惊叹：d9j.com逃避查杀，难倒高手一片！！ bbs.ikaka.com

小呀小顽童 - 2007-3-1 10:04:00

CODE:

2007-03-01,09:44:29

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ShStatEXE><"D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE> [McAfee, Inc.]
<McAfeeUpdaterUI><"D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey> [Network Associates, Inc.]
<Network Associates Error Reporting Service><"D:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"> [Network Associates, Inc.]
<nod32kui><"D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE> [(Verified)Eset ]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><D:\WINDOWS\system32\userinit.exe> [(Verified)Microsoft Corporation]
<UIHost><%SystemRoot%\system32\logonui.exe> [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Framework 服务 / McAfeeFramework][Running/Auto Start]
<D:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Network Associates McShield / McShield][Running/Auto Start]
<"D:\Program Files\Network Associates\VirusScan\Mcshield.exe"><McAfee, Inc.>
[Network Associates Task Manager / McTaskManager][Running/Auto Start]
<"D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
<"D:\Program Files\Eset\nod32krn.exe"><Eset>
[RsRavMon Service / RsRavMon][Stopped/Auto Start]
<"D:\Program Files\Rising\Rav1\Ravmond.exe"><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Disabled]
<><N/A>

==================================
驱动程序
[AMON / AMON][Running/Auto Start]
<\SystemRoot\system32\drivers\amon.sys><Eset>
[ati2mpad / ati2mpad][Running/Manual Start]
<system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[Intel(R) PRO/1000 Device Driver / E1000][Running/Manual Start]
<system32\DRIVERS\e1000325.sys><Intel Corporation>
[ExpScaner / ExpScaner][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\ExpScan.sys><N/A>
[HookCont / HookCont][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\HOOKCONT.sys><N/A>
[HookReg / HookReg][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\HookReg.sys><N/A>
[HookSys / HookSys][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\HookSys.sys><N/A>
[IP in IP Tunnel Driver / IpInIp][Stopped/Disabled]
<system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\MEMSCAN.sys><N/A>
[NaiAvFilter1 / NaiAvFilter1][Running/Manual Start]
<system32\drivers\naiavf5x.sys><McAfee Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
<system32\drivers\mvstdi5x.sys><McAfee Inc.>
[nod32drv / nod32drv][Running/System Start]
<\SystemRoot\system32\drivers\nod32drv.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RSPPSYS / RSPPSYS][Stopped/Disabled]
<\??\D:\Program Files\Rising\Rav1\RSPPSYS.sys><N/A>
[Secdrv / Secdrv][Stopped/Disabled]
<system32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<system32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[symmpi / symmpi][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\symmpi.sys><LSI Logic>
[xyfilemon / xyantivirus][Stopped/Disabled]
<\??\D:\tem\VRV2005\VRV2005\vrv2005\filemon.sys><N/A>
[EntDrv52 / EntDrv52][Running/Manual Start]
<\??\D:\WINDOWS\system32\drivers\EntDrv52.sys><McAfee, Inc>

==================================
浏览器加载项
[Shell name]
{D682D42E-BE2C-4758-AB18-926D2E7553B8} <D:\WINDOWS\system32\vmmreg32.dll, Microsoft Corporation>
[kele8]
{84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[Fc2Boot Class]
{ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <D:\WINDOWS\Downloaded Program Files\fc2boot.dll, 北京线线通科技开发有限公司>
[&使用BitComet下载]
<res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm, N/A>
[&使用BitComet下载全部链接]
<res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[&使用BitComet下载本页视频]
<res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm, N/A>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 404][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 456][\??\D:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 480][\??\D:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 524][D:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 536][D:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 688][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 740][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 912][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 980][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1020][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1268][D:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[PID: 1296][D:\WINDOWS\system32\msdtc.exe] [Microsoft Corporation, 2001.12.4720.0 (srv03_rtm.030324-2048)]
[PID: 1400][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1432][D:\Program Files\Network Associates\Common Framework\FrameworkService.exe] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\applib.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\Logging.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\InternetManager.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\naInet.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\UserSpace.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\Management.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\cmalib.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\naPolicyManager.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\PsApi.dll] [Microsoft Corporation, 4.00]
[D:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\Scheduler.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\TCSubSys.dll] [Network Associates, Inc., 3.5.0.412]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1500][D:\Program Files\Network Associates\VirusScan\Mcshield.exe] [McAfee, Inc., 8.0.0.336]
[D:\Program Files\Network Associates\VirusScan\Res04\McShield.DLL] [Network Associates, Inc., 8.0.0.251]

小呀小顽童 - 2007-3-1 10:04:00

[D:\Program Files\Network Associates\VirusScan\FTL.Dll] [Network Associates, Inc., 8.0.0.135]
[D:\Program Files\Network Associates\VirusScan\naiann.dll] [Network Associates, Inc., 8.0.0.308]
[D:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[D:\Program Files\Network Associates\Common Framework\GenEvtInf.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\VirusScan\NaEventU.DLL] [Network Associates, Inc., 8.0.0.356]
[D:\Program Files\Network Associates\VirusScan\Res04\naEvtRes.dll] [Network Associates, Inc., 8.0.0.342]
[D:\Program Files\Network Associates\VirusScan\VSIDSvr.dll] [Network Associates, Inc., 8.0.0.291]
[D:\Program Files\Common Files\Network Associates\Engine\MCSCAN32.DLL] [McAfee, Inc., 5.1.00]
[D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\VirusScan\EntSrv.Dll] [McAfee, Inc, 8.0.0.453]
[D:\WINDOWS\system32\msxml4.dll] [Microsoft Corporation, 4.20.9818.0]
[PID: 1528][D:\Program Files\Network Associates\VirusScan\VsTskMgr.exe] [Network Associates, Inc., 8.0.0.1004]
[D:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [McAfee, Inc., 8.0.0.1036]
[D:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\naicondl.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\RES04\VsTskMgr.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\MIDUtil.Dll] [McAfee, Inc., 8.0.0.155]
[PID: 1584][D:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe] [Network Associates, Inc., 3.5.0.412]
[D:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[D:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[D:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[D:\PROGRA~1\NETWOR~1\COMMON~1\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\VirusScan\VsPlugin.dll] [McAfee, Inc., 8.0.0.1039]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1612][D:\Program Files\Eset\nod32krn.exe] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\ps_amon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\ps_dmon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\ps_emon.dll] [Eset , 2, 70, 32 ]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\ps_nod32.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\ps_upd.dll] [Eset , 2, 70, 32 ]
[PID: 1660][D:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 1728][D:\WINDOWS\system32\Dfssvc.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 660][D:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[D:\winrar\rarext.dll] [N/A, N/A]
[PID: 936][D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE] [McAfee, Inc., 8.0.0.1040]
[D:\Program Files\Network Associates\VirusScan\SHUTIL.dll] [McAfee, Inc., 8.0.0.1036]
[D:\Program Files\Network Associates\VirusScan\naiwmain.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\RES04\shstat.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\RES04\Product.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\RES04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[D:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll] [Network Associates, Inc., 8.0.0.912]
[D:\Program Files\Network Associates\VirusScan\Graphics.dll] [Network Associates, Inc., 8.0.0.912]
[PID: 964][D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\nailog.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\naCmnLib.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\naXML.dll] [Network Associates, Inc., 3.5.0.474]
[D:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll] [Network Associates, Inc., 3.5.0.412]
[D:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] [Network Associates, Inc., 3.5.0.412]
[PID: 920][D:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe] [Network Associates, Inc., 2.0.275.0]
[PID: 1196][D:\Program Files\Eset\nod32kui.exe] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_amon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_dmon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_emon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_imon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_nod32.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Eset\pu_upd.dll] [Eset , 2, 70, 32 ]
[PID: 1540][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\vmmreg32.dll] [Microsoft Corporation, 5.00.3700.6690]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Network Associates\VirusScan\scriptproxy.dll] [Network Associates, Inc., 8.0.0.1012]
[D:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[D:\Program Files\Network Associates\VirusScan\Res04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[D:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]
[D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[D:\WINDOWS\system32\msdmo.dll] [N/A, N/A]
[D:\WINDOWS\system32\01668EA6.IME] [LongWen Corporation, 3.8.200]
[PID: 3228][D:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 3368][D:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[PID: 4028][D:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.3790.0 (srv03_rtm.030324-2048)]
[D:\WINDOWS\system32\EntApi.dll] [McAfee, Inc, 8.0.0.453]
[D:\WINDOWS\system32\vmmreg32.dll] [Microsoft Corporation, 5.00.3700.6690]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\Program Files\Network Associates\VirusScan\scriptproxy.dll] [Network Associates, Inc., 8.0.0.1012]
[D:\Program Files\Network Associates\VirusScan\mytilus.dll] [McAfee, Inc., 8.0.0.337]
[D:\Program Files\Network Associates\VirusScan\Res04\McShield.dll] [Network Associates, Inc., 8.0.0.251]
[D:\Program Files\Common Files\Network Associates\Engine\mcscan32.dll] [McAfee, Inc., 5.1.00]
[D:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[PID: 2472][D:\SREng2.3\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[D:\WINDOWS\system32\imon.dll] [Eset , 2, 70, 32 ]
[D:\SREng2.3\Plugins\SRECXTMG.SRE] [Smallfrogs Studio, 1, 5, 0, 55]
[D:\SREng2.3\Plugins\NWMON.SRE] [Smallfrogs Studio, 1, 0, 0, 8]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP Error. [winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
NOD32 protected [MSAFD Tcpip [TCP/IP]]
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [UDP/IP]]
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [MSAFD Tcpip [RAW/IP]]
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP UDP Service Provider]
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32 protected [RSVP TCP Service Provider]
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)
NOD32
D:\WINDOWS\system32\imon.dll(Eset , NOD32 IMON - Internet scanning support)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================

小呀小顽童 - 2007-3-1 10:04:00

请指点。怎么样去除？

小呀小顽童 - 2007-3-1 17:24:00

过瘾，这样的病毒，推荐大家都中几回。

oarbznd1 - 2007-3-1 17:28:00

try,看留言

小呀小顽童 - 2007-3-1 17:36:00

引用:

【oarbznd1的贴子】try,看留言
………………

多谢，目前尚未成功，正在进一步测试。

此首页实在是厉害，HACKJACKTHIS，卡卡助手，NOD32，MCAFEE，SRE等都未查出明显异常，而且首页也可以修改，但片刻后改回，服务亦未发现异常。平时处理此类病毒的高手，这次都已无能为力了！

行星001 - 2007-3-1 17:41:00

看一下“反浏览器劫持终极方法之我是流氓我怕谁”，应该能解决。

小呀小顽童 - 2007-3-1 17:49:00

引用:

【行星001的贴子】看一下“反浏览器劫持终极方法之我是流氓我怕谁”，应该能解决。
………………

多谢提醒。
不到万不得已，我不准备改这个，虽然这招很绝。刚才我看了，加个参数应该会有用，但我不知道这次除了浏览器之外，是否还有别的伤害。

瑞星卡卡安全论坛