中了，system32\inetsrv\csrss.exe 这是什么病毒，请高手指点 bbs.ikaka.com

迷你超音速 - 2006-9-5 14:57:00

进程结束后自动加载

附件: 744405200695144935.jpg

迷你超音速 - 2006-9-5 15:08:00

我暂时用SSM将它封住了
这个不知道对分析有没有用

附件: 744405200695150030.jpg

mopery - 2006-9-5 15:09:00

http://forum.ikaka.com/topic.asp?board=28&artid=6979213 ⒊楼下载System Repair Engineer
解压-运行SREng.exe-智能扫描-扫描-保存日志
然后把日志内容复制上来

迷你超音速 - 2006-9-5 15:14:00

先谢谢mopery哥了
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WIN2K\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
<WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll> [System Safety Limited]

==================================
启动文件夹
服务
[QoS Service / BRGNS]
<C:\WIN2K\SYSTEM32\RUNDLL32.EXE C:\WIN2K\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[Dcfssvc / Dcfssvc]
<C:\WIN2K\system32\DRIVERS\dcfssvc.exe><Eastman Kodak Company>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WIN2K\System32\dmadmin.exe /com><VERITAS Software Corp.>
[EPSON Printer Status Agent2 / EPSONStatusAgent2]
<C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><Kaspersky Lab>
[Net Logon / Netlogon]
<><N/A>
[NT LM Security Support Provider / NtLmSsp]
<><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WIN2K\system32\nvsvc32.exe><NVIDIA Corporation>
[IPSEC Policy Agent / PolicyAgent]
<><N/A>
[Security Accounts Manager / SamSs]
<><N/A>

迷你超音速 - 2006-9-5 15:14:00

==================================
浏览器加载项
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yAngling.dll, Yahoo.>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WIN2K\system32\COMBoHEvent.dll, N/A>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WIN2K\system32\Macromed\Flash\Flash8b.ocx, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 192][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 216][\??\C:\WIN2K\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 212][\??\C:\WIN2K\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6714>
[C:\WIN2K\system32\SSMWinlogonEx.dll] <System Safety Limited><2.2.0.585>
[PID: 264][C:\WIN2K\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[PID: 276][C:\WIN2K\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6695>
[PID: 448][C:\WIN2K\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 460][C:\WIN2K\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 536][C:\WIN2K\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 772][C:\WIN2K\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] <Kaspersky Lab><5.0.1.18>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] <Kaspersky Lab><5.0.388.2>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] <Kaspersky Lab><5.0.388.0>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] <Yahoo!><2, 0, 5, 1027>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] <N/A><1, 0, 1, 1014>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\3721\ske\contmenu.dll] <N/A><N/A>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll] <Kaspersky Lab><5.0.388.1>
[C:\WIN2K\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.6085>
[PID: 744][C:\Program Files\Tencent\TT\TTraveler.exe] <深圳市腾讯计算机系统有限公司><2, 0, 14, 196>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] <Kaspersky Lab><5.0.1.18>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] <Kaspersky Lab><5.0.388.2>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] <Kaspersky Lab><5.0.388.0>
[C:\WIN2K\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\WIN2K\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 848][E:\setup\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

迷你超音速 - 2006-9-5 15:15:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WIN2K\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

迷你超音速 - 2006-9-5 15:31:00

重贴个带毒的
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WIN2K\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\System Safety Monitor]
<WinlogonNotify: System Safety Monitor><SSMWinlogonEx.dll> [System Safety Limited]

==================================
启动文件夹
服务
[QoS Service / BRGNS]
<C:\WIN2K\SYSTEM32\RUNDLL32.EXE C:\WIN2K\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>
[Dcfssvc / Dcfssvc]
<C:\WIN2K\system32\DRIVERS\dcfssvc.exe><Eastman Kodak Company>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WIN2K\System32\dmadmin.exe /com><VERITAS Software Corp.>
[EPSON Printer Status Agent2 / EPSONStatusAgent2]
<C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><Kaspersky Lab>
[Net Logon / Netlogon]
<><N/A>
[NT LM Security Support Provider / NtLmSsp]
<><N/A>
[NVIDIA Display Driver Service / NVSvc]
<C:\WIN2K\system32\nvsvc32.exe><NVIDIA Corporation>
[IPSEC Policy Agent / PolicyAgent]
<><N/A>
[Security Accounts Manager / SamSs]
<><N/A>

迷你超音速 - 2006-9-5 15:32:00

==================================
浏览器加载项
[AntiFish Class]
{38928D50-8A48-44C2-945F-D2F23F771410} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yAngling.dll, Yahoo.>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[IeCatch2 Class]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <C:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WIN2K\system32\COMBoHEvent.dll, N/A>
[雅虎助手]
{406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll, Yahoo!>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WIN2K\system32\Macromed\Flash\Flash8b.ocx, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>

==================================
正在运行的进程
[PID: 192][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 216][\??\C:\WIN2K\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 212][\??\C:\WIN2K\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6714>
[C:\WIN2K\system32\SSMWinlogonEx.dll] <System Safety Limited><2.2.0.585>
[PID: 264][C:\WIN2K\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[PID: 276][C:\WIN2K\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6695>
[PID: 448][C:\WIN2K\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 460][C:\WIN2K\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 536][C:\WIN2K\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 772][C:\WIN2K\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\PROGRA~1\FLASHGET\jccatch.dll] <Amaze Soft><1, 1, 4, 0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] <Kaspersky Lab><5.0.1.18>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] <Kaspersky Lab><5.0.388.2>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] <Kaspersky Lab><5.0.388.0>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll] <Yahoo!><2, 0, 5, 1027>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll] <N/A><1, 0, 1, 1014>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\3721\ske\contmenu.dll] <N/A><N/A>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll] <Kaspersky Lab><5.0.388.1>
[C:\WIN2K\system32\nvshell.dll] <NVIDIA Corporation><6.14.10.6085>
[PID: 744][C:\Program Files\Tencent\TT\TTraveler.exe] <深圳市腾讯计算机系统有限公司><2, 0, 14, 196>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] <Kaspersky Lab><5.0.1.18>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] <Kaspersky Lab><5.0.388.2>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] <Kaspersky Lab><5.0.388.0>
[C:\WIN2K\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\WIN2K\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045>
[PID: 1116][c:\win2k\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[PID: 808][E:\setup\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WIN2K\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

迷你超音速 - 2006-9-5 16:04:00

这个不会无解吧，郁闷！！！

baohe - 2006-9-5 16:09:00

【回复“迷你超音速”的帖子】
打开注册表编辑器，查看下列4个服务指向的文件名及其路径。记下。然后，将这些文件名及其路径贴上来。
1、[Net Logon / Netlogon]
<><N/A>
2、[NT LM Security Support Provider / NtLmSsp]
<><N/A>

3、[IPSEC Policy Agent / PolicyAgent]
<><N/A>
4、[Security Accounts Manager / SamSs]
<><N/A>

『可乐』℡ - 2006-9-5 16:22:00

H5N1病毒＋猪链球菌病毒,没看广告吗？

迷你超音速 - 2006-9-5 16:51:00

谢谢版主关心
4个服务似乎都是系统服务，请看

附件: 744405200695164318.jpg

迷你超音速 - 2006-9-5 16:52:00

另外查到的

附件: 744405200695164426.jpg

迷你超音速 - 2006-9-5 16:54:00

网上发现和我同命相连的了，但未发现解决方法

迷你超音速 - 2006-9-5 17:24:00

不知道还有没有救了，看来我只能靠SSM过日子了

baohe - 2006-9-5 17:53:00

引用:

【迷你超音速的贴子】不知道还有没有救了，看来我只能靠SSM过日子了
………………

请将system32\inetsrv\csrss.exe用WINRAR做成压缩包，加密（解压密码用virus），发到：baohelin@yahoo.com.cn。帮你想办法。

瑞星卡卡安全论坛