瑞星卡卡安全论坛
我是杉木 - 2006-11-25 10:05:00
发现木马病毒 Trojan.rootkit49152.d
C:\WINDOWS\system32\wjuajv20.dll
这个程序我复制不了，我停了很多进程后，只留下系统进程，发现还是复制不了。猜想，这个病毒估计已经帮定系统进程运行的。唉！！
然后过一段时间在在C:\WINDOWS\system32\ 下建立一个perfstringBackup.TMP的文件
不知道干吗用的。
木马清道夫也杀不了，杀了又自身启动，很强的病毒！！！
请帮忙了。。。
[img][/img]
附件:
7076012006112595642.JPG
我是杉木 - 2006-11-25 10:06:00
下面那个LOG文件也不知道是如何生成的、
newcenturymoon - 2006-11-25 10:07:00
rookit病毒
下载 System Repair Engineer，
http://www.kztechs.com/sreng/sreng2.zip
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
我是杉木 - 2006-11-25 10:14:00
2006-11-25,10:01:14
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe> [(Verified)Symantec Corporation]
<IRUSERSUR><C:\PROGRA~1\IRESEA~1\ICLICK\iResearchiClick.exe -d 150> [iResearch]
<\\6020f8bbf2b64e4\EPSON Stylus C67 Series><C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE /P41 "\\6020f8bbf2b64e4\EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<DAEMON Tools-2052><"D:\Program Files\D-Tools\daemon.exe" -lang 2052> [DAEMON'S HOME]
<QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<Windows木马防火墙><D:\TDDownload\Trojanwall_8.8\ftcsetup\Trojanwall.exe> [风云谷]
<bikcnj10><C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\bikcnj10.dll,DllCanUnloadNow> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [(Verified)Symantec Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<AGRSMMSG><; AGRSMMSG.exe> [(Verified)Agere Systems]
<Apoint><; C:\Program Files\Apoint2K\Apoint.exe> [(Verified)Alps Electric Co., Ltd.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<bgswitch><; C:\WINDOWS\system32\bgswitch.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<BigDogPath><; C:\WINDOWS\VM_STI.EXE USB PC Camera 301P> [N/A]
<bikcnj10><; C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\bikcnj10.dll,DllCanUnloadNow> [Microsoft Corporation]
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [(Verified)Symantec Corporation]
<ClientQyule><; C:\Program Files\Qyule\Qyule.exe -autostart> [N/A]
<Cpqset><; C:\Program Files\HPQ\Default Settings\cpqset.exe> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<eabconfg.cpl><; C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start> [Hewlett-Packard ]
<HotKeysCmds><; C:\WINDOWS\system32\hkcmd.exe> [(Verified)Intel Corporation]
<IgfxTray><; C:\WINDOWS\system32\igfxtray.exe> [(Verified)Intel Corporation]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<iTunesHelper><; "C:\Program Files\iTunes\iTunesHelper.exe"> [Apple Computer, Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<QuickTime Task><; "C:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<SoundMAX><; C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray> [Analog Devices, Inc.]
<SoundMAXPnP><; C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<updateMgr><; D:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<WatchDog><; C:\Program Files\InterVideo\DVD Check\DVDCheck.exe> [InterVideo Inc.]
<WG511WLU><; C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe -hide> [ ]
<Windows木马防火墙><; D:\TDDownload\cr-ftcsetup\Trojanwall_8.8\ftcsetup\Trojanwall.exe> [N/A]
<YOKAssiant><; Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<恢复BOOT菜单><; c:\windows\BOOT-hf.exe> [N/A]
==================================
我是杉木 - 2006-11-25 10:15:00
启动文件夹
N/A
==================================
服务
[ASP.NET State Service / aspnet_state]
<C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[BlueSoleil Hid Service / BlueSoleil Hid Service]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[HP WMI Interface / hpqwmi]
<C:\Program Files\HPQ\SHARED\HPQWMI.exe><Hewlett-Packard Development Company, L.P.>
[InstallDriver Table Manager / IDriverT]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService]
<C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[Pml Driver HPZ12 / Pml Driver HPZ12]
<C:\WINDOWS\system32\HPZipm12.exe><HP>
[SavRoam / SavRoam]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[User Profile Hive Cleanup / UPHClean]
<C:\Program Files\UPHClean\uphclean.exe><Microsoft Corporation>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
<system32\drivers\ac97intc.sys><Intel Corporation>
[aeaudio / aeaudio]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Agere Systems Soft Modem / AgereSoftModem]
<system32\DRIVERS\AGRSM.sys><Agere Systems>
[AliIde / AliIde]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Alps Pointing-device Filter Driver / ApfiltrService]
<system32\DRIVERS\Apfiltr.sys><Alps Electric Co., Ltd.>
[AWINDIS5 Protocol Driver / AWINDIS5]
<\??\C:\WINDOWS\system32\AWINDIS5.SYS><AMBIT Microsystems Corporation.>
[bikcnj1 / bikcnj10]
<\SystemRoot\System32\DRIVERS\bikcnj10.sys><Microsoft Corporation>
[Bluetooth Audio Service / BlueletAudio]
<system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[Bluetooth PAN Network Adapter / BT]
<system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth USB For Bluetooth Service / Btcsrusb]
<System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth HID Enumerator / BTHidEnum]
<system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[BVRPMPR5 NDIS Protocol Driver / BVRPMPR5]
<\??\F:\INSTAL~E\Core\BVRPMPR5.SYS><N/A>
[CdaC15BA / CdaC15BA]
<\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd>
[CmdIde / CmdIde]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[d347bus / d347bus]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[eabfiltr / eabfiltr]
<\??\C:\WINDOWS\system32\drivers\EABFiltr.sys><Hewlett-Packard Company>
[eabusb / eabusb]
<\??\C:\WINDOWS\system32\drivers\eabusb.sys><Hewlett-Packard Company>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[GEARAspiWDM / GEARAspiWDM]
<System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[ialm / ialm]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[WPA Security Protocol (IEEE 802.1x) v2.2.0.0 / MDC8021X]
<system32\DRIVERS\mdc8021x.sys><Meetinghouse Data Communications>
[MegaIDE / MegaIDE]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MidiSyn / MidiSyn]
<system32\drivers\MidiSyn.sys><Analog Devices Inc>
[mywiege / mywiegem]
<\SystemRoot\System32\DRIVERS\mywiegem.sys><Microsoft Corporation>
[NAVENG / NAVENG]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\naveng.sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\navex15.sys><Symantec Corporation>
[npkcrypt / npkcrypt]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NPPTNT2 / NPPTNT2]
<\??\C:\WINDOWS\system32\npptNT2.sys><INCA Internet Co., Ltd.>
[nv / nv]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Pnpnt / Pnpnt]
<\SystemRoot\System32\Drivers\pnpnt.sys><N/A>
[NETGEAR WG511 Wireless LAN Driver / PRISM_ICB]
<system32\DRIVERS\WG511ICB.sys><Conexant Systems, Inc.>
[Direct Parallel Link Driver / Ptilink]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[SAVRT / SAVRT]
<\??\C:\Program Files\Symantec AntiVirus\savrt.sys><Symantec Corporation>
[SAVRTPEL / SAVRTPEL]
<\??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys><Symantec Corporation>
[Secdrv / Secdrv]
<system32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt]
<system32\drivers\senfilt.sys><Sensaura>
[smwdm / smwdm]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[SymEvent / SymEvent]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV]
<\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI]
<\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[tifm21 / tifm21]
<system32\drivers\tifm21.sys><Texas Instruments>
[Virtual Serial port driver / VComm]
<system32\DRIVERS\VComm.sys><IVT Corporation>
[Bluetooth VComm Manager Service / VcommMgr]
<System32\Drivers\VcommMgr.sys><IVT Corporation>
我是杉木 - 2006-11-25 10:15:00
==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Google Toolbar Helper]
{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[启动迅雷]
{0062C9BD-B349-40DE-91A0-755F37ACD559} <d:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[微软]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.microsoft.com/china/index.htm, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[PGEdit Class]
{2BFAA61B-5C83-4865-8281-D8BDBF863061} <C:\WINDOWS\Downloaded Program Files\PG_ATL_Edit.dll, 银联网络支付集团有限公司>
[Google Script Object]
{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[QuickTime Object]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, Microsoft Corp.>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[IETag Factory]
{38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[MediaComm Class]
{7670648D-461B-42AF-BDFE-46D26AF5EFF2} <d:\Program Files\Thunder Network\Thunder\Components\InMedia\MediaAddin07.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Google Toolbar Helper]
{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>
[PRBHO.HTMLDocumentCtrl]
{AAC73F50-03DD-47E5-AD18-FDD65BF29E3D} <C:\WINDOWS\system32\ZComBHO.dll, zcom>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Microsoft DirectAnimation Control]
{B6FFC24C-7E13-11D0-9B47-00C04FC2F51D} <C:\WINDOWS\system32\danim.dll, Microsoft Corporation>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Adobe Acrobat 7.0 Browser Document]
{CA8A9780-280D-11CF-A24D-444553540000} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroPDF.dll, Adobe Systems, Inc.>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<d:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<d:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[Google 搜索(&G)]
<res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用影音传送带下载]
<C:\Program Files\Xi\NetTransport 2\NTAddLink.html, N/A>
[使用影音传送带下载全部链接]
<C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A>
[反向链接]
<res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html, N/A>
[在Foxmail中添加该RSS频道/频道组]
<res://C:\WINDOWS\system32\fmrsslink.dll/201, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[珊瑚虫搜索]
<C:\Program Files\YOK.com\SuperSearch\yoksch.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[类似网页]
<res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html, N/A>
[缓存的网页快照]
<res://c:\program files\google\GoogleToolbar2.dll/cmcache.html, N/A>
[翻译英文字词(&T)]
<res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html, N/A>
我是杉木 - 2006-11-25 10:17:00
正在运行的进程
[PID: 588][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 640][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 668][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\NavLogon.dll] [Symantec Corporation, 9.0.0.338]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 712][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 724][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 868][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 936][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 992][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1140][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1180][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1284][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] [Symantec Corporation, 2.2.0.577]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 2.2.0.577]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1336][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] [Symantec Corporation, 2.2.0.577]
[C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] [Symantec Corporation, 2.2.0.577]
[C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] [Symantec Corporation, 2.2.0.577]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1468][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\HPLTLM5.DLL] [Hewlett-Packard Corporation, Microsoft Corporation, v6.04]
[C:\WINDOWS\system32\HPBMMON.DLL] [Hewlett-Packard, 10.00.16]
[C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00]
[C:\WINDOWS\system32\HPBHealr.dll] [N/A, N/A]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\HPPRN05.DLL] [Hewlett-Packard Corporation, 60.05.72.21]
[C:\WINDOWS\system32\hppadt40.dll] [HP, 10, 1, 0, 2]
[C:\WINDOWS\system32\HPZidr12.dll] [HP, 10, 1, 1, 2]
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FUICAAP.DLL] [SEIKO EPSON CORP., 0. 3. 40, 33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
我是杉木 - 2006-11-25 10:17:00
[PID: 1724][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, N/A]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1764][C:\WINDOWS\system32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1820][C:\Program Files\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 9.0.0.338]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1864][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 9.0.0.338]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll] [Autodesk, 16.0.0.86]
[PID: 1924][C:\WINDOWS\system32\HPZipm12.exe] [HP, 10, 1, 1, 2]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1952][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1976][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 2028][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 9.0.0.338]
[C:\WINDOWS\system32\CBA.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\MsgSys.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\NTS.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\PDS.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] [Symantec Corp., 1.1.0.3]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\ecmsvr32.dll] [Symantec Corporation, 61.3.0.18]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\NAVEX32a.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\NAVENG32.DLL] [Symantec Corporation, 20061.3.0.12]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\Program Files\Symantec AntiVirus\IMail.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\vpmsece.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\DecSDK.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ID.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2SS.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2Text.dll] [Symantec Corporation, 3.02.11.32]
[PID: 488][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 608][C:\PROGRA~1\SYMANT~1\VPTray.exe] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 9.0.0.338]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
我是杉木 - 2006-11-25 10:18:00
[PID: 1724][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, N/A]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1764][C:\WINDOWS\system32\drivers\CDAC11BA.EXE] [Macrovision, 4.20.020]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1820][C:\Program Files\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 9.0.0.338]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1864][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 9.0.0.338]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll] [Autodesk, 16.0.0.86]
[PID: 1924][C:\WINDOWS\system32\HPZipm12.exe] [HP, 10, 1, 1, 2]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1952][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1976][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 2028][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 9.0.0.338]
[C:\WINDOWS\system32\CBA.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\MsgSys.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\NTS.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\PDS.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] [Symantec Corp., 1.1.0.3]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\ecmsvr32.dll] [Symantec Corporation, 61.3.0.18]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\NAVEX32a.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061122.019\NAVENG32.DLL] [Symantec Corporation, 20061.3.0.12]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\Program Files\Symantec AntiVirus\IMail.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\vpmsece.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\DecSDK.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ID.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2SS.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2Text.dll] [Symantec Corporation, 3.02.11.32]
[PID: 488][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 608][C:\PROGRA~1\SYMANT~1\VPTray.exe] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 9.0.0.338]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
我是杉木 - 2006-11-25 10:18:00
[PID: 880][C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE] [SEIKO EPSON CORPORATION, 4.00]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1096][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3536]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1212][C:\Program Files\UPHClean\uphclean.exe] [Microsoft Corporation, 1.5.5.21]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 1496][D:\TDDownload\Trojanwall_8.8\ftcsetup\Trojanwall.exe] [风云谷, 4.7.0.1405]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ftcapi.dll] [fygsoft, 1.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[PID: 1524][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 3716][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 2624][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\WINDOWS\system32\AcSignIcon.dll] [Autodesk, 16.0.0.86]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400]
[C:\Program Files\Common Files\CPUSH\cpush.dll] [N/A, 1.0.1.9]
[d:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[c:\program files\google\googletoolbar2.dll] [Google Inc., 3, 0, 131, 0]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] [Autodesk, 16.0.0.86]
[C:\WINDOWS\system32\PYJJU.IME] [北京六合正邦信息技术有限公司, 2, 2, 0, 5]
[d:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent_003.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
[PID: 1920][C:\WINDOWS\system32\PYINTAU.EXE] [北京六合正邦信息技术有限公司, 2, 2, 1, 5]
[C:\WINDOWS\system32\PYCODEU.dll] [北京六合正邦信息技术有限公司, 2, 2, 0, 5]
[C:\WINDOWS\system32\PYJJCZU.dll] [北京六合正邦信息技术有限公司, 2, 2, 0, 5]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 2248][C:\WINDOWS\system32\RUNDLL32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\PROGRA~1\COMMON~1\CPUSH\cpush.dll] [N/A, 1.0.1.9]
[PID: 2756][D:\AutoCAD 2004\acad.exe] [Autodesk, Inc., R16.00.086]
[C:\Program Files\Common Files\Autodesk Shared\ac1st16.dll] [Autodesk, Inc., 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\acdb16.dll] [Autodesk, Inc., 16.0.0.86]
[C:\Program Files\Common Files\Autodesk Shared\AcGe16.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\acui16.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\ANav.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\adui16.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\dswhip.dll] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\heidi8.dll] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\dlint8.dll] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\SFTTABAC.dll] [Softel vdm, 16.0.0.86]
[D:\AutoCAD 2004\UserData.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\adlmdll.dll] [Autodesk, Inc., 4.0.0.2]
我是杉木 - 2006-11-25 10:18:00
[D:\AutoCAD 2004\adctrls.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\adui16res.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\AnavRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\acui16res.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\DsWhipRes.dll] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\sfttabacRes.dll] [Softel vdm, 16.0.0.86]
[C:\DOCUME~1\new\LOCALS~1\Temp\~ef37eb\~df394b.tmp] [N/A, N/A]
[C:\DOCUME~1\new\LOCALS~1\Temp\~ef37eb\~de8c3a.tmp] [N/A, 2.20.020]
[D:\AutoCAD 2004\ADCtrlsRes.dll] [Autodesk, Inc., 16.0.0.86]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[D:\AutoCAD 2004\acadbtn.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\acadres.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\adlmres.dll] [Autodesk, Inc., 4.0.0.2]
[D:\AutoCAD 2004\PrxyInet.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\PrxyInetRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\oleaprot.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\colorRes.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\drv\gdi8.hdi] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\drv\gdi8Res.dll] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\drv\szb8.hdi] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\drv\rblast8.hdi] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\drv\gdifont8.hdi] [Autodesk, Inc., 8.0.16.86]
[d:\AutoCAD 2004\acgs.dll] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\acgsRes.dll] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\hcreg8.dll] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\hcreg8Res.dll] [Autodesk, Inc., 8.0.16.86]
[D:\AutoCAD 2004\vl.arx] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\VLMSG.DLL] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\VLLIB.DLL] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\AcApp.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcDblClkEdit.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcDblClkEditPE.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcDblClkEditRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\acdim.arx] [, 16.0.0.86]
[D:\AutoCAD 2004\ShareAC.dll] [Autodesk, Inc, 16.0.0.86]
[D:\AutoCAD 2004\ShareMFC.dll] [Autodesk, Inc, 16.0.0.86]
[D:\AutoCAD 2004\AcDimRes.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\aceplotx.arx] [Autodesk, 16.0.0.86]
[c:\program files\common files\autodesk shared\achapi16.dbx] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\AcEplotXRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\achlnkui.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\achlnkuiRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcIDropMgr.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcIDropMgrRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcLayerP.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcLayerPRes.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\AcSign.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcSignRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcSpaceTrans.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcSpaceTransRes.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\AcStd.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcStStdRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcTp.arx] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcTc.DLL] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcTcUi.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcTcRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\AcTcUiRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\whohas.arx] [, 16.0.0.86]
[D:\AutoCAD 2004\whohasRes.dll] [, 16.0.0.86]
[D:\AutoCAD 2004\Express\Fscreen.arx] [ , 1, 0, 0, 1]
[D:\AutoCAD 2004\acetlodr.arx] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\Express\MoveBak.arx] [Autodesk, Inc., 2.00]
[D:\AutoCAD 2004\express\Acetutil.arx] [Autodesk, Inc., 1.38]
[d:\autocad 2004\express\Acetutil.dll] [Autodesk, Inc., 2.38]
[D:\AutoCAD 2004\WSCommCntrAcCon.arx] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\WSCommCntrAcConRes.dll] [Autodesk, 16.0.0.86]
[D:\AutoCAD 2004\vlcom.dll] [Autodesk Inc., 16.0.0.86]
[D:\AutoCAD 2004\vlreac.dll] [Autodesk, Inc., 16.0.0.86]
[D:\AutoCAD 2004\axdb16.dll] [N/A, N/A]
[C:\DOCUME~1\new\LOCALS~1\Temp\~e5d141.tmp] [Macrovision Europe Ltd., 1, 0, 0, 1]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[PID: 3148][C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe] [Autodesk, Inc., 1.0.0.1]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[C:\Program Files\Common Files\Autodesk Shared\WebServices1.dll] [Autodesk, Inc., 1.0.0.1]
[PID: 2152][d:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe] [Thunder Networking Technologies,LTD, 5.4.0.226]
[d:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
[d:\Program Files\Thunder Network\Thunder\Program\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
[d:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll] [STLport Consulting, Inc., 4.6.2003.1031]
[d:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll] [, 1, 0, 2, 1]
[d:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll] [N/A, N/A]
[d:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
[d:\Program Files\Thunder Network\Thunder\Program\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
[d:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 1, 0, 18]
[d:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll] [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll] [ , 1, 0, 0, 11]
[d:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed04.dll] [ , 2, 3, 0, 37]
[d:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll] [Thunder Networking Technologies,LTD, 1, 0, 4, 10]
[d:\Program Files\Thunder Network\Thunder\Program\iTargetAd.dll] [Thunder Networking Technologies,LTD, 1, 0, 1, 59]
[C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx] [Adobe Systems, Inc., 9,0,16,0]
[PID: 928][C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.594\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\ProcessHook.dll] [Fygsoft and Microsoft, 1.0.0.33]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\Filehook.dll] [Fygsoft and Microsoft, 2.0.0.0]
[D:\TDDownload\Trojanwall_8.8\ftcsetup\SocketMon.dll] [Fygsoft and Microsoft, 1.1.0.0]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
我是杉木 - 2006-11-25 10:20:00
rer发完了，发现最后那个文件关联有问题，CHM都关联了HH.EXE
我是杉木 - 2006-11-25 10:33:00
我的首页http://www.my123.com/，改都改不了，
改为空后，自动改成http://www.my123.com/
newcenturymoon - 2006-11-25 10:36:00
my123是个特别难对付的病毒
下载卡卡安全助手 3.0试试
灭情至尊 - 2006-11-25 11:43:00
支持楼上的，再下个木马杀客
我是杉木 - 2006-11-25 13:45:00
附件是病毒 请大虾看看
由于不能够上传文件，我把RAR格式改成JPG，请大虾改好后就可以看到压缩文件夹里面的病毒文件了
附件:
70760120061125133653.jpg
applechen - 2006-11-25 15:28:00
| 引用: |
【灭情至尊的贴子】支持楼上的，再下个木马杀客
……………… |
木马杀客误报太多了,还敢用?
我是杉木 - 2006-11-26 9:37:00
呀？？就没人理会了？？
♂折翼天使♀ - 2006-11-26 10:06:00
my123它有个驱动保护，用这个方法试试
1.找出驱动
下载auturuns
地址 http://down1.tech.sina.com.**/*ownload/downContent/2004-09-13/11464.shtml
运行autoruns之后，在它的“Options(选项）”菜单中有两项“Verifiy Code Signatures（验证代码签名）“Hide Signed Microsoft Entries（隐藏已签名的微软项）“，把这两项都选中了。
然后点击 Drivers选项卡 按F5键刷新
关于my123的驱动是一个伪造的微软驱动 注意病毒名是随机的 规律是一般是8个随机数字或字母组成 最后两个一般是数字 记下这个驱动的文件名 我这里是pxvxou38.sys
也可以用360安全卫士出的专杀找出病毒驱动
http://dl.360safe.com/MY123Killer2.rar
再使用手工和专杀 综合起来查杀
2.下载Proces* **plorer
地址 http://www.onlinedown.net/soft/31805.htm
打开Proces* **plorer
菜单栏 点击查找－句柄或Dll
在搜索框中输入那个驱动的名称 我这里是pxvxou38.sys
搜索出来了
单击那个搜索结果 软件会自动定位到那个 驱动的位置
然后在那个上面点右键——关闭句柄
然后同理 查找与那个启动同名的dll文件 我这里便是pxvxou38.dll
在搜索框中输入那个dll文件的名称
此时会出现两个结果 一个是system 一个是explorer.exe (这个可能会有不同 有的是rundll32加载）
单击那个搜索结果中的system 软件会自动定位到那个 dll的位置
然后在那个上面点右键——关闭句柄
3.打开任务管理器 结束刚才那个dll加载的另外一个进程 我这里是explorer.exe
然后 依次点击 文件－新建任务 浏览 在浏览对话框中找到 那两个文件 一般sys在C:\windows\system32\drivers下
dll在C:\windows\system32 右键删除掉他们
4.开始 运行 输入regedit
依次展开HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00X\Services (X代表任意 比如1,2,3,4...)
查找与那两个 文件同名的文件夹 我这里便是pxvxou38
右键删除掉整个文件夹
5.但是测试过程中发现我的方法有时候重启后又出现了 所以再加一步
http://dl.360safe.com/MY123Killer2.rar
和http://www.arswp.com/
下载这两个工具
重启计算机
重启后用这两个工具杀一遍
6.右键单击 IE浏览器 属性 Intenet文件 删除文件 在删除所有脱机内容上挑构 确定
然后 把主页修改过来
7.此时这个病毒应该被完全干掉了 并且不会出现 加载dll错误的情况
最后祝你成功！！！！！！！
1
© 2000 - 2026 Rising Corp. Ltd.