【求助】关于windows\explorer.exe访问网络 bbs.ikaka.com

字节之间 - 2006-9-7 22:02:00

防火墙里显示c:\windows\explorer.exe要访问网络，访问地址是：222.215.152.125
这应该是在自动下载木马病毒
如果不允许访问，则杀毒软件不会有反应
如果允许其访问网络，杀毒软件就会报告系统试图从www://forum.v369v.com……（具体地址记不清楚了）下载含有木马的文件，会提示拦截。但是有时候会拦截失败，然后系统会在C:\Documents and Settings\%username%\Local Settings\Temp文件夹下发现木马，就是那个1.exe、2.exe……8.exe那几个可执行文件。

不知道应该如何解决这个问题，虽然现在我用天网禁止c:\windows\explorer.exe自动访问网络了，也不会下载那些木马了，但是不知道是不是机子已经中了什么木马才让c:\windows\explorer.exe自动访问网络的，请问应该如何解决啊？

baohe - 2006-9-7 22:04:00

【回复“字节之间”的帖子】
扫日志贴上

字节之间 - 2006-9-7 22:07:00

天网的日志里面也看不到啊，就是问我是不是允许它访问网络，我禁止之后它就没什么反应了。应该怎么弄啊拜托楼上的大哥指点一二，俺是个菜鸟，谢谢^_^

zzq11211 - 2006-9-7 22:08:00

机器里没什么重要的东西就允许他访问尽快杀毒

baohe - 2006-9-7 22:09:00

【回复“字节之间”的帖子】
用HijackThis或SREng扫日志贴上。
这两个工具都是免费的。网上可以找到。

从头爱你 - 2006-9-7 22:10:00

引用:

【baohe的贴子】【回复“字节之间”的帖子】
扫日志贴上
………………

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

他说的日志是这个``

从头爱你 - 2006-9-7 22:12:00

引用:

【baohe的贴子】【回复“字节之间”的帖子】
用HijackThis或SREng扫日志贴上。
这两个工具都是免费的。网上可以找到。
………………

遇见猫叔......在线``

字节之间 - 2006-9-7 22:17:00

好的，谢谢各位的指点，我马上下载扫描

字节之间 - 2006-9-7 22:22:00

Logfile of HijackThis v1.99.1
Scan saved at 22:12:23, on 2006-9-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
E:\BitComet\BitComet.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\2006723193254411\HijackThis.exe

R3 - URLSearchHook: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - E:\迅雷\ComDlls\XUNLEIBHO_002.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [SKYNET Personal FireWall] C:\PROGRA~1\SkyNet\FireWall\pfw.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: 查看 Exif 信息(&V) - res://C:\Program Files\Exif Show\ExShow.dll/EXSHOW.HTML
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - Extra 'Tools' menuitem: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157472726149
O17 - HKLM\System\CCS\Services\Tcpip\..\{E8030A7A-B1DE-4E09-A310-B9C2950D8CDB}: NameServer = 202.102.134.68,202.102.137.68
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

字节之间 - 2006-9-7 22:32:00

日志贴出来了，烦劳各位大哥帮忙看看吧，前一次也是因为这个重装了系统，这是刚刚重装的，也不知道上什么网，又弄上了。

zzq11211 - 2006-9-7 22:32:00

修复O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll是毒
控制面版-管理工具-服务-找到他-禁用
删除C:\WINDOWS\system32\klogon.dll

字节之间 - 2006-9-7 22:47:00

引用:

【zzq11211的贴子】修复O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll是毒
控制面版-管理工具-服务-找到他-禁用
删除C:\WINDOWS\system32\klogon.dll
………………

谢谢啊，我已经在HijackThis里面修复它了，就是删除了。但是在“服务”里面找不到这个服务啊，在system32下看到klogon.dll，但是提示删除不了

baohe - 2006-9-7 22:49:00

引用:

【字节之间的贴子】
谢谢啊，我已经在HijackThis里面修复它了，就是删除了。但是在“服务”里面找不到这个服务啊，在system32下看到klogon.dll，但是提示删除不了
………………

C:\WINDOWS\system32\klogon.dll——这是卡巴斯基的，不要动它。

字节之间 - 2006-9-7 22:56:00

引用:

【baohe的贴子】
C:\WINDOWS\system32\klogon.dll——这是卡巴斯基的，不要动它。
………………

那我已经在HijackThis里面把O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll给删了，不会有影响吧？

baohe - 2006-9-7 23:05:00

引用:

【字节之间的贴子】
那我已经在HijackThis里面把O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll给删了，不会有影响吧？
………………

问题不大。
只是登陆系统时，见不到卡巴斯基的显示信息了。

字节之间 - 2006-9-7 23:06:00

那我机子上的病毒呢，应该怎么杀啊？从HijackThis的日志里能看到系统潜在的问题么？

字节之间 - 2006-9-8 11:34:00

各位大侠帮忙啊，小弟先谢过了

魔羯￡小子 - 2006-9-8 12:08:00

就是啊一看KASPER~1就知道是卡巴斯基的

westbeck - 2006-9-8 12:47:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

Flying1889 - 2006-9-8 12:53:00

R3项修复一下

字节之间 - 2006-9-8 14:24:00

2006-09-08,14:11:38

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize> []
<kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
<SKYNET Personal FireWall><C:\PROGRA~1\SkyNet\FireWall\pfw.exe> [广州众达天网技术有限公司]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{11760322-2400-4AC3-9605-6CAF086E809E}><C:\Program Files\Internet Explorer\PLUGINS\Windows.sys> []

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk><N>
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================
服务
[Kaspersky Internet Security 6.0 / AVP]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <E:\迅雷\ComDlls\XUNLEIBHO_002.dll, Thunder Networking Technologies,LTD>
[Web Anti-Virus]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[番茄花园]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <E:\迅雷\ComDlls\XUNLEIBHO_002.dll, Thunder Networking Technologies,LTD>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\Flash85.ocx, Macromedia, Inc.>
[查看 Exif 信息(&V)]
<res://C:\Program Files\Exif Show\ExShow.dll/EXSHOW.HTML, N/A>

字节之间 - 2006-9-8 14:25:00

==================================
正在运行的进程
[PID: 552][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 612][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 636][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 684][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 848][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 896][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 960][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[PID: 1032][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1084][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1340][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Media Player Classic\Codecs\mmfinfo.dll] <N/A><N/A>
[C:\Program Files\Media Player Classic\Codecs\mkunicode.dll] <N/A><N/A>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.7.2006011200>
[E:\迅雷\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[PID: 1392][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1592][C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll] <Kaspersky Lab><6.0.5.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avpgui.ppl] <Kaspersky Lab><6.0.0.300>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\basegui.dll] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\inflate.ppl] <Kaspersky Lab><6.0.0.16>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\report.ppl] <Kaspersky Lab><6.0.0.299>
[PID: 1624][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1716][C:\WINDOWS\system32\nvsvc32.exe] <NVIDIA Corporation><5.13.01.2183>
[PID: 1744][C:\WINDOWS\system32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 492][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2352][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 3056][C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\FSSync.dll] <Kaspersky Lab><6.0.5.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\AVPGS.PPL] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\winreg.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tm.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\bl.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\wmihlpr.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\ndetect.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\crpthlpr.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\schedule.ppl] <Kaspersky Lab><6.0.0.299>

字节之间 - 2006-9-8 14:26:00

[c:\program files\kaspersky lab\kaspersky internet security 6.0\timer.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\thpimpl.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\lic60.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\report.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\hashmd5.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avs.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avpmgr.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\wdiskio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avlib.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avspm.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avp3info.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\ahfw.ppl] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHUM.dll] <Kaspersky Lab><6.0.0.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\CKAHComm.dll] <Kaspersky Lab><6.0.0.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ckahrule.dll] <Kaspersky Lab><6.0.0.1>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\sc.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\httpscan.ppl] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klaveng.dll] <N/A><N/A>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\ahids.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\mc.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\aphisht.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\og.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pdm.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\oas.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\adialtsk.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\resip.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\dtreg.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\httpanlz.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\procmon.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\prutil.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\aphish.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\trafficmonitor2.ppl] <N/A><N/A>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\avp1.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\l_llio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\sfdb.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\ichk2.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\icheckersa.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\smtpprotocoller.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pop3protocoller.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\hashcont.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\imapprotocoller.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\hccmp.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nntpprotocoller.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\iwgen.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\uniarc.ppl] <Kaspersky Lab><6.0.0.16>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\minizip.ppl] <Kaspersky Lab><6.0.0.16>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\cab.ppl] <Kaspersky Lab><6.0.0.16>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\arj.ppl] <Kaspersky Lab><6.0.0.16>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\rar.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\lha.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\mdb.ppl] <Kaspersky Lab><6.0.0.300>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\msoe.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\qb.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\prseqio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\inflate.ppl] <Kaspersky Lab><6.0.0.16>
[PID: 3672][E:\BitComet\BitComet.exe] <www.BitComet.com><0.70>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>

字节之间 - 2006-9-8 14:26:00

[PID: 3520][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.7.2006011200>
[E:\迅雷\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\macromed\flash\Flash85.ocx] <Macromedia, Inc.><8,5,0,133>
[C:\Program Files\Media Player Classic\Codecs\mmfinfo.dll] <N/A><N/A>
[C:\Program Files\Media Player Classic\Codecs\mkunicode.dll] <N/A><N/A>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 2544][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.7.2006011200>
[E:\迅雷\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[PID: 1272][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.7.2006011200>
[E:\迅雷\ComDlls\XUNLEIBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] <Kaspersky Lab><1.0.6.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] <Kaspersky Lab><6.0.0.299>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] <Kaspersky Lab><6.0.0.299>
[C:\WINDOWS\system32\UNISPIM.IME] <北京清华紫光软件股份有限公司><3.0.0.3045>
[C:\WINDOWS\system32\upengine.dll] <北京清华紫光软件股份有限公司><3.0.0.3045>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] <Kaspersky Lab><6.0.0.299>
[c:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] <Kaspersky Lab><6.0.0.299>
[PID: 3648][F:\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] <Kaspersky Lab><6.0.0.299>

字节之间 - 2006-9-8 14:28:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

字节之间 - 2006-9-8 14:35:00

以上就是我用System Repair Engineer扫描后的结果

westbeck - 2006-9-8 14:49:00

重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项
<{11760322-2400-4AC3-9605-6CAF086E809E}><C:\Program Files\Internet Explorer\PLUGINS\Windows.sys>
显示隐藏文件删除：
C:\Program Files\Internet Explorer\PLUGINS\Windows.sys

字节之间 - 2006-9-8 15:12:00

啊，对了，昨天晚上我上网的时候就突然报告说发现病毒，就是在楼上大哥说的那个文件下发现的，是QQPass病毒，已经杀除了，稍后我就去安全模式下处理一下
还有刚刚用System Repair Engineer的“启动项目”查看时，发现有如下提示：
警告：注册表值AppInit_DLLs被修改为非正常值（默认值是空），请检查你的系统中可能存在的计算机病毒
我从旁边的列表查看了那个项，这一项是用红色标注的
值是“C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll”
路径是：HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
这个不会有问题吧？
下面有一项用蓝色标注的，就是楼上大哥说的那个病毒项

westbeck - 2006-9-8 15:27:00

C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
这一项正常的，卡吧的

瑞星卡卡安全论坛