞星安装以后，网吧这些服务程序就打不开了，所以现在用瑞星在线杀毒，大概有30-40个病毒杀出来了，但是一会又会出来，怎么杀也杀不光。
redcindy1 - 2006-9-1 13:44:00
版主好历害，一下子就知道是网吧主机。
redcindy1 - 2006-9-1 13:46:00
2006-09-01,13:38:49

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <CheckFaultKernel><C:\WINNT\system32\mswdm.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><EXPLORER.EXE>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []

==================================
启动文件夹
[Pubwin EP服务控制器]
  <C:\Documents and Settings\yh\「开始」菜单\程序\启动\Pubwin EP服务控制器.lnk><N>
[SyncAgent]
  <C:\Documents and Settings\yh\「开始」菜单\程序\启动\SyncAgent.lnk><N>
[网吧服务器]
  <C:\Documents and Settings\yh\「开始」菜单\程序\启动\网吧服务器.lnk><N>

==================================
服务
[Pubwin Application Server / AppServer]
  <"D:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe" -s "D:\Program Files\Hintsoft\PubwinServer\appServ\conf\wrapper.conf"><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[FG3000 Server / FG3000Server]
  <d:\Winfgate\winntfgate.exe><Zhuhai Zetronic Ltd.>
[InstallDriver Table Manager / IDriverT]
  <C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe><Macrovision Corporation>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[Pubwin Update / PubwinUpdate]
  <"D:\Program Files\Hintsoft\PubwinServer\version\bin\wrapper.exe" -s "D:\Program Files\Hintsoft\PubwinServer\version\conf\wrapper.conf"><N/A>
[ray_Pigeon_s / rayPigeon]
  <2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINNT\system32\xunleibho_v8.dll, >
[Yahoo!Photo]
  {33BBE430-0E42-4f12-B075-8D21ACB10DCB} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll, Yahoo! China>
[AntiFish Class]
  {38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll, Yahoo.>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll, Yahoo!>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, >
[Google Toolbar Helper]
  {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[Yahoo 1G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll, Yahoo!>
[BitComet工具栏]
  {3F1ABCDB-A875-46c1-8345-B72A4567E486} <d:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar1.dll, Google Inc.>
[nEdit Control]
  {32D72994-45B9-42B5-8980-FB561D1BE2D0} <C:\WINNT\system32\nEdit\nEdit.ocx, NetEase Information Technology (Beijing) Co. Ltd>
[CMCBooter Object]
  {53AF6E02-F18F-4228-AC13-3E79773FBE50} <C:\WINNT\system32\Booter.ocx, 北京高维视讯科技有限公司>
[PowerPlayer Control]
  {5EC7C511-CD0F-42E6-830C-1BD9882F3458} <C:\WINNT\DOWNLO~1\POWERP~1.DLL, PPStream Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[VCR.Scan]
  {E4F500BF-C1A3-11D6-9697-0090961B771E} <C:\WINNT\Downloaded Program Files\VCRSCAN.OCX, New Technology Wave Inc.>
[&使用迅雷下载]
  <d:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <d:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[Google 搜索(&G)]
  <res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[反向链接]
  <res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[添加到雅虎订阅(&Y)]
  <res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[类似网页]
  <res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html, N/A>
[缓存的网页快照]
  <res://c:\program files\google\GoogleToolbar1.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
  <res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html, N/A>
[雅虎搜索]
  <res://C:\PROGRA~1\Yahoo!\Assistant\Assist\yasbar.dll/246, N/A>
redcindy1 - 2006-9-1 13:47:00
==================================
正在运行的进程
[PID: 152][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 176][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 172][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6898>
[PID: 224][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 236][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 412][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 440][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.6659>
[PID: 472][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 488][d:\Winfgate\winntfgate.exe]  <Zhuhai Zetronic Ltd.><2.8.200.11>
    [C:\WINNT\system32\LIBDB41.DLL]  <Sleepycat Software><4.1.25>
    [C:\WINNT\system32\PACKET.DLL]  <Politecnico di Torino><3, 0, 0, 18>
    [C:\WINNT\system32\WPCAP.DLL]  <Politecnico di Torino><3, 0, 0, 18>
    [C:\WINNT\system32\pthreadVC.dll]  <N/A><N/A>
[PID: 532][C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe]  <Microsoft Corporation><2000.080.0760.00>
[PID: 612][C:\WINNT\system32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.7772>
[PID: 636][C:\WINNT\system32\regsvc.exe]  <Microsoft Corporation><5.00.2195.6701>
[PID: 692][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6704>
[PID: 740][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 792][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 804][C:\Program Files\ZETRONIC\ZEUPDATE\zeupdsvr.exe]  <Zhuhai Zetronic Ltd.><1.2.0.2>
[PID: 944][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\WINNT\downlo~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 7>
    [C:\WINNT\system32\ALSNDMGR.CPL]  <Realtek Semiconductor Corp.><2.2.0.34>
    [C:\WINNT\system32\nvtuicpl.cpl]  <NVIDIA Corporation><6.14.10.10525>
    [C:\WINNT\system32\NVWRSZHC.DLL]  <NVIDIA Corporation><6.14.10.10525>
    [C:\WINNT\system32\xunleibho_v8.dll]  <><4, 5, 1, 33>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 1, 3, 1035>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll]  <Yahoo!><2, 1, 8, 1048>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll]  <N/A><1, 0, 1, 1014>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 1200][d:\Winfgate\ServerGuard.exe]  <N/A><N/A>
[PID: 1064][D:\Program Files\Hintsoft\PubwinServer\version\bin\ServiceManager.exe]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\version\bin\SMDLL.dll]  <TODO: <公司名>><1.0.0.1>
[PID: 1352][D:\Program Files\Hintsoft\SyncAgent\SyncAgent.exe]  <N/A><N/A>
    [D:\Program Files\Hintsoft\SyncAgent\log4cpp.dll]  <Bastiaan Bakker, LifeLine Networks bv ><0.3.2rc2>
    [D:\Program Files\Hintsoft\SyncAgent\Crypto.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\SyncAgent\LIBEAY32.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\SyncAgent\IF_GLW.dll]  <TODO: <公司名>><1.0.0.1>
    [D:\Program Files\Hintsoft\SyncAgent\IF_LIB\IF_GLW\UserOperate.dll]  <N/A><N/A>
[PID: 1104][D:\Program Files\Hintsoft\PubwinServer\appServ\bin\wrapper.exe]  <N/A><N/A>
[PID: 1372][D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\java.exe]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\client\jvm.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\hpi.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\verify.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\java.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\zip.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\wrapper.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\jre\bin\net.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\a.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\Crypto.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\LIBEAY32.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\c.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\java\bin\b.dll]  <N/A><N/A>
[PID: 1452][D:\Program Files\Hintsoft\PubwinServer\appServ\bin\FasterSnake.exe]  <3SMovie><1.0.0.2>
    [D:\Program Files\Hintsoft\PubwinServer\appServ\bin\NetTraffic.dll]  <TODO: <公司名>><1.0.0.1>
[PID: 496][D:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\PW_Manager.exe]  <珠海捷朗菱网络科技有限公司><2.8.200.3>
[PID: 1700][D:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\GARec.exe]  <><1, 0, 0, 1>
[PID: 1736][d:\Program Files\Zetronic\过滤王网吧版2.8.200.0一卡通 - 控制台\RecLog.exe]  <><1, 0, 0, 1>
[PID: 1788][C:\WINNT\system32\internat.exe]  <Microsoft Corporation><5.00.2920.0000>
[PID: 1832][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
[PID: 588][C:\Documents and Settings\yh\My Documents\PubwinEPzs\f8.exe]  <N/A><N/A>
[PID: 1812][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
[PID: 2120][C:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE]  <Microsoft Corporation><5.00.3502.6602>
[PID: 2012][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2256][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2180][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1876][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2048][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1836][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1896][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2268][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1976][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1796][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1420][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 840][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2388][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2064][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2324][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1144][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2448][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2456][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2516][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2524][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 1336][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 712][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2176][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1808][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2276][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1916][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2248][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2412][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 560][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 592][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2608][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 2616][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 2568][C:\WINNT\system32\cmd.exe]  <Microsoft Corporation><5.00.2195.6824>
[PID: 1964][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
redcindy1 - 2006-9-1 13:47:00
[PID: 1692][C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlagent.EXE]  <Microsoft Corporation><2000.080.0760.00>
[PID: 2632][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\xunleibho_v8.dll]  <><4, 5, 1, 33>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 1, 3, 1035>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll]  <Yahoo.><1, 0, 2, 1002>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll]  <Yahoo!><2, 1, 8, 1048>
    [D:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><3, 0, 131, 0>
    [C:\WINNT\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
    [C:\WINNT\Downloaded Program Files\OL2005.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\RavWeb\libload.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\RavWeb\VirusLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
    [C:\Program Files\Rising\RavWeb\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\RavWeb\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\Scanner.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 32>
    [C:\Program Files\Rising\RavWeb\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\RavWeb\MVEngine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 15>
    [C:\Program Files\Rising\RavWeb\Engine.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 31>
    [C:\Program Files\Rising\RavWeb\ScanExec.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\Unpacker.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\RavWeb\UnExe.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
    [C:\Program Files\Rising\RavWeb\ScanEx.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
    [C:\Program Files\Rising\RavWeb\RSUnpack.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 13>
    [C:\Program Files\Rising\RavWeb\PostTrt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\RavWeb\NvFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
    [C:\Program Files\Rising\RavWeb\ScanMac.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
    [C:\Program Files\Rising\RavWeb\ScanSct.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 18>
    [C:\Program Files\Rising\RavWeb\ExtMail.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\Program Files\Rising\RavWeb\ExtFile.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 21>
    [C:\Program Files\Rising\RavWeb\ExtOLE.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
    [C:\Program Files\Rising\RavWeb\ScanNet.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 2480][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106>
    [C:\WINNT\system32\xunleibho_v8.dll]  <><4, 5, 1, 33>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yphtb.dll]  <Yahoo! China><1, 1, 3, 1035>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yangling.dll]  <Yahoo.><1, 0, 2, 1002>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll]  <Yahoo!><2, 1, 8, 1048>
    [D:\Program Files\Tencent\QQ\QQIEHelper.dll]  <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  <><1, 2, 7, 1006>
    [c:\program files\google\googletoolbar1.dll]  <Google Inc.><3, 0, 131, 0>
    [C:\WINNT\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 1344][D:\Program Files\Hintsoft\PubwinConsole\PubwinConsole.exe]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinConsole\log4cpp.dll]  <Bastiaan Bakker, LifeLine Networks bv ><0.3.2rc2>
    [D:\Program Files\Hintsoft\PubwinConsole\LIBEAY32.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinConsole\Crypto.dll]  <N/A><N/A>
    [D:\Program Files\Hintsoft\PubwinConsole\RealName.dll]  <TODO: <公司名>><1.0.0.1>
    [D:\Program Files\Hintsoft\PubwinConsole\Drv\MifareReader\MifareReader.dll]  <TODO: <公司名>><1.0.0.1>
    [D:\Program Files\Hintsoft\PubwinConsole\Drv\MifareReader\MF1\Advic32.dll]  <N/A><N/A>
[PID: 1148][D:\Program Files\Thunder Network\Thunder\Thunder.exe]  <Thunder Networking Technologies,LTD><5.0.2.80>
    [D:\Program Files\Thunder Network\Thunder\UpdateDownload.dll]  <N/A><N/A>
    [D:\Program Files\Thunder Network\Thunder\download_interface.dll]  <N/A><N/A>
    [D:\Program Files\Thunder Network\Thunder\log4cplus.dll]  <N/A><N/A>
    [D:\Program Files\Thunder Network\Thunder\stlport_vc646.dll]  <STLport Consulting, Inc.><4.6.2003.1031>
    [D:\Program Files\Thunder Network\Thunder\historyinfo_manage.dll]  <N/A><N/A>
    [D:\Program Files\Thunder Network\Thunder\iThunder.dll]  <迅雷网络><1, 0, 0, 29>
    [D:\Program Files\Thunder Network\Thunder\RegisterDll.dll]  <N/A><N/A>
    [C:\WINNT\system32\Macromed\Flash\Flash8.ocx]  <Macromedia, Inc.><8,0,22,0>
[PID: 2560][D:\新建文件夹\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>

==================================
redcindy1 - 2006-9-1 13:47:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================
redcindy1 - 2006-9-1 13:48:00
哎，好长，总算贴完了，版主帮我看看。3Q
mopery - 2006-9-1 13:52:00
打开SRE 系统修复 修复文件关联..

打开注册表编辑器，展开：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
搜索 rayPigeon 删除..

打开SRE 启动项目 注册表 删除
<CheckFaultKernel><C:\WINNT\system32\mswdm.exe> []
删除
C:\WINNT\system32\mswdm.exe

http://www.pctutu.com/srmsdown.asp
下载超级兔子..用超级兔子清理王卸载流氓软件...(安全模式...)
redcindy1 - 2006-9-1 14:00:00
我用瑞星查出了34个病毒，这样能杀干净吗/？？
mopery - 2006-9-1 14:02:00
病毒路径能列出来么?
redcindy1 - 2006-9-1 14:07:00
恩，我要慢慢列。。。等等啊。
redcindy1 - 2006-9-1 14:32:00
我把查到的病毒一个个都删除了。管他呢，这样行不行？版主有空帮我一会再看看日志。
redcindy1 - 2006-9-1 14:32:00
我就是直接删文件的，实在不行就用备份恢复算了。
mopery - 2006-9-1 14:34:00
你日志我已经帮你看了...- - 9楼..
redcindy1 - 2006-9-1 14:37:00
嘿嘿  SRE在哪打开啊。。。
还有

删除
C:\WINNT\system32\mswdm.exe  这个文件没有。。。。
redcindy1 - 2006-9-1 14:38:00
版主啊，再问你一件事，为什么我的正版瑞星装不了，装了重启以后，我的这台机器那些网吧管理软件就开不起来，55555555
1
查看完整版本: 有好多病毒，杀不干净，有日志，高手来帮忙，非常感谢！
© 2000 - 2026 Rising Corp. Ltd.