大虾们过来看看,开机时老是自动运行rundl132.exe，速度特慢,有扫描报告 bbs.ikaka.com

ly4171 - 2006-12-12 8:49:00

前段时间中了w32.looked.0和w32.looded.ah病毒，后面使用杀毒软件(12.1更新）杀了好几遍，现在查不到病毒了，但开机时老是自动运行C:\WINDOWS\uninstall\rundl132.exe.速度好慢，老半天才打开一个文件，只见硬盘响，不见文件开.哪位大虾指点一下？
扫描报告如下:
2006-12-12,08:28:13

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 非管理权限用户 - 受限功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation]
<ccApp><; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"> [Symantec Corporation]
<vptray><; C:\PROGRA~1\SYMANT~1\VPTray.exe> [Symantec Corporation]
<load><C:\WINDOWS\uninstall\rundl132.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
<WinlogonNotify: NavLogon><C:\WINDOWS\system32\NavLogon.dll> [Symantec Corporation]

ly4171 - 2006-12-12 8:54:00

==================================
启动文件夹
[FortuneDate]
<C:\Documents and Settings\saca201\「开始」菜单\程序\启动\FortuneDate.lnk><N>

==================================
服务
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[LiveUpdate / LiveUpdate]
<"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[SavRoam / SavRoam]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec SPBBCSvc / SPBBCSvc]
<"C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[VNC Server Version 4 / WinVNC4]
<"C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service><RealVNC Ltd.>

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Office file\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\Office file\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <D:\Office file\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<D:\Office file\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Office file\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Office file\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Office file\QQ\SendMMS.htm, N/A>

ly4171 - 2006-12-12 8:54:00

正在运行的进程
[PID: 2084][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll] <Adobe Systems Incorporated><6.0.0.2003051500>
[PID: 2244][C:\WINDOWS\system32\conime.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2464][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3000>
[PID: 2472][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2516][D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\FortuneDate.exe] <N/A><N/A>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\bdertl60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\rtl60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\dbrtl60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\dclaxserver60.bpl] <Borland Software Corporation><1.0.0.0>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\vcl60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\vcldb60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\dsnap60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\HDSNDLL.dll] <N/A><N/A>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\Print.bpl] <><1.0.0.0>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\printbase.bpl] <><1.0.0.0>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\tee60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\uadl.bpl] <><1.0.0.0>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\vcljpg60.bpl] <Borland Software Corporation><6.0.6.163>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\VclSmp60.bpl] <Borland Software Corporation><1.0.0.0>
[D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\vclx60.bpl] <Borland Software Corporation><6.0.6.163>
[PID: 2576][C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe] <Adobe Systems Incorporated><6.0.0.2003051900>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\AGM.dll] <Adobe Systems Incorporated><4.10.49>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\CoolType.dll] <Adobe Systems Incorporated><4.13.41>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\JP2KLib.dll] <Adobe system Incorporated><1.0.22891>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\OPP.dll] <Adobe Systems Incorporated><1.02.05>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\BIB.dll] <Adobe Systems Incorporated><1.1.14>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\ACE.dll] <Adobe Systems Incorporated><2.03.24>
[C:\WINDOWS\system32\ATMLIB.dll] <Adobe Systems><5.1 Build 226>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\SPPlugins\ADMPlugin.apl] <Adobe Systems Incorporated><3.00x75>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\SPPlugins\ExpressViews.apl] <Adobe Systems Incorporated><6.0>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Accessibility.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\AcroForm.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Annotations\Annots.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\DigSig.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\eBook.api] <Adobe Systems Incorporated><6.0.0.0>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\EScript.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\EWH32.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\HLS.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\IA32.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\ImageViewer\ImageViewer.API] <Adobe Systems Inc.><5.0.0.38163>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\MakeAccessible.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Multimedia\Multimedia.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\PDDom.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\PictureTasks\PictureTasks.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\PPKLite.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\printme.api] <Electronics For Imaging, Inc.><6, 0, 16, 1>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\reflow.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\SaveAsRTF.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Search.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Search5.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\SendMail.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Soap.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\Updater.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\esdupdate.dll] <Adobe Systems><2, 0, 0, 21>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\weblink.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\Program Files\Adobe\Acrobat 6.0\Reader\plug_ins\XFA.api] <Adobe Systems Incorporated><6.0.0.2003051500>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDNT5UI.DLL] <Zenographics, Inc.><5.60.709.0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDM32.DLL] <Zenographics, Inc.><5, 60, 1511, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZSPOOL.dll] <Zenographics, Inc.><5, 51, 709, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZGDI32.dll] <Zenographics, Inc.><5, 60, 709, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\ZTAG32.dll] <Zenographics, Inc.><5, 60, 1210, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SDDMUI.DLL] <Zenographics, Inc.><5, 60, 1520, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\SR32.dll] <Zenographics, Inc.><5, 60, 1407, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\IMFNT5.DLL] <Zenographics, Inc.><0, 3, 1418, 0>
[C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\Imf32.dll] <Zenographics, Inc.><5, 60, 1204, 0>

ly4171 - 2006-12-12 8:55:00

[PID: 2652][C:\WINDOWS\system32\WISPTIS.EXE] <Microsoft Corporation><1.0.2201.0 (xpsp1.020820-1800)>
[PID: 2688][D:\Tec Data\online v2\SocksOnlineV2.exe] <N/A><N/A>
[PID: 2764][D:\Office file\QQ\QQ.exe] <TENCENT><0, 0, 0, 0>
[D:\Office file\QQ\CoralAssist.DLL] <N/A><4.0.0 Build 20051112>
[D:\Office file\QQ\CoralQQ.DLL] <Coral Team><4.2.1 Build 20060127>
[D:\Office file\QQ\IPSearcher.dll] <N/A><1.0.0.4>
[D:\Office file\QQ\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QQHelperDll.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\BasicCtrlDll.dll] <Tencent><5, 0, 200, 14>
[D:\Office file\QQ\QQAPI.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\LoginCtrl.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\npkcntc.dll] <INCA Internet Co., Ltd.><2005, 9, 1, 1>
[D:\Office file\QQ\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[D:\Office file\QQ\QQRes.dll] <tencent><1, 0, 0, 1>
[D:\Office file\QQ\QQMainFrame.dll] <N/A><N/A>
[D:\Office file\QQ\CQQApplication.dll] <N/A><N/A>
[D:\Office file\QQ\NewSkin.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\HostingMgr.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\CameraDll.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\MailSummary.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[D:\Office file\QQ\QQGroupMng.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\UserDefinedHead.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QQPlugin.dll] <N/A><N/A>
[D:\Office file\QQ\QQAllInOne.dll] <N/A><N/A>
[D:\Office file\QQ\SCCore.dll] <N/A><N/A>
[D:\Office file\QQ\QQCustomFace.dll] <N/A><N/A>
[D:\Office file\QQ\QQPet.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QQSysMsgMng.dll] <N/A><N/A>
[D:\Office file\QQ\QQConfigPlugin.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QRingMng.dll] <N/A><N/A>
[D:\Office file\QQ\PhoneAPI.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[D:\Office file\QQ\LongConnection.dll] <tencent><0, 3, 3, 8>
[D:\Office file\QQ\QQAvatar.dll] <N/A><N/A>
[D:\Office file\QQ\FlashAvatarDll.dll] <><1, 4, 0, 1>
[C:\WINDOWS\system32\macromed\flash\flash.ocx] <Macromedia, Inc.><6,0,79,0>
[D:\Office file\QQ\QQMagicFace.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\QQSceneMng.dll] <N/A><N/A>
[D:\Office file\QQ\GroupConnection.dll] <Tencent><0, 3, 3, 5>
[D:\Office file\QQ\BQQApplication.dll] <N/A><N/A>
[D:\Office file\QQ\CommercesMng.dll] <><1, 0, 0, 1>
[D:\Office file\QQ\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[D:\Office file\QQ\QQUdpGetFileLib.dll] <tencent><0, 2, 2, 3>
[D:\Office file\QQ\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 141>
[D:\Office file\QQ\ImageOle.dll] <TODO: <Company name>><1.0.0.1>
[D:\Office file\QQ\QQZip.dll] <tencent><0, 3, 2, 4>
[D:\Office file\QQ\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><1, 1, 1, 30>
[D:\Office file\QQ\ShareFiles.dll] <N/A><N/A>
[PID: 3636][C:\Program Files\WinRAR\WinRAR.exe] <Eugene Roshal><3.30>
[PID: 3728][C:\DOCUME~1\saca201\LOCALS~1\Temp\Rar$EX00.999\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

高歌猛进 - 2006-12-12 9:36:00

用SR删除启动--注册表项：

<load><C:\WINDOWS\uninstall\rundl132.exe> []
删除这个文件
清理注册表

ly4171 - 2006-12-12 11:54:00

在SR里面的注册表选项下：删除这个<load><C:\WINDOWS\uninstall\rundl132.exe>好几遍，重开几次机又有了.

ly4171 - 2006-12-12 17:07:00

再顶上去

s1g1f1 - 2006-12-12 17:12:00

必须删除原文件！

博文网络 - 2006-12-12 17:15:00

楼主，麻烦你在扫描的时候，关闭其他的所有进程，看的人眼花，而且用hijackthis再扫描并传上来。

ly4171 - 2006-12-13 8:33:00

用hijackthis扫描结果：

Running processes:
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\saca201\LOCALS~1\Temp\Rar$EX00.976\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Office file\QQ\QQIEHelper.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMSCMig] ; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [ccApp] ; "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] ; C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [load] C:\WINDOWS\uninstall\rundl132.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: FortuneDate.lnk = D:\Tec Data\www file\SOFT\FortuneDate\FortuneDate\FortuneDate.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Office file\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Office file\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Office file\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Office file\QQ\SendMMS.htm
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Office file\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Office file\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = alltronics.local
O17 - HKLM\Software\..\Telephony: DomainName = alltronics.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = alltronics.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = alltronics.local
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

瑞星卡卡安全论坛