高手帮忙！！！ bbs.ikaka.com

我若醉爱 - 2006-11-24 12:04:00

我用冰刃的ssdt察看，看见几乎全部是红色的大多是模块safemon.sys和systemroot\system32\drivers\klif.sys几乎全部是红色的阿！！！！为什么，怎么办啊，机器很慢阿

红夜鬼1 - 2006-11-24 12:13:00

请下载SREng2（最新版），使用“智能扫描”，按下“扫描”按钮进行扫描，
扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告
日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。

下载地址
http://www.kztechs.com/sreng/sreng2.zip

我若醉爱 - 2006-11-24 12:26:00

【回复“红夜鬼1”的帖子】
2006-11-24,12:09:55

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><Internat.exe> [(Verified)Microsoft Corporation]
<msnmsgr><"C:\Program Files\MSN Messenger\msnmsgr.exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Corporation]
<Zone Labs Client><C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe> [(Verified)Computer Associates]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize> [Kaspersky Lab]
<MINI_BFYY><C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe> [深圳市三代科技开发有限公司]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]

==================================

我若醉爱 - 2006-11-24 12:27:00

启动文件夹
N/A

==================================
服务
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINNT\system32\drivers\CDAC11BA.EXE><Macrovision>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[ewido anti-malware 4.0 guard / ewido anti-malware 4.0 guard]
<C:\Program Files\ewido anti-malware 4.0\guard.exe><N/A>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"><Kaspersky Lab>
[Internet Protect Service / MOVEESS]
<C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE C:\WINNT\SYSTEM32\WBEM\NHQWAC89.DLL,Export 1087><N/A>
[Distributed Console Manager / NtStub]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\okowfk27.dll><Microsoft Corporation>
[TrueVector Internet Monitor / vsmon]
<C:\WINNT\system32\ZONELABS\vsmon.exe -service><Zone Labs, LLC>
[Portable Media Serial Number Service / WmdmPmSN]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[ati2mtag / ati2mtag]
<system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[CdaC15BA / CdaC15BA]
<\??\C:\WINNT\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[cdnprot / cdnprot]
<\SystemRoot\system32\drivers\cdnprot.sys><中国互联网络信息中心(CNNIC)>
[Cdr4_2K / Cdr4_2K]
<C:\WINNT\SYSTEM32\DRIVERS\Cdr4_2K.SYS><Roxio>
[Cdralw2k / Cdralw2k]
<C:\WINNT\SYSTEM32\DRIVERS\Cdralw2k.SYS><Roxio>
[dmboot / dmboot]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ewido anti-malware 4.0 driver / ewido anti-malware 4.0 driver]
<\??\C:\Program Files\ewido anti-malware 4.0\guard.sys><N/A>
[Kl1 / Kl1]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[Klif / Klif]
<System32\drivers\klif.sys><Kaspersky Labs>
[Klmc / Klmc]
<System32\drivers\klmc.sys><Kaspersky Lab>
[KWATCH / KWATCH]
<\??\C:\KAV2003\KWATCH.SYS><N/A>
[npkcrypt / npkcrypt]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[WAN 微型端口 (PPP over Ethernet 协议) / RMSPPPOE]
<system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029]
<System32\DRIVERS\RTL8029.SYS><REALTEK Semiconductor Corp.>
[System Safety Monitor 2.0 Core Engine / safemon]
<\SystemRoot\system32\drivers\safemon.sys><System Safety Limited>
[StarForce Protection Environment Driver (version 1.x) / sfdrv01]
<\SystemRoot\System32\drivers\sfdrv01.sys><Protection Technology>
[StarForce Protection Helper Driver (version 2.x) / sfhlp02]
<\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology>
[StarForce Protection Synchronization Driver (version 2.x) / sfsync02]
<\SystemRoot\System32\drivers\sfsync02.sys><Protection Technology>
[sptd / sptd]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[Audio Driver (WDM) - SigmaTel CODEC / STAC97]
<system32\drivers\STAC97.sys><SigmaTel, Inc.>
[SVKP / SVKP]
<\??\C:\WINNT\system32\SVKP.sys><AntiCracking>

==================================

我若醉爱 - 2006-11-24 12:27:00

浏览器加载项
[Cdn Class]
{471A662A-4030-42BC-B632-758700A64DB9} <C:\PROGRA~1\cdnpack\cdncn.dll, CNNIC>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <C:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\Program Files\Kingsoft\FastAIT 2005\IEBand.dll, 金山软件股份有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[FavImport Class]
{30CADB40-6FD7-433F-BF0D-4827CA7B5BDF} <C:\WINNT\Downloaded Program Files\ImportAx.dll, Microsoft Corp.>
[MSN Photo Upload Tool]
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINNT\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[DigitalTrafic Control]
{7FC22A16-79E6-4787-9C96-B6359BB1106D} <C:\WINNT\DOWNLO~1\DIGITA~1.OCX, Broad-way>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.>
[&使用暴风下载器下载]
<C:\Program Files\Ringz Studio\Storm Downloader\geturl.htm, N/A>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[&使用迷你迅雷下载]
<C:\Program Files\Thunder Network\ThunderMini\Program\GetUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================

我若醉爱 - 2006-11-24 12:28:00

正在运行的进程
[PID: 228][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 252][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 248][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[PID: 304][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 316][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011]
[PID: 492][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 520][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[C:\WINNT\system32\CNMLM3y.DLL] [CANON INC., 1.52.2.0]
[C:\WINNT\system32\spool\PRTPROCS\W32X86\CNMPD3y.DLL] [CANON INC., 1.52.2.0]
[PID: 548][C:\WINNT\system32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020]
[PID: 572][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 592][C:\Program Files\ewido anti-malware 4.0\guard.exe] [N/A, 4, 0, 0, 10]
[C:\Program Files\ewido anti-malware 4.0\engine.dll] [ewido networks GmbH & Co. KG, 4, 0, 0, 7]
[PID: 700][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.6701]
[PID: 720][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6972]
[PID: 816][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[PID: 836][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 980][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 0, 0, 2]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[PID: 1188][C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe] [深圳市三代科技开发有限公司, 1, 1, 0, 4]
[C:\Program Files\Ringz Studio\Storm Downloader\boost_thread-vc6-mt-1_31.dll] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 0, 0, 2]
[PID: 1192][C:\WINNT\system32\Internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 0, 0, 2]
[PID: 1172][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 0, 0, 2]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\PROGRA~1\cdnpack\cdncn.dll] [CNNIC, 1, 0, 0, 7]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[C:\WINNT\system32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0]
[PID: 1368][D:\bt\BitComet\BitComet\BitComet\BitComet.exe] [www.BitComet.com, 0.68]
[C:\WINNT\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrchpg.dll] [Kaspersky Lab, 5.0.1.18]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\scrch_ag.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\FSSync.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\pr_rmt.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ccclient.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\klipc.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\KLUtil.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\rpt.dll] [Kaspersky Lab, 5.0.388.2]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\CCIFACE.dll] [Kaspersky Lab, 5.0.388.1]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prloader.dll] [Kaspersky Lab, 5.0.388.0]
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\prkernel.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\prstring.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_srv.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\pr_clnt.ppl] [Kaspersky Lab, 5.0.388.0]
[c:\program files\kaspersky lab\kaspersky anti-virus personal pro\tempfile.ppl] [Kaspersky Lab, 5.0.388.0]
[PID: 1164][C:\TDdownload\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]

==================================

我若醉爱 - 2006-11-24 12:28:00

文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [AutoCADScriptFile]
.CHM Error. ["hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

我若醉爱 - 2006-11-24 12:30:00

红夜鬼！！！帮忙阿！万分感谢

红夜鬼1 - 2006-11-24 12:36:00

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
Internet Protect Service
Distributed Console Manager
，选择“删除服务”
点“设置”选择“否”
重启按F８进入安全模式下
显示隐藏文件
删除：
C:\WINNT\SYSTEM32\RUNDLLFROMWIN2000.EXE
C:\WINNT\SYSTEM32\WBEM\NHQWAC89.DLL
C:\WINNT\system32\okowfk27.dll

瑞星卡卡安全论坛