瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 恳求无邪蓝天等高手给看看
清净的沫子 - 2006-10-5 13:00:00
我这机器比较老了，快七年了，不过因为平时就是打打字上上网看看油箱，一直凑或用，可是现在是越来越慢，以前开3个窗口就不行了，现在开一个上来就得等半天，而且还会弹一些窗口，什么dm71.fx120.....还有什么mydown反正是经常的换着弹，然后指示灯猛闪，基本就处于不能看网页的死机状态，我这机器光驱太老，读不了盘重装系统比较困难，您给看看能不能给治治，凑或能用就行，哪怕就顺利的开一个ie窗口也行啊，谢谢您了。下面是我的扫描日志，我不是很懂，希望您指点时给写细一点，万分感谢
清净的沫子 - 2006-10-5 13:03:00
2006-10-05,12:45:20

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Kernel32><D:\WINNT\SYSTEM\Kernel32.dll>  [N/A]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <Service><D:\WINNT\system32\Intenet.exe>  [N/A]
    <CdnCtr><D:\Program Files\CNNIC\Cdn\cdnup.exe>  [N/A]
    <TkBellExe><"D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ffldm.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{B48F6409-4740-475B-A474-651F54CCE460}><D:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.Dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <webwork><D:\WINNT\webwork\webwork.dll>  [MSWebwork Cop.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><D:\WINNT\system32\ssstars.scr>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[Microsoft Office]
  <D:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[JMediaService / JMediaService]
  <D:\WINNT\system32\rundll32.exe D:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><Microsoft Corporation>
[StdService / StdService]
  <D:\WINNT\system32\rundll32.exe D:\WINNT\System32\STDSVER.DLL,Service><Microsoft Corporation>
[winaua / winaua]
  <D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\aua\aua.exe -R><N/A>
[wint / wint]
  <D:\WINNT\system32\RunDLL32.exe "D:\PROGRA~1\wint\wint.dll",Run -r><Microsoft Corporation>
[WinWrCup / WinWrCup]
  <D:\WINNT\wincup\wincup.exe -R><N/A>

==================================
清净的沫子 - 2006-10-5 13:04:00
==================================
驱动程序
[Albus / Albus]
  <\SystemRoot\system32\drivers\Albus.SYS><N/A>
[cdnprot / cdnprot]
  <\SystemRoot\system32\drivers\cdnprot.sys><N/A>
[cdntran / cdntran]
  <system32\drivers\cdntran.sys><CNNIC>
[Cdr4_2K / Cdr4_2K]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[CnsMinKP / CnsMinKP]
  <system32\drivers\CnsMinKP.sys><N/A>
[dmboot / dmboot]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[fgqjvg / fgqjvg]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\fgqjvgrgh><N/A>
[hfbdcjjc / hfbdcjjc]
  <\SystemRoot\system32\drivers\hfbdcjjc.sys><N/A>
[i81x / i81x]
  <System32\DRIVERS\i81xnt5.sys><Intel Corporation>
[Virtual IR COM Port / IrCOMM2k]
  <system32\DRIVERS\ircomm2k.sys><N/A>
[kmsinput / kmsinput]
  <\??\D:\WINNT\system32\drivers\kmsinput.sys><N/A>
[LT Modem Driver / ltmodem5]
  <System32\DRIVERS\ltmdmnt.sys><LT>
[md / md]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\mdqtn><N/A>
[Nokia USB Generic / Nokia USB Generic]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
  <system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt]
  <\??\F:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkcusb / npkcusb]
  <\??\F:\Program Files\Tencent\qq\npkcusb.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[sptd / sptd]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[M-Systems DiskOnChip 2000 / tffsport]
  <\SystemRoot\System32\DRIVERS\tffsport.sys><M-Systems>
[udch / udch]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\udchxol><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <D:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[XBTP03129 Class]
  {6029B367-250A-4696-925C-641709CA7381} <D:\PROGRA~1\KUAISO~1\KUAISO~1.DLL, IE Toolbar>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Vision]
  {6671A431-5C3D-463d-A7CF-5587F9B7E191} <D:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[stdup]
  {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} <D:\WINNT\SYSTEM32\stdup.dll, MStdup Co Ltd.>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <F:\FLASHGET\jccatch.dll, N/A>
[Google Toolbar Helper]
  {AA58ED58-01DD-4d91-8333-CF10577473F7} <d:\program files\google\googletoolbar2.dll, Google Inc.>
[WMHlprObj Class]
  {F5824EFB-728A-4726-A5A5-85A68B20EDC3} <D:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, CNNIC>
[维宇RealLink]
  {0713E8D2-850A-101B-AFC0-4210122A8DA9} <C:\Program Files\VerySoft\RealLink\RealLink.exe, 武汉维宇软件有限公司>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <D:\WINNT\System32\msjava.dll, Microsoft Corporation>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[MMSAssistMenu]
  {6671A433-5C3D-463d-A7CF-5587F9B7E191} <D:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[酷热影音]
  {7D73FF86-05F1-39ed-C850-A423120EC338} <www.kuree.com/index.htm?id=00011001, N/A>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\FLASHGET\flashget.exe, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[完美网译通]
  {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} <D:\WINNT\WORLD2\TOOLBAR\hmtoolbar.dll, 北京完美时空有限公司>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <d:\program files\google\googletoolbar2.dll, Google Inc.>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <D:\WINNT\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[  >> 彩信发送 <<]
  <res://D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm, N/A>
[&使用迅雷下载]
  <c:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <c:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[&使用迷你迅雷下载]
  <D:\Program Files\Maxthon\Thundermini\geturl.htm, N/A>
[>>彩信发送<<]
  <res://D:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm, N/A>
[Download by Net Transport]
  <C:\PROGRA~1\XI\NETTRA~1\NTAddLink.html, N/A>
[Google 搜索(&G)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
  <F:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[反向链接]
  <res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html, N/A>
[导出到 Microsoft Excel(&x)]
  <res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[新浪搜索]
  <http://cha.sina.com.cn/ddt.html, N/A>
[添加到QQ自定义面板]
  <F:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[百度-搜索MP3]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM, N/A>
[百度-搜索图片]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM, N/A>
[百度-搜索新闻]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM, N/A>
[百度-搜索歌词]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM, N/A>
[百度-搜索网页]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM, N/A>
[百度-搜索贴吧]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM, N/A>
[百度-词典搜索]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM, N/A>
[类似网页]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html, N/A>
[缓存的网页快照]
  <res://d:\program files\google\GoogleToolbar2.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html, N/A>
[访问通用网址]
  <D:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>
清净的沫子 - 2006-10-5 13:05:00
==================================
正在运行的进程
[PID: 188][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 216][\??\D:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 236][\??\D:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
[PID: 268][D:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [D:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 280][D:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 464][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 488][D:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 520][D:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 536][D:\WINNT\system32\hidserv.exe]  [Microsoft Corporation, 5.00.2195.6655]
[PID: 552][D:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\PROGRA~1\MMSASS~1\MMSSVER.DLL]  [, 1, 2, 0, 6]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 612][D:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 644][D:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 768][D:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 812][D:\WINNT\system32\mspmspsv.exe]  [Microsoft Corporation, 7.10.00.3059]
[PID: 940][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1080][D:\Program Files\CNNIC\Cdn\cdnup.exe]  [, 2, 4, 0, 10]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdntdns.dll]  [CNNIC, 2, 2, 0, 3]
[PID: 1064][D:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3510]
[PID: 960][D:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1124][D:\WINNT\system32\conime.exe]  [Microsoft Corporation, 5.00.2195.6655]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
[PID: 1120][D:\WINNT\explorer.exe]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
    [D:\WINNT\webwork\webwork.nls]  [MSWebwork Cop., 1, 0, 0, 1]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\WINNT\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [D:\PROGRA~1\MMSASS~1\mmsass~1.dll]  [, 1, 2, 0, 6]
    [D:\PROGRA~1\MMSASS~1\albus.dll]  [Albus, 1, 0, 0, 2]
    [D:\WINNT\SYSTEM32\stdup.dll]  [MStdup Co Ltd., 3, 2, 2, 3]
[PID: 808][D:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
    [d:\program files\google\googletoolbar2.dll]  [Google Inc., 3, 0, 131, 0]
    [D:\WINNT\system32\DrvTrNTm.dll]  [High Criteria inc., 5, 2, 0, 1]
    [D:\WINNT\system32\DrvTrNTl.dll]  [High Criteria inc., 5, 2, 0, 1]
    [D:\WINNT\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [F:\Program Files\Tencent\qq\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [D:\PROGRA~1\KUAISO~1\KUAISO~1.DLL]  [IE Toolbar, 1, 0, 0, 4]
    [D:\PROGRA~1\MMSASS~1\mmsass~1.dll]  [, 1, 2, 0, 6]
    [D:\PROGRA~1\MMSASS~1\albus.dll]  [Albus, 1, 0, 0, 2]
    [D:\WINNT\SYSTEM32\stdup.dll]  [MStdup Co Ltd., 3, 2, 2, 3]
    [D:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll]  [CNNIC, 1, 1, 0, 0]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
    [D:\WINNT\system32\Macromed\Flash\Flash8.ocx]  [Macromedia, Inc., 8,0,22,0]
[PID: 916][D:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\System32\STDSVER.DLL]  [MStdup Co Ltd., 3, 2, 2, 3]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 736][D:\Program Files\FlashFXP\FlashFXP.exe]  [IniCom Networks, Inc., 3.0.1.1022]
    [D:\WINNT\system32\DrvTrNTm.dll]  [High Criteria inc., 5, 2, 0, 1]
    [D:\WINNT\system32\DrvTrNTl.dll]  [High Criteria inc., 5, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
    [D:\Program Files\FlashFXP\libeay32.dll]  [N/A, N/A]
    [D:\Program Files\FlashFXP\ssleay32.dll]  [N/A, N/A]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]
[PID: 1096][D:\Documents and Settings\Administrator.YUANNIU\桌面\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [D:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [D:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 0, 0, 6]
    [D:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 4, 0, 3]
    [D:\WINNT\system32\cdnns.dll]  [CNNIC, 2, 0, 0, 0]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
清净的沫子 - 2006-10-5 13:09:00
我曾经试图删除D:\Program Files\CNNIC\Cdn\中的东西，感觉那个一根机器启动占内存，但每次上完网下来又被自动安装了，下次启动又有了。别的我就不懂了，反正是慢的可以，指点一下吧，让您费心了
清净的沫子 - 2006-10-5 13:26:00
一点sre的启动项目注册表就警告说userinit被修改为非正常值
D:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ffldm.exe
可我在c盘那个路径下根本没那个文件啊，是不是点删除？
4706634 - 2006-10-5 13:36:00
说句闲话,在你买新电脑之前,先买个新光驱吧，借一个也成。
清净的沫子 - 2006-10-5 22:22:00
帮帮忙吧，真得快不行了
秋日里的蓝天 - 2006-10-5 22:31:00
运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
JMediaService
StdService
[winaua
wint
WinWrCup
，选择“删除服务”
点“设置”选择“否”

运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
D:\WINNT\SYSTEM\Kernel32.dll
D:\WINNT\system32\Intenet.exe
D:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.Dll

D:\WINNT\system32\cdnns.dll
请下载LSPFix和WinsockXPFix这两个软件，
小软件下载
http://free5.ys168.com/?ufwihgu168
　　重新启动电脑, 进入安全模式。运行LSPFix.exe，删除：
cdnns.dll点“Finish”即可。
修复后重启计算机，如果无法上网，请运行WinsockXPFix，
让它修复一下。

删除
D:\PROGRA~1\MMSASS~1\文件夹
D:\WINNT\System32\STDSVER.DLL
D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\aua\aua.exe
D:\PROGRA~1\wint\文件夹
<D:\WINNT\wincup\文件夹
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ffldm.exe
D:\WINNT\SYSTEM\Kernel32.dll
D:\WINNT\system32\Intenet.exe
D:\Program Files\Common Files\Microsoft Shared\MSINFO\文件夹

运行SREng2,使用：系统修复－－文件关联－－全选－－修复

修复后,请重新扫描上来
我无邪 - 2006-10-6 0:08:00
楼主按以上说的做，完后重启。
再扫个日志粘上来。
清净的沫子 - 2006-10-6 12:24:00
D:\PROGRA~1\MMSASS~1\文件夹
D:\WINNT\System32\STDSVER.DLL
这两个删不掉，我进入安全模式删掉了，但重新启动后它们又自动产生了。别的好象都删了，以下是最新的扫描纪录，让您费心了
清净的沫子 - 2006-10-6 12:26:00
006-10-06,12:21:58

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><; ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <TkBellExe><; "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ffldm.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <webwork><D:\WINNT\webwork\webwork.dll>  [MSWebwork Cop.]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><; D:\WINNT\system32\ssstars.scr>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[Microsoft Office]
  <D:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[JMediaService / JMediaService]
  <D:\WINNT\system32\rundll32.exe D:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service><Microsoft Corporation>
[StdService / StdService]
  <D:\WINNT\system32\rundll32.exe D:\WINNT\SYSTEM32\STDSVER.DLL,Service><Microsoft Corporation>
[WMDM PMSP Service / WMDM PMSP Service]
  <D:\WINNT\system32\mspmspsv.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN]
  <D:\WINNT\System32\svchost.exe -k netsvcs-->D:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[Albus / Albus]
  <\SystemRoot\system32\drivers\Albus.SYS><N/A>
[cdnprot / cdnprot]
  <\SystemRoot\system32\drivers\cdnprot.sys><N/A>
[cdntran / cdntran]
  <system32\drivers\cdntran.sys><CNNIC>
[Cdr4_2K / Cdr4_2K]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[CnsMinKP / CnsMinKP]
  <system32\drivers\CnsMinKP.sys><N/A>
[dmboot / dmboot]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[fgqjvg / fgqjvg]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\fgqjvgrgh><N/A>
[hfbdcjjc / hfbdcjjc]
  <\SystemRoot\system32\drivers\hfbdcjjc.sys><N/A>
[i81x / i81x]
  <System32\DRIVERS\i81xnt5.sys><Intel Corporation>
[Virtual IR COM Port / IrCOMM2k]
  <system32\DRIVERS\ircomm2k.sys><N/A>
[kmsinput / kmsinput]
  <\??\D:\WINNT\system32\drivers\kmsinput.sys><N/A>
[LT Modem Driver / ltmodem5]
  <System32\DRIVERS\ltmdmnt.sys><LT>
[md / md]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\mdqtn><N/A>
[Nokia USB Generic / Nokia USB Generic]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
  <system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt]
  <\??\F:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkcusb / npkcusb]
  <\??\F:\Program Files\Tencent\qq\npkcusb.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[sptd / sptd]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[M-Systems DiskOnChip 2000 / tffsport]
  <\SystemRoot\System32\DRIVERS\tffsport.sys><M-Systems>
[udch / udch]
  <\??\D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp\udchxol><N/A>

==================================
清净的沫子 - 2006-10-6 12:27:00
==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <D:\WINNT\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <F:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[XBTP03129 Class]
  {6029B367-250A-4696-925C-641709CA7381} <D:\PROGRA~1\KUAISO~1\KUAISO~1.DLL, IE Toolbar>
[DragSearch BHO]
  {62EED7C6-9F02-42f9-B634-98E2899E147B} <D:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL, N/A>
[Vision]
  {6671A431-5C3D-463d-A7CF-5587F9B7E191} <D:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[stdup]
  {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} <D:\WINNT\SYSTEM32\stdup.dll, MStdup Co Ltd.>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <F:\FLASHGET\jccatch.dll, N/A>
[Google Toolbar Helper]
  {AA58ED58-01DD-4d91-8333-CF10577473F7} <d:\program files\google\googletoolbar2.dll, Google Inc.>
[WMHlprObj Class]
  {F5824EFB-728A-4726-A5A5-85A68B20EDC3} <D:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll, CNNIC>
[维宇RealLink]
  {0713E8D2-850A-101B-AFC0-4210122A8DA9} <C:\Program Files\VerySoft\RealLink\RealLink.exe, 武汉维宇软件有限公司>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <D:\WINNT\System32\msjava.dll, Microsoft Corporation>
[CdnForIE Class]
  {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <D:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[MMSAssistMenu]
  {6671A433-5C3D-463d-A7CF-5587F9B7E191} <D:\PROGRA~1\MMSASS~1\mmsass~1.dll, >
[酷热影音]
  {7D73FF86-05F1-39ed-C850-A423120EC338} <www.kuree.com/index.htm?id=00011001, N/A>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\FLASHGET\flashget.exe, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\Program Files\Tencent\qq\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[完美网译通]
  {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} <D:\WINNT\WORLD2\TOOLBAR\hmtoolbar.dll, 北京完美时空有限公司>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <d:\program files\google\googletoolbar2.dll, Google Inc.>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <D:\WINNT\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[  >> 彩信发送 <<]
  <res://D:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm, N/A>
[&使用迅雷下载]
  <c:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <c:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[&使用迷你迅雷下载]
  <D:\Program Files\Maxthon\Thundermini\geturl.htm, N/A>
[>>彩信发送<<]
  <res://D:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm, N/A>
[Download by Net Transport]
  <C:\PROGRA~1\XI\NETTRA~1\NTAddLink.html, N/A>
[Google 搜索(&G)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
  <F:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[反向链接]
  <res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html, N/A>
[导出到 Microsoft Excel(&x)]
  <res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[新浪搜索]
  <http://cha.sina.com.cn/ddt.html, N/A>
[添加到QQ自定义面板]
  <F:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[百度-搜索MP3]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM, N/A>
[百度-搜索图片]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM, N/A>
[百度-搜索新闻]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM, N/A>
[百度-搜索歌词]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM, N/A>
[百度-搜索网页]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM, N/A>
[百度-搜索贴吧]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM, N/A>
[百度-词典搜索]
  <res://D:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM, N/A>
[类似网页]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html, N/A>
[缓存的网页快照]
  <res://d:\program files\google\GoogleToolbar2.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html, N/A>
[访问通用网址]
  <D:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>

==================================
正在运行的进程
[PID: 188][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 216][\??\D:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 236][\??\D:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
[PID: 268][D:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [D:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 280][D:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 468][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 492][D:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
[PID: 524][D:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 540][D:\WINNT\system32\hidserv.exe]  [Microsoft Corporation, 5.00.2195.6655]
[PID: 556][D:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\PROGRA~1\MMSASS~1\MMSSVER.DLL]  [, 1, 2, 0, 6]
[PID: 616][D:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 644][D:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
[PID: 796][D:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 836][D:\WINNT\system32\mspmspsv.exe]  [Microsoft Corporation, 7.10.00.3059]
[PID: 848][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 376][D:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [D:\WINNT\SYSTEM32\STDSVER.DLL]  [MStdup Co Ltd., 3, 2, 2, 3]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
[PID: 1072][D:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\System32\msimtf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\webwork\webwork.nls]  [MSWebwork Cop., 1, 0, 0, 1]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\WINNT\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [D:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.0.2004121400]
    [D:\WINNT\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [D:\PROGRA~1\MMSASS~1\mmsass~1.dll]  [, 1, 2, 0, 6]
    [D:\PROGRA~1\MMSASS~1\albus.dll]  [Albus, 1, 0, 0, 2]
    [D:\WINNT\SYSTEM32\stdup.dll]  [MStdup Co Ltd., 3, 2, 2, 3]
    [D:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [D:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll]  [Nokia, 6, 60, 4, 7]
    [D:\WINNT\system32\ConnAPI.DLL]  [Nokia., 6, 60, 21, 1]
    [D:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll]  [Nokia, 6, 60, 45, 3]
    [D:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr]  [Nokia, 6, 60, 5, 0]
    [D:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr]  [Nokia, 6, 60, 1, 0]
    [D:\PROGRA~1\PICAVIEW\PicaView.dll]  [ACD Systems, Ltd., 2, 0, 0, 78]
    [D:\Program Files\ACD Systems\PlugIns\IDE_ACDStd.apl]  [ACD Systems, Ltd., 1, 1, 1, 78]
    [D:\WINNT\system32\msxml3.dll]  [Microsoft Corporation, 8.30.9926.0]
[PID: 952][D:\Documents and Settings\Administrator.YUANNIU\桌面\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1148][D:\WINNT\system32\NOTEPAD.EXE]  [Microsoft Corporation, 5.00.2140.1]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 420][D:\WINNT\system32\notepad.exe]  [Microsoft Corporation, 5.00.2140.1]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 568][D:\WINNT\system32\notepad.exe]  [Microsoft Corporation, 5.00.2140.1]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]

==================================
清净的沫子 - 2006-10-6 12:28:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["D:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
清净的沫子 - 2006-10-6 12:30:00
D:\PROGRA~1\MMSASS~1\文件夹
D:\WINNT\System32\STDSVER.DLL
这两个删不掉，我进入安全模式删掉了，但重新启动后它们又自动产生了。别的好象都删了，以下是最新的扫描纪录，让您费心了
清净的沫子 - 2006-10-6 18:35:00
让您费心了
我无邪 - 2006-10-6 19:46:00
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），点“启动项目，服务，点“驱动程序”勾选“隐藏以认证的微软服务”选中病毒服务udch,sptd,md,fgqjvg,CnsMinKP，选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）

下载超级兔子。
http://www.pctutu.com/srmsdown.asp
安装好后，打开“超级兔子优化王”“专业卸载,卸载所有提示的垃圾软件，卸载是不要打开任何浏览窗口。卸载不了可以重启后再去卸载。
卸载不了，可以考虑到安全模式下卸载。
重启后删除
D:\DOCUME~1\ADMINI~1.YUA\LOCALS~1\Temp
D:\WINNT\System32\Drivers\sptd.sys

D:\WINNT\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ffldm.exe这一项看以下的帖子
http://forum.ikaka.com/topic.asp?board=28&artid=8122808

完后重启，再扫个日志粘上来。
清净的沫子 - 2006-10-6 22:40:00
2006-10-06,22:32:47

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Corporation]
    <TkBellExe><; "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><D:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><; D:\WINNT\system32\ssstars.scr>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
[Microsoft Office]
  <D:\Documents and Settings\All Users.WINNT\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~2\Office10\OSA.EXE [Microsoft Corporation]><N>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <D:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[WMDM PMSP Service / WMDM PMSP Service]
  <D:\WINNT\system32\mspmspsv.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN]
  <D:\WINNT\System32\svchost.exe -k netsvcs-->D:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[Cdr4_2K / Cdr4_2K]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
  <D:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[dmboot / dmboot]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[hfbdcjjc / hfbdcjjc]
  <\SystemRoot\system32\drivers\hfbdcjjc.sys><N/A>
[i81x / i81x]
  <System32\DRIVERS\i81xnt5.sys><Intel Corporation>
[Virtual IR COM Port / IrCOMM2k]
  <system32\DRIVERS\ircomm2k.sys><N/A>
[kmsinput / kmsinput]
  <\??\D:\WINNT\system32\drivers\kmsinput.sys><N/A>
[LT Modem Driver / ltmodem5]
  <System32\DRIVERS\ltmdmnt.sys><LT>
[Nokia USB Generic / Nokia USB Generic]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent]
  <system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt]
  <\??\F:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkcusb / npkcusb]
  <\??\F:\Program Files\Tencent\qq\npkcusb.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[M-Systems DiskOnChip 2000 / tffsport]
  <\SystemRoot\System32\DRIVERS\tffsport.sys><M-Systems>

==================================
清净的沫子 - 2006-10-6 22:41:00
==================================
浏览器加载项
[维宇RealLink]
  {0713E8D2-850A-101B-AFC0-4210122A8DA9} <C:\Program Files\VerySoft\RealLink\RealLink.exe, 武汉维宇软件有限公司>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <D:\WINNT\System32\msjava.dll, Microsoft Corporation>
[酷热影音]
  {7D73FF86-05F1-39ed-C850-A423120EC338} <www.kuree.com/index.htm?id=00011001, N/A>
[kele8]
  {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <F:\Program Files\Tencent\qq\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\FLASHGET\flashget.exe, N/A>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <F:\Program Files\Tencent\qq\QQIEHelper.dll, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <D:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[&Google]
  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <d:\program files\google\googletoolbar2.dll, N/A>
[AxInputControl Class]
  {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <D:\WINNT\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINNT\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[&使用迅雷下载]
  <c:\Program Files\Thunder Network\Thunder\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <c:\Program Files\Thunder Network\Thunder\getallurl.htm, N/A>
[Download by Net Transport]
  <C:\PROGRA~1\XI\NETTRA~1\NTAddLink.html, N/A>
[Google 搜索(&G)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
  <F:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[反向链接]
  <res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html, N/A>
[导出到 Microsoft Excel(&x)]
  <res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[新浪搜索]
  <http://cha.sina.com.cn/ddt.html, N/A>
[添加到QQ自定义面板]
  <F:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <F:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <F:\Program Files\Tencent\qq\SendMMS.htm, N/A>
[类似网页]
  <res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html, N/A>
[缓存的网页快照]
  <res://d:\program files\google\GoogleToolbar2.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
  <res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html, N/A>

==================================
正在运行的进程
[PID: 136][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 164][\??\D:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 184][\??\D:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
[PID: 212][D:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [D:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 224][D:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
[PID: 400][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 428][D:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.6659]
[PID: 472][D:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 492][D:\WINNT\system32\hidserv.exe]  [Microsoft Corporation, 5.00.2195.6655]
[PID: 544][D:\WINNT\system32\regsvc.exe]  [Microsoft Corporation, 5.00.2195.6701]
[PID: 564][D:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6704]
[PID: 604][D:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 668][D:\WINNT\system32\mspmspsv.exe]  [Microsoft Corporation, 7.10.00.3059]
[PID: 684][D:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 788][D:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\system32\msctf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\System32\msimtf.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 988][D:\WINNT\system32\ctfmon.exe]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\MSUTB.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\mui\fallback\0804\msutb.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 856][D:\Documents and Settings\Administrator.YUANNIU\桌面\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [D:\WINNT\system32\MSCTF.dll]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
    [D:\WINNT\system32\IMSC40W.IME]  [Microsoft Corporation, 6.0.0.2524]
    [D:\WINNT\mui\fallback\0804\msctf.dll.mui]  [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]

==================================
清净的沫子 - 2006-10-6 22:42:00
==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["D:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
清净的沫子 - 2006-10-6 22:44:00
好像好用一些了，您再给看看，感谢阿
我无邪 - 2006-10-6 22:47:00
看不出问题了
随手修复
打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，浏览器加载项”来删除以下选项。
D:\WINNT\DOWNLO~1\INPUTC~1.DLL
有异常你描述一下。
清净的沫子 - 2006-10-6 22:50:00
删了，好像没有反应，没异常
我无邪 - 2006-10-6 22:53:00
嗯，且先这样，有异常再扫日志。
清净的沫子 - 2006-10-6 22:54:00
好的，真的谢谢了，帮了我很大的忙
xdxcrack - 2006-10-7 0:41:00
这年头偶都无语了~网络上不厚道的元素越来越多~这样不一定能清除干净~~也可以从硬盘装系统，不一定要光驱~~或者ghost~~有时候不是谁都有时间去分析~~能用就好~~个人看法~
清净的沫子 - 2006-10-7 10:53:00
en,you r right
1
查看完整版本: 恳求无邪蓝天等高手给看看
© 2000 - 2026 Rising Corp. Ltd.