supermancool - 2007-1-1 22:57:00
一在桌面上双击我的电脑或其他程序，都会在"system32"文件夹下生成"myconfig.ini"文件
在"windows"文件夹下生成"count.ini"和"downnew.ini"文件，并且还在"windows"下生成个"mycount.exe"文件，并自动执行，然后硬盘就狂响，有时就会弹出www.zhaomeimei.cn网页！
以下是我用SREng2扫描的结果，请尽快推出解决办法！！！
supermancool - 2007-1-1 22:58:00
2007-01-01,22:40:54
System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<IntelliPoint><"C:\Program Files\Microsoft IntelliPoint\ipoint.exe"> [(Verified)Microsoft Corporation]
<dr><D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe> [N/A]
<kis><"D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
<Anti-Spy Tools><E:\ast\ast\ast.exe -min> [DSW Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[卡巴斯基互联网安全套装 6.0 / AVP]
<D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r><Kaspersky Lab>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[Human Interface Device Access / HidServ]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
<"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[WinXP DHCP Service / WinXPDHCPsvc]
<C:\WINDOWS\System32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
==================================
supermancool - 2007-1-1 22:58:00
驱动程序
[ewido anti-spyware 4.0 driver / ewido anti-spyware 4.0 driver]
<\??\D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.sys><N/A>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS]
<System32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[kl1 / kl1]
<\SystemRoot\System32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif]
<\??\C:\WINDOWS\System32\drivers\klif.sys><Kaspersky Lab>
[KRegEx / KRegEx]
<\??\D:\KV2006\KRegEx.sys><N/A>
[KSysCall Service / KSysCall]
<\??\D:\KV2006\KSysCall.sys><N/A>
[KVDriver for NT (KVDP) / KVDP]
<\??\D:\KV2006\KVDP.sys><N/A>
[KvMemon / KvMemon]
<\??\D:\KV2006\KvMemon.sys><N/A>
[KVREDIR / KVREDIR]
<\??\D:\KV2006\KVREDIR.sys><N/A>
[NetGroup Packet Filter Driver / NPF]
<system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt]
<\??\D:\Program Files\Tencent\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nv4 / nv4]
<System32\DRIVERS\nv4.sys><NVIDIA Corporation>
[oqxa / oqxay]
<\SystemRoot\System32\DRIVERS\oqxay.sys><N/A>
[PProtect / PProtect]
<\??\D:\KV2006\PProtect.sys><N/A>
[PSTRIP / PSTRIP]
<\??\C:\WINDOWS\System32\DRIVERS\PSTRIP.SYS><N/A>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware]
<\SystemRoot\System32\drivers\RsBoot.sys><N/A>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[sptd / sptd]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
==================================
supermancool - 2007-1-1 22:59:00
浏览器加载项
[Thunder Browser Helper]
{54EBD537-9BC1-480B-966A-843A333CA162} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, N/A>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, N/A>
[]
{C155E2F4-EA4D-48AD-BEE2-C837C0DC137F} <C:\WINDOWS\system32\vxtoltasaxgam.dll, N/A>
[acss]
{E94529A9-1D27-4BC5-B1EE-321474D6EB79} <C:\PROGRA~1\jlii\npmm.dll, N/A>
[浩方对战平台]
{0A155D3C-68E2-4215-A47A-E800A446447A} <D:\Program Files\浩方对战平台\GameClient.exe, N/A>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[Sothink SWF Catcher]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\System32\aliedit\AliEdit.dll, www.alipay.com>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\System32\SUBMIT~1.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <D:\Program Files\淘宝网\淘宝旺旺\WangWangX3.dll, 淘宝（中国）软件有限公司>
[&使用迅雷下载]
<D:\Program Files\Thunder Network\Thunder\Program\geturl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\Program Files\Thunder Network\Thunder\Program\getallurl.htm, N/A>
[Download all links using BitComet]
<, N/A>
[Download all videos using BitComet]
<, N/A>
[Download link using BitComet]
<, N/A>
[Sothink SWF Catcher]
<C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm, N/A>
[使用BitComet下載全部鏈接]
<, N/A>
[使用BitComet下載鏈接]
<, N/A>
[使用BitComet下载]
<, N/A>
[使用BitComet下载全部链接]
<, N/A>
[使用BitComet下载本页视频]
<, N/A>
[查看 Exif 信息(&V)]
<res://D:\Program Files\Exif Show\ExShow.dll/EXSHOW.HTML, N/A>
==================================
正在运行的进程
[PID: 652][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 736][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 760][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 804][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 816][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1000][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1100][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1224][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1236][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1328][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1660][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\WINDOWS\system32\dxhnc.dll] [N/A, N/A]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\System32\xpdhcp.dll] [N/A, N/A]
[C:\WINDOWS\system32\vxtoltasaxgam.dll] [N/A, N/A]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[PID: 1992][C:\Program Files\Microsoft IntelliPoint\ipoint.exe] [Microsoft Corporation, 5.50.662.0]
[PID: 2028][D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\ishare_user.exe] [N/A, N/A]
[D:\Program Files\北京城市热点资讯有限公司\Dr.COM 宽带客户端\cw3220.DLL] [Borland International, 2.0]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 168][E:\ast\ast\ast.exe] [DSW Lab, 1.6]
[E:\ast\ast\aScanCom.dll] [DSW Lab, 2. 0. 1. 3]
[E:\ast\ast\AutoRun.dll] [ DSW Lab, 2.0]
[E:\ast\ast\Common.dll] [N/A, 1.4.0.0]
[E:\ast\ast\EngineSDK.dll] [DSW Lab, 1.7]
[E:\ast\ast\FileAnalyser.dll] [DSW Lab, 1.0.0.1]
[E:\ast\ast\KillModule.dll] [DSW Lab, 1.2.0.0]
[E:\ast\ast\ManagerProcess.dll] [N/A, 1.3.1.0]
[E:\ast\ast\ManagerService.dll] [N/A, 1.0.0.0]
[E:\ast\ast\Monitor.dll] [DSW Lab, 1.6]
[E:\ast\ast\PortAssociate.dll] [DSW Lab, 1.0.0.8]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[E:\ast\ast\SSDT.dll] [ DSW Lab, 1.0.0.1]
[E:\ast\ast\TIERepair.dll] [N/A, 1.2.0.0]
[E:\ast\ast\tRubbishClear.dll] [DSW Lab, 1.4.0.0]
[E:\ast\ast\tSecurityOptimize.dll] [DSW Lab, 1.1.0.0]
[E:\ast\ast\zDiagnosticTool.dll] [DSW Lab, 1.1.0.0]
[E:\ast\ast\unarc.dll] [DSW Lab, 1.2]
[PID: 192][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 476][D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\guard.exe] [Anti-Malware Development a.s., 4, 0, 0, 172]
[D:\Program Files\ewido anti-spyware 4.0\ewido anti-spyware 4.0\engine.dll] [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 520][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.13.10.3082]
[PID: 3956][D:\Program Files\Maxthon\Maxthon.exe] [MY Soft Technology, 1, 5, 0, 95]
[D:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Maxthon\Plugin\ViewSource\ViewSrc.dll] [, 1, 0, 0, 1]
[D:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scr_ch_pg.dll] [Kaspersky Lab, 1.0.6.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\klscav.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\pr_remote.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prloader.dll] [Kaspersky Lab, 6.0.0.299]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\prkernel.ppl] [Kaspersky Lab, 6.0.0.304]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\params.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\pxstub.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\tempfile.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\nfio.ppl] [Kaspersky Lab, 6.0.0.299]
[d:\program files\kaspersky lab\kaspersky internet security 6.0\fsdrvplgn.ppl] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 3752][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3596][D:\sreng2\SREng\SREng.exe] [Smallfrogs Studio, 2.2.6.605]
[D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
N/A
==================================
红夜鬼1 - 2007-1-1 23:03:00
运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
Remote Packet Capture Protocol v.0
[WinXP DHCP Service
，选择“删除服务”
点“设置”选择“否”
运行SREng2,使用“系统修复”－－浏览器加载项－－删除
[]
{C155E2F4-EA4D-48AD-BEE2-C837C0DC137F} <C:\WINDOWS\system32\vxtoltasaxgam.dll, N/A>
[Sothink SWF Catcher]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >
重启按F８进入安全模式下
显示隐藏文件
删除：
C:\WINDOWS\System32\CMBEdit.dll
C:\WINDOWS\system32\vxtoltasaxgam.dll
xpdhcp.dll
:\Program Files\WinPcap\rpcapd.exe"
"C:\Program Files\WinPcap\rpcapd.ini
supermancool - 2007-1-1 23:26:00
| 引用: |
【红夜鬼1的贴子】运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
Remote Packet Capture Protocol v.0
[WinXP DHCP Service
，选择“删除服务”
点“设置”选择“否”
运行SREng2,使用“系统修复”－－浏览器加载项－－删除
[]
{C155E2F4-EA4D-48AD-BEE2-C837C0DC137F} <C:\WINDOWS\system32\vxtoltasaxgam.dll, N/A>
[Sothink SWF Catcher]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3} <, N/A>
[Edit Class]
{0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\System32\CMBEdit.dll, >
重启按F８进入安全模式下
显示隐藏文件
删除：
C:\WINDOWS\System32\CMBEdit.dll
C:\WINDOWS\system32\vxtoltasaxgam.dll
xpdhcp.dll
:\Program Files\WinPcap\rpcapd.exe"
"C:\Program Files\WinPcap\rpcapd.ini
……………… |
太感谢了，按你说的重起后没问题了
还有就是[Sothink SWF Catcher]
{E19ADC6E-3909-43E4-9A89-B7B676377EE3}这个键值不是恶意软件
© 2000 - 2026 Rising Corp. Ltd.