中招，4199，高手帮看下日志~~ bbs.ikaka.com

flyineagle - 2006-9-22 10:13:00

HijackThis_815汉化版扫描日志 V1.99.1
保存于 9:59:56, 日期 2006-9-22
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\rundl132.exe
C:\WINDOWS\System32\Call.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\TBPanel.exe
C:\Vrv\Client\vrvnet.exe
C:\Vrv\Client\vrvmon.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\Intel\rundll32.exe
C:\Program Files\Microsoft\svhost32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\mshost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Tencent\TT\TTraveler.exe
C:\WINDOWS\System32\wuauclt.exe
E:\Hijackthis1991zww\HijackThis1991zww.exe

flyineagle - 2006-9-22 10:13:00

F3 - REG:win.ini: load=C:\WINDOWS\rundl132.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O1 - Hosts: 125.91.1.20 localhost
O1 - Hosts: 125.91.1.20 www.7939.com
O1 - Hosts: 125.91.1.20 www.hao123.com
O1 - Hosts: 125.91.1.20 www.9991.com
O1 - Hosts: 125.91.1.20 www.5566.net
O1 - Hosts: 125.91.1.20 www.gjj.cc
O1 - Hosts: 125.91.1.20 www.265.com
O1 - Hosts: 125.91.1.20 www.v111.com
O1 - Hosts: 125.91.1.20 www.7322.com
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v10.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE Address Browser Helper - {2A0176FE-008B-4706-90F5-BBA532A49731} - C:\WINDOWS\Downlo~1\SearchNet\SNHpr.dll
O2 - BHO: IE Browser Helper - {3CE496D1-1746-41CD-9489-3C0B93DF10E2} - C:\WINDOWS\Downlo~1\o2d1wjl.dll
O2 - BHO: (no name) - {4BBC1A4D-DD20-4980-A645-2E13F6FC286D} - C:\WINDOWS\system32\3721.2.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [vrvnet] C:\Vrv\Client\vrvnet.exe
O4 - 启动项HKLM\\Run: [xysecond] C:\Vrv\Client\vrvmon.exe
O4 - 启动项HKLM\\Run: [SrvNet32] RunDll32 "C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll",Run
O4 - 启动项HKLM\\Run: [TkBellExe] rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - 启动项HKLM\\Run: [xy] C:\WINDOWS\Download\svhost32.exe
O4 - 启动项HKLM\\Run: [rundll] rundll32 user.dll s
O4 - 启动项HKLM\\Run: [Tray] C:\WINDOWS\command\rundll32.exe
O4 - 启动项HKLM\\Run: [zt] C:\WINDOWS\Intel\rundll32.exe
O4 - 启动项HKLM\\Run: [ms] C:\Program Files\Microsoft\svhost32.exe

flyineagle - 2006-9-22 10:14:00

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - 浏览器额外的“工具”菜单项: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - IE插件，支持文件类型.spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: KB399952M.LOG
O23 - NT 服务: host Service For Windows (mshost) - Unknown owner - C:\WINDOWS\mshost.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

flyineagle - 2006-9-22 10:24:00

Call.exe，和rundl1.exe
是什么进程啊？这个肯定有问题

小舞小舞 - 2006-9-22 10:48:00

我也中老~~~我都快发疯了~~~

猪知山 - 2006-9-22 11:00:00

C:\WINDOWS\rundl132.exe
C:\WINDOWS\System32\Call.exe
C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\Intel\rundll32.exe
太多了
问题MS比较严重
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

flyineagle - 2006-9-22 13:17:00

2006-09-22,13:04:01

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><C:\WINDOWS\rundl132.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<Gainward><C:\WINDOWS\TBPanel.exe /A> [Gainward Co.]
<NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize> []
<vrvnet><C:\Vrv\Client\vrvnet.exe> [BeiXinYuan]
<xysecond><C:\Vrv\Client\vrvmon.exe> [vrv]
<SrvNet32><RunDll32 "C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll",Run> [中搜在线]
<TkBellExe><rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> []
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"> [Sun Microsystems, Inc.]
<xy><C:\WINDOWS\Download\svhost32.exe> []
<rundll><rundll32 user.dll s> []
<Tray><C:\WINDOWS\command\rundll32.exe> []
<zt><C:\WINDOWS\Intel\rundll32.exe> []
<ms><C:\Program Files\Microsoft\svhost32.exe> []
<YOKAssiant><Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant> [www.yok.com]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<NiceSoft><C:\WINDOWS\System32\Call.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB399952M.LOG> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]

flyineagle - 2006-9-22 13:17:00

==================================
启动文件夹
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>
[腾讯QQ珊瑚虫版]
<C:\Documents and Settings\lianghaowen\「开始」菜单\程序\启动\腾讯QQ珊瑚虫版.lnk><N>

==================================
服务
[host Service For Windows / mshost]
<C:\WINDOWS\mshost.exe><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\System32\xunleibho_v10.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IE Address Browser Helper]
{2A0176FE-008B-4706-90F5-BBA532A49731} <C:\WINDOWS\Downlo~1\SearchNet\SNHpr.dll, Beijing Zhongsou Online Software>
[IE Browser Helper]
{3CE496D1-1746-41CD-9489-3C0B93DF10E2} <C:\WINDOWS\Downlo~1\o2d1wjl.dll, 中搜在线软件有限公司>
[]
{4BBC1A4D-DD20-4980-A645-2E13F6FC286D} <C:\WINDOWS\system32\3721.2.dll, 3721公司<推荐使用>>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[珊瑚虫工具栏]
{75FE2B5A-D3A4-4EFA-AC11-ADC9C9459688} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.yok.com>
[SSVHelper Class]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, Sun Microsystems, Inc.>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[]
{A9930D97-9CF0-42A0-A10D-4F28836579D5} <C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX, N/A>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, >
[Java Plug-in 1.5.0_08]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, Sun Microsystems, Inc.>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[珊瑚虫工具栏]
{F869BB38-FFEF-4589-B986-610B7AD0ADA2} <C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll, www.yok.com>
[Java Plug-in 1.5.0_08]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_08]
{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.5.0_08]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll, Sun Microsystems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
<C:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[珊瑚虫搜索]
<C:\Program Files\YOK.com\SuperSearch\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

flyineagle - 2006-9-22 13:18:00

==================================
正在运行的进程
[PID: 548][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 612][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 636][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 680][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 692][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 876][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 976][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1140][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1152][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1456][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\WINDOWS\Downlo~1\o2d1wjl.dll] <中搜在线软件有限公司><2, 0, 2, 5>
[C:\WINDOWS\system32\3721.2.dll] <3721公司<推荐使用>><1.0.0.0>
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 2>
[C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll] <www.yok.com><2.0.1.6>
[C:\WINDOWS\Dll.dll] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll] <Yahoo! China><3, 0, 1, 1001>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><7.0.7.2006011200>
[C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX] <N/A><N/A>
[PID: 1516][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1616][C:\WINDOWS\System32\Call.exe] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[PID: 1636][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[PID: 1696][C:\WINDOWS\TBPanel.exe] <Gainward Co.><3.00>
[C:\WINDOWS\TBManage.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[PID: 1732][C:\Vrv\Client\vrvnet.exe] <BeiXinYuan><2006.5.18>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[PID: 1748][C:\Vrv\Client\vrvmon.exe] <vrv><1, 0, 0, 1>
[C:\Vrv\Client\vrvmonsc.dll] <BeiXinYuan><1, 0, 0, 1>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\Vrv\Client\vrvcfg.dll] <N/A><N/A>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>
[C:\Vrv\Client\vrvdll.dll] <N/A><N/A>
[C:\Vrv\Client\UNARJ.dll] <N/A><N/A>
[C:\Vrv\Client\UNZIP.dll] <N/A><N/A>
[C:\Vrv\Client\vrvguard.dll] <N/A><N/A>
[PID: 1828][C:\WINDOWS\Download\svhost32.exe] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[PID: 1848][C:\WINDOWS\command\rundll32.exe] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[PID: 1856][C:\WINDOWS\Intel\rundll32.exe] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>

flyineagle - 2006-9-22 13:19:00

[PID: 1864][C:\Program Files\Microsoft\svhost32.exe] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[PID: 1900][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[PID: 288][C:\WINDOWS\mshost.exe] <N/A><N/A>
[PID: 424][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.13.10.2980>
[PID: 1448][C:\WINDOWS\System32\taskmgr.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>
[PID: 1912][C:\WINDOWS\System32\wuauclt.exe] <Microsoft Corporation><5.4.3630.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[PID: 496][C:\Program Files\Tencent\QQ\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 1660][C:\Program Files\Tencent\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[C:\Program Files\Tencent\QQ\CoralAssist.DLL] <Coral Team><4.5.0 build 20060515>
[C:\Program Files\Tencent\QQ\CoralQQ.DLL] <Coral Team><4.5.1 Build 20060620>
[C:\Program Files\Tencent\QQ\ipsearcher.dll] <N/A><1.0.0.4>
[C:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[C:\Program Files\Tencent\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[C:\Program Files\Tencent\QQ\QQAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\TIMProxy.dll] <tencent><0, 3, 2, 4>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>
[C:\Program Files\Tencent\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQMainFrame.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\CQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\NewSkin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\CameraDll.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\MailSummary.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\msdmo.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\GroupLive.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\LongConnection.dll] <tencent><5, 0, 200, 160>
[C:\Program Files\Tencent\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQPlugin.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QRingMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[C:\Program Files\Tencent\QQ\QQPet.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQAvatar.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\Program Files\Tencent\QQ\BQQApplication.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQSysMsgMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[C:\Program Files\Tencent\QQ\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[C:\Program Files\Tencent\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[C:\Program Files\Tencent\QQ\QQSceneMng.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 1, 10>
[C:\Program Files\Tencent\QQ\videodevice.dll] <Tencent><1.5.0.0>
[C:\Program Files\Tencent\QQ\inplus.dll] <Tencent><1.5.0.0>
[C:\WINDOWS\System32\l3codeca.acm] <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\Tencent\QQ\OEMApplication.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQAllInOne.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\SCCore.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\QQCustomFace.dll] <N/A><N/A>
[C:\Program Files\Tencent\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[C:\Program Files\Tencent\QQ\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[C:\Program Files\Tencent\QQ\QQMagicFace.dll] <><1, 0, 0, 1>
[C:\Program Files\Tencent\QQ\QQZip.dll] <tencent><0, 3, 2, 4>
[PID: 1244][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.1.0.259>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\Program Files\YOK.com\SuperSearch\YOK_SuperSearch.dll] <www.yok.com><2.0.1.6>
[PID: 128][C:\WINDOWS\Logo1_.exe] <><1.0.0.0>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[PID: 1192][E:\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\WINDOWS\System32\user.dll] <N/A><N/A>
[C:\WINDOWS\System32\RChook.dll] <N/A><N/A>
[C:\WINDOWS\System32\msdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\ztdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\tdll.dll] <N/A><N/A>
[C:\WINDOWS\System32\xydll.dll] <N/A><N/A>
[C:\WINDOWS\Downlo~1\SearchNet\SrvNet32.dll] <中搜在线><1, 0, 2, 7>

==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [regedit.exe %1]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

flyineagle - 2006-9-22 13:20:00

又中了这个worm.win32.viking.aa，我晕4啊

flyineagle - 2006-9-22 13:21:00

下载这个的时候中的，哭~~老大，帮帮忙啊

flyineagle - 2006-9-22 13:50:00

不能沉啊，这问题可是很严重啊

猪知山 - 2006-9-22 14:15:00

C:\WINDOWS\Logo1_.exe
威金，汗死！！先搞他
下载专杀，安全模式下搞定，发作了就只好重装了
顺便下载超级兔子，把流氓软件清理了，都在安全模式下
启动一直按F8就能进的

然后显示所有文件
运行System Repair Engineer，使用“启动项目，注册表”来删除以下选项
<load><C:\WINDOWS\rundl132.exe>
xy><C:\WINDOWS\Download\svhost32.exe>
<rundll><rundll32 user.dll s>
<Tray><C:\WINDOWS\command\rundll32.exe>
<zt><C:\WINDOWS\Intel\rundll32.exe>
<ms><C:\Program Files\Microsoft\svhost32.exe
YOKAssiant><Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant> [www.yok.com]
<NiceSoft><C:\WINDOWS\System32\Call.exe>

<Userinit><C:\WINDOWS\System32\userinit.exe>
userinit.exe后面加,

进程禁掉
C:\WINDOWS\System32\Call.exe
删除C:\WINDOWS\System32\Call.exe
C:\WINDOWS\System32\RChook.dll

进程禁掉C:\WINDOWS\Download\svhost32.exe
删除C:\WINDOWS\Download\svhost32.exe
C:\WINDOWS\System32\xydll.dll
C:\WINDOWS\System32\msdll.dll
C:\WINDOWS\System32\ztdll.dll
C:\WINDOWS\System32\tdll.dll
C:\WINDOWS\System32\RChook.dll

进程禁掉C:\WINDOWS\command\rundll32.exe
删除C:\WINDOWS\command\rundll32.exe
C:\WINDOWS\System32\ztdll.dll
C:\WINDOWS\System32\msdll.dll
C:\WINDOWS\System32\tdll.dll
C:\WINDOWS\System32\xydll.dll
C:\WINDOWS\System32\RChook.dll

进程禁掉C:\Program Files\Microsoft\svhost32.exe
删除C:\Program Files\Microsoft\svhost32.exe
C:\WINDOWS\System32\msdll.dll
C:\WINDOWS\System32\ztdll.dll
C:\WINDOWS\System32\tdll.dll
C:\WINDOWS\System32\xydll.dll
C:\WINDOWS\System32\RChook.dll

小舞小舞 - 2006-9-22 14:25:00

4199这个网太可恶了~~只要是被指定了这个网~就会中好多木马的~~

flyineagle - 2006-9-22 14:48:00

是啊，高手，救命啊~~

猪知山 - 2006-9-22 14:50:00

先照上面的做

yanmings - 2006-9-22 15:01:00

<AppInit_DLLs><KB399952M.LOG> []这项一并处理

flyineagle - 2006-9-23 6:28:00

昨天好象出了什么问题，把javascript给禁了，没法登陆论坛，后来才发现。本来想把昨天的日志发上来的，以为解决了，现在~~~问题跟严重了，还中了新毒Trogan.QQpass.pxe，还有其它很多种，晕啊，扫描如下

flyineagle - 2006-9-23 6:29:00

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TBPanel.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Tencent\TT\TTraveler.exe
C:\vrv\client\vrvmon.exe
C:\vrv\client\vrvnet.exe
C:\vrv\client\vrv.exe
C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\mmsk.exe
E:\Hijackthis1991zww\HijackThis1991zww.exe

flyineagle - 2006-9-23 6:29:00

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [vrvnet] C:\Vrv\Client\vrvnet.exe
O4 - 启动项HKLM\\Run: [xysecond] C:\Vrv\Client\vrvmon.exe
O4 - 启动项HKLM\\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - 启动项HKLM\\Run: [Tray] C:\WINDOWS\command\rundll32.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: 腾讯QQ珊瑚虫版.lnk = C:\Program Files\Tencent\QQ\CoralQQ.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 珊瑚虫搜索 - C:\Program Files\YOK.com\SuperSearch\yoksch.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 浏览器额外的按钮: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll (file missing)
O12 - IE插件，支持文件类型.spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

flyineagle - 2006-9-23 6:30:00

还有几个带有ip的网址，让我给删了

flyineagle - 2006-9-23 6:32:00

2006-09-23,06:21:50

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<rx><C:\WINDOWS\System32\explore.exe> []
<zz><C:\WINDOWS\System32\intenet.exe> []
<wow><C:\WINDOWS\System32\Launcher.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<Gainward><C:\WINDOWS\TBPanel.exe /A> [Gainward Co.]
<NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize> []
<vrvnet><C:\Vrv\Client\vrvnet.exe> [BeiXinYuan]
<xysecond><C:\Vrv\Client\vrvmon.exe> [vrv]
<SunJavaUpdateSched><"C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"> [Sun Microsystems, Inc.]
<Tray><C:\WINDOWS\command\rundll32.exe> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<9><C:\WINDOWS\System32\Ravdm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]

flyineagle - 2006-9-23 6:32:00

==================================
启动文件夹
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk><N>
[腾讯QQ珊瑚虫版]
<C:\Documents and Settings\lianghaowen\「开始」菜单\程序\启动\腾讯QQ珊瑚虫版.lnk><N>

==================================
服务
[host Service For Windows / mshost]
<><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>

==================================
浏览器加载项
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Java Plug-in 1.5.0_08]
{8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, N/A>
[Java Plug-in 1.5.0_08]
{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll, N/A>
[Java Plug-in 1.5.0_08]
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll, Sun Microsystems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用KuGoo3下载(&K)]
<C:\Program Files\KuGoo3\KuGoo3DownX.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[珊瑚虫搜索]
<C:\Program Files\YOK.com\SuperSearch\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

flyineagle - 2006-9-23 6:32:00

==================================
正在运行的进程
[PID: 552][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 608][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 632][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 676][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 688][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 872][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 972][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1072][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1136][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1376][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[PID: 1580][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] <Adobe Systems, Inc.><7.0.0.0>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\WinInfo.rxk] <N/A><N/A>
[C:\WINDOWS\System32\myztr.dll] <N/A><N/A>
[C:\WINDOWS\System32\myrx.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\WINDOWS\System32\mywow.dll] <N/A><N/A>
[PID: 1812][C:\WINDOWS\TBPanel.exe] <Gainward Co.><3.00>
[C:\WINDOWS\TBManage.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 1940][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 2012][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.13.10.2980>
[PID: 120][C:\WINDOWS\System32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 168][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3492>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 176][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 2028][C:\WINDOWS\System32\wuauclt.exe] <Microsoft Corporation><5.4.3630.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 1568][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 1852][C:\WINDOWS\System32\conime.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1148][C:\WINDOWS\System32\taskmgr.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 472][C:\Program Files\Tencent\TT\TTraveler.exe] <腾讯公司><3.1.0.259>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll] <腾讯公司><1, 1, 0, 5>
[C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll] <><1, 0, 0, 3>
[C:\Program Files\Tencent\TT\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 4>
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[PID: 1620][C:\vrv\client\vrvmon.exe] <vrv><1, 0, 0, 1>
[C:\vrv\client\vrvmonsc.dll] <BeiXinYuan><1, 0, 0, 1>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\vrv\client\vrvcfg.dll] <N/A><N/A>
[C:\vrv\client\vrvdll.dll] <N/A><N/A>
[C:\vrv\client\UNARJ.dll] <N/A><N/A>
[C:\vrv\client\UNZIP.dll] <N/A><N/A>
[C:\vrv\client\vrvguard.dll] <N/A><N/A>

flyineagle - 2006-9-23 6:33:00

[PID: 1180][C:\vrv\client\vrvnet.exe] <BeiXinYuan><2006.5.18>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 368][C:\vrv\client\vrv.exe] <N/A><N/A>
[C:\vrv\client\vrvsc.dll] <BeiXinYuan><1, 0, 0, 1>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\vrv\client\vrvcfg.dll] <N/A><N/A>
[C:\vrv\client\MailDll.dll] <N/A><N/A>
[C:\vrv\client\vrvdll.dll] <N/A><N/A>
[C:\vrv\client\UNARJ.dll] <N/A><N/A>
[C:\vrv\client\UNZIP.dll] <N/A><N/A>
[C:\vrv\client\ScanBoot.dll] <N/A><N/A>
[PID: 1532][C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\mmsk.exe] <木马杀客><2,0,0,6>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\krnln.fnr] <><1, 0, 0, 1>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\iext2.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\iext.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\HYExtLib.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\HtmlView.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\TrayIcon.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\iext3.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\xplib.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\mmskskin.dll] <><2, 0, 0, 6>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\SkinPPWTL.dll] <http://www.skinplusplus.com><2, 1, 0, 0>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\shell.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\EThread.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\dp1.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\eAPI.fne] <><1, 0, 0, 1>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\eCompress.fne] <N/A><N/A>
[C:\Documents and Settings\lianghaowen\桌面\setup\木马杀客\internet.fne] <><1, 0, 0, 1>
[PID: 204][C:\WINDOWS\System32\notepad.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[PID: 588][E:\sreng2\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>

==================================
文件关联
.TXT Error. [notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [regedit.exe %1]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

yanmings - 2006-9-23 10:14:00

<9><C:\WINDOWS\System32\Ravdm.exe> []的处理：
删除病毒文件：C:\WINDOWS\system32\Ravdm.exe
C:\WINDOWS\system32\drivers\Rinld.sys
删除病毒创建的启动项[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
"9"="C:\WINDOWS\system32\Ravdm.exe"
删除QQ目录下的TIMPlatform.exe，将TIMPlatfrom.exe改名为TIMPlatform.exe

在安全模式下用sreng
删除启动项目=>注册表
<rx><C:\WINDOWS\System32\explore.exe> []
<zz><C:\WINDOWS\System32\intenet.exe> []
<wow><C:\WINDOWS\System32\Launcher.exe> []
Gainward><C:\WINDOWS\TBPanel.exe /A> [Gainward Co.]
<Tray><C:\WINDOWS\command\rundll32.exe> []

删除(如果删除不了请禁止)服务[Win32服务应用程序=>删除服务=>设置(如果删除不了Win32服务应用程序=>修改启动类型Disabled=>设置)]
[host Service For Windows / mshost]
<><N/A>

删除(如果文件删除不了可以下载置顶工具的killbox)
C:\Program Files\Common Files\Microsoft Shared\MSINFO\WinInfo.rxk] <N/A><N/A>
[C:\WINDOWS\System32\myztr.dll] <N/A><N/A>
[C:\WINDOWS\System32\myrx.dll] <N/A><N/A>
[C:\Program Files\Internet Explorer\PLUGINS\system16.sys] <N/A><N/A>
[C:\WINDOWS\System32\mywow.dll] <N/A><N/A>
[PID: 1812][C:\WINDOWS\TBPanel.exe] <Gainward Co.><3.00>
[C:\WINDOWS\TBManage.dll] <N/A><N/A>
><C:\WINDOWS\System32\explore.exe> []
<zz><C:\WINDOWS\System32\intenet.exe> []
<wow><C:\WINDOWS\System32\Launcher.exe> []
<Tray><C:\WINDOWS\command\rundll32.exe> []

修复文件关联

如果有可疑文件要检测，请上传到www.virustotal.com或http://virusscan.jotti.org/检测

flyineagle - 2006-9-23 16:41:00

哭啊~~~~

瑞星卡卡安全论坛