遇到超级麻烦的事了。。请高人帮忙急！！！ bbs.ikaka.com

心冷 - 2006-9-10 11:23:00

昨天晚上我弟弟装NBA 突然开机速度一下慢了许多
一看超级兔子。。。都是流氓软件大部分都删了
还有2个删除了重启又有手动去根目录删在重启还是有，，，
大家不知道有没有什么好办法。。。
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 11:13:03, 日期 2006-9-10
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Tencent\TT\TTraveler.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\入侵工具\灰鸽子黑防专版\H_Client.exe
D:\入侵工具\WebMan\WebMan.exe
c:\windows\system32\inetsrv\csrss.exe
C:\Program Files\Tencent\TT\TCPlus.exe
D:\HijackThis1991汉化版\HijackThis1991zww.exe

O2 - BHO: Sun Java2 - {C61A70F3-505E-4B90-916F-627A8706B4BC} - c:\WINDOWS\system32\COMBoHEvent.dll
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://tomatolei.com (file missing)
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://tomatolei.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A001B6B-14D7-4CEA-9998-813CEB8A7038}: NameServer = 218.85.157.99 202.101.103.55
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

就是那个讨厌的02项还有一个“酷站导航”

秋日里的蓝天 - 2006-9-10 11:35:00

运行Hijackthis，把下面的选中打上钩，修复
O2 - BHO: Sun Java2 - {C61A70F3-505E-4B90-916F-627A8706B4BC} - c:\WINDOWS\system32\COMBoHEvent.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing

双击我的电脑－－单击“工具”－“文件夹选项”菜单项－“单击查看”选项卡，取消“
隐藏受保护的操作系统文件”前的对勾，在隐藏文件及文件夹中“显示所有文件和文件夹”
选项，然后单击确定按钮。

删除：
C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll
c:\WINDOWS\system32\COMBoHEvent.dll

流氓软件到控制面板添加删除里面卸载掉

心冷 - 2006-9-10 11:42:00

10修复出现这个。。。。。

附件: 6193962006910113420.BMP

秋日里的蓝天 - 2006-9-10 11:47:00

010项

看贴子，下个超级兔子
http://forum.ikaka.com/topic.asp?board=36&artid=8164763

Flying1889 - 2006-9-10 12:12:00

O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://tomatolei.com (file missing)
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
修复
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
这个用
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
8楼的工具修复一下.修复后如果上不了网请用2楼的工具修复一下就可以啦

心冷 - 2006-9-10 13:03:00

很遗憾 02项修复后重启又自动出现。。。。
这个我试了很多次都这样。。。。。HijackThis_zww汉化版扫描日志 V1.99.1
保存于 12:53:28, 日期 2006-9-10
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Super Rabbit\MagicSet\winspeed.exe
C:\Program Files\Tencent\TT\TTraveler.exe
D:\HijackThis1991汉化版\HijackThis1991zww.exe
c:\windows\system32\inetsrv\csrss.exe

O2 - BHO: Sun Java2 - {C61A70F3-505E-4B90-916F-627A8706B4BC} - c:\WINDOWS\system32\COMBoHEvent.dll
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\getallurl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://tomatolei.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A001B6B-14D7-4CEA-9998-813CEB8A7038}: NameServer = 218.85.157.99 202.101.103.55
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

秋日里的蓝天 - 2006-9-10 15:29:00

关于02项你真提太幸运了,刚写了小贴子，希望能解决你的问题

http://forum.ikaka.com/topic.asp?board=67&artid=8167310

显示隐藏文件，运行Hijackthis，把下面的选中打上钩，修复
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll

修复后重新扫描上来

心冷 - 2006-9-10 15:47:00

还是老样子没有任何改变。。。。重启后又出现

秋日里的蓝天 - 2006-9-10 15:50:00

02项嘛

秋日里的蓝天 - 2006-9-10 15:50:00

重新扫描上来，

笑看闲云 - 2006-9-10 16:04:00

O2 - BHO: Sun Java2 - {C61A70F3-505E-4B90-916F-627A8706B4BC} - c:\WINDOWS\system32\COMBoHEvent.dll
要彻底根治请尝试以下做法:
1.回到安全模式下，删了该DLL
2.然后在此位置上建立同样名字的一个0字节DLL
3.把该DLL的属性改成“系统、只读、隐藏”
4.regedit查找所有的 "C61A70F3-505E-4B90-916F-627A8706B4BC",删

我无邪 - 2006-9-10 16:15:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

心冷 - 2006-9-15 19:50:00

2006-09-15,19:36:52

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WindowBlinds><C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><wbsys.dll> [Stardock.Net, Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><D:\动漫周边\开机画面\logonui.exe> [www.edgardva.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
<WinlogonNotify: WBSrv><C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll> [Stardock]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ATIModeChange><; Ati2mdxx.exe> [ATI Technologies, Inc.]
<AtiPTA><; atiptaxx.exe> [ATI Technologies, Inc.]
<BigDogPath><; C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera> []
<CoolSwitch><; C:\WINDOWS\system32\taskswitch.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\CTFMON.EXE> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<DAEMON Tools><; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [DT Soft Ltd.]
<HF_GameClient><; E:\浩方对战平台\gameclient.exe> [上海浩方在线信息技术有限公司]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<Network Associates Error Reporting Service><; "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> []
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<RavAV><; C:\WINDOWS\RavMonE.exe> []
<ShStatEXE><; "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> []
<SoundMan><; SOUNDMAN.EXE> [Realtek Semiconductor Corp.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[windows / windows]
<C:\WINDOWS\Hacker.com.cn.exe><N/A>

==================================
浏览器加载项
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[NaviHelperObj Class]
{3E422F49-1566-40D3-B43D-077EF739AC32} <C:\WINDOWS\system32\NaviHelper.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Helper Class]
{6E28339B-7A2A-47B6-AEB2-197004272379} <C:\WINDOWS\vchelper.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Sun Java2]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Windows ToyClass]
{E3DB85B5-C559-4894-B474-42E89FAA1EFD} <C:\WINDOWS\system32\winmsd.dll, Microsoft Corporation>
[BHelper Class]
{F2E37336-BFDB-409B-8D0E-6F013C438B20} <C:\WINDOWS\system32\65coea20.dll, N/A>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 716][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 776][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 804][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4133>
[C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll] <Stardock><5, 0, 0, 1>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 852][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 864][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1012][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1060][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1200][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\System32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 1684][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>

心冷 - 2006-9-15 19:50:00

[C:\Program Files\Stardock\Object Desktop\WindowBlinds\tray.dll] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 1900][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\System32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 1960][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 748][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 980][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 228][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[c:\WINDOWS\system32\COMBoHEvent.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 272][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[c:\WINDOWS\system32\COMBoHEvent.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 404][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[c:\WINDOWS\system32\COMBoHEvent.dll] <N/A><N/A>
[c:\WINDOWS\system32\COMAdEvent.dll] <N/A><N/A>
[PID: 1796][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.1.0.259>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1456][C:\WINDOWS\system32\cmd.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1536][C:\WINDOWS\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 528][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[C:\Program Files\Tencent\QQ\CoralAssist.DLL] <Coral Team><4.5.0 build 20060515>
[C:\Program Files\Tencent\QQ\CoralQQ.DLL] <Coral Team><4.5.1 Build 20060620>
[C:\Program Files\Tencent\QQ\ipsearcher.dll] <N/A><1.0.0.4>
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[C:\Program Files\Tencent\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\MailSummary.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\GroupLive.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQPet.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[C:\Program Files\Tencent\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\Program Files\Tencent\QQ\QQMagicFace.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\Tencent\QQ\QQFileTransfer.dll] <Tencent><5, 0, 202, 180>
[C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A>
[PID: 452][C:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 936][C:\Documents and Settings\许为栋\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

我无邪 - 2006-9-15 19:52:00

请到www.27814939.ys168.com,点“我的软件”下载诺顿进程管理器，终止c:\windows\system32\inetsrv\csrss.exe的进程，注意病毒的路径，不要终止错。
删除
c:\windows\system32\inetsrv\csrss.exe
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复
c:\WINDOWS\system32\COMBoHEvent.dll
重启后删除
c:\WINDOWS\system32\COMBoHEvent.dll
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

心冷 - 2006-9-15 20:20:00

我无邪 - 2006-9-15 20:39:00

只要能删除c:\windows\system32\inetsrv\csrss.exe
重启后就能删除c:\WINDOWS\system32\COMBoHEvent.dll
不管什么结果，重启后，再扫个日志粘上来。

心冷 - 2006-9-15 20:59:00

2006-09-15,20:47:30

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WindowBlinds><C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><wbsys.dll> [Stardock.Net, Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><D:\动漫周边\开机画面\logonui.exe> [www.edgardva.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
<WinlogonNotify: WBSrv><C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll> [Stardock]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ATIModeChange><; ; Ati2mdxx.exe> []
<AtiPTA><; ; atiptaxx.exe> []
<BigDogPath><; ; C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera> []
<CoolSwitch><; ; C:\WINDOWS\system32\taskswitch.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; ; C:\WINDOWS\system32\CTFMON.EXE> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<DAEMON Tools><; ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> []
<HF_GameClient><; ; E:\浩方对战平台\gameclient.exe> [上海浩方在线信息技术有限公司]
<IMJPMIG8.1><; ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<Network Associates Error Reporting Service><; ; "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> []
<PHIME2002A><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<RavAV><; ; C:\WINDOWS\RavMonE.exe> []
<ShStatEXE><; ; "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> []
<SoundMan><; ; SOUNDMAN.EXE> []
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[windows / windows]
<C:\WINDOWS\Hacker.com.cn.exe><N/A>

==================================
浏览器加载项
[Macromedia. Flash8 Object]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[NaviHelperObj Class]
{3E422F49-1566-40D3-B43D-077EF739AC32} <C:\WINDOWS\system32\NaviHelper.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Helper Class]
{6E28339B-7A2A-47B6-AEB2-197004272379} <C:\WINDOWS\vchelper.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Macromedia. Flash8 Object]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Windows ToyClass]

心冷 - 2006-9-15 20:59:00

{E3DB85B5-C559-4894-B474-42E89FAA1EFD} <C:\WINDOWS\system32\winmsd.dll, Microsoft Corporation>
[BHelper Class]
{F2E37336-BFDB-409B-8D0E-6F013C438B20} <C:\WINDOWS\system32\65coea20.dll, N/A>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 712][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 772][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 800][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4133>
[C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll] <Stardock><5, 0, 0, 1>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 848][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 860][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1012][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1056][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 1196][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\System32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 1676][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\tray.dll] <N/A><N/A>
[PID: 1816][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\System32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 1864][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[PID: 656][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[PID: 312][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1612][F:\Norton Process Viewer\taskmgr.exe] <" "><5.2.11.1>
[C:\WINDOWS\system32\wbsys.dll] <Stardock.Net, Inc><4, 0, 0, 0>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[PID: 1840][C:\Documents and Settings\许为栋\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wblind.dll] <Stardock Corporation><5.01>
[C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbhelp.dll] <Stardock.Net, Inc><4.01>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

我无邪 - 2006-9-15 21:16:00

关闭所有浏览窗口以及一些不必要的程序
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，浏览器加载项”来删除以下选项。
c:\WINDOWS\system32\COMBoHEvent.dll
c:\WINDOWS\vchelper.dll
C:\WINDOWS\system32\NaviHelper.dll
C:\WINDOWS\system32\65coea20.dll

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“启动项目，注册表”来删除以下选项
C:\WINDOWS\RavMonE.exe（如果删除不了，用诺顿查看是否有它的进程）
删除
C:\WINDOWS\RavMonE.exe

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务windows，选择“删除服务”点“设置”选择“否”
重启后删除
c:\WINDOWS\system32\COMBoHEvent.dll
c:\WINDOWS\vchelper.dll
C:\WINDOWS\system32\NaviHelper.dll
C:\WINDOWS\system32\65coea20.dll
C:\WINDOWS\Hacker.com.cn.exe
完后再扫个日志粘上来，建议修复你所有的密码。

心冷 - 2006-9-15 21:47:00

什么叫修复所有密码呢是修改吗？

心冷 - 2006-9-15 21:54:00

按照步骤依然是到重启后无法删除那些文件。。。。。。。。以下是扫描日志

2006-09-15,21:43:48

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WindowBlinds><C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe> []
<ctfmon.exe><; ; ; C:\WINDOWS\system32\CTFMON.EXE> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<WindowBlinds><C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbconfig.exe> [Stardock Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIModeChange><; ; ; Ati2mdxx.exe> []
<AtiPTA><; ; ; atiptaxx.exe> []
<BigDogPath><; ; ; C:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera> []
<CoolSwitch><; ; ; C:\WINDOWS\system32\taskswitch.exe> []
<DAEMON Tools><; ; ; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> []
<HF_GameClient><; ; ; E:\浩方对战平台\gameclient.exe> [上海浩方在线信息技术有限公司]
<IMJPMIG8.1><; ; ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<Network Associates Error Reporting Service><; ; ; "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> []
<PHIME2002A><; ; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<PHIME2002ASync><; ; ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<ShStatEXE><; ; ; "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> []
<SoundMan><; ; ; SOUNDMAN.EXE> []
<TkBellExe><; ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><wbsys.dll> [Stardock.Net, Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><D:\动漫周边\开机画面\logonui.exe> [www.edgardva.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
<WinlogonNotify: AtiExtEvent><Ati2evxx.dll> [ATI Technologies Inc.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
<WinlogonNotify: WBSrv><C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\wbsrv.dll> [Stardock]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>

==================================
浏览器加载项
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <E:\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v8.dll, >
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Macromedia. Flash8 Object]
{C61A70F3-505E-4B90-916F-627A8706B4BC} <c:\WINDOWS\system32\COMBoHEvent.dll, N/A>

心冷 - 2006-9-15 21:55:00

[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Windows ToyClass]
{E3DB85B5-C559-4894-B474-42E89FAA1EFD} <C:\WINDOWS\system32\winmsd.dll, Microsoft Corporation>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 712][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 772][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 804][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\WINDOWS\system32\Ati2evxx.dll] <ATI Technologies Inc.><6.14.10.4133>
[PID: 852][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 864][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1016][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1060][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1200][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1648][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 1776][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1836][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 460][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 308][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1592][c:\windows\system32\inetsrv\csrss.exe] <Microsoft><1.0.0.0>
[PID: 968][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[C:\Program Files\Tencent\QQ\CoralAssist.DLL] <Coral Team><4.5.0 build 20060515>
[C:\Program Files\Tencent\QQ\CoralQQ.DLL] <Coral Team><4.5.1 Build 20060620>
[C:\Program Files\Tencent\QQ\ipsearcher.dll] <N/A><1.0.0.4>
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[C:\Program Files\Tencent\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\MailSummary.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\GroupLive.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[C:\Program Files\Tencent\QQ\QQPet.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\Tencent\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[C:\Program Files\Tencent\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[PID: 1968][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.1.0.259>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 648][C:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 560][C:\Documents and Settings\许为栋\桌面\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

瑞星卡卡安全论坛