秋天。。 bbs.ikaka.com

ogim - 2006-11-9 18:53:00

2006-11-09,18:40:17

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<ctfmon.exe><ctfmon.exe> [Microsoft Corporation]
<Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Corporation]
<OfficeScanNT Monitor><"C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow> [Trend Micro Inc.]
<MINI_MYDRIVERS><C:\Program Files\DriverDownload\DriverDownloader.exe> [N/A]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<DAEMON Tools-2052><"C:\Program Files\D-Tools\daemon.exe" -lang 2052> [DAEMON'S HOME]
<NeroFilterCheck><C:\WINNT\system32\NeroCheck.exe> [Ahead Software Gmbh]
<NWTRAY><NWTRAY.EXE> [Novell, Inc.]
<InCD><C:\Program Files\Ahead\InCD\InCD.exe> [Nero AG]
<o3zwmr7p><RunDll32 "C:\WINNT\Downlo~1\rx7k.dll",Run> [Microsoft Corporation]
<SrvNet32><RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll",Run> [中搜在线]
<IEBarUp><RunDll32 "C:\WINNT\system32\IeBar.dll",Run> [Microsoft Corporation]
<Desktop><C:\WINNT\system32\rundll32.exe "C:\WINNT\system32\NTService32.dll" ,Run> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<GinaDLL><NWGINA.DLL> [Novell, Inc.]

==================================
启动文件夹
[Image Transfer]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Image Transfer.lnk --> C:\PROGRA~1\SONYCO~1\IMAGET~1\SonyTray.exe [N/A]><N>
[地址栏搜索]
<C:\Documents and Settings\csc\「开始」菜单\程序\启动\地址栏搜索.lnk --> C:\WINNT\Downlo~1\SEARCH~1\ServeUp.exe [中搜在线]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINNT\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINNT\system32\ati2sgag.exe><>
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InCD Helper / InCDsrv]
<C:\Program Files\Ahead\InCD\InCDsrv.exe><Nero AG>
[OfficeScanNT 实时扫描 / ntrtscan]
<"C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe"><Trend Micro Inc.>
[OfficeScanNT 个人防火墙 / OfcPfwSvc]
<"C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe"><Trend Micro Inc.>
[System Event Notification / SENS]
<C:\WINNT\system32\svchost.exe -k netsvcs-->%SystemRoot%\system32\sens.dll><N/A>
[OfficeScanNT 侦听程序 / tmlisten]
<"C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe"><Trend Micro Inc.>
[Portable Media Serial Number Service / WmdmPmSN]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[699145 / 699145]
<\SystemRoot\System32\drivers\699145.sys><N/A>
[ADProt / ADProt]
<\SystemRoot\system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[Service for WDM 3D Audio Driver / ALCXSENS]
<system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CdaC15BA / CdaC15BA]
<\??\C:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[Cdr4_2K / Cdr4_2K]
<C:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
<C:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[dmboot / dmboot]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[D-Link DFE-530TX PCI Fast Ethernet Adapter Driver / FETNDIS]
<system32\DRIVERS\dlkfet5b.sys><D-Link>
[hardlock / hardlock]
<\??\C:\WINNT\system32\drivers\hardlock.sys><Aladdin Knowledge Systems>
[Haspnt / Haspnt]
<\??\C:\WINNT\system32\drivers\Haspnt.sys><Aladdin Knowledge Systems>
[Ahead InCDFat File System Driver / InCDFat]
<\??\C:\WINNT\system32\Drivers\InCDFat.sys><Nero AG>
[InCD File System / InCDfs]
<C:\WINNT\SYSTEM32\DRIVERS\InCDfs.SYS><Nero AG>
[InCDPass / InCDPass]
<System32\DRIVERS\InCDPass.sys><Nero AG>
[InCD Reader / incdrm]
<C:\WINNT\SYSTEM32\DRIVERS\incdrm.SYS><Nero AG>
[kmsinput / kmsinput]
<\??\C:\WINNT\system32\drivers\kmsinput.sys><N/A>
[MASPINT / MASPINT]
<C:\WINNT\SYSTEM32\DRIVERS\MASPINT.SYS><MicroStaff Co.,Ltd.>
[Novell Client for Windows / NetwareWorkstation]
<system32\NetWare\nwfs.sys><Novell, Inc.>
[%ProductNICMDisplayName% / NICM]
<system32\drivers\nicm.sys><Novell, Inc.>
[npkcrypt / npkcrypt]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Novell DHCP Inform Client / NWDHCP]
<system32\NetWare\nwdhcp.sys><N/A>
[Novell DNS Name Space Service Provider / NWDNS]
<system32\NetWare\nwdns.sys><N/A>
[Novell Host File Name Space Service Provider / NWHOST]
<system32\NetWare\NWHOST.sys><N/A>
[Novell SAP Name Space Provider / NWSAP]
<system32\NetWare\NWSAP.sys><N/A>
[Novell NetWare IPX/SPX Transport Interface / NWSIPX32]
<system32\NetWare\nwsipx32.sys><Novell, Inc.>
[Novell SLP Name Space Service Provider / NWSLP]
<system32\NetWare\nwslp.sys><N/A>
[Novell Simple Naming Services / NWSNS]
<system32\NetWare\NWSNS.sys><N/A>
[Padus ASPI Shell / pfc]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Novell NetWare Resource Manager / RESMGR]
<system32\NetWare\resmgr.sys><Novell, Inc.>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Novell Service Location / SRVLOC]
<system32\NetWare\srvloc.sys><Novell, Inc.>
[Trend Micro Filter / TmFilter]
<\??\C:\Program Files\Trend Micro\OfficeScan Client\TmFilter.sys><Trend Micro Inc.>
[Trend Micro VSAPI NT / VSApiNt]
<\??\C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys><Trend Micro Inc.>
[w / w]
<\SystemRoot\system32\drivers\add_sys.sys><>
[World Standard Teletext Codec / WSTCODEC]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================

ogim - 2006-11-9 18:55:00

浏览器加载项
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINNT\system32\deskipn.dll, >
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[解霸]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\HEROSOFT\Hero3000\MPLAYER.EXE, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[MSN]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} <C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\zh-cn\msntb.dll, Microsoft Corporation>
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} <C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, N/A>
[ObjWinNTCheck Class]
{00134F72-5284-44F7-95A8-52A619F70751} <C:\WINNT\Downloaded Program Files\WinNTChk.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment SetupINICtrl Class]
{08D75BB0-D2B5-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanSetupINI.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment SetupCtrl Class]
{08D75BC1-D2B5-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanSetup.dll, Trend Micro Inc.>
[OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class]
{5EFE8CB1-D095-11D1-88FC-0080C859833B} <C:\WINNT\Downloaded Program Files\OfficeScanRemoveCtrl.dll, Trend Micro Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 176][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 204][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 224][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6970]
[C:\WINNT\system32\NWGINA.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\NLS\ENGLISH\NWGINAR.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\Ati2evxx.dll] [N/A, N/A]
[PID: 252][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 264][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6902]
[C:\WINNT\system32\nwv1_0.dll] [Novell, Inc., v4.71 (000217)]
[PID: 376][C:\WINNT\system32\Ati2evxx.exe] [N/A, N/A]
[PID: 448][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[PID: 496][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 548][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[C:\WINNT\system32\ZLMhp1.DLL] [Zenographics, 5, 51, 1203, 0]
[C:\WINNT\system32\ZLM.dll] [Zenographics, Inc., 5, 50, 1416, 0]
[C:\WINNT\system32\ZPJL.dll] [Zenographics, Inc., 1, 0, 1410, 1]
[C:\WINNT\system32\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[C:\WINNT\system32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINNT\system32\Imf32.dll] [Zenographics, Inc., 5, 51, 405, 0]
[C:\WINNT\system32\ZTAG32.dll] [Zenographics, Inc., 5, 50, 1725, 0]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\nwspool.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\NLS\ENGLISH\NWSPOOLR.DLL] [Novell, Inc., 4.70]
[PID: 616][C:\WINNT\system32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020]
[PID: 660][C:\Program Files\Ahead\InCD\InCDsrv.exe] [Nero AG, 4, 3, 11, 6]
[C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll] [Ahead Software AG, 1, 0, 0, 17]
[C:\Program Files\Ahead\InCD\incdshx.dll] [Nero AG, 4, 3, 11, 6]
[PID: 800][C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[PID: 340][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.6701]
[PID: 836][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6920]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[PID: 892][C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\TMSOCK.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\libTmCAV.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\WINNT\system32\NOVNPNT.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\MAPBASE.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSHLXNT.dll] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL] [Novell, Inc., v4.83]
[C:\Program Files\Trend Micro\OfficeScan Client\TmUpdate.dll] [Trend Micro Inc., 2,63,0,1007]

ogim - 2006-11-9 18:55:00

[PID: 936][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[PID: 972][C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwCommon.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\ZLib.dll] [Trend Micro Inc., 1.31.0.1708]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\Program Files\Trend Micro\OfficeScan Client\tmCfwApi.dll] [Trend Micro Inc., 1.2.0.1020]
[PID: 796][C:\WINNT\TEMP\CP8DFC.EXE] [N/A, N/A]
[PID: 1208][C:\WINNT\system32\Ati2evxx.exe] [N/A, N/A]
[PID: 1308][C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll] [N/A, N/A]
[C:\Program Files\Trend Micro\OfficeScan Client\ntmonres.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.3.0.1028]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[PID: 1316][C:\WINNT\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.26]
[PID: 1364][C:\WINNT\system32\NWTRAY.EXE] [Novell, Inc., v4.83]
[C:\WINNT\system32\NOVNPNT.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\MAPBASE.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSHLXNT.dll] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL] [Novell, Inc., v4.83]
[PID: 1412][C:\Program Files\Ahead\InCD\InCD.exe] [Nero AG, 4, 3, 11, 6]
[C:\Program Files\Ahead\InCD\InCdApi.dll] [Nero AG, 4, 3, 11, 6]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Ahead\Lib\DriveLocker.dll] [Ahead Software AG, 1, 0, 0, 17]
[C:\Program Files\Ahead\InCD\incdshx.dll] [Nero AG, 4, 3, 11, 6]
[PID: 1444][C:\Program Files\MSN Messenger\MsnMsgr.Exe] [Microsoft Corporation, 7.0.0816]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\msdmo.dll] [N/A, N/A]
[PID: 1452][C:\WINNT\system32\ctfmon.exe] [Microsoft Corporation, 1.00.2409.7 built by: Lab06_N]
[PID: 1468][C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe] [N/A, N/A]
[C:\Program Files\Sony Corporation\Image Transfer\SonyTray.dll] [N/A, N/A]
[PID: 1540][C:\WINNT\system32\taskmgr.exe] [Microsoft Corporation, 5.00.2195.6620]
[C:\WINNT\system32\FOURIER_M1.IME] [北京紫光华宇软件股份有限公司, 4.0.0.5001]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[PID: 1260][C:\WINNT\explorer.exe] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\WINNT\system32\NOVNPNT.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\MAPBASE.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSHLXNT.dll] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL] [Novell, Inc., v4.83]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\WINNT\Downloaded Program Files\859845\ExDLL.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\WebPageParser.dll] [N/A, N/A]
[C:\WINNT\system32\Charset.dll] [N/A, N/A]
[C:\WINNT\system32\CreateDomTree.dll] [N/A, N/A]
[C:\WINNT\Downloaded Program Files\859845\fshook.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]

ogim - 2006-11-9 18:56:00

[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\ALSNDMGR.CPL] [Realtek Semiconductor Corp., 2.2.25]
[C:\WINNT\system32\styleman.cpl] [Autodesk, Inc., 8.0.16.86]
[C:\WINNT\system32\plotman.cpl] [Autodesk, Inc., 8.0.16.86]
[PID: 1608][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\WINNT\system32\deskipn.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\WINNT\system32\NOVNPNT.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\MAPBASE.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSHLXNT.dll] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL] [Novell, Inc., v4.83]
[PID: 1688][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\WINNT\system32\deskipn.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NOVNPNT.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\CALWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLXWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\MAPBASE.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSHLXNT.dll] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\MAPBASER.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NLS\ENGLISH\NWSHLXNR.DLL] [N/A, N/A]
[C:\WINNT\system32\NLS\ENGLISH\NOVNPNTR.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[PID: 1148][C:\Program Files\Ringz Studio\Storm Codec\mplayerc.exe] [Gabest, 6, 4, 8, 3]
[C:\WINNT\system32\msdmo.dll] [N/A, N/A]
[C:\Program Files\Common Files\Ahead\DSFilter\NDParser.ax] [Nero AG, 3, 2, 0, 0]
[C:\WINNT\system32\ffdshow.ax] [N/A, 1, 0, 0, 1]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll] [N/A, N/A]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] [Gabest, 1, 0, 0, 9]
[C:\Program Files\Common Files\Ahead\DSFilter\NeVideo.ax] [Nero AG, 3, 2, 0, 0]
[C:\Program Files\Common Files\Ahead\Lib\AdvrCntr.dll] [Ahead Software AG, 1,2,2, 2279]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\mpeg2dmx.ax] [Moonlight Cordless Ltd., 3, 1, 190, 41018]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\RMSplt.ax] [Gabest, 1, 0, 0, 9]
[C:\Program Files\Common Files\Ahead\DSFilter\NeAudio.ax] [Ahead Software AG and its licensors, 3, 2, 0, 0]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\MP4Demux.ax] [Moonlight Cordless Ltd., 1, 0, 5, 41110]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\AMRDec.ax] [Moonlight Cordless Ltd, 0, 0, 1, 40816]
[C:\Program Files\PIXELA\ImageMixer\MPG2SPPX.AX] [PiXELA Corp., 1, 0, 1, 4]
[C:\Program Files\Ringz Studio\Storm Codec\Codecs\OGGSplt.ax] [Gabest, 1, 0, 0, 0]
[PID: 1340][C:\WINNT\system32\mshta.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[PID: 1712][D:\tools\sreng最新版\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[C:\WINNT\system32\netware\NWWS2NDS.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NETWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\CLNWIN32.DLL] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\LOCWIN32.DLL] [Novell, Inc., 5.4.20]
[C:\WINNT\system32\NCPWIN32.dll] [Novell, Inc., 5.5.8]
[C:\WINNT\system32\netware\NWWS2SLP.DLL] [Novell, Inc., v4.83]
[C:\WINNT\system32\NWSRVLOC.dll] [Novell, Inc., v4.83]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS Error. [超级解霸3000]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

ogim - 2006-11-9 18:59:00

。。。

ogim - 2006-11-9 19:04:00

这个我着急呢!

秋日里的蓝天 - 2006-11-9 19:12:00

结束进程
C:\WINNT\TEMP\CP8DFC.EXE

重新启动电脑，自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）

运行(双击)SRENG2，点“启动项目，服务，点“驱动程序”
勾选“隐藏已认证的微软项目”选中病毒服务
699145
w
选择“删除服务”
点“设置”选择“否”

关闭所有浏览窗口以及一些不必要的程序
运行SREng2,使用“启动项目”－－注册表－－选中以下的项删除
C:\WINNT\system32\rundll32.exe "C:\WINNT\system32\NTService32.dll
C:\Program Files\DriverDownload\DriverDownloader.exe
RunDll32 "C:\WINNT\Downlo~1\rx7k.dll
RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
RunDll32 "C:\WINNT\system32\IeBar.dll

显示隐藏文件
删除：
C:\WINNT\System32\drivers\699145.sys
C:\WINNT\system32\drivers\add_sys.sys
C:\WINNT\system32\NTService32.dll
C:\Program Files\DriverDownload\DriverDownloader.exe
C:\WINNT\Downlo~1\rx7k.dll
C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
C:\WINNT\system32\IeBar.dll

卸载掉:中搜在线

ogim - 2006-11-9 19:59:00

秋天。有几个模糊的地方。
1。RunDll32 "C:\WINNT\Downlo~1\SearchNet\SrvNet32.dll
删除不了。我是在CMD下删除的。提示拒绝访问。还有这个也删除不了 C:\WINNT\system32\NTService32.dll
2。找不到
C:\Program Files\DriverDownload\DriverDownloader.exe
699145
w服务。

昨夜西风凋碧树 - 2006-11-9 20:31:00

SrvNet32.dll
这个病毒的查杀办法,运行msconfig,察看启动里面是不是有这个病毒相关的启动,还有搞不清楚的,最好都去掉,

然后进入注册表查找病毒关键字的键值,也删除,删之前做好备份,

最后重启进入安全模式查找病毒文件删除,或者进入dos删除,

这样几步下来应该差不多了,实在不行只能重新安装系统了

ogim - 2006-11-9 21:21:00

还不至于到这个份上！

瑞星卡卡安全论坛