病毒名：Trojan.Clicker.Agent.akn　日志　，跪求高手帮忙解决, bbs.ikaka.com

麦兜的西西 - 2006-10-25 12:27:00

在用瑞星杀毒软件杀毒的时候提示有Trojan.Clicker.Agent.akn　启动后删除但是没用的!C:\Documents and Settings\All Users\Application Data\Microsoft\User date 文件夹　下面的　ＩＥ．ＥＸＥ文件

麦兜的西西 - 2006-10-25 12:28:00

1

麦兜的西西 - 2006-10-25 12:29:00

1

westbeck - 2006-10-25 12:41:00

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。谢谢．．．

westbeck - 2006-10-25 12:41:00

我要这个日志

麦兜的西西 - 2006-10-25 13:11:00

2006-10-25,12:49:17

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 娗棟?尷梡? - 姰惍岟擻

埲壓撪梕旐?拞丗
強桳揑???栚乮曪妵拲檈昞丄??暥審?丄暈?摍乯
??婍壛??
惓嵼?峴揑?掱乮曪妵?掱柾?怣懅乯
暥審??
Winsock 採嫙幰
Autorun.inf
HOSTS 暥審

???栚
拲檈昞
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<DrvMon.exe><C:\WINDOWS\system32\DrvMon.exe> [Alcor Micro, Corp.]
<91cast><> [N/A]
<svc><C:\WINDOWS\svchost.exe> [N/A]
<pit><C:\WINDOWS\SVCHOST.EXE> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<{18F9174D-03E7-2052-0425-020051}><"C:\Program Files\Common Files\{18F9174D-03E7-2052-0425-020051}\Update.exe" te-110-12-0000057> [N/A]
<rx><C:\WINDOWS\system32\explore.exe> [N/A]
<wm><C:\WINDOWS\system32\grtosts.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Intel Corporation]
<TkBellExe><"C:\Program Files\Realpack\Update_OB\realsched.exe" -osboot> [N/A]
<Poco><D:\新建文件夹\PP\pp.exe> [N/A]
<BigDog303><C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)> [N/A]
<iTunesHelper><"C:\Program Files\iTunes\iTunesHelper.exe"> [Apple Computer, Inc.]
<QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<Thunder><"C:\Program Files\Thunder Network\Thunder\Thunder.exe" /s> [Thunder Networking Technologies,LTD]
<realtpsk><C:\WINDOWS\system\realsched.exe> [N/A]
<91cast><> [N/A]
<svc><C:\WINDOWS\svchost.exe> [N/A]
<UserFaultCheck><%systemroot%\system32\dumprep 0 -u> [N/A]
<RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<Galaxy><rundll32.exe C:\WINDOWS\system32\ppgaxea.dll,Su> []
<Power><rundll32.exe C:\WINDOWS\system32\alxklt.dll,Start> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><EXPLORER.EXE> [(Verified)Microsoft Corporation]
<Userinit><userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]

==================================
??暥審?
[Adobe Reader Speed Launch]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\Acrobat 7.0\Reader\reader_sl.exe [Adobe Systems Incorporated]><N>
[BlueSoleil]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\BlueSoleil.lnk --> C:\PROGRA~1\IVT Corporation\BlueSoleil\BlueSoleil.exe [IVT Corporation]><N>
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> C:\PROGRA~1\MICROS~3\Office\OSA9.EXE [Microsoft Corporation]><N>
[MSN Messenger 7.0]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\MSN Messenger 7.0.lnk --> C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314600425}\MsblIco.Exe [N/A]><N>
[腾讯QQ]
<C:\Documents and Settings\heyong\「开始」菜单\程序\启动\腾讯QQ.lnk --> C:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>

==================================
暈?
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[ASP.NET Work State Service / aspwstate]
<C:\WINDOWS\System32\svchost.exe -k aspwstate-->c:\windows\system32\aspwswin.dll><Microsoft Corporation>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[Commander Service / Commander Service]
<C:\Program Files\Seagull\BarTender\7.51\CmdrSrv.exe><Seagull Scientific, Inc>
[Crypkey License / Crypkey License]
<crypserv.exe><N/A>
[DCOM 服务器进程启动器 / DcomLaunch]
<C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService]
<C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[Spectrum24 Events Monitor / IPRIP]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\acss.dll><LINKMEDIA Tech>
[ClipManage / Mercha2]
<C:\WINDOWS\SYSTEM32\RUNDLL.EXE C:\WINDOWS\SYSTEM32\WBEM\TOJNIA01.DLL,Export 1087><Microsoft Corporation>
[MessageService / MessageService]
<C:\WINDOWS\system32\Svchost.exe -k MessageService-->C:\WINDOWS\system32\MsServices\svchost.dll><N/A>
[Network Logon / NetWorkLogon]
<rundll32.exe KB896475.log,start><Microsoft Corporation>
[Network Logons / NetWorkLogons]
<rundll32.exe KB27861012.log,start><Microsoft Corporation>
[NetFrame Wireless Configuration / NFSWZCSVC]
<C:\WINDOWS\System32\svchost.exe -k NFSWZCSVC-->c:\windows\system32\nfswzwin32.dll><Microsoft Corporation>
[WindowsNT Protected Storage / NTProStorage]
<C:\WINDOWS\System32\svchost.exe -k NTProStorage-->c:\windows\system32\ntprostorage.dll><Microsoft Corporation>
[NetMeeting Remote Desktop Agent / Nwsapagent]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Nwsapagent.dll><LINKMEDIA Tech>
[PPPoE Service / PPPoEService]
<C:\PROGRA~1\Efficient Networks\EnterNet 500\app\pppoeservice.exe><N/A>
[Remote IIS Admin Service / ReIISAdmin]
<C:\WINDOWS\System32\svchost.exe -k ReIISAdmin-->c:\windows\system32\reinetinfo.dll><Microsoft Corporation>
[Remote Procedure Call (RPC) / RpcSs]
<C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><>
[Rising Process Communication Center / RsCCenter]
<"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Application Accelerator / Tech]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\cbisra02.dll><Microsoft Corporation>
[Terminal Services / TermService]
<C:\WINDOWS\System32\svchost -k DComLaunch-->%SystemRoot%\System32\termsrv.dll><Microsoft Corporation>
[wint / wint]
<C:\WINDOWS\system32\RunDLL32.exe "C:\WINDOWS\system32\wint\wint.dll",Run -r><Microsoft Corporation>
[Windows Media Connect (WMC) / WmcCds]
<c:\program files\windows media connect\mswmccds.exe><Microsoft Corporation>
[Windows Media Connect (WMC) 帮助程序 / WmcCdsLs]
<C:\Program Files\Windows Media Connect\mswmcls.exe><Microsoft Corporation>

麦兜的西西 - 2006-10-25 13:12:00

==================================
??掱彉
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Rising TDI Base Driver / BaseTDI]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Bluetooth Audio Service / BlueletAudio]
<system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[bootbus / bootbus]
<\??\C:\WINDOWS\system32\drivers\bootbus.sys><N/A>
[Bluetooth PAN Network Adapter / BT]
<system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth Audio / BtAudio]
<System32\DRIVERS\btaudio.sys><N/A>
[Bluetooth USB For Bluetooth Service / Btcsrusb]
<System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth Virtual Communications Driver / BTDriver]
<System32\DRIVERS\btport.sys><N/A>
[Bluetooth HID Enumerator / BTHidEnum]
<system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[Bluetooth Network Filter / BTNetFilter]
<\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys><N/A>
[Bluetooth LAN Access Server / BTWDNDIS]
<System32\DRIVERS\btwdndis.sys><N/A>
[btwhid / btwhid]
<System32\DRIVERS\btwhid.sys><WIDCOMM, Inc.>
[WIDCOMM USB Bluetooth Driver / BTWUSB]
<System32\Drivers\btwusb.sys><N/A>
[DENSO WAVE USB-COM Port / DWCOM]
<system32\DRIVERS\dwcom.sys><DENSO WAVE INC.>
[ExpScaner / ExpScaner]
<\??\C:\Program Files\rising\Rav\ExpScan.sys><>
[GEARAspiWDM / GEARAspiWDM]
<System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[hardlock / hardlock]
<\??\C:\WINDOWS\system32\drivers\hardlock.sys><Aladdin Knowledge Systems>
[Haspnt / Haspnt]
<\??\C:\WINDOWS\system32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[hidport / hidport]
<\??\C:\WINDOWS\system32\drivers\hidport.sys><Microsoft Corporation>
[HookCont / HookCont]
<\??\C:\Program Files\rising\Rav\HOOKCONT.sys><Rising tech Co. ltd>
[HookReg / HookReg]
<\??\C:\Program Files\rising\Rav\HookReg.sys><>
[HookSys / HookSys]
<\??\C:\Program Files\rising\Rav\HookSys.sys><Rising>
[ialm / ialm]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput]
<\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[Lucent Technologies Soft Modem / LucentSoftModem]
<System32\DRIVERS\LTSM.sys><Lucent Technologies>
[MCSTRM / MCSTRM]
<C:\WINDOWS\SYSTEM32\DRIVERS\MCSTRM.SYS><RealNetworks, Inc.>
[MEMSCAN / MEMSCAN]
<\??\C:\Program Files\rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[NetworkX / NetworkX]
<\SystemRoot\system32\ckldrv.sys><N/A>
[New0 / New0]
<\??\C:\WINDOWS\System32\new.sys><N/A>
[ProcServ / ProcServ]
<\??\C:\WINDOWS\system32\drivers\ProcServ.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20]
<\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[QuakeDRV / QuakeDRV]
<\SystemRoot\system32\DRIVERS\quakedrv.sys><N/A>
[RAWESR / RAWESR]
<\??\C:\PROGRA~1\Efficient Networks\EnterNet 500\app\RAWESR.SYS><Microsoft Corporation>
[rfdrv910 / rfdrv910]
<\SystemRoot\System32\drivers\rfdrv910.sys><RunFei>
[Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp]
<System32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel]
<\SystemRoot\System32\Drivers\SENTINEL.SYS><Rainbow Technologies, Inc.>
[sound / sound]
<\??\C:\WINDOWS\system32\drivers\sound.sys><N/A>
[Virtual Serial port driver / VComm]
<system32\DRIVERS\VComm.sys><IVT Corporation>
[Bluetooth VComm Manager Service / VcommMgr]
<System32\Drivers\VcommMgr.sys><IVT Corporation>
[WinDriver kernel module / WinDriver]
<System32\Drivers\windrvr.sys><Jungo>
[World Standard Teletext Codec / WSTCODEC]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303]
<System32\Drivers\usbVM303.sys><Vimicro Corporation>

麦兜的西西 - 2006-10-25 13:15:00

==================================
??婍壛??
[netup]
{0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} <C:\WINDOWS\system32\netiup.dll, >
[symndis]
{166DF856-08F0-4D1C-991D-7CE3DB5C26F5} <C:\WINDOWS\system32\rasacd.dll, >
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5025.dll, N/A>
[SYM]
{36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} <C:\WINDOWS\system32\usersrd.dll, N/A>
[]
{500911F3-16C7-4120-BBEF-DF82FDCD2149} <C:\WINDOWS\system32\ATIDEMGRED.dll, N/A>
[SrchHook Class]
{6E1BC898-505A-44f4-BC88-BCE43016AC96} <C:\WINDOWS\system32\BarSea.dll, N/A>
[UMU Class]
{86450826-9507-44DC-9009-F92D2F5864EE} <C:\WINDOWS\system32\sysag.dll, >
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[商务快车]
{E4CBC54F-170A-46F0-936B-659D6C265B7A} <, N/A>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[Kuaiso Toolsbar]
{6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} <C:\Program Files\Kuaiso Toolsbar\kuaiso_06040.dll, IE Toolbar>
[ToolBar888]
{C004DEC2-2623-438e-9CA2-C9043AB28508} <C:\Program Files\Common Files\{38F9174D-03E7-2052-0425-020051}\MyToolBar.dll, N/A>
[Search Bar]
{FBFF8F98-AE9D-4599-975E-E9B31E88EF04} <C:\WINDOWS\system32\ToolBar.dll, N/A>
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[MessengerStatsClient Class]
{8E0D4DE5-3180-4024-A327-4DFAD1796A8D} <C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\Program Files\DeskAdTop\deskipn.dll, >
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\System32\msjava.dll, Microsoft Corporation>
[netup]
{0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} <C:\WINDOWS\system32\netiup.dll, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[symndis]
{166DF856-08F0-4D1C-991D-7CE3DB5C26F5} <C:\WINDOWS\system32\rasacd.dll, >
[MyIEHelper Class]
{16B770A0-0E87-4278-B748-2460D64A8386} <C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5025.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[]
{29A8B48F-9AB3-43D3-8B87-7D1888197563} <C:\WINDOWS\system32\ATIDEMGRED.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\WINDOWS\system32\dllcache\dhtmled.ocx, Microsoft Corporation>
[google bar]
{3020C3F1-744B-4C9E-8404-DBCD3705D6A9} <C:\WINDOWS\Win32ef.dll, N/A>
[Tabular Data Control]
{333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\System32\tdc.ocx, Microsoft Corporation>
[SYM]
{36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} <C:\WINDOWS\system32\usersrd.dll, N/A>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[SafeMe Internet Explorer Helper]
{3AE06CEE-58A6-4F5F-AF89-6C5350842F16} <C:\WINDOWS\system32\SafeHelper12.dll, LINKMEDIA Tech>
[HHCtrl Object]
{41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[raObject Class]
{46F194EB-B7DB-4B7A-BD42-5FF39FD17664} <C:\PROGRA~1\pcast\hbcast.dll, Shanghai Henbang Technology Co., Ltd>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[]
{500911F3-16C7-4120-BBEF-DF82FDCD2149} <C:\WINDOWS\system32\ATIDEMGRED.dll, N/A>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\System32\shdocvw.dll, N/A>
[XBTP03129 Class]
{6029B367-250A-4696-925C-641709CA7381} <C:\PROGRA~1\Kuaiso Toolsbar\kuaiso_06040.dll, IE Toolbar>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[DivXBrowserPlugin Object]
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} <C:\Program Files\DivX\DivX Web Player\npdivx32.dll, DivX,Inc.>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[Kuaiso Toolsbar]
{6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} <C:\Program Files\Kuaiso Toolsbar\kuaiso_06040.dll, IE Toolbar>
[SrchHook Class]
{6E1BC898-505A-44F4-BC88-BCE43016AC96} <C:\WINDOWS\system32\BarSea.dll, N/A>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[UMU Class]
{86450826-9507-44DC-9009-F92D2F5864EE} <C:\WINDOWS\system32\sysag.dll, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\System32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Spoolsv Class]
{9C363D55-07D7-433D-A13E-D9C105202F6F} <C:\WINDOWS\system32\drivers\spoolsv.dll, >
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\System32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[ToolBar888]
{C004DEC2-2623-438E-9CA2-C9043AB28508} <C:\Program Files\Common Files\{38F9174D-03E7-2052-0425-020051}\MyToolBar.dll, N/A>
[Adobe Acrobat 7.0 Browser Document]
{CA8A9780-280D-11CF-A24D-444553540000} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroPDF.dll, Adobe Systems, Inc.>
[Webacc Class]
{CAC068F3-A608-406B-8581-458788A67694} <C:\WINDOWS\system32\svchost.dll, >
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Microsoft Agent Control 2.0]
{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F} <C:\WINDOWS\msagent\agentctl.dll, Microsoft Corporation>
[SDObmObj Class]
{D4D5C535-BA95-4327-870D-A33826FDD17A} <C:\WINDOWS\system32\obwbkya.dll, 北京兴华基业软件技术有限公司>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[InteSearch]
{EBBC6E6D-7B65-46BE-B509-86CED2D17876} <C:\WINDOWS\system32\Inte32.dll, N/A>
[SHLaunch Control]
{FA463B6E-93D5-4E02-B7F2-E0BA98DA73FC} <C:\WINDOWS\System32\SHLaunch.ocx, >
[Search Bar]
{FBFF8F98-AE9D-4599-975E-E9B31E88EF04} <C:\WINDOWS\system32\ToolBar.dll, N/A>
[]
{FE32DECF-06AD-426E-9F53-3018A366B5AE} <C:\WINDOWS\system32\sys32version.dll, N/A>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[使用影音传送带下载]
<, N/A>
[使用影音传送带下载全部链接]
<, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

麦兜的西西 - 2006-10-25 13:16:00

==================================
惓嵼?峴揑?掱
[PID: 508][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 624][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 636][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 844][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 880][C:\Program Files\rising\Rav\CCenter.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
[PID: 904][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\windows\system32\acss.dll] [LINKMEDIA Tech, 1, 5, 0, 4]
[c:\windows\system32\nwsapagent.dll] [LINKMEDIA Tech, 1, 5, 0, 4]
[PID: 948][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1020][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1060][C:\Program Files\rising\Rav\Ravmond.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 35]
[C:\Program Files\rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\rising\Rav\RsLog.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
[C:\Program Files\rising\Rav\HOOKSYS.dll] [Beijing Rising Technology Co., Ltd., 18, 1, 0, 11]
[C:\Program Files\rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 32]
[C:\Program Files\rising\Rav\libload.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\rising\Rav\VirusLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 12]
[C:\Program Files\rising\Rav\regmon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\rising\Rav\HookWeb.dll] [rising, 18, 0, 0, 2]
[C:\Program Files\rising\Rav\MemMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\rising\Rav\expscan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\rising\Rav\mPorts.dll] [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
[C:\Program Files\rising\Rav\MailMon.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\rising\Rav\SpamEng.dll] [N/A, 18, 0, 0, 6]
[C:\Program Files\rising\Rav\engine.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 34]
[C:\Program Files\rising\Rav\PostTrt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 17]
[C:\Program Files\rising\Rav\UnExe.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\rising\Rav\ScanExec.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 15]
[C:\Program Files\rising\Rav\ScanEx.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 30]
[C:\Program Files\rising\Rav\RSUnpack.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 18]
[C:\Program Files\rising\Rav\NvFile.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 7]
[C:\Program Files\rising\Rav\ScanMac.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 10]
[C:\Program Files\rising\Rav\ScanSct.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[C:\Program Files\rising\Rav\Unpacker.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\rising\Rav\RsStore.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\rising\Rav\ScanNet.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\rising\Rav\ExtOLE.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
[C:\Program Files\rising\Rav\ExtMail.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[PID: 1256][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\hpzsnt09.dll] [HP, 2.236.4.0]
[C:\WINDOWS\system32\prt32lm.dll] [Seagull Scientific, Inc., 6,5,0,0]
[C:\WINDOWS\system32\prt32m.dll] [Seagull Scientific, Inc., 6.6 M-21]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\Smproc.dll] [Windows (R) 2000 DDK provider, 5.1.2600.0 built by: WinDDK]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1332][C:\Program Files\rising\Rav\RavStub.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 16]
[C:\Program Files\rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1512][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, N/A]
[PID: 1524][C:\WINDOWS\system32\crypserv.exe] [N/A, N/A]
[PID: 1596][C:\WINDOWS\SYSTEM32\RUNDLL.EXE] [Microsoft Corporation, 5.00.2134.1]
[PID: 1620][C:\WINDOWS\system32\Svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\windows\system32\msservices\svchost.dll] [N/A, N/A]
[c:\windows\system32\msservices\MsService.dll] [Microsoft Corporation All rights reserved, 1, 0, 0, 1]
[c:\windows\system32\msservices\unreg1.dll] [N/A, N/A]
[c:\windows\system32\msservices\OldUnReg.dll] [N/A, N/A]
[PID: 1768][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1796][C:\PROGRA~1\Efficient Networks\EnterNet 500\app\pppoeservice.exe] [N/A, N/A]
[PID: 1816][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1844][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1876][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1912][C:\WINDOWS\system32\RunDLL32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wint\wint.dll] [N/A, N/A]
[PID: 428][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2104][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wint\wint.dll] [N/A, N/A]
[C:\WINDOWS\system32\alxklt.dll] [, 1, 0, 0, 0]
[C:\WINDOWS\system32\ppgaxea.dll] [, 1, 0, 0, 0]
[C:\WINDOWS\system32\sysag.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\sutxre.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\wpsont.dll] [N/A, N/A]
[C:\WINDOWS\system32\ccpgen.dll] [N/A, N/A]
[C:\WINDOWS\system32\ex\Dhcom.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\ex\kerdpm.dll] [N/A, N/A]
[C:\WINDOWS\system32\ex\Pac.dll] [, 1, 0, 0, 1]
[C:\Program Files\rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[PID: 3268][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kuaiso Toolsbar\kuaiso_06040.dll] [IE Toolbar, 1, 0, 0, 4]
[C:\WINDOWS\system32\netiup.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\rasacd.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\BarSea.dll] [N/A, 1, 0, 0, 1]
[C:\WINDOWS\system32\sysag.dll] [, 1, 0, 0, 1]
[PID: 384][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\sdmAgent22.dll] [LINKMEDIA Tech, 1, 5, 0, 7]
[PID: 1096][c:\windows\system32\wbem\services.exe] [Microsoft, 1.0.0.0]
[PID: 3628][C:\Program Files\Windows Media Player\wmplayer.exe] [Microsoft Corporation, 10.00.00.3802]
[C:\WINDOWS\system32\wint\wint.dll] [N/A, N/A]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\WINDOWS\system32\RealMediaSplitter.ax] [Gabest, 1, 0, 1, 0]
[PID: 2192][C:\WINDOWS\system32\NOTEPAD.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\wint\wint.dll] [N/A, N/A]
[PID: 3368][E:\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINDOWS\system32\wint\wint.dll] [N/A, N/A]

==================================
暥審??
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 採嫙幰
N/A

==================================
Autorun.inf
N/A

麦兜的西西 - 2006-10-25 13:16:00

HOSTS 暥審
127.0.0.1 localhost
127.0.0.1www.ccnnic.com
127.0.0.1www.ccnnlc.com
127.0.0.1www.bodoto.com
127.0.0.1bj.bodoto.com
127.0.0.1nb.bodoto.com
127.0.0.1hangzhou.bodoto.com
127.0.0.1jh.bodoto.com
127.0.0.1shangh.bodoto.com
127.0.0.1my.bodoto.com
127.0.0.1mail.bodoto.com
127.0.0.1www.bodoto.net
127.0.0.1www.bodoto.cn
127.0.0.1www.bodoto.com.cn
127.0.0.1www.bodoto.net.cn
127.0.0.1www.bodoto.org
127.0.0.1www.edmchina.com
127.0.0.1www.edmchina.net
127.0.0.1www.edmchina.cn
127.0.0.1www.edmchina.com.cn
127.0.0.1ad.edmchina.com
127.0.0.1agent.edmchina.com
127.0.0.1sales.edmchina.com
127.0.0.1mail.edmchina.com
127.0.0.1edmchina.com
127.0.0.1edmchina.net
127.0.0.1edmchina.cn
127.0.0.1edmchina.com.cn
127.0.0.1www.pk265.com
127.0.0.1pk265.com
127.0.0.1www.qqbao.com
127.0.0.1www.qqbao.net
127.0.0.1www.qqbao.cn
127.0.0.1www.qqbao.com.cn
127.0.0.1qqbao.com
127.0.0.1qqbao.cn
127.0.0.1qqbao.com.cn
127.0.0.1ad.pvka.com
127.0.0.1da.pvka.com
127.0.0.1www.20060106.com
127.0.0.120060106.com
127.0.0.1www.huajundown.com
127.0.0.1www.huajundown.net
127.0.0.1huajundown.net

==================================

麦兜的西西 - 2006-10-25 14:14:00

为什么没人帮我~?

麦兜的西西 - 2006-10-25 14:48:00

123112

lansely - 2006-10-25 14:59:00

Alcor Micro公司的显示器？
那C:\WINDOWS\system32\DrvMon.exe大概是正常的
你扫出来的东西看起来不是只有一个病毒文件吧？
瑞星只报一个？
C:\WINDOWS\system32\explore.exe
c:\windows\svchost.exe
太长了看的我头晕
你好好杀杀看

麦兜的西西 - 2006-10-25 16:43:00

【回复“lansely”的帖子】
我已经几乎天天杀瑞星也是最新版的但是一直杀不了反正一开机就是自动出现2个毒显示杀掉了然后我全盘杀毒的话还是原来的哪个IE.EXE杀不了显示启动后删除但是没用的
超级郁闷难道就没一个人能帮我彻底解决吗/~~~

麦兜的西西 - 2006-10-25 17:11:00

上帝来帮我

麦兜的西西 - 2006-10-26 13:52:00

312312

瑞星卡卡安全论坛