进程里出现成堆的svchost.exe bbs.ikaka.com

宇智 - 2007-1-27 15:15:00

用WinRAR查看（没办法，显示隐藏文件的选项给锁定了，怎么改注册表都没用，我把系统盘格了但是装好后还是老样子，估它在所有分区都做足了工作……）发现每个分区下都有个svchost.exe和Autorun.inf，其中系统统盘还有其他的隐藏文件。
另外还有就是尝试打开“WINDOWS”系统文件夹时出现“选择打开方式”对话框,右键选择打开却又没问题。除windows文件夹其他文件夹都没事。
不知道中了什么毒啊～～好烦。

水树雨下 - 2007-1-27 15:16:00

mizuki.ys168.com下载sreng2,关闭所有不必要的程序后扫个日志上来，一次贴不完分段贴，不要修改

宇智 - 2007-1-27 15:20:00

嗯，但是我想说我之前用过sreng2扫描，启动项什么的都显示N/A～～～我再试一次吧。

宇智 - 2007-1-27 15:25:00

07-01-27,15:12:16

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\windows\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<pyjj><C:\常用软件\拼音加加\jj4\jjsvr4.exe> [加加开发组]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\windows\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[McAfee E-mail Proxy / Emproxy]
<C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe><McAfee, Inc.>
[Human Interface Device Access / HidServ]
<C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee HackerWatch Service / McAfee HackerWatch Service]
<"C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe"><McAfee, Inc.>
[McAfee Log Manager / McLogManagerService]
<C:\PROGRA~1\McAfee\MSC\mclogsrv.exe><McAfee, Inc.>
[McAfee Update Manager / mcmispupdmgr]
<C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe><McAfee, Inc.>
[McAfee Network Agent / McNASvc]
<"c:\program files\common files\mcafee\mna\mcnasvc.exe"><McAfee, Inc.>
[McAfee Scanner / McODS]
<C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe><McAfee, Inc.>
[McAfee Protection Manager / mcpromgr]
<C:\PROGRA~1\McAfee\MSC\mcpromgr.exe><McAfee, Inc.>
[McAfee Redirector Service / McRedirector]
<c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe><McAfee, Inc.>
[McAfee Real-time Scanner / McShield]
<C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe><McAfee, Inc.>
[McAfee SystemGuards / McSysmon]
<C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe><McAfee, Inc.>
[McAfee Task Scheduler / mctskshd.exe]
<C:\PROGRA~1\McAfee\MSC\mctskshd.exe><McAfee, Inc.>
[McAfee User Manager / mcusrmgr]
<C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe><McAfee, Inc.>
[McAfee Personal Firewall Service / MpfService]
<"C:\Program Files\McAfee\MPF\MPFSrv.exe"><McAfee, Inc.>
[Shadow System Service / ShadowSystemService]
<C:\WINDOWS\system32\shadow\ShadowService.exe><N/A>
[StarWind iSCSI Service / StarWindService]
<D:\软件\虚拟光驱\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>

==================================

宇智 - 2007-1-27 15:27:00

驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
<system32\drivers\ac97intc.sys><Intel Corporation>
[McAfee Inc. / mfeavfk]
<system32\drivers\mfeavfk.sys><McAfee, Inc.>
[McAfee Inc. / mfebopk]
<system32\drivers\mfebopk.sys><McAfee, Inc.>
[McAfee Inc. / mfehidk]
<system32\drivers\mfehidk.sys><McAfee, Inc.>
[McAfee Inc. / mferkdk]
<system32\drivers\mferkdk.sys><McAfee, Inc.>
[McAfee Inc. / mfesmfk]
<system32\drivers\mfesmfk.sys><McAfee, Inc.>
[MPFP / MPFP]
<System32\Drivers\Mpfp.sys><McAfee, Inc.>
[npkcrypt / npkcrypt]
<\??\C:\常用软件\腾讯QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
[snpshot / snpshot]
<C:\windows\SYSTEM32\DRIVERS\snpshot.SYS><PowerShadow>
[TCP/IP Protocol Driver / Tcpip]
<System32\DRIVERS\tcpip.sys><Microsoft Corporation>
[vax347b / vax347b]
<\SystemRoot\system32\DRIVERS\vax347b.sys><>
[vax347s / vax347s]
<\SystemRoot\System32\Drivers\vax347s.sys><>

==================================
浏览器加载项
[]
{089FD14D-132B-48FC-8861-0048AE113215} <C:\Program Files\SiteAdvisor\SiteAdv.dll, McAfee, Inc.>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\软件\BitComet\tools\BitCometBHO.dll, N/A>
[scriptproxy]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} <c:\program files\mcafee\virusscan\scriptcl.dll, McAfee, Inc.>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\软件\迅雷\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[McAfee SiteAdvisor]
{0BF43445-2F28-4351-9252-17FE6E806AA0} <C:\Program Files\SiteAdvisor\SiteAdv.dll, McAfee, Inc.>
[全能助手广告拦截专家]
{ED51E9A3-16C5-4236-99E0-9F093B021433} <D:\软件\全能助手\TweakAssist\AssistIEBar.dll, 全能助手工作室>
[]
{089FD14D-132B-48FC-8861-0048AE113215} <C:\Program Files\SiteAdvisor\SiteAdv.dll, McAfee, Inc.>
[McAfee SiteAdvisor]
{0BF43445-2F28-4351-9252-17FE6E806AA0} <C:\Program Files\SiteAdvisor\SiteAdv.dll, McAfee, Inc.>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <D:\软件\BitComet\tools\BitCometBHO.dll, N/A>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\windows\system32\wmp.dll, Microsoft Corporation>
[scriptproxy]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} <c:\program files\mcafee\virusscan\scriptcl.dll, McAfee, Inc.>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <D:\软件\迅雷\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
[全能助手广告拦截专家]
{ED51E9A3-16C5-4236-99E0-9F093B021433} <D:\软件\全能助手\TweakAssist\AssistIEBar.dll, 全能助手工作室>
[&使用BitComet下载]
<res://D:\软件\BitComet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
<res://D:\软件\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
<res://D:\软件\BitComet\BitComet.exe/AddVideo.htm, N/A>
[&使用迅雷下载]
<D:\软件\迅雷\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<D:\软件\迅雷\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\常用软件\腾讯QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\常用软件\OFFICE~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\常用软件\腾讯QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\常用软件\腾讯QQ\AddEmotion.htm, N/A>
[添加到广告杀手]
<D:\软件\全能助手\TweakAssist\AdKiller.htm, N/A>
[用QQ彩信发送该图片]
<C:\常用软件\腾讯QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 520][\??\C:\windows\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 544][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 588][C:\windows\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 600][C:\windows\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 764][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 820][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 912][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1008][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1020][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1212][C:\windows\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1372][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[c:\program files\mcafee\virusscan\scriptcl.dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[D:\软件\迅雷\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[PID: 1616][C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe] [McAfee, Inc., 8.1.105.0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapips.dll] [McAfee, Inc., 8.1.105.0]
[PID: 1644][C:\PROGRA~1\McAfee\MSC\mclogsrv.exe] [McAfee, Inc., 7,1,131,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcdbmgr.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\COMMON~1\McAfee\MSC\sqlite3.dll] [McAfee, Inc., 7,1,114,0]
[PID: 1668][C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe] [McAfee, Inc., 7,1,137,0]
[C:\PROGRA~1\COMMON~1\McAfee\MSC\McUtil.dll] [McAfee, Inc., 7,1,114,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcshllps.dll] [McAfee, Inc., 7,1,128,0]
[PID: 1708][c:\program files\common files\mcafee\mna\mcnasvc.exe] [McAfee, Inc., 1,1,110,0]
[C:\PROGRA~1\COMMON~1\McAfee\MSC\McUtil.dll] [McAfee, Inc., 7,1,114,0]
[c:\program files\mcafee\msc\mcnmcsrv.dll] [McAfee, Inc., 1,1,108,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\common files\mcafee\mna\mcnasvcps.dll] [McAfee, Inc., 1,1,110,0]
[c:\program files\mcafee\msc\mcnmcsps.dll] [McAfee, Inc., 1,1,108,0]
[c:\program files\mcafee\msc\mcshllps.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcregobj\7,0,317,0\mcregobj.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\mcafee\msc\mcmismgr.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McLocRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MSC\oem\0-195\Mccobres.dll] [McAfee, Inc., 7,0,327,0]
[C:\PROGRA~1\McAfee\MSC\Mccobres.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcsubmgr\7,0,317,0\mcsubmgr.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\common files\mcafee\mna\mcuj.dll] [McAfee, Inc., 1,1,110,0]
[C:\PROGRA~1\McAfee\MSC\McNmcRes.dll] [McAfee, Inc., 1,1,108,0]
[C:\PROGRA~1\McAfee\MSC\McNmcLoR.dll] [McAfee, Inc., 1,1,108,0]
[C:\PROGRA~1\McAfee\MSC\McNmcCoR.dll] [McAfee, Inc., 1,1,108,0]
[PID: 1788][C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe] [McAfee, Inc., 11,1,124,0]
[PID: 1816][C:\windows\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1856][C:\PROGRA~1\McAfee\MSC\mcpromgr.exe] [McAfee, Inc., 7,1,131,0]
[C:\PROGRA~1\McAfee\MSC\McRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McLocRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MSC\oem\0-195\Mccobres.dll] [McAfee, Inc., 7,0,327,0]
[C:\PROGRA~1\McAfee\MSC\Mccobres.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\COMMON~1\McAfee\MSC\McUtil.dll] [McAfee, Inc., 7,1,114,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcsubmgr\7,0,317,0\mcsubmgr.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\mcafee\msc\mcmscver.dll] [McAfee, Inc., 7,1,128,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mvsap.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\mpf\mc\mpfmisp.dll] [McAfee, Inc., 8.1.123.0]
[c:\program files\mcafee.com\agent\mcagntps.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MPF\L10N.DLL] [McAfee Security, 8.1.123.0]
[C:\Program Files\SiteAdvisor\SiteAdv.dll] [McAfee, Inc., 1.6.0.23]
[c:\program files\mcafee\virusscan\mcvspp.dll] [McAfee, Inc., 11,1,124,0]
[c:\program files\mcafee\msc\mcprotpv.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcnmcprv.dll] [McAfee, Inc., 1,1,108,0]
[C:\PROGRA~1\McAfee\MSC\McNmcRes.dll] [McAfee, Inc., 1,1,108,0]
[C:\PROGRA~1\McAfee\MSC\McNmcLoR.dll] [McAfee, Inc., 1,1,108,0]
[C:\PROGRA~1\McAfee\MSC\McNmcCoR.dll] [McAfee, Inc., 1,1,108,0]

宇智 - 2007-1-27 15:27:00

[c:\program files\common files\mcafee\mna\mcnasvcps.dll] [McAfee, Inc., 1,1,110,0]
[c:\program files\mcafee\msc\mcnmcsps.dll] [McAfee, Inc., 1,1,108,0]
[c:\program files\mcafee\msc\mcshllps.dll] [McAfee, Inc., 7,1,128,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\naiannps.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mcodsax.dll] [McAfee, Inc., 11,1,124,0]
[c:\program files\mcafee\msc\mcregobj\7,0,317,0\mcregobj.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\mcafee\mpf\mc\mpfp.dll] [McAfee, Inc., 8.1.123.0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mvsver.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\COMMON~1\mcafee\emproxy\empxyver.dll] [McAfee, Inc., 11,2,115,0]
[c:\program files\common files\mcafee\redirsvc\redirver.dll] [McAfee, Inc., 1,1,116,0]
[C:\PROGRA~1\McAfee\MSC\McProHlp.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcnmcver.dll] [McAfee, Inc., 1,1,108,0]
[c:\program files\mcafee\mqc\qcmisp.dll] [McAfee, Inc., 7,1,123,0]
[c:\program files\mcafee\mqc\QcLite.dll] [McAfee, Inc., 7,1,123,0]
[PID: 1876][C:\常用软件\拼音加加\jj4\jjsvr4.exe] [加加开发组, 4.0.0.19]
[PID: 1932][c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe] [McAfee, Inc., 1,1,116,0]
[c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapips.dll] [McAfee, Inc., 8.1.105.0]
[PID: 1960][C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\LockDown.dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\mytilus.dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\mytilus2.dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\RES00\McShield.dll] [McAfee, Inc., VSCORE.13.3.0.132]
[C:\PROGRA~1\McAfee\VIRUSS~1\FTL.Dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\naiann.dll] [McAfee, Inc., 11,1,124,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mcvsps.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\naiannps.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mcvsqt.dll] [McAfee, Inc., 11,1,124,0]
[C:\PROGRA~1\McAfee\VIRUSS~1\McQtLib.dll] [McAfee, Inc., 11,1,124,0]
[c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll] [McAfee, Inc., 2,1,103,0]
[C:\PROGRA~1\McAfee\VIRUSS~1\mvslog.dll] [McAfee, Inc., 11,1,124,0]
[C:\PROGRA~1\McAfee\VIRUSS~1\scriptsv.dll] [McAfee, Inc., VSCORE.13.3.0.132.x86]
[C:\Program Files\McAfee\VirusScan\mcscan32.dll] [McAfee, Inc., 5.1.00]
[C:\PROGRA~1\McAfee\VIRUSS~1\mfebopa.dll] [McAfee, Inc., SYSCORE.13.3.0.111.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\mfehida.dll] [McAfee, Inc., SYSCORE.13.3.0.111.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\mfeavfa.dll] [McAfee, Inc., SYSCORE.13.3.0.111.x86]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[PID: 1996][C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe] [McAfee, Inc., 11,1,130,0]
[C:\PROGRA~1\McAfee\VIRUSS~1\mvslog.dll] [McAfee, Inc., 11,1,124,0]
[C:\PROGRA~1\McAfee\VIRUSS~1\mfesmfa.dll] [McAfee, Inc., SYSCORE.13.3.0.111.x86]
[C:\PROGRA~1\McAfee\VIRUSS~1\mfehida.dll] [McAfee, Inc., SYSCORE.13.3.0.111.x86]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapips.dll] [McAfee, Inc., 8.1.105.0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll] [McAfee, Inc., 11,1,124,0]
[c:\program files\mcafee\msc\mcsubmgr\7,0,317,0\mcsubmgr.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\mcafee\VIRUSS~1\mcvsps.dll] [McAfee, Inc., 11,1,124,0]
[PID: 196][C:\PROGRA~1\McAfee\MSC\mctskshd.exe] [McAfee, Inc., 7,1,133,0]
[PID: 188][C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe] [McAfee, Inc., 7,1,131,0]
[C:\PROGRA~1\McAfee\MSC\McRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McLocRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MSC\oem\0-195\Mccobres.dll] [McAfee, Inc., 7,0,327,0]
[C:\PROGRA~1\McAfee\MSC\Mccobres.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\COMMON~1\McAfee\MSC\sqlite3.dll] [McAfee, Inc., 7,1,114,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[PID: 356][C:\Program Files\McAfee\MPF\MPFSrv.exe] [McAfee, Inc., 8.1.123.0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapips.dll] [McAfee, Inc., 8.1.105.0]
[c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll] [McAfee, Inc., 2,1,103,0]
[c:\PROGRA~1\mcafee\mpf\mc\mpfmisp.dll] [McAfee, Inc., 8.1.123.0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MPF\L10N.DLL] [McAfee Security, 8.1.123.0]
[c:\PROGRA~1\mcafee\mpf\mc\mpfaltps.dll] [McAfee, Inc., 8.1.123.0]
[PID: 368][c:\PROGRA~1\mcafee.com\agent\mcagent.exe] [McAfee, Inc., 7,1,133,0]
[C:\PROGRA~1\McAfee\MSC\McRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McLocRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MSC\oem\0-195\Mccobres.dll] [McAfee, Inc., 7,0,327,0]
[C:\PROGRA~1\McAfee\MSC\Mccobres.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcsubmgr\7,0,317,0\mcsubmgr.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\mcafee\msc\mcregobj\7,0,317,0\mcregobj.dll] [McAfee, Inc., 7,0,317,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcmispps.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee.com\agent\mcagntps.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mccfgpv.dll] [McAfee, Inc., 7,1,128,0]
[c:\program files\mcafee\msc\mcuicfg.dll] [McAfee, Inc., 7,1,128,0]
[PID: 372][C:\windows\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 728][C:\WINDOWS\system32\shadow\ShadowService.exe] [N/A, N/A]
[PID: 1004][D:\软件\虚拟光驱\Alcohol 120\StarWind\StarWindService.exe] [Rocket Division Software, 2.6.1 Build 0x20050401]
[PID: 988][C:\WINDOWS\System32\tlntsvr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3008][C:\windows\system32\wscntfy.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 4060][c:\program files\mcafee\msc\mcuimgr.exe] [McAfee, Inc., 7,1,128,0]
[c:\program files\common files\mcafee\core\mccoreps.dll] [McAfee, Inc., 2,1,103,0]
[c:\program files\mcafee\msc\mcshllps.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\PROGRA~1\McAfee\MSC\McLocRes.dll] [McAfee, Inc., 7,1,128,0]
[C:\Program Files\McAfee\MSC\oem\0-195\Mccobres.dll] [McAfee, Inc., 7,0,327,0]
[C:\PROGRA~1\McAfee\MSC\Mccobres.dll] [McAfee, Inc., 7,1,128,0]
[PID: 448][C:\DOCUME~1\MYXP~1\LOCALS~1\Temp\Rar$EX00.598\SREng.exe] [Smallfrogs Studio, 2.2.6.605]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=svchost.exe /start
shellexecute=svchost.exe /start
shell\打开(&O)\command=svchost.exe /start
[D:\]
[AutoRun]
open=svchost.exe /start
shellexecute=svchost.exe /start
shell\打开(&O)\command=svchost.exe /start
[E:\]
[AutoRun]
open=svchost.exe /start
shellexecute=svchost.exe /start
shell\打开(&O)\command=svchost.exe /start
[F:\]
[AutoRun]
open=svchost.exe /start
shellexecute=svchost.exe /start
shell\打开(&O)\command=svchost.exe /start

==================================
HOSTS 文件
127.0.0.1 localhost

==================================

Jokkkka - 2007-1-27 15:33:00

该用户帖子内容已被屏蔽

水树雨下 - 2007-1-27 15:34:00

load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
是你自己的？

用winrar打开各个硬盘分区删除svchost.exe ，Autorun.inf

打开文本，把下边保存为.reg导入修复
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="隐藏文件和文件夹"
"Type"="group"
"Bitmap"="C:\\WINNT\\system32\\shell32.dll,4"
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="不显示隐藏的文件和文件夹"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="显示所有文件和文件夹"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"Type"="checkbox"
"Text"="隐藏受保护的操作系统文件(推荐)"
"WarningIfNotDefault"="@shell32.dll,-28964"
"HKeyRoot"=dword:80000001
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"ValueName"="ShowSuperHidden"
"CheckedValue"=dword:00000000
"UncheckedValue"=dword:00000001
"DefaultValue"=dword:00000000
"HelpID"="shell.hlp#51103"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

宇智 - 2007-1-27 15:43:00

load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
·····不是

宇智 - 2007-1-27 15:45:00

引用:

【水树雨下的贴子】load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
是你自己的？

用winrar打开各个硬盘分区删除svchost.exe ，Autorun.inf

打开文本，把下边保存为.reg导入修复
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="隐藏文件和文件夹"
"Type"="group"
"Bitmap"="C:\\WINNT\\system32\\shell32.dll,4"
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="不显示隐藏的文件和文件夹"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"Text"="显示所有文件和文件夹"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]
"Type"="checkbox"
"Text"="隐藏受保护的操作系统文件(推荐)"
"WarningIfNotDefault"="@shell32.dll,-28964"
"HKeyRoot"=dword:80000001
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
"ValueName"="ShowSuperHidden"
"CheckedValue"=dword:00000000
"UncheckedValue"=dword:00000001
"DefaultValue"=dword:00000000
"HelpID"="shell.hlp#51103"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

………………

用WinRAR删除后它会马上自己重建，根本删除不了。在安全模式下我也试过了～～

水树雨下 - 2007-1-27 15:47:00

<load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
在注册表删除这一项，重启后删除之

宇智 - 2007-1-27 15:47:00

引用:

【Jokkkka的贴子】编辑注册表展开
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
右边新建二进制值:命名为CheckedValue,打开修改数据为"1"

显示隐藏文件/显示受保护系统文件

右键打开c:\ d:\ e:\ f:\
删除
autorun.inf
svchost.exe

删除前请用winrar压缩加密为joka发送到yanpean@126.com
………………

修改注册表根本没作用。

宇智 - 2007-1-27 15:50:00

引用:

【水树雨下的贴子】<load><C:\windows\system32\dllcache\rund1132.exe> [广州大学华软软件学院05软件开发05班 By Amoeba]
在注册表删除这一项，重启后删除之
………………

嗯，那其它的咋办？
广大华软的三八！我几个同学电脑也中了这个rund1132.exe～

水树雨下 - 2007-1-27 15:53:00

杀完以后再删除每个分区下的svchost.exe ，autorun.inf
若还是杀不掉就压缩一个svchost.exe发到我邮箱mizukiuka@163.com
加密码123

宇智 - 2007-1-27 15:53:00

还有……我不知道去注册表哪里删rundll32.exe……见谅～～

水树雨下 - 2007-1-27 15:55:00

会扫日志不会删？就是你扫日志的软件，在启动项目，注册表删，删后重启再删文件，找不到用winrar找

宇智 - 2007-1-27 15:55:00

呵呵～～～～～

宇智 - 2007-1-27 15:56:00

引用:

【水树雨下的贴子】杀完以后再删除每个分区下的svchost.exe ，autorun.inf
若还是杀不掉就压缩一个svchost.exe发到我邮箱mizukiuka@163.com
加密码123
………………

好～我现在就试一下～～

宇智 - 2007-1-27 16:14:00

有两个rund1132.exe，其中一个删不掉。按软件扫到的文件路径用killbox删除提示“文件不能删除”。我还是给你打包发过去吧～～

Jokkkka - 2007-1-27 16:18:00

该用户帖子内容已被屏蔽

宇智 - 2007-1-27 16:28:00

进程里面没有rundll32.exe，只有很多的svchost……我试过一个一个结束svchost，但是结束某个svchost时会出现重启倒数。

水树雨下 - 2007-1-27 16:34:00

汗死了……不要乱动系统进程，收件去……

宇智 - 2007-1-27 16:40:00

等你消息～～

咪咪小子 - 2007-1-27 17:04:00

给你个用DOS删除的办法，去看看我的帖子，里面有详细的方法

中毒真郁闷 - 2007-1-27 17:19:00

我的电脑也是,自从中了魔波病毒,装了一个补丁之后就发现任务管理器中有很多SVCHOST.EXE进程.
有办法的帮帮忙哈.

瑞星卡卡安全论坛