一开机时间就变成1987-10-17日 bbs.ikaka.com

镇海铜牛 - 2007-3-11 23:17:00

各位老大：我的机器一开机时间就变成1987-10-17日，修改系统时间后卡巴启动，过一会就会发现几个木马，删除之后机器自动重启，可问题

依旧。我把日志贴上来请各位帮我分析一下，先谢了！

[CODE]

2007-03-11,21:49:55

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> [N/A]
<BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}><"C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"> [Nero AG]
<eMuleAutoStart><C:\Program Files\eMule\emule.exe -AutoStart> [http://www.emule-project.net]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation]
<Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<DAEMON Tools-1033><"C:\Program Files\D-Tools\daemon.exe" -lang 1033> [DAEMON'S HOME]
<kis><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"> [Kaspersky Lab]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [(Verified)Microsoft Corporation]
<SoundMan><SOUNDMAN.EXE> [(Verified)Realtek Semiconductor Corp.]
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<PCSuiteTrayApplication><C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup> [Nokia]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A]
<System><C:\Program Files\Common Files\System\Updaterun.exe> [N/A]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]

==================================

镇海铜牛 - 2007-3-11 23:18:00

==================================
启动文件夹
[BlueSoleil]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\BlueSoleil.lnk --> C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE [IVT Corporation]><N>
[WanSo]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WanSo.lnk --> C:\WINDOWS\system32\rundll32.exe [Microsoft Corporation]><N>

==================================
服务
[4FDF5FD4 / 4FDF5FD4][Stopped/Auto Start]
<C:\WINDOWS\system32\4FDF5FD4.EXE -service><Microsoft Corporation>
[卡巴斯基互联网安全套装 6.0 / AVP][Running/Auto Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r><Kaspersky Lab>
[BlueSoleil Hid Service / BlueSoleil Hid Service][Running/Auto Start]
<C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe><N/A>
[CE3735C6 / CE3735C6][Stopped/Auto Start]
<C:\WINDOWS\system32\CE3735C6.EXE -service><Microsoft Corporation>
[sdhcvs / edfscv][Stopped/Auto Start]
<C:\WINDOWS\system32\fgdfsdf.exe -service><Microsoft Corporation>
[File Replication / File Replication][Running/Auto Start]
<C:\WINDOWS\system32\ntfis.exe><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Vsn hxoy Service / hxoy][Running/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\naue\uhyl.dll,Service><Microsoft Corporation>
[Application Accelerator / Investor][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\cbwii.dll><N/A>
[Messagerp / Messagerp][Running/Auto Start]
<c:\svchost.exe><N/A>
[ServiceLayer / ServiceLayer][Running/Manual Start]
<"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>
[Network IPSEC Connections / SOCEESe][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL2000.EXE C:\WINDOWS\SYSTEM32\WBEM\CYVOT.DLL,Export 1087><Microsoft Corporation>
[Std yofs Service / yofs][Running/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\COMMON~1\agxk\dtkx.dll,Service -s><Microsoft Corporation>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Bluetooth Audio Service / BlueletAudio][Running/Manual Start]
<system32\DRIVERS\blueletaudio.sys><IVT Corporation>
[Bluetooth SCO Audio Service / BlueletSCOAudio][Running/Manual Start]
<system32\DRIVERS\BlueletSCOAudio.sys><IVT Corporation>
[Bluetooth PAN Network Adapter / BT][Running/Manual Start]
<system32\DRIVERS\btnetdrv.sys><IVT Corporation>
[Bluetooth USB For Bluetooth Service / Btcsrusb][Stopped/Manual Start]
<System32\Drivers\btcusb.sys><IVT Corporation>
[Bluetooth HID Enumerator / BTHidEnum][Running/Manual Start]
<system32\DRIVERS\vbtenum.sys><N/A>
[Bluetooth HID Manager Service / BTHidMgr][Running/Boot Start]
<\SystemRoot\System32\Drivers\BTHidMgr.sys><IVT Corporation>
[Bluetooth Network Filter / BTNetFilter][Stopped/Manual Start]
<\??\C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys><N/A>
[cdnprot / cdnprot][Running/Boot Start]
<\SystemRoot\system32\drivers\cdnprot.sys><中国互联网络信息中心(CNNIC)>
[C-Media WDM Audio Interface / cmuda][Stopped/Manual Start]
<system32\drivers\cmuda.sys><C-Media Inc>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
<system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[fkwld / fkwld][Running/System Start]
<system32\drivers\fkwld.sys><Microsoft Corporation>
[fsszzh2 / fsszzh20][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\fsszzh20.sys><N/A>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
<\??\H:\INSTALL\GMSIPCI.SYS><N/A>
[hagcifbh / hagcifbh][Stopped/Boot Start]
<\SystemRoot\system32\drivers\hagcifbh.sys><N/A>
[hidproc / hidproc][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\hidproc.sys><N/A>
[InCD File System / InCDFs][Stopped/Disabled]
<system32\drivers\InCDFs.sys><N/A>
[InCDPass / InCDPass][Stopped/System Start]
<system32\drivers\InCDPass.sys><N/A>
[InCD Reader / InCDRm][Stopped/System Start]
<system32\drivers\InCDRm.sys><N/A>
[irgijr5 / irgijr56][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\irgijr56.sys><Microsoft Corporation>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[mgkzzb82 / mgkzzb82][Stopped/Boot Start]
<\SystemRoot\system32\\drivers\\mgkzzb82.sys><N/A>
[ncio / ncio][Running/Auto Start]
<system32\DRIVERS\ncio.sys><N/A>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
<system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
<system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
<system32\drivers\nmwcd.sys><Nokia>
[Nokia USB Port / Nokia USB Port][Stopped/Manual Start]
<system32\drivers\nmwcdcj.sys><Nokia>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[npsfsb7 / npsfsb74][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\npsfsb74.sys><N/A>
[NTACCESS / NTACCESS][Stopped/Manual Start]
<\??\H:\NTACCESS.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[SetupNTGLM7X / SetupNTGLM7X][Stopped/Manual Start]
<\??\H:\NTGLM7X.sys><N/A>
[szkkm / szkkm][Stopped/Auto Start]
<\??\C:\WINDOWS\system32\drivers\szkkm.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[xuuj_x / xuuj_x][Stopped/Boot Start]
<\SystemRoot\system32\drivers\xuuj_x.sys><N/A>

镇海铜牛 - 2007-3-11 23:22:00

==================================
浏览器加载项
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[eulv]
{28AF26C4-E346-4D94-A7C6-B97AFE223018} <C:\PROGRA~1\COMMON~1\naue\revi.dll, >
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[Web反病毒保护]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll, Kaspersky Lab>
[豪杰超级解霸9]
{367E0A21-8601-4986-9C9A-153BF5ACA118} <C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE, herosoft>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[番茄花园]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[BitComet工具栏]
{3F1ABCDB-A875-46c1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
[PeerDraw Class]
{10072CEC-8CC1-11D1-986E-00A0C955B42E} <C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll, Microsoft Corporation>
[CAdLogic Object]
{11F09AFD-75AD-4E51-AB43-E09E9351CE16} <C:\Program Files\Common Files\CPUSH\cpush.dll, N/A>
[CEnroll Class]
{127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>
[iTrusPTA Class]
{1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, >
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[eulv]
{28AF26C4-E346-4D94-A7C6-B97AFE223018} <C:\PROGRA~1\COMMON~1\naue\revi.dll, >
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[BitComet工具栏]
{3F1ABCDB-A875-46C1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A>
[CEditCtrl Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[HHCtrl Object]
{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Shell Name Space]
{55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, CNNIC>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[WangWangObj Class]
{6E213FC7-DD5A-4115-B7E6-D4C7838C361E} <C:\Program Files\淘宝网\淘宝旺旺\WangWangX4.dll, 阿里软件（中国）有限公司>
[AxInputControl Class]
{73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, >
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll, Thunder Networking Technologies,LTD>
[AxSubmitControl Class]
{8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Qzone Media Tools]
{AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <C:\PROGRA~1\Tencent\QQ\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
{CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
<C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
<C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用超级解霸播放]
<C:\Program Files\Herosoft\Hero 9\MPURLGET.HTM, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[访问通用网址]
<C:\Program Files\CNNIC\Cdn\cnnic.htm, N/A>

镇海铜牛 - 2007-3-11 23:24:00

==================================
正在运行的进程
[PID: 916][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1016][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\klogon.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\bdrrdf.dll] [Microsoft Corporation, N/A]
[PID: 1060][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1072][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1232][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1280][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1492][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 1608][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1704][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1940][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll] [Nokia, 6, 80, 37, 4]
[C:\Program Files\Nokia\Nokia PC Suite 6\PCSCM.dll] [Nokia, 6, 80, 66, 0]
[C:\WINDOWS\system32\ConnAPI.DLL] [Nokia., 6, 80, 55, 5]
[C:\Program Files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_chi-sc.nlr] [Nokia, 6, 80, 26, 0]
[C:\Program Files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr] [Nokia, 6, 80, 8, 0]
[C:\WINDOWS\system32\bdrrdf.dll] [Microsoft Corporation, N/A]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll] [Nero AG, 2, 0, 0, 7]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.5.2005092300]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\PROGRA~1\COMMON~1\naue\revi.dll] [, 1, 2, 0, 8]
[PID: 172][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 396][C:\Program Files\CNNIC\Cdn\cdnup.exe] [CNNIC, 2, 5, 0, 6]
[C:\Program Files\CNNIC\Cdn\cdnuplib.dll] [CNNIC, 2, 5, 0, 5]
[C:\Program Files\CNNIC\Cdn\cdnprh.dll] [CNNIC, 2, 4, 0, 3]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 556][C:\Program Files\D-Tools\daemon.exe] [DAEMON'S HOME, 3.47.0.0]
[C:\WINDOWS\daemon.dll] [N/A, 3.47.0.0]
[C:\Program Files\D-Tools\PFCTOC.DLL] [Padus(R), Inc., 1, 0, 0, 12]
[C:\Program Files\D-Tools\Plugins\Images\ccdmount.dll] [GENERIC, 1.02.0.0]
[C:\Program Files\D-Tools\Plugins\Images\mdsmount.dll] [GENERIC, 1.01.0.0]
[C:\Program Files\D-Tools\Plugins\Images\pdimount.dll] [GENERIC, 1.01.0.0]
[C:\Program Files\D-Tools\Plugins\Images\nrgmount.dll] [GENERIC, 1.02.0.0]
[C:\Program Files\D-Tools\Plugins\Images\bw5mount.dll] [N/A, 1.0.2.0]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[PID: 604][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 54]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 684][C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE] [Nokia, 6, 80, 53, 3]
[C:\WINDOWS\system32\ConnAPI.DLL] [Nokia., 6, 80, 55, 5]
[C:\PROGRA~1\Nokia\NOKIAP~1\PCSCM.dll] [Nokia, 6, 80, 66, 0]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Common Files\PCSuite\ConfServer\ConfServer.dll] [Nokia, 6, 80, 20, 4]
[C:\WINDOWS\system32\NclTools.dll] [Nokia., 6, 80, 18, 3]
[C:\PROGRA~1\Nokia\NOKIAP~1\Lang\LaunchApplication_chi-sc.NLR] [Nokia, 6, 80, 56, 0]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[PID: 800][C:\Program Files\Common Files\System\Updaterun.exe] [N/A, N/A]
[PID: 872][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 1436][C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe] [Nero AG, 1, 0, 1, 5]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Common Files\Ahead\lib\NMIndexStoreSvrPS.dll] [Nero AG, 1, 0, 1, 5]
[C:\Program Files\Common Files\Ahead\lib\NMDataServices.dll] [Nero AG, 1, 0, 1, 5]
[PID: 1452][C:\Program Files\eMule\emule.exe] [http://www.emule-project.net, 0.47.2 Unicode]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\eMule\lang\zh_CN.dll] [http://www.emule-project.net, 0.47.2]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[PID: 1556][C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe] [IVT Corporation, 2, 1, 3, 0]
[C:\Program Files\IVT Corporation\BlueSoleil\btpcfg.dll] [IVT Corporation, 2, 1, 0, 0]
[C:\Program Files\IVT Corporation\BlueSoleil\setup.dll] [IVT Corporation, 2, 2, 0, 0]
[C:\Program Files\IVT Corporation\BlueSoleil\hcicmd.dll] [N/A, N/A]
[C:\Program Files\IVT Corporation\BlueSoleil\btwin.dll] [, 1, 1, 0, 0]
[C:\Program Files\IVT Corporation\BlueSoleil\versit.dll] [Versit Consortium (Apple Computer, AT&T, IBM and Siemens), 1, 0, 0, 1]
[C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\Program Files\IVT Corporation\BlueSoleil\btpres.dll] [IVT Corporation, 2, 2, 0, 0]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\IVT Corporation\BlueSoleil\Driver\USB\btcusb.dll] [IVT Corporation, 1, 2, 1, 0]
[C:\WINDOWS\system32\L3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\WINDOWS\system32\tssoft32.acm] [DSP GROUP, INC., 1.01]
[C:\WINDOWS\system32\tsd32.dll] [N/A, N/A]
[C:\WINDOWS\system32\sl_anet.acm] [Sipro Lab Telecom Inc., 3.02]
[C:\WINDOWS\system32\iac25_32.ax] [Intel Corporation, 2.05.53]
[C:\WINDOWS\system32\vorbis.acm] [HMS http://hp.vector.co.jp/authors/VA012897/, 0, 0, 3, 6]
[C:\WINDOWS\system32\vct3216.acm] [Voxware, Inc., 1.6.0.17]
[C:\WINDOWS\system32\vct3216.dll] [Voxware, Inc., 1.6.0.12]
[C:\WINDOWS\system32\msms001.vwp] [Voxware, Inc., 2.0.2.61]
[C:\WINDOWS\system32\mvoice.vwp] [Voxware, Inc., 2.0.0.12.01]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 1548][C:\WINDOWS\system32\RunDll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\COMMON~1\WANSO\Player.dll] [ , 1, 0, 0, 1]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 292][C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe] [N/A, N/A]
[PID: 1776][C:\WINDOWS\system32\cdsdf.exe] [N/A, N/A]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 2060][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\COMMON~1\naue\uhyl.dll] [, 1, 2, 0, 8]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 2092][C:\WINDOWS\system32\inetsrv\inetinfo.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2116][c:\svchost.exe] [N/A, N/A]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[PID: 2236][C:\WINDOWS\SYSTEM32\RUNDLL2000.EXE] [Microsoft Corporation, 5.00.2134.1]
[PID: 2372][C:\WINDOWS\system32\rundll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\PROGRA~1\COMMON~1\agxk\dtkx.dll] [ , 4, 1, 0, 4]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\ivps.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]
[PID: 3024][C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe] [Nokia., 6, 80, 56, 4]
[C:\WINDOWS\system32\NclTools.dll] [Nokia., 6, 80, 18, 3]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Common Files\PCSuite\Transports\NCLIrDAMM.dll] [Nokia Corp., 6, 80, 26, 0]
[C:\Program Files\Common Files\PCSuite\Transports\NCLRSMM.dll] [Nokia, 6, 80, 33, 0]
[C:\Program Files\Common Files\PCSuite\Transports\NCLUSBMM.dll] [Nokia, 6, 80, 37, 0]
[C:\Program Files\Common Files\PCSuite\Transports\NclMSBTMM.dll] [Nokia., 6, 80, 38, 2]
[PID: 3564][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 336][F:\反病毒\tool\sreng2\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\system32\irgijr56.dll] [, 1, 1, 1, 1002]
[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
[C:\PROGRA~1\COMMON~1\agxk\gwnx.dll] [, 1, 0, 0, 6]
[C:\PROGRA~1\COMMON~1\agxk\lysc.dll] [ , 1, 0, 0, 6]
[C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\adialhk.dll] [Kaspersky Lab, 6.0.0.299]

镇海铜牛 - 2007-3-11 23:25:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
警告！System Repair Engineer 提醒
你下面的函数内容与预期值不符，他
们可能被一些恶意的软件所修改：
RVA 错误： LoadLibraryA
RVA 错误： LoadLibraryExA
RVA 错误： LoadLibraryExW
RVA 错误： LoadLibraryW

==================================

[/CODE]

镇海铜牛 - 2007-3-12 12:06:00

自己顶一下，希望能获得帮助

guanshenyan - 2007-3-12 12:24:00

我好像在哪本书看过..这病毒我还记得,但是解决方法呢,,我就无能为力了~.

范午夜Gravity - 2007-3-12 12:30:00

[C:\Program Files\CNNIC\Cdn\cdnforie.dll] [CNNIC, 2, 1, 0, 3]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> [CNNIC]
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\BlueSoleil.lnk --> C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE [IVT Corporation]><N>
[WanSo]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\WanSo.lnk --> C:\WINDOWS\system32\rundll32.exe [Microsoft Corporation]><N>

范午夜Gravity - 2007-3-12 12:30:00

有把握先告诉你了,可能杀不干净

thomas2004 - 2007-3-12 12:49:00

【回复“镇海铜牛”的帖子】
CMOS电池没电了吧..??

newcenturymoon - 2007-3-12 13:32:00

安全模式下(开机后不断按F8键然后出来一个高级菜单选择第一项安全模式进入系统)
打开sreng （就是你扫日志的软件）启动项目注册表删除如下项目 (如果有哪项你认识或者确认不是病毒请不要删除)
<System><C:\Program Files\Common Files\System\Updaterun.exe> [N/A]

“启动项目”-“服务”-“Win32服务应用程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：

4FDF5FD4 / 4FDF5FD4
CE3735C6 / CE3735C6
Messagerp / Messagerp
sdhcvs / edfscv
File Replication / File Replication
Vsn hxoy Service / hxoy
Application Accelerator / Investor
Std yofs Service / yofs

在“启动项目”-“服务”-“驱动程序”中点“隐藏经认证的微软项目”，
选中以下项目，点“删除服务”，再点“设置”，在弹出的框中点“否”：
fkwld / fkwld
szkkm / szkkm

双击我的电脑－工具－文件夹选项－查看－显示所有文件和文件夹，把“隐藏受保护的系统文件”的勾去掉。
然后删除system32\drivers\fkwld.sys
C:\WINDOWS\system32\drivers\szkkm.sys
:\WINDOWS\system32\bdrrdf.dll
C:\WINDOWS\system32\irgijr56.dll
C:\PROGRA~1\COMMON~1\agxk下面所有文件
C:\WINDOWS\system32\cdsdf.exe
C:\PROGRA~1\COMMON~1\naue下面所有文件
c:\svchost.exe
C:\WINDOWS\system32\4FDF5FD4.EXE
C:\WINDOWS\system32\CE3735C6.EXE
C:\WINDOWS\system32\fgdfsdf.exe
C:\WINDOWS\system32\ntfis.exe
C:\WINDOWS\system32\cbwii.dll

瑞星卡卡安全论坛