【求助】重做系统还是不行，且现在打开文件夹就自动弹出网页 bbs.ikaka.com

郑州咿呀 - 2006-12-28 0:31:00

========Content========
上个星期电脑不甚中招，症状是不停的弹出网页，且大概没隔5分钟就运行N多程序，造成假死机，迫于无奈，重做系统（只格式化系统盘C盘），但没有效果。于是便将这个硬盘全部格式化后安装win2000。
今日开机又发现还有病毒，症状比上周好些，但现在又多了一个问题，打开文件夹就自动弹出其他网页。（这时好像系统迟钝下，感觉是在下载允许某些程序）

看大家发帖都有软件的扫描日志，用“sreng”扫描结果如下，麻烦大家有空给看看，谢谢！！！

郑州咿呀 - 2006-12-28 0:32:00

[CODE]

2006-12-28,00:21:30

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<updatereal><; C:\WINNT\realupdate.exe other> [N/A]
<Internat.exe><; internat.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><; mobsync.exe /logon> [(Verified)Microsoft Corporation]
<NvCplDaemon><; RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<vptray><; C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe> [Symantec Corporation]
<MSConfig><; D:\Soft\msconfig.exe /auto> [N/A]
<Desktop><"C:\WINNT\system32\rundll32.exe" "C:\WINNT\system32\NTService32.dll",Run> []
<NvMediaCenter><; RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)NVIDIA Corporation]
<nwiz><; nwiz.exe /install> [NVIDIA Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WebSecurity><C:\WINNT\system32\PvSec.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCardLogn]
<WinlogonNotify: ScCardLogn><C:\WINNT\ScNotify.dll> [Microsoft Corporation]

郑州咿呀 - 2006-12-28 0:32:00

==================================
启动文件夹
N/A

==================================
服务
[DefWatch / DefWatch][Running/Disabled]
<C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Symantec AntiVirus Client / Norton AntiVirus Server][Running/Disabled]
<C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe><Symantec Corporation>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[VisionService / VisionService][Running/Disabled]
<C:\WINNT\system32\rundll32.exe C:\PROGRA~1\vision\VISVER.DLL,Service><Microsoft Corporation>
[RestoreService / RestoreService][Stopped/Auto Start]
<C:\WINNT\system32\Svchost.exe -k RestoreService-->C:\WINNT\system32\drivers\restore.dll><Microsoft Corporation All rights reserved>
[D1C2264C / D1C2264C][Stopped/Auto Start]
<C:\WINNT\system32\D1C2264C.EXE -service><N/A>
[Windows NT Service32 / Windows NT Service32][Stopped/Auto Start]
<"C:\WINNT\system32\rundll32.exe" "C:\WINNT\system32\NTService32.dll",Start><Microsoft Corporation>
[Indexing Data / 8NASCAR][Running/Auto Start]
<C:\WINNT\SYSTEM32\RUNDLL32.EXE C:\WINNT\SYSTEM32\WBEM\BGTWO.DLL,Export 1087><N/A>
[Network Security / Live][Stopped/Auto Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\ohvge.dll><Microsoft Corporation>

郑州咿呀 - 2006-12-28 0:32:00

==================================
驱动程序
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[NAVAP / NAVAP][Running/Manual Start]
<\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys><Symantec Corporation>
[NAVAPEL / NAVAPEL][Running/Auto Start]
<\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS><Symantec Corporation>
[NAVENG / NAVENG][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVENG.sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
<\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVEX15.sys><Symantec Corporation>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\F:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
<system32\DRIVERS\Rtlnic.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[SymEvent / SymEvent][Running/Manual Start]
<\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[VIA AGP Filter / viaagp1][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[VIA USB Filter / viafilter][Stopped/Manual Start]
<\SystemRoot\System32\Drivers\viausb.sys><VIA Technologies, Inc.>
[viaide / viaide][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><VIA Technologies, Inc.>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
<system32\drivers\viaudios.sys><VIA Technologies, Inc.>
[parcls / parcls][Running/Disabled]
<\??\C:\WINNT\system32\drivers\parcls.sys><N/A>
[000002aa / 000002aa][Stopped/Boot Start]
<\SystemRoot\system32\drivers\000002aa.SYS><N/A>
[lkcxbcmz / lkcxbcmz][Running/Boot Start]
<\SystemRoot\system32\drivers\lkcxbcmz.sys><N/A>
[msprotect / msprotect][Stopped/System Start]
<system32\DRIVERS\msprotect.sys><Windows (R) 2000 DDK provider>
[hqrkoj91 / hqrkoj91][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\hqrkoj91.sys><N/A>
[squell / squell][Running/]
<2 - 系统找不到指定的文件。
><N/A>
[Netgroup Packet Filter / NPF][Running/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>

郑州咿呀 - 2006-12-28 0:33:00

==================================
浏览器加载项
[IEMonitor Class]
{08A312BB-5409-49FC-9347-54BB7D069AC6} <C:\WINNT\system32\IESHEL~1.DLL, >
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[Vision]
{6671A431-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\vision\vision.dll, >
[TBSB02607 Class]
{92CE9EC0-A77A-4A62-91F3-007C6E45BA47} <C:\PROGRA~1\KASPER~1\kaka.dll, N/A>
[WinSC Class]
{9ACEEE31-1440-471B-AA46-72B061FE7D61} <C:\WINNT\system32\SCIntruder.dll, N/A>
[]
{D3341007-C77C-4F1C-B2A5-D94D5BE55F7E} <C:\WINNT\system32\ibgcsytagreauyd.dll, N/A>
[IEHlprObj Class]
{DE7C3CF0-4B15-11D1-ABED-709549C10000} <C:\WINNT\POPNTS.DLL, >
[SysShellKernel Class]
{E04B27AA-3973-4D68-8F42-B7C2FC8C6CF7} <C:\WINNT\system32\SysShellKernel.dll, TODO: <Company name>>
[gFlash Class]
{F156768E-81EF-470C-9057-481BA8380DBA} <F:\Program Files\FlashGet\getflash.dll, >
[]
{F770522B-198D-4134-9D74-D30F41B3BA44} <C:\WINNT\system32\ktykfmiyxuazzoy.dll, N/A>
[MMSAssistMenu]
{6671A433-5C3D-463d-A7CF-5587F9B7E191} <C:\PROGRA~1\vision\vision.dll, >
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <F:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com>
[快车(FlashGet)]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <F:\Program Files\FlashGet\fgiebar.dll, Amaze Soft>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Kaspersky Anti-Virus]
{8498248D-CDCE-4E95-8F88-B8C9BF96A1C2} <C:\Program Files\Kaspersky Anti-Virus\kaka.dll, N/A>
[Submit Class]
{A3CD7F74-93C9-4BC4-B892-CCDF1514F714} <C:\WINNT\Downloaded Program Files\safein.dll, Beijing eChannels Century Technology Co.,Ltd>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[&使用快车(FlashGet)下载]
<F:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<F:\Program Files\FlashGet\jc_all.htm, N/A>
[>>彩信发送<<]
<res://C:\Program Files\vision\vision.dll/mms.htm, N/A>
[在Foxmail中添加该RSS频道/频道组]
<res://C:\WINNT\system32\fmrsslink.dll/201, N/A>

郑州咿呀 - 2006-12-28 0:34:00

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 164][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 160][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6898]
[C:\WINNT\system32\NavLogon.dll] [N/A, N/A]
[PID: 212][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.6700]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 224][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.6902]
[PID: 404][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 444][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.6659]
[PID: 472][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 8.00.00.9374]
[PID: 492][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 524][C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 8.00.00.9374]
[C:\WINNT\system32\CBA.DLL] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\MsgSys.dll] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\NTS.dll] [Intel? Corporation, 6.12.0.71 E]
[C:\WINNT\system32\PDS.DLL] [Intel? Corporation, 6.12.0.71 E]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec/Peter Norton Group, 1, 0, 0, 1]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\i2ldvp3.dll] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPI32.DLL] [Symantec Corp., 4.1.0.15]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVEX32a.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVENG32.DLL] [Symantec Corporation, 20061.3.0.12]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP32.DLL] [Symantec Corporation, 9.0.0.14]
[C:\PROGRA~1\COMMON~1\SYMANT~1\SSC\Scandlgs.dll] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DecSDK.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ID.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2UUE.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2AMG.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ARJ.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2CAB.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2EXE.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2GZIP.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2HQX.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2LHA.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2LZ.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2MIME.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2SS.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2RTF.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2TAR.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2TNEF.dll] [Symantec Corporation, 3.02.07.19]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Dec2ZIP.dll] [Symantec Corporation, 3.02.07.19]
[PID: 592][C:\WINNT\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.5672]
[PID: 612][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2195.6701]
[PID: 632][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6704]
[PID: 692][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[PID: 712][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 1132][C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe] [Symantec Corporation, 8.00.00.9374]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 8.00.00.9374]
[C:\PROGRA~1\SYMANT~1\SYMANT~1\NAVNTUTL.DLL] [Symantec/Peter Norton Group, 1, 0, 0, 1]
[C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 8.00.00.9374]
[PID: 1140][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3760]
[PID: 1152][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[PID: 1340][C:\WINNT\system32\rundll32.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\PROGRA~1\vision\VISVER.DLL] [, 1, 2, 0, 7]
[PID: 432][F:\Program Files\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 5, 9, 30]
[F:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2]
[F:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1]
[F:\PROGRA~1\淘宝网\淘宝旺旺\WangWangX1.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINNT\system32\upengine.dll] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINNT\system32\aliedit\pta.dll] [, 2, 4, 2, 471]
[C:\WINNT\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\WINNT\system32\msdmo.dll] [N/A, N/A]
[C:\WINNT\system32\ffdshow.ax] [N/A, 1.0.2.2028]
[f:\Program Files\Ringz Studio\Storm Codec\Codecs\VSFilter.dll] [Gabest, 1, 0, 1, 3]
[C:\WINNT\system32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[PID: 1444][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[PID: 1820][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[PID: 1392][C:\WINNT\explorer.exe] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\system32\PvSec.dll] [, 5, 1, 100, 2500]
[C:\WINNT\system32\IESHEL~1.DLL] [, 5.1.2600.0]
[C:\WINNT\Downloaded Program Files\807605\ExDLL.dll] [, 1, 0, 0, 1]
[C:\WINNT\system32\webpageparser.dll] [N/A, N/A]
[C:\WINNT\system32\Charset.dll] [N/A, N/A]
[C:\WINNT\system32\CreateDomTree.dll] [N/A, N/A]
[C:\WINNT\Downloaded Program Files\807605\fshook.dll] [, 1, 0, 0, 1]
[C:\PROGRA~1\vision\vision.dll] [, 1, 2, 0, 7]
[C:\PROGRA~1\vision\alvsn.dll] [N/A, 1, 0, 0, 4]
[C:\WINNT\system32\SCIntruder.dll] [N/A, N/A]
[F:\PROGRA~1\FLASHGET\jccatch.dll] [Amaze Soft, 1, 1, 4, 0]
[C:\PROGRA~1\COMMON~1\{3CC19~1\Bar888.dll] [N/A, 1, 0, 0, 1]
[C:\WINNT\system32\jbqkdehtegtxrxt.dll] [N/A, N/A]
[C:\WINNT\system32\SysShellKernel.dll] [TODO: <Company name>, 1.0.0.1]
[C:\WINNT\system32\ktykfmiyxuazzoy.dll] [N/A, N/A]
[C:\WINNT\system32\nvtuicpl.cpl] [NVIDIA Corporation, 6.14.10.5672]
[C:\WINNT\system32\NVWRSZHC.DLL] [NVIDIA Corporation, 6.14.10.5672]
[F:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll] [Symantec Corporation, 8.00.00.9374]
[PID: 1632][C:\WINNT\SYSTEM32\RUNDLL32.EXE] [Microsoft Corporation, 5.00.2134.1]
[PID: 2040][F:\Program Files\FlashGet\FLASHGET.EXE] [FlashGet.com, 1, 8, 0, 1002]
[F:\Program Files\FlashGet\FGBTCORE.dll] [N/A, 1, 0, 0, 25]
[PID: 1968][F:\Program Files\WinRAR\WinRAR.exe] [N/A, N/A]
[E:\Downloads\software\SREng【teyqiu】.COM] [Smallfrogs Studio, 2.3.13.690]

郑州咿呀 - 2006-12-28 0:34:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================

[/CODE]

鸟儿天上飞 - 2006-12-28 0:41:00

如果你已经吧硬盘全格过了请检查系统光盘吧这哪像刚做的系统全是病毒

郑州咿呀 - 2006-12-28 0:46:00

这个系统光盘以前经常用呀，这几天我都没有用电脑，偶尔我父亲玩玩联众（其他东西不动）

可以提供下手动查杀的方法吗？

afkp4e7 - 2006-12-28 1:11:00

系统加密码没有
和这台连接的电脑有没问题
怎么会还中

清清风风 - 2006-12-28 2:29:00

好象我们的症状是一样的。唯一的不同。就是我没有全盘格。只是重做了系统。和没作一样。做完系统。不开其它盘。没问题。只要一点开其它盘。马上爆发。

依靠白云 - 2006-12-28 8:54:00

这就是传说中的流氓软件,下载一款windows优化大师,清除流氓软件即可,如果不行,建议购买正版杀毒软件,里面有清除流氓软件功能即可,不妨试试!

郑州咿呀 - 2006-12-28 19:58:00

谢谢各位，我下载清除流氓软件试试看，不知有推荐某款软件的吗？

郑州咿呀 - 2006-12-28 19:59:00

引用:

【清清风风的贴子】好象我们的症状是一样的。唯一的不同。就是我没有全盘格。只是重做了系统。和没作一样。做完系统。不开其它盘。没问题。只要一点开其它盘。马上爆发。
………………

好郁闷呀，不知这是什么病毒啊

終生學習 - 2006-12-28 20:01:00

【回复“郑州咿呀”的帖子】
[VisionService / VisionService][Running/Disabled]
<C:\WINNT\system32\rundll32.exe C:\PROGRA~1\vision\VISVER.DLL,Service><Microsoft Corporation>
[RestoreService / RestoreService][Stopped/Auto Start]
<C:\WINNT\system32\Svchost.exe -k RestoreService-->C:\WINNT\system32\drivers\restore.dll><Microsoft Corporation All rights reserved>
<MSConfig><; D:\Soft\msconfig.exe /auto> [N/A]
<Desktop><"C:\WINNT\system32\rundll32.exe" "C:\WINNT\system32\NTService32.dll",Run> []

郑州咿呀 - 2006-12-28 20:04:00

是要删除以上列出的文件吗？

郑州咿呀 - 2006-12-28 20:06:00

搜索前几天创建的文件有这么多，运啊。删除，重启之后又会重新出现

附件: 81105920061228195836.jpg

鸟儿天上飞 - 2006-12-28 20:07:00

这个机器没发是删 60%的启动项都是病毒建议你在DOS下格式化所有磁盘重新安装系统给机器打好补丁给administrator加密码

郑州咿呀 - 2006-12-28 20:12:00

如果删除有问题的启动项，会有作用吗？

除了使用msconfig删除启动加载项外，还有什么办法删除那，谢谢。

瑞星卡卡安全论坛