【求助】win2000server启动后自动运行很多个IEEXPLORE.EXE进程 bbs.ikaka.com

blacksmile - 2007-1-27 12:49:00

服务器原来装的是macfee，平时不连internet，有天连上网在线升级macfee发现升一半就停在那不会动了，后来重装macfee仍然不能升级，检查进程发现系统启动自动运行多个IEEXPLORE.EXE，网上查了下以为是灰鸽子，下载了一个瑞星专杀工具也检测不出来，不知道要怎么搞，请各位大哥指点一二，谢谢！

blacksmile - 2007-1-27 12:58:00

系统是2003server，头晕了

水树雨下 - 2007-1-27 13:12:00

mizuki.ys168.com下载sreng2,关闭不必要的程序后扫个日志上来，一次贴不完分段贴，不要修改

blacksmile - 2007-1-27 14:14:00

日志来了，请帮看看, 谢谢！

[CODE]

2007-01-27,13:50:02

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition Service Pack 1 (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
<ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<nod32kui><"C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE> [Eset ]
<UserFaultCheck><%systemroot%\system32\dumprep 0 -u> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[DameWare Mini Remote Control / DWMRCS][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\DWRCS.EXE -service><DameWare Development LLC>
[Cluster Monitor Service / HAMonitorService][Running/Auto Start]
<C:\Program Files\Cluster Manager\MonitorService.exe><N/A>
[Cluster Service / HAService][Running/Auto Start]
<C:\Program Files\Cluster Manager\Service.exe><N/A>
[Network Associates McShield / McShield][Stopped/Auto Start]
<"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager][Stopped/Auto Start]
<"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
<"C:\Program Files\Eset\nod32krn.exe"><Eset>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

==================================
驱动程序
[adpu320 / adpu320][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[AMON / AMON][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\amon.sys><Eset>
[ati2mpad / ati2mpad][Running/Manual Start]
<system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
<system32\DRIVERS\e1000325.sys><Intel Corporation>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
<system32\DRIVERS\ipinip.sys><N/A>
[NaiAvFilter1 / NaiAvFilter1][Stopped/Manual Start]
<system32\drivers\naiavf5x.sys><Network Associates, Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
<system32\drivers\mvstdi5x.sys><Network Associates, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

blacksmile - 2007-1-27 14:16:00

==================================
浏览器加载项
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XML HTTP 4.0]
{88D969C5-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>

==================================
正在运行的进程
[PID: 900][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 972][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1068][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1112][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1124][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1316][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1396][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1512][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1620][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1632][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 668][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 704][C:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation, 2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 868][C:\WINDOWS\SYSTEM32\DWRCS.EXE] [DameWare Development LLC, 5, 0, 1, 5]
[PID: 920][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1448][C:\Program Files\Eset\nod32krn.exe] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\nod32krr.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\ps_amon.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_amon.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\ps_dmon.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_dmon.dll] [N/A, N/A]
[C:\Program Files\Eset\ps_emon.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_emon.dll] [N/A, N/A]
[C:\WINDOWS\system32\imon.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_imon.dll] [N/A, N/A]
[C:\Program Files\Eset\ps_mirr.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_mirr.dll] [N/A, N/A]
[C:\Program Files\Eset\ps_nod32.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_nod32.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\ps_upd.dll] [Eset , 2, 51, 26 ]
[C:\Program Files\Eset\pr_upd.dll] [N/A, N/A]
[PID: 348][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 620][C:\Program Files\Cluster Manager\MonitorService.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 640][C:\Program Files\Cluster Manager\Service.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 1816][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 1560][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 1904][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll] [N/A, N/A]
[C:\WINDOWS\RichDll.dll] [N/A, N/A]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[C:\Program Files\Network Associates\VirusScan\shext.dll] [Network Associates, Inc., 8.0.0.912]
[C:\Program Files\UltraEdit\ue32ctmn.dll] [, 1, 0, 0, 1]
[C:\Program Files\Eset\nodshex.dll] [N/A, N/A]
[C:\WINDOWS\SYSTEM32\DWRCShell.DLL] [DameWare Development LLC, 5, 0, 1, 5]
[PID: 204][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[C:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[PID: 2044][C:\WINDOWS\alga.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[PID: 316][C:\WINDOWS\SYSTEM32\DWRCST.exe] [DameWare Development, 5, 0, 1, 5]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[PID: 520][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.dll] [N/A, N/A]
[PID: 1276][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] [Network Associates, Inc., 2.0.275.0]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]
[PID: 324][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 344][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 280][C:\WINDOWS\system32\iexp1ore.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll] [N/A, N/A]
[PID: 1596][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 3956][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2212][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2876][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 3748][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2120][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2924][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 3896][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 2364][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 3312][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 300][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 12264][c:\zxin10\imp\impmoni.exe] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 10988][C:\WINDOWS\system32\cmd.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[PID: 11096][C:\zxin10\imp\imp.exe] [N/A, N/A]
[C:\zxin10\imp\impfunc.dll] [N/A, N/A]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\zxin10\imp\IdfSyb.dll] [N/A, N/A]
[C:\Sybase\DLL\libsybdb.dll] [N/A, N/A]
[C:\Sybase\DLL\libtcl.dll] [N/A, N/A]
[C:\Sybase\DLL\libintl.dll] [N/A, N/A]
[C:\Sybase\DLL\libcomn.dll] [N/A, N/A]
[C:\Sybase\DLL\libcs.dll] [N/A, N/A]
[C:\zxin10\imp\service300.dll] [N/A, N/A]
[C:\zxin10\imp\service332.dll] [N/A, N/A]
[C:\zxin10\imp\service340.dll] [N/A, N/A]
[C:\zxin10\imp\service333.dll] [N/A, N/A]
[C:\Sybase\DLL\nlmsnmp.dll] [N/A, N/A]
[C:\Sybase\DLL\nlwnsck.dll] [N/A, N/A]
[PID: 10600][D:\扫描日志sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\system32\windds32.dll] [N/A, N/A]
[C:\WINDOWS\system32\windhcp.ocx] [N/A, N/A]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll] [N/A, N/A]
[C:\WINDOWS\system32\agtz.dll] [N/A, N/A]

blacksmile - 2007-1-27 14:17:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI Error. [UltraEdit.ini]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS Error. [UltraEdit.js]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

[/CODE]

水树雨下 - 2007-1-27 14:19:00

mizuki.ys168.com下载威金专杀，先更新，杀完重做系统去吧

blacksmile - 2007-1-27 14:29:00

引用:

【水树雨下的贴子】 mizuki.ys168.com下载威金专杀，先更新，杀完重做系统去吧
………………

水哥，能不能说的稍微具体点，这个机器中的什么招，让我死个明白呀！必须重做系统吗，这可不太好弄，是台服务器

水树雨下 - 2007-1-27 14:34:00

中的是威金，这两个已经插入所有进程
C:\WINDOWS\system32\windds32.dll
[C:\WINDOWS\system32\windhcp.ocx
以下都是病毒
SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

blacksmile - 2007-1-27 14:43:00

引用:

【水树雨下的贴子】中的是威金，这两个已经插入所有进程
C:\WINDOWS\system32\windds32.dll
[C:\WINDOWS\system32\windhcp.ocx
以下都是病毒
SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

………………

非常感谢，俺这就杀毒去！

blacksmile - 2007-1-27 15:04:00

已经用专杀工具杀了一遍viking（100多个毒哦），为什么IEEXPLORE.EXE进程还是不断跳出？

水树雨下 - 2007-1-27 15:09:00

威金专杀只杀威金，其他的你自己动手杀，就是上边的，你的动手操作能力怎么样？不行的话格机，有信心的话就去上边网址下载冰刃，现用你扫日志的软件删除
SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
重启后删除相应文件

冰刃使用方法http://forum.ikaka.com/topic.asp?board=28&artid=7168178
参考这个http://forum.ikaka.com/topic.asp?board=28&artid=8240356
杀C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

安全模式下清空这个文件夹C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\

Jokkkka - 2007-1-27 15:11:00

该用户帖子内容已被屏蔽

blacksmile - 2007-1-27 15:45:00

不想格盘，还是试试手动杀毒吧

to： Jokkkka
哥们你要病毒干什么，邮箱扫描附件是病毒不让发送的

安全防卫 - 2007-1-27 16:55:00

压缩一下再发

安全防卫 - 2007-1-27 17:21:00

先解决维金,下载农夫专杀升级到最新再杀.

其它病毒安全模式下.

删除注册表启动项\病毒服务项
按照水树雨下写的病毒文件和服务项

卸载QQ重装,一定要重装QQ

安全防卫 - 2007-1-27 17:23:00

楼主这台是服务器,装着远程控制开始还以为被黑客黑了.

水树雨下 - 2007-1-27 17:23:00

没见楼主装q……

blacksmile - 2007-1-27 19:05:00

手动删除了病毒，看进程是正常了，但是c:\windows\system32\ieexplore.exe还在，不知道还有什么影响！

安全防卫 - 2007-1-27 19:33:00

引用:

【blacksmile的贴子】手动删除了病毒，看进程是正常了，但是c:\windows\system32\ieexplore.exe还在，不知道还有什么影响！
………………

ieexplore.exe 楼主有没有打错

这个名称很不正常

安全防卫 - 2007-1-27 19:37:00

引用:

【水树雨下的贴子】没见楼主装q……
………………

没装就不做那一步喽.没仔细看有没有装QQ

dodo66 - 2007-1-27 19:49:00

SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
<NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<UserFaultCheck><%systemroot%\system32\dumprep 0 -u> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
<C:\Program Files\Cluster Manager\MonitorService.exe><N/A>
<C:\Program Files\Cluster Manager\Service.exe><N/A>

这个是什么?
<system32\DRIVERS\ipinip.sys><N/A>

瑞星卡卡安全论坛