【讨论】这个是什么病毒各位高手来看看 bbs.ikaka.com

痛并快乐的熊猫 - 2007-1-29 15:11:00

病毒名称还是SPOCLSV 但是生成有MY.EXE system.exe logo1_.exe。并感染所有的EXE文件，EXE激活病毒又生成上述几个病毒文件。开机出现静音。金山熊猫专杀只能删除SPOCLSV，对其他无能为力，被感染的EXE文件也不能恢复。1.26的江民也未能查出。希望各位高手指导。
扫描如下。如需要病毒样本请联系。

痛并快乐的熊猫 - 2007-1-29 15:11:00

[CODE]

2007-01-29,14:40:19

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [(Verified)Microsoft Corporation]
<KvXP><C:\Program Files\KV2005\KvXP.kxp /ScanBoot /ScanSys> [Jiangmin Co.Ltd]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Intel Corporation]
<HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Intel Corporation]
<SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe> [(Verified)Analog Devices, Inc.]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)NVIDIA Corporation]
<nwiz><nwiz.exe /install> [N/A]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)NVIDIA Corporation]
<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log> [Microsoft Corporation]
<DAEMON Tools><"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033> [(Verified)DT Soft Ltd.]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [N/A]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [N/A]
<StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto> [(Verified)Microsoft Corporation]
<KvMonXP><C:\Program Files\KV2005\KVMonXP.kxp /auto> [JiangMin Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><KB235780M.LOG> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1A404685-7563-4d02-B0F6-58B308A406A9}?><> [N/A]
<{2D49692C-A5FD-4E29-A3CD-37E9B182FCC6}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys> [N/A]
<{1A404685-7563-4d02-B0F6-58B308A406A9}><c:\program files\daemon tools\ejwxldmk.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<DLMon><C:\WINDOWS\system32\DLMain.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ClientQyule><; C:\Program Files\Qyule\Qyule.exe -autostart> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; ?> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<runeip><; C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<Speek><; C:\WINDOWS\my.exe> [N/A]
<upxdn><; C:\DOCUME~1\new\LOCALS~1\Temp\upxdn.exe> [N/A]

==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>

==================================
服务
[Remote Registry Protect / AtHome][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\szdj.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Kerberos Key Distribution Centers / kkdc][Stopped/Auto Start]
<C:\WINDOWS\lsass.exe -netsvcs><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Routing Protect Access / WIDETS][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\VQLEV.DLL,Export 1087><N/A>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,input><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe xpdhcp.dll,input><Microsoft Corporation>

痛并快乐的熊猫 - 2007-1-29 15:14:00

驱动程序
[a320raid / a320raid][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>
[AAC / AAC][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AAC.SYS><Adaptec, Inc.>
[aar1210 / aar1210][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aar1210.sys><Adaptec, Inc.>
[abp480n5 / abp480n5][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\abp480n5.sys><Microsoft Corporation>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[adpu160m / adpu160m][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[adpu320 / adpu320][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[ACARD AEC6210UF UltraDMA33 Controller / aec6210][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>
[ACARD AEC6260 UltraDMA-66 Controller / aec6260][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>
[aec6280 / aec6280][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>
[AEC6290 / AEC6290][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC6290.SYS><ACARD Technology Corp.>
[AEC67160 / AEC67160][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC67160.SYS><ACARD Technology Corp.>
[AEC671X / AEC671X][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC671X.SYS><ACARD Technology Corp.>
[AEC6880 / AEC6880][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC6880.SYS><ACARD Technology Corp.>
[AEC6890 / AEC6890][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\AEC6890.sys><ACARD Technology Corp.>
[aec68x5 / aec68x5][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>
[afzq / afzqw][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\afzqw.sys><N/A>
[Aha154x / Aha154x][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aic78xx.sys><Microsoft Corporation>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><Acer Laboratories Inc.>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
<System32\DRIVERS\amdk8.sys><Microsoft Corporation>
[arc / arc][Stopped/Boot Start]
<\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>
[asc / asc][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\asc.sys><Advanced System Products, Inc.>
[asc3550 / asc3550][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\asc3550.sys><Advanced System Products, Inc.>
[Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Stopped/Manual Start]
<system32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[dac2w2k / dac2w2k][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\dac2w2k.sys><Mylex Corporation>
[dpti2o / dpti2o][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\dpti2o.sys><Microsoft Corporation>
[dump_wmimmc / dump_wmimmc][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\dump_wmimmc.sys><N/A>
[elxstor / elxstor][Stopped/Boot Start]
<\SystemRoot\system32\drivers\elxstor.sys><Emulex>
[FASTSX / FASTSX][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\FASTSX.SYS><Promise Technology, Inc.>
[fasttrak / fasttrak][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttrak.sys><Promise Technology, Inc.>
[fasttx2k / fasttx2k][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttx2k.sys><Promise Technology, Inc.>
[fasttx2k2 / fasttx2k2][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\fasttx2k2.sys><Promise Technology, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[HpCISSs / HpCISSs][Stopped/Boot Start]
<\SystemRoot\system32\drivers\hpcisss.sys><Hewlett-Packard Company>
[Hpt366 / Hpt366][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\Hpt366.sys><Microsoft Corporation>
[HPT371 / HPT371][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\HPT371.sys><HighPoint Technologies, Inc.>
[hpt374 / hpt374][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hpt374.sys><HighPoint Technologies, Inc.>
[hpt3xx / hpt3xx][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hpt3xx.sys><HighPoint Technologies, Inc.>
[hptmv / hptmv][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hptmv.sys><HighPoint Technologies, Inc.>
[hptpro / hptpro][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\hptpro.sys><HighPoint Technologies, Inc.>
[ialm / ialm][Stopped/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Intel Integrated RAID / iaStor][Stopped/Boot Start]
<\SystemRoot\system32\drivers\iaStor.sys><Intel Corporation>
[iirsp / iirsp][Stopped/Boot Start]
<\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
[ini910u / ini910u][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\ini910u.sys><Microsoft Corporation>
[ITERAID_Service_Install / iteraid][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\iteraid.sys><Integrated Technology Express, Inc.>
[KVDriver for NT (KVDP) / KVDP][Stopped/Manual Start]
<\??\C:\PROGRA~1\KV2005\KVDP.sys><Beijing Jiangmin New Sci.&Tec. Co.Ltd.>
[LSI_SAS / LSI_SAS][Stopped/Boot Start]
<\SystemRoot\system32\drivers\lsi_sas.sys><LSI Logic>
[LSI_SCSI / LSI_SCSI][Stopped/Boot Start]
<\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Logic>

痛并快乐的熊猫 - 2007-1-29 15:17:00

正在运行的进程
[PID: 628][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[c:\program files\daemon tools\ejwxldmk.dll] [, 1, 0, 0, 11]
[PID: 760][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 772][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 944][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1020][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1176][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1260][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1420][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1604][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 240][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8195]
[PID: 304][C:\Program Files\DAEMON Tools\daemon.exe] [DT Soft Ltd., 4.08.0.0]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\Program Files\DAEMON Tools\daemon.dll] [DT Soft Ltd., 4.08.0.0]
[C:\Program Files\DAEMON Tools\PFCTOC.DLL] [Padus(R), Inc., 1, 0, 0, 12]
[C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] [N/A, 1.1.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] [GENERIC, 1.10.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\cuemount.dll] [DT Soft Ltd., 1.0.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] [DT Soft Ltd., 1.18.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] [DT Soft Ltd., 1.12.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] [GENERIC, 1.01.0.0]
[PID: 372][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3427]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 464][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 48]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 560][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 576][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 688][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 856][C:\Program Files\MSN Messenger\MsnMsgr.Exe] [Microsoft Corporation, 8.0.0812.00]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 1144][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 284][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 2100][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 2192][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\WINDOWS\system32\DLMon.dll] [N/A, N/A]
[C:\WINDOWS\trunk_16.dll] [N/A, N/A]
[C:\Program Files\KV2005\KvShell.dll] [JiangMin Lmt, 9, 0, 0, 505]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\Kvxp0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\APIImpl.dll] [JiangMin Ltd., 9.0.0.500]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\WINDOWS\system32\systemher.dll] [system, 1.00]
[C:\Program Files\KV2005\GUIExt.dll] [JiangMin Ltd., 9.0.0.501]
[C:\Program Files\KV2005\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[c:\program files\daemon tools\ejwxldmk.dll] [, 1, 0, 0, 11]
[PID: 3456][C:\Documents and Settings\new\桌面\procexp.exe] [Sysinternals, 9.11]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 3584][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1268][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1232][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1572][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]

痛并快乐的熊猫 - 2007-1-29 15:17:00

正在运行的进程
[PID: 628][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 684][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[c:\program files\daemon tools\ejwxldmk.dll] [, 1, 0, 0, 11]
[PID: 760][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 772][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 944][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1020][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1176][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1260][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1420][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 1604][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 240][C:\WINDOWS\system32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\NvMcTray.dll] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\system32\NVRSZHC.DLL] [NVIDIA Corporation, 6.14.10.8195]
[PID: 304][C:\Program Files\DAEMON Tools\daemon.exe] [DT Soft Ltd., 4.08.0.0]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\Program Files\DAEMON Tools\daemon.dll] [DT Soft Ltd., 4.08.0.0]
[C:\Program Files\DAEMON Tools\PFCTOC.DLL] [Padus(R), Inc., 1, 0, 0, 12]
[C:\Program Files\DAEMON Tools\Plugins\Images\bw5mount.dll] [N/A, 1.1.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\ccdmount.dll] [GENERIC, 1.10.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\cuemount.dll] [DT Soft Ltd., 1.0.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\mdsmount.dll] [DT Soft Ltd., 1.18.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\nrgmount.dll] [DT Soft Ltd., 1.12.0.0]
[C:\Program Files\DAEMON Tools\Plugins\Images\pdimount.dll] [GENERIC, 1.01.0.0]
[PID: 372][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3427]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 464][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 48]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 560][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.8195]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 576][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 688][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 856][C:\Program Files\MSN Messenger\MsnMsgr.Exe] [Microsoft Corporation, 8.0.0812.00]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 1144][C:\WINDOWS\SYSTEM32\RUNDLL32.EXE] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 284][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[PID: 2100][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 2192][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\WINDOWS\system32\DLMon.dll] [N/A, N/A]
[C:\WINDOWS\trunk_16.dll] [N/A, N/A]
[C:\Program Files\KV2005\KvShell.dll] [JiangMin Lmt, 9, 0, 0, 505]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\Kvxp0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\APIImpl.dll] [JiangMin Ltd., 9.0.0.500]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\WINDOWS\system32\systemher.dll] [system, 1.00]
[C:\Program Files\KV2005\GUIExt.dll] [JiangMin Ltd., 9.0.0.501]
[C:\Program Files\KV2005\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[c:\program files\daemon tools\ejwxldmk.dll] [, 1, 0, 0, 11]
[PID: 3456][C:\Documents and Settings\new\桌面\procexp.exe] [Sysinternals, 9.11]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 3584][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1268][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1232][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 1572][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]

痛并快乐的熊猫 - 2007-1-29 15:18:00

[PID: 2688][D:\Program Files\Tencent\QQ\QQ.exe] [TENCENT, 0, 0, 0, 0]
[D:\Program Files\Tencent\QQ\CoralAssist.DLL] [Coral Team, 4.5.0 build 20060515]
[D:\Program Files\Tencent\QQ\CoralQQ.DLL] [Coral Team, 4.5.4 Build 20061001]
[D:\Program Files\Tencent\QQ\ipsearcher.dll] [N/A, 1.0.0.4]
[D:\Program Files\Tencent\QQ\QQBaseClassInDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQHelperDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\BasicCtrlDll.dll] [Tencent, 5, 0, 200, 370]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\TMDlls\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\LoginCtrl.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\npkcntc.dll] [INCA Internet Co., Ltd., 2006, 6, 27, 1]
[D:\Program Files\Tencent\QQ\npkpdb.dll] [INCA Internet Co., Ltd., 2003, 10, 1, 1]
[D:\Program Files\Tencent\QQ\QQRes.dll] [tencent, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQMainFrame.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\CQQApplication.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\NewSkin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\HostingMgr.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\CameraDll.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\MailSummary.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQSpace.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQGroupMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\GroupLive.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\LongConnection.dll] [tencent, 5, 0, 200, 160]
[D:\Program Files\Tencent\QQ\QQPlugin.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\ShareFiles.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQZip.dll] [tencent, 0, 3, 2, 4]
[D:\Program Files\Tencent\QQ\QQAllInOne.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\SCCore.dll] [TENCENT, 2, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQCustomFace.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\GroupConnection.dll] [Tencent, 0, 3, 3, 5]
[D:\Program Files\Tencent\QQ\UserDefinedHead.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQConfigPlugin.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\FlashAvatarDll.dll] [, 1, 4, 0, 1]
[D:\Program Files\Tencent\QQ\QQAvatar.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QQPet.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQSysMsgMng.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\QRingMng.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\PhoneAPI.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\DialerAllinOne.dll] [tencent, 1, 4, 0, 0]
[D:\Program Files\Tencent\QQ\VPortal.dll] [, 1, 0, 0, 4]
[D:\Program Files\Tencent\QQ\QQSceneMng.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\ImageOle.dll] [TODO: <Company name>, 1.0.0.1]
[D:\Program Files\Tencent\QQ\BQQApplication.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\PersonalDesktop.dll] [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 2]
[D:\Program Files\Tencent\QQ\CommercesMng.dll] [, 1, 0, 0, 1]
[D:\Program Files\Tencent\QQ\QQAddr.dll] [深圳市腾讯计算机系统有限公司, 5, 0, 101, 240]
[D:\Program Files\Tencent\QQ\QQPhoneHelper.dll] [腾讯科技（深圳）有限公司, 2, 1, 3, 30]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 860][D:\Program Files\Tencent\QQ\TMDlls\TIMPlatform.exe] [tencent, 0, 3, 1, 8]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[D:\Program Files\Tencent\QQ\TMDlls\TIMProxy.dll] [tencent, 0, 3, 2, 4]
[C:\Program Files\KV2005\KVMonXP.kxp] [JiangMin Ltd., 9, 0, 0, 505]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\Kvxp0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\PProtect.dll] [北京江民新科技术公司, 1.0.121]
[C:\Program Files\KV2005\KVWPSet.dll] [N/A, 9, 0, 0, 505]
[C:\Program Files\KV2005\GUIExt.dll] [JiangMin Ltd., 9.0.0.501]
[C:\Program Files\KV2005\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\KV2005\KvOffice.dll] [JiangMin New Tech., 9.0.0.1213]
[C:\Program Files\KV2005\lang\KVOffice0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\VirusUpload.dll] [N/A, 2, 0, 0, 0]
[C:\Program Files\KV2005\TrojDie.kxp] [Jiangmin Co.Ltd, 9, 0, 5, 512]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\TrojDie0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\GUIExt.dll] [JiangMin Ltd., 9.0.0.501]
[C:\Program Files\KV2005\lang\GUIExt0804.lng] [JiangMin Ltd., 7, 1, 0, 200]
[C:\Program Files\KV2005\PProtect.dll] [北京江民新科技术公司, 1.0.121]
[C:\Program Files\KV2005\ComUIPS.dll] [N/A, 9. 5. 5. 20]
[PID: 2128][C:\Program Files\KV2005\KRegEx.exe] [Jiangmin, 1.0.1.0413]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\Program Files\KV2005\KRegEx.dll] [N/A, N/A]
[C:\Program Files\KV2005\KRegTrust.dll] [Jiangmin Co., 1, 0, 0, 1]
[PID: 2364][C:\WINDOWS\system32\DllHost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\Program Files\KV2005\ComUI.dll] [Jiangmin Ltd., 9. 5. 5. 20]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\ComUIPS.dll] [N/A, 9. 5. 5. 20]
[PID: 2628][F:\downloads\杀毒\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[PID: 2396][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\WINDOWS\trunk_16.dll] [N/A, N/A]
[C:\Program Files\KV2005\KvShell.dll] [JiangMin Lmt, 9, 0, 0, 505]
[C:\Program Files\KV2005\UpdateX.dll] [JiangMin Ltd., 8, 0, 0, 0]
[C:\Program Files\KV2005\lang\Kvxp0804.lng] [N/A, N/A]
[C:\Program Files\KV2005\APIImpl.dll] [JiangMin Ltd., 9.0.0.500]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll] [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[C:\WINDOWS\system32\systemher.dll] [system, 1.00]
[PID: 2440][C:\WINDOWS\SoftwareDistribution\Download\2b803c12d5d304e1b77fd9fb59c86e75\update\update.exe] [Microsoft Corporation, 6.2.0029.0 (SRV03_QFE.031113-0918)]
[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
[C:\WINDOWS\system32\xpdhcp.dll] [N/A, N/A]
[C:\WINDOWS\system32\nvcod.dll] [NVIDIA Corporation, 1 , 0 , 0 , 34 ]

痛并快乐的熊猫 - 2007-1-29 15:18:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA 错误： GetVersion
RVA 错误： GetVersionExA
RVA 错误： GetVersionExW
RVA 错误： DeleteFileA
RVA 错误： DeleteFileW
RVA 错误： FindFirstFileA
RVA 错误： FindFirstFileExA
RVA 错误： FindFirstFileExW
RVA 错误： FindFirstFileW
RVA 错误： FindNextFileA
RVA 错误： FindNextFileW
RVA 错误： LoadLibraryW
RVA 错误： Process32First
RVA 错误： Process32FirstW
RVA 错误： Process32Next
RVA 错误： Process32NextW
RVA 错误： Module32First
RVA 错误： Module32FirstW
RVA 错误： Module32Next
RVA 错误： Module32NextW
RVA 错误： MoveFileA
RVA 错误： MoveFileExA
RVA 错误： MoveFileExW
RVA 错误： MoveFileW
RVA 错误： TerminateThread
RVA 错误： Thread32First
RVA 错误： Thread32Next
RVA 错误： CreateFileW
RVA 错误： Thread32First
RVA 错误： Thread32Next
RVA 错误： CopyFileA
RVA 错误： CopyFileExA
RVA 错误： CopyFileExW
RVA 错误： CopyFileW
RVA 错误： CreateFileMappingA
RVA 错误： CreateFileMappingW
RVA 错误： CreateRemoteThread
RVA 错误： CreateThread
RVA 错误： CreateToolhelp32Snapshot
RVA 错误： ExitProcess
RVA 错误： ExitThread
RVA 错误： FindCloseChangeNotification
RVA 错误： FindFirstChangeNotificationA
RVA 错误： FindFirstChangeNotificationW
RVA 错误： FreeLibrary
RVA 错误： GetCurrentProcess
RVA 错误： GetCurrentProcessId
RVA 错误： GetCurrentThread
RVA 错误： GetCurrentThreadId
RVA 错误： GetFileSize
RVA 错误： GetFileSizeEx
RVA 错误： GetFileInformationByHandle
RVA 错误： GetFileAttributesA
RVA 错误： GetFileAttributesExA
RVA 错误： GetFileAttributesExW
RVA 错误： GetFileAttributesW
RVA 错误： GetModuleFileNameA
RVA 错误： GetModuleFileNameW
RVA 错误： Toolhelp32ReadProcessMemory

==================================

[/CODE]

痛并快乐的熊猫 - 2007-1-29 15:19:00

OVER 请各位大虾指教

wangfire - 2007-1-29 15:20:00

去下一个0122的免疫补丁吧，熊猫变种，应该是

痛并快乐的熊猫 - 2007-1-29 15:24:00

0122是什么啊？嘿嘿不知道是什么呢

瑞星卡卡安全论坛