SVKP.SYS病毒怎么杀,日志如下 bbs.ikaka.com

shanyang - 2007-2-1 9:34:00

2007-02-01,09:02:51

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"D:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Intel Corporation]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Intel Corporation]
<WangWang><"D:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE"> [淘宝（中国）软件有限公司]
<RfwMain><"D:\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<WebThunder><D:\迅雷下载\WebThunder.exe> [深圳市迅雷网络技术有限公司]
<CAP3ON><C:\WINDOWS\System32\spool\drivers\w32x86\3\CAP3ONN.EXE> [CANON INC.]
<KsgUpdateRun><C:\Program Files\Common Files\kingsoft\KSG\client.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><C:\WINDOWS\Resources\19\What a sight\What a sight.exe> [Narcissus Screen Design]

==================================
启动文件夹
[木马杀客2007]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\木马杀客2007.Lnk --> D:\木马清~1\木马杀客\mmsk.exe [N/A]><N>

==================================
服务
[File Replication / File Replication][Stopped/Disabled]
<C:\WINDOWS\system32\ntfis.exe><N/A>
[GrayPigeon_Hacker.com.cn / GrayPigeon_Hacker.com.cn][Stopped/Disabled]
<C:\WINDOWS\Hacker.com.cn><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Media Serial Number Services / Media Serial Number Services][Stopped/Auto Start]
<C:\WINDOWS\System32\moviemk.exe><N/A>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<D:\Rising\Rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\acpidisk.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Running/Manual Start]
<System32\DRIVERS\bcm4sbxp.sys><Broadcom Corporation>
[Cdsys / Cdsys][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\cdcd.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\D:\Rising\Rav\ExpScan.sys><>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\G:\INSTALL\GMSIPCI.SYS><N/A>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
<\??\D:\瑞星\RAV\HOOKAPI.SYS><N/A>
[HookCont / HookCont][Running/Auto Start]
<\??\D:\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\D:\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\D:\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
<\??\D:\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\D:\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
<\??\D:\Rising\Rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[ncio / ncio][Running/Auto Start]
<system32\DRIVERS\ncio.sys><N/A>
[New0 / New0][Running/Auto Start]
<\??\C:\WINDOWS\System32\new.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\cxs qq\qq\XTZJQQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[OMCI / OMCI][Running/System Start]
<\SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS><Dell Computer Corporation>
[PortTalk / PortTalk][Stopped/Manual Start]
<System32\Drivers\PortTalk.sys><Beyond Logic http://www.beyondlogic.org>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Stopped/Disabled]
<\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
<\??\D:\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\D:\Rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[senfilt / senfilt][Running/Manual Start]
<system32\drivers\senfilt.sys><Creative Technology Ltd.>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[SVKP / SVKP][Running/Auto Start]
<\??\C:\WINDOWS\System32\SVKP.sys><AntiCracking>
[win64 / win64][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\system64.sys><Microsoft Corporation>
[WINIO / WINIO][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\winio.sys><N/A>
[XDDFFSS / XDDFFSS][Stopped/Manual Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3sw5.sys><N/A>
[xinstall / xinstall][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\xinstall.sys><N/A>

shanyang - 2007-2-1 9:36:00

[D:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1656][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 272][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.3889]
[D:\迅雷下载\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[D:\瑞星\上网助手\ske\contmenu.dll] [N/A, N/A]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[D:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 308][D:\Rising\Rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 56]
[D:\Rising\Rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[D:\Rising\Rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Rising\Rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[D:\Rising\Rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[D:\Rising\Rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 620][D:\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 776][D:\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
[D:\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[D:\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[D:\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[D:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[D:\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 908][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxhk.dll] [Intel Corporation, 3.0.0.3889]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.3889]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 328][D:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE] [淘宝（中国）软件有限公司, 1, 7, 6, 829]
[D:\Program Files\淘宝网\淘宝旺旺\AliViewCtrl.dll] [vline, 1, 0, 0, 1]
[D:\Program Files\淘宝网\淘宝旺旺\VLNetwork.dll] [, 1, 0, 0, 6]
[D:\Program Files\淘宝网\淘宝旺旺\AliViewMedia.dll] [vline, 1, 0, 0, 1]
[D:\Program Files\淘宝网\淘宝旺旺\VideoCAP.dll] [, 1, 0, 0, 4]
[D:\Program Files\淘宝网\淘宝旺旺\VLAudio.dll] [, 1, 0, 0, 4]
[D:\Program Files\淘宝网\淘宝旺旺\JsmShow.dll] [, 1, 0, 0, 3]
[D:\Program Files\淘宝网\淘宝旺旺\Ali_Res.DLL] [N/A, N/A]
[D:\Program Files\淘宝网\淘宝旺旺\RichOne.dll] [淘宝(中国)软件有限公司, 1.0.0.1]
[D:\Program Files\淘宝网\淘宝旺旺\WangWangX0.dll] [, 1, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

shanyang - 2007-2-1 9:37:00

[D:\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\msdmo.dll] [N/A, N/A]
[PID: 940][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 500][D:\迅雷下载\WebThunder.exe] [深圳市迅雷网络技术有限公司, 1, 6, 0, 87]
[D:\迅雷下载\taskmanage.dll] [Thunder Networking Technologies,LTD, 1, 6, 0, 87]
[D:\迅雷下载\download_interface.dll] [Thunder Networking Technologies,LTD, 2, 12, 3, 46]
[D:\迅雷下载\asyn_dns.dll] [Thunder Networking Technologies,LTD, 2, 12, 3, 46]
[D:\迅雷下载\RegisterDll.dll] [Thunder Networking Technologies,LTD, 2, 2, 1, 43]
[D:\迅雷下载\historyinfo_manage.dll] [Thunder Networking Technologies,LTD, 5, 3, 0, 228]
[D:\迅雷下载\iEmbedShell.dll] [　, 1, 0, 0, 14]
[D:\迅雷下载\iEmbed07.dll] [　, 3, 1, 0, 58]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0]
[PID: 788][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 2656][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\WINDOWS\System32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 2, 6]
[D:\迅雷下载\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll] [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0]
[C:\WINDOWS\System32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINDOWS\System32\upengine.dll] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[PID: 2936][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3484][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
[C:\WINDOWS\System32\KakaTool.dll] [Beijing Rising Technology Co., Ltd., 2, 0, 2, 6]
[D:\迅雷下载\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll] [金泰丰(广州)科技有限公司, 2, 3, 0, 0]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Rising\Rav\RavScrCh.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\WINDOWS\System32\UNISPIM.IME] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[C:\WINDOWS\System32\upengine.dll] [北京清华紫光软件股份有限公司, 3.0.0.3045]
[PID: 3120][D:\Rising\Rav\Rav.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[D:\Rising\Rav\PlugIn\RsPgScan.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 17]
[D:\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[D:\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
[D:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[D:\Rising\Rav\RavUI.Dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
[D:\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
[D:\Rising\Rav\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[D:\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\Rising\Rav\Scanner.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 8]
[D:\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
[D:\Rising\Rav\RavQu.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
[PID: 2812][D:\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[D:\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3348][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3422]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1540][D:\ha_hijackthis_1991\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[D:\ha_hijackthis_1991\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

Enao2005 - 2007-2-1 10:00:00

删除的文件，可以的话传给我 QQ：510704033，麻烦你了

服务部分
删除
[File Replication / File Replication][Stopped/Disabled]
<C:\WINDOWS\system32\ntfis.exe><N/A>
[GrayPigeon_Hacker.com.cn / GrayPigeon_Hacker.com.cn][Stopped/Disabled]
<C:\WINDOWS\Hacker.com.cn><N/A>
[IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start]
<C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Media Serial Number Services / Media Serial Number Services][Stopped/Auto Start]
<C:\WINDOWS\System32\moviemk.exe><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mspmsnsv.dll><Microsoft Corporation>

驱动部分
删除
[Cdsys / Cdsys][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\cdcd.sys><N/A>
[win64 / win64][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\system64.sys><Microsoft Corporation>
[XDDFFSS / XDDFFSS][Stopped/Manual Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3sw5.sys><N/A>

重启删除
C:\WINDOWS\system32\ntfis.exe
C:\WINDOWS\Hacker.com.cn
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\System32\moviemk.exe
C:\WINDOWS\System32\moviemk.exe
C:\WINDOWS\System32\cdcd.sys
C:\WINDOWS\System32\system64.sys
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3sw5.sys

清空下C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\文件

瑞星卡卡安全论坛