我的机器开机会自动运行IEXPLORE.EXE进程 bbs.ikaka.com

qq10059 - 2006-9-3 14:52:00

不管正常启动还是安全模式，都会又这个进程，而有了这个进程，杀毒软件无法启动，关闭这个进程后，一会它又会自动启动。我用软件查看，这个进程的指向就是真正的IEXPLORE.EXE。
然后我以为是泡泡说的那个什么木马，但是看起来又不一样。在WINDOWS\system32目录下没发现SVCHOST。EXE文件。郁闷。。。

希望快乐 - 2006-9-3 14:56:00

去http://www.kztechs.com/sreng/download.html下载SReng2`
把日志发上来``

qq10059 - 2006-9-3 15:14:00

2006-09-03,14:51:38

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
<N2000SysMonitor><d:\n2000\server\bin\startn2000.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IgfxTray><D:\WINNT\System32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><D:\WINNT\System32\hkcmd.exe> [Intel Corporation]
<vptray><D:\PROGRA~1\SAV\vptray.exe> [Symantec Corporation]
<!ewido><"D:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized> [Anti-Malware Development a.s.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<CheckFaultKernel><D:\WINNT\system32\mswdm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><D:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{288BD9BD-F0DC-46B1-81B5-2B61DF8077CE}><D:\WINNT\system32\CCG1.DLL> []
<{CF49F9F2-A8D3-464F-83EC-6AFC6573C267}><D:\WINNT\system32\CCG2.dll> []
<{8A238B14-A6FF-11E0-9A84-00C04FD8DBD8}><D:\WINNT\system32\sysldr.dll> []
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><D:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll> [Anti-Malware Development a.s.]
<{6E44887F-5214-41F2-AB46-4728735C4CC6}><D:\Program Files\Internet Explorer\PLUGINS\system.sys> []
<{8EF697AE-7C40-48EF-B3D7-6EF503893A88}><D:\WINNT\system32\wintfm.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><D:\WINNT\system32\\NavLogon.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\PCANotify]
<WinlogonNotify: PCANotify><PCANotify.dll> [Symantec Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> []

==================================
启动文件夹
[Microsoft Office]
<D:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[服务管理器]
<D:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk><N>
[腾讯QQ]
<D:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[pcAnywhere Host Service / awhost32]
<D:\Program Files\Symantec\pcAnywhere\awhost32.exe><Symantec Corporation>
[DefWatch / DefWatch]
<D:\PROGRA~1\SAV\DefWatch.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
<D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<D:\Program Files\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Intel Alert Handler / Intel Alert Handler]
<D:\WINNT\system32\ams_ii\hndlrsvc.exe><Intel? Corporation>
[Intel Alert Originator / Intel Alert Originator]
<D:\WINNT\system32\ams_ii\iao.exe><Intel? Corporation>
[Intel File Transfer / Intel File Transfer]
<D:\WINNT\system32\cba\xfr.exe><Intel? Corporation>
[Intel PDS / Intel PDS]
<D:\WINNT\system32\cba\pds.exe><Intel? Corporation>
[Symantec AntiVirus Server / Norton AntiVirus Server]
<D:\PROGRA~1\SAV\Rtvscan.exe><Symantec Corporation>
[Symantec System Center Discovery Service / NSCTOP]
<D:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE><Symantec Corporation>

qq10059 - 2006-9-3 15:17:00

==================================
浏览器加载项
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[FlashFXP Helper for Internet Explorer]
{E5A1691B-D188-4419-AD02-90002030B8EE} <D:\PROGRA~1\FlashFXP\IEFlash.dll, IniCom Networks, Inc.>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <e:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <e:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<E:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<E:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<E:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<E:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 164][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 188][\??\D:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 208][\??\D:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6714>
[D:\WINNT\system32\PCANotify.dll] <Symantec Corporation><10.5.1.505>
[D:\WINNT\system32\NavLogon.dll] <N/A><N/A>
[PID: 236][D:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[D:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[PID: 248][D:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6695>
[PID: 436][D:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[PID: 480][D:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659>
[D:\WINNT\system32\awmon.dll] <Symantec Corporation><9.2.1>
[PID: 508][D:\WINNT\System32\msdtc.exe] <Microsoft Corporation><1999.9.3421.3>
[PID: 616][D:\PROGRA~1\SAV\DefWatch.exe] <Symantec Corporation><8.1.0.821>
[PID: 632][D:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 648][D:\Program Files\ewido anti-spyware 4.0\guard.exe] <Anti-Malware Development a.s.><4, 0, 0, 172>
[D:\Program Files\ewido anti-spyware 4.0\engine.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 676][D:\WINNT\system32\cba\pds.exe] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\loc32vc0.dll] <Intel><3, 0, 0, 2>
[PID: 728][D:\WINNT\System32\llssrv.exe] <Microsoft Corporation><5.00.2195.6697>
[PID: 756][D:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe] <Microsoft Corporation><2000.080.0760.00>
[PID: 876][D:\PROGRA~1\SAV\Rtvscan.exe] <Symantec Corporation><8.1.0.821>
[D:\WINNT\system32\CBA.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\PROGRA~1\SAV\NAVLU.dll] <Symantec Corporation><8.1.0.821>
[D:\PROGRA~1\SAV\NAVNTUTL.DLL] <Symantec/Peter Norton Group><1, 0, 0, 1>
[D:\PROGRA~1\SAV\i2ldvp3.dll] <Symantec Corporation><8.1.0.821>
[D:\PROGRA~1\SAV\NAVAPI32.DLL] <Symantec Corp.><4.2.0.7>
[D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060830.022\NAVEX32a.DLL] <Symantec Corporation><20061.2.0.26>
[D:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060830.022\NAVENG32.DLL] <Symantec Corporation><20061.2.0.26>
[D:\PROGRA~1\SAV\NAVAP32.DLL] <Symantec Corporation><9.1.0.26>
[D:\WINNT\system32\amslib.dll] <Intel? Corporation><6.12.0.105 E>
[D:\PROGRA~1\SAV\loc32vc0.dll] <Intel><3, 0, 0, 2>
[D:\PROGRA~1\COMMON~1\SYMANT~1\SSC\scandlgs.dll] <Symantec Corporation><8.1.0.821>
[PID: 920][D:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE] <Symantec Corporation><8.1.0.821>
[D:\PROGRA~1\COMMON~1\SYMANT~1\SSC\Transman.dll] <Symantec Corporation><8.1.0.821>
[D:\WINNT\system32\CBA.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>

qq10059 - 2006-9-3 15:17:00

[PID: 1052][D:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701>
[PID: 1088][D:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6704>
[PID: 1152][D:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 1200][D:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 1220][D:\WINNT\system32\Dfssvc.exe] <Microsoft Corporation><5.00.2195.6664>
[PID: 1252][D:\WINNT\System32\inetsrv\inetinfo.exe] <Microsoft Corporation><5.00.0984>
[PID: 1264][D:\WINNT\system32\ams_ii\hndlrsvc.exe] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\AMSLIB.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\loc32vc0.dll] <Intel><3, 0, 0, 2>
[D:\WINNT\system32\CBA.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\bcsthndl.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\itmlhndl.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\msbxhndl.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\pagehndl.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\prgxhndl.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\ntelhndl.dll] <Intel? Corporation><6.12.0.105 E>
[PID: 1284][D:\WINNT\system32\MsgSys.EXE] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\CBA.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\PDS.DLL] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTSU2T.DLL] <Intel Corporation><6.12.0.0000 E>
[PID: 1360][D:\WINNT\system32\ams_ii\iao.exe] <Intel? Corporation><6.12.0.108 E>
[D:\WINNT\system32\loc32vc0.dll] <Intel><3, 0, 0, 2>
[D:\WINNT\system32\AMSLIB.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\ams_ii\origreg.dll] <Intel? Corporation><6.12.0.105 E>
[PID: 1368][D:\WINNT\system32\cba\xfr.exe] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\loc32vc0.dll] <Intel><3, 0, 0, 2>
[D:\WINNT\system32\cbaxfr.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\MsgSys.dll] <Intel? Corporation><6.12.0.105 E>
[D:\WINNT\system32\NTS.dll] <Intel? Corporation><6.12.0.105 E>
[PID: 1412][D:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe] <Microsoft Corporation><9.107.8320.0>
[PID: 1664][D:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 448][D:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\system32\sysldr.dll] <N/A><N/A>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\wintfm.dll] <N/A><N/A>
[D:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[D:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[D:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] <Symantec Corporation><8.1.0.821>
[PID: 2008][D:\WINNT\System32\igfxtray.exe] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\hccutils.DLL] <Intel Corporation><3,0,0,2104>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\System32\igfxdev.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\System32\igfxsrvc.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\igfxres.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\igfxress.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\system32\netcfgw.dll] <N/A><N/A>
[PID: 1560][D:\WINNT\System32\hkcmd.exe] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\hccutils.DLL] <Intel Corporation><3,0,0,2104>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\System32\igfxdev.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\igfxsrvc.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\System32\igfxhk.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\System32\igfxres.dll] <Intel Corporation><3,0,0,2104>
[D:\WINNT\system32\netcfgw.dll] <N/A><N/A>
[PID: 2056][D:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[PID: 2104][D:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] <Microsoft Corporation><2000.080.0760.00>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[PID: 2096][D:\WINNT\system32\wuauclt.exe] <Microsoft Corporation><5.4.3630.2554 built by: lab04_n>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\system32\netcfgw.dll] <N/A><N/A>
[PID: 2196][d:\n2000\server\bin\EmfSysMoniDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>

qq10059 - 2006-9-3 15:17:00

[[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2268][d:\n2000\server\bin\mdp.exe] <N/A><N/A>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[PID: 2180][d:\n2000\server\bin\DmsResDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2252][d:\n2000\server\bin\EmfDBBackup.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 1568][d:\n2000\server\bin\EmfExamDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[PID: 2276][d:\n2000\server\bin\EmfPerfDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2288][d:\n2000\server\bin\EmfProxyServer.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[PID: 2368][d:\n2000\server\bin\EmfSecuDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\emfrescommon.dll] <N/A><N/A>
[d:\n2000\server\dll\xDB_ODBC.dll] <N/A><N/A>
[d:\n2000\server\dll\csxmlutil.dll] <N/A><N/A>
[d:\n2000\server\dll\xerces-c_1_5_1.dll] <Apache Software Foundation><1, 5, 1>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2456][d:\n2000\server\bin\EmfTopoDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2464][d:\n2000\server\bin\SNMPServer.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>

qq10059 - 2006-9-3 15:18:00

[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[PID: 2924][d:\n2000\server\bin\EmfFaultDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\emfirules.dll] <N/A><N/A>
[d:\n2000\server\dll\rules.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\emfrescommon.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\ovsnmp.dll] <N/A><N/A>
[d:\n2000\server\dll\ov.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[d:\n2000\server\plugin\trapdll\EmfFaultTrapDefault.dll] <N/A><N/A>
[d:\n2000\server\plugin\trapdll\rsalarmdll.dll] <N/A><N/A>
[d:\n2000\server\plugin\mmldll\EmfFaultMMLDefault.dll] <N/A><N/A>
[d:\n2000\server\dll\imapn2000adapter.dll] <N/A><N/A>
[d:\n2000\server\dll\imapadapterframe.dll] <N/A><N/A>
[PID: 2932][D:\Program Files\Internet Explorer\Connection Wizard\ICWCONN1.EXE] <Microsoft Corporation><5.00.3502.6602>
[PID: 2904][d:\n2000\server\bin\DmsDcDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\TelnetAPI.dll] <N/A><N/A>
[d:\n2000\server\dll\FileCompress.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 2988][d:\n2000\server\bin\EmfQvDm.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 3272][d:\n2000\server\bin\EmfGnlDevDm.exe] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\gnlcfgfrm.dll] <N/A><N/A>
[d:\n2000\server\dll\csxmlutil.dll] <N/A><N/A>
[d:\n2000\server\dll\xerces-c_1_5_1.dll] <Apache Software Foundation><1, 5, 1>
[d:\n2000\server\dll\gscommon.dll] <N/A><N/A>
[d:\n2000\server\dll\gnlcfgsnmp.dll] <N/A><N/A>
[d:\n2000\server\dll\imapadapterframe.dll] <N/A><N/A>
[d:\n2000\server\dll\imapn2000adapter.dll] <N/A><N/A>
[d:\n2000\server\dll\imaplogbroadcast.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 3280][d:\n2000\server\bin\TrapServer.exe] <N/A><N/A>
[d:\n2000\server\dll\stlport_vc645.dll] <STLport Consulting, Inc.><4.1.2000.1111>
[d:\n2000\server\dll\tls76-m.dll] <N/A><N/A>
[d:\n2000\server\dll\snaccCpp_stlport.dll] <华为技术有限公司><1, 3, 7, 0>
[d:\n2000\server\dll\ace.dll] <N/A><5.3>
[d:\n2000\server\dll\snmp.dll] <N/A><N/A>
[d:\n2000\server\dll\des.dll] <N/A><N/A>
[d:\n2000\server\dll\imaptaskmgr.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommondb.dll] <N/A><N/A>
[d:\n2000\server\dll\dbt43-m.dll] <N/A><N/A>
[d:\n2000\server\dll\imaputil.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommon.dll] <N/A><N/A>
[d:\n2000\server\dll\emfexam.dll] <N/A><N/A>
[d:\n2000\server\dll\emfcommonasn.dll] <N/A><N/A>
[d:\n2000\server\dll\msq43-m.dll] <N/A><N/A>
[PID: 1576][D:\Program Files\ewido anti-spyware 4.0\ewido.exe] <Anti-Malware Development a.s.><4, 0, 0, 172>
[D:\Program Files\ewido anti-spyware 4.0\engine.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\system32\wintfm.dll] <N/A><N/A>
[PID: 3540][D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\foxrar.exe] <Alexander Roshal><3.60.2.0>
[D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\js.dll] <Microsoft Corporation><5.00.1764.1>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\packet.dll] <CACE Technologies><3, 1, 0, 27>
[D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WanPacket.dll] <CACE Technologies><3, 1, 0, 27>
[D:\WINNT\system32\netcfgw.dll] <N/A><N/A>
[PID: 3500][D:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\netcfgw.dll] <N/A><N/A>
[PID: 3520][D:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[PID: 1924][E:\tool\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[D:\Program Files\Internet Explorer\PLUGINS\system.sys] <N/A><N/A>
[D:\WINNT\system32\CCG2.dll] <N/A><N/A>
[D:\WINNT\system32\wintfm.dll] <N/A><N/A>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["D:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

yyhhking - 2006-9-15 14:27:00

【回复“qq10059”的帖子】
每次都让把日志发上来怎么没人解决阿？？？？！！！！

sd213637 - 2006-10-23 17:38:00

还不清楚这是什么恶意软件造成的，我也碰到过几次。
你在msconfig里是不是有个乱码的启动项？
如果是的话先把这个启动项去掉，然后按他启动项的路径到注册表里面把相关的键值删掉，再把该项注册表的权限设置为拒绝，重启就不会再启动了。。

瑞星卡卡安全论坛