急，高手速度进哦！听说是熊猫-烧香（- -！~） bbs.ikaka.com

气质妞妞 - 2007-3-16 22:45:00

郁闷```不知是怎么样惹上的病毒，电脑上的办公软件都没问题，就是下载的网络游戏，包括迅雷和QQ，起先它们的图标就都变成一样的好象是红色图标“AT1”，后来经过我一番折腾，就变成那种我们打开记事本的那个格式，四四方方的，要打开它们的时候，出现这种字样：
c:\Documents and Settings\user\桌面\腾讯QQ.1nk NTVDM CPU 遇到无效指令
CS：0dc6 IP:042a OP:63 ac 3c 3b 74 选择“关闭”终止应用程序

各位好心人请帮帮忙，我对电脑一窃不通，现在电脑中了病毒，真的急啊，郁闷，晚上一定会失眠的，这是公司的电脑，唉。。。。。。在线等消息。。。

IBM①5 - 2007-3-16 22:52:00

你用的是什么杀毒软件啊?

气质妞妞 - 2007-3-16 22:56:00

用“NimayaKiller.scr” 这个``还有那个瑞星杀毒软件，两个一起杀的，杀来杀去```就是不起作用耶```哭死`````怎么办泥？

IBM①5 - 2007-3-16 23:08:00

晕~~一台机上不要装两种杀毒软件啊!!

气质妞妞 - 2007-3-16 23:11:00

呃，那种“NimayaKiller.scr”是专杀熊猫—烧香的专用工具，55555`晚上才下载哦，那那那，我接下来该怎么办，你能肯定的告诉我不是中了熊猫吗？我刚才看了一些资料，它好象是新病毒来的哦，还很难杀，这回真的只有等死了。。。。。

IBM①5 - 2007-3-16 23:28:00

你公司应该有GHSOT备份的吧!!GHOST下啦!

气质妞妞 - 2007-3-16 23:37:00

“GHOST”下？妈妈咪啊```是什么意思啊```5555`帅哥请你说清楚点哦```对电脑我实在是外行```- -！！！！

异族风剑 - 2007-3-16 23:39:00

有图吗？发上来看看！或发给扫苗日记上来看看！~

寻找北方的哥儿 - 2007-3-16 23:41:00

下载 System Repair Engineer，
http://www.kztechs.com/sreng/download.html
1 解压缩sreng2.zip
2 运行SREng.exe
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改

扫描前关闭所有手工打开的软件和窗口，扫描后将日志发上来。但请不要用附件形式贴。
注意在没有进一步提示前，勿要胡乱修复，否则系统可能变的情况更糟。

如果发现SREng.exe运行无反应或者不能运行或者扫描出错,你可以将SREng.exe重命名为SREng.com(SREng.scr\SREng.bat\SREng.pif)或者abc.exe运行.

气质妞妞 - 2007-3-16 23:51:00

呃，QQ打开不了，所以截不了图，唉。。。
上面的好心人，你说的东东偶现在在弄，给偶点时间哦，你们也不要偷溜哦，再等一下下，偶在时刻发表最新消息的哦。。。（呜呜，偶可怜的皮肤啊，可怜的眼睛，可怜的心灵。。。）

气质妞妞 - 2007-3-17 0:07:00

[CODE]

2007-03-16,23:48:26

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<igfxtray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<igfxhkcmd><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Publisher]
<igfxpers><C:\WINDOWS\system32\igfxpers.exe> [(Verified)Microsoft Windows Publisher]
<FASTKEY><C:\Program Files\Lenovo\功能键盘\HotKeyB.exe> [联想电脑公司]
<locker><C:\WINDOWS\locker.exe> []
<OrderReminder><C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe> [Hewlett-Packard]
<WebThunder><E:\新建文件夹\WebThunder.exe> [N/A]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\Windows\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
<UIHost><"\Program Files\Logonui\Logonui.exe"> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
<WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\uklognf]
<WinlogonNotify: uklognf><uklognf.dll> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\Program Files\TCL\EROS\theme\SHE02\SHE02.Scr> []

==================================
启动文件夹
N/A

==================================
服务
[Lenovo file protect service / fsp][Running/Auto Start]
<C:\WINDOWS\fsp.exe><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[KDDelegateService / KDDelegateService][Stopped/Manual Start]
<C:\Program Files\Kingdee\KIS\Advance\KDDelegateService.exe><N/A>
[Lenovo auto login helper / usblogon][Running/Auto Start]
<C:\WINDOWS\usblogon.exe><N/A>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AliIde / AliIde][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\aliide.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CmdIde / CmdIde][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[ialm / ialm][Running/Manual Start]
<system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[MegaIDE / MegaIDE][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\D:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[nv / nv][Stopped/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
<system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[Sentinel / Sentinel][Running/Auto Start]
<\SystemRoot\System32\Drivers\SENTINEL.SYS><Rainbow Technologies, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>

扫描之后就是这个报告哦。。。晕晕。。。看不懂。。。

气质妞妞 - 2007-3-17 0:08:00

==================================
浏览器加载项
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\新建文件夹\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[启动Web迅雷]
{962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll, >
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[LiveMediaOcx Control]
{9242BB35-0DB0-43AC-8DFC-8EA07E63B92A} <D:\PROGRA~1\Tencent\QQLIVE~1\QQLive.ocx, Tencent>
[WebThunder Browser Helper]
{00000AAA-A363-466E-BEF5-9BB68697AA7F} <E:\新建文件夹\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[ActiveMovieControl Object]
{05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4CD4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll, >
[Active Desktop Mover]
{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
[Microsoft Web 浏览器]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[RMGetLicense Class]
{A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Messenger Object]
{B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[RDS.DataSpace]
{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[卡卡上网安全助手]
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[上传到QQ网络硬盘]
<D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用Web迅雷下载]
<E:\新建文件夹\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
<E:\新建文件夹\GetAllUrl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://c:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

气质妞妞 - 2007-3-17 0:08:00

==================================
正在运行的进程
[PID: 476][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 548][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 572][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\uklognf.dll] [N/A, ]
[C:\WINDOWS\system32\mangdrive.dll] [N/A, ]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 616][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 628][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 892][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 936][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1004][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1196][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\CNMLM3y.DLL] [CANON INC., 1.52.2.0]
[C:\WINDOWS\system32\ZLhp1018.DLL] [Zenographics, Inc., 5, 53, 3726, 0]
[C:\WINDOWS\system32\ZLM.dll] [Zenographics, Inc., 5, 50, 1416, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD3y.DLL] [CANON INC., 1.52.2.0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINDOWS\system32\Imf32.dll] [Zenographics, Inc., 5, 60, 1204, 0]
[C:\WINDOWS\system32\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\system32\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[PID: 1800][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3790.3646 built by: DNSRV(bld4act)]
[C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\igfxpph.dll] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\igfxress.dll] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4396]
[E:\新建文件夹\WebThunderBHO_016.dll] [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 2028][C:\WINDOWS\system32\hkcmd.exe] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\WINDOWS\system32\igfxres.dll] [Intel Corporation, 3.0.0.4396]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 136][C:\WINDOWS\system32\igfxpers.exe] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4396]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 172][C:\Program Files\Lenovo\功能键盘\HotKeyB.exe] [联想电脑公司, 2, 2, 0, 1]
[C:\Program Files\Lenovo\功能键盘\kbddrv.dll] [N/A, ]
[C:\Program Files\Lenovo\功能键盘\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 164][C:\WINDOWS\locker.exe] [N/A, ]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 212][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe] [Hewlett-Packard, 2, 1, 1, 29]
[PID: 248][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3275]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 256][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[PID: 264][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1720][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 18320][D:\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\WINDOWS\system32\WINWB86.IME] [Microsoft Corporation, 4.00.950]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

异族风剑 - 2007-3-17 0:15:00

你电脑中木马，中病毒，我只能看出几个等高手来帮你看日记吧！~

寻找北方的哥儿 - 2007-3-17 0:18:00

对联想电脑的安装服务以及驱动不怎么熟....因此不敢武断..

打开sreng （就是你扫日志的软件）启动项目注册表删除如下项目
<locker><C:\WINDOWS\locker.exe> []
<WinlogonNotify: uklognf><uklognf.dll> []

进入安全模式,双击我的电脑－工具－文件夹选项－查看－显示所有文件和文件夹,显示系统文件夹的内容-确定
删除
C:\WINDOWS\locker.exe

气质妞妞 - 2007-3-17 0:25:00

惨啊````真想哭`````
那个软件的启动项目不让打开啊，偶点它的时候有一个对话框一闪就过，偶点了好几次，就只能看到警告还有结尾的病毒，郁闷，这样的话，还要进安全模式删掉那个文件吗？？？：（

异族风剑 - 2007-3-17 0:32:00

C:\WINDOWS\system32\mangdrive.dll

气质妞妞 - 2007-3-17 0:41:00

郁闷。。。麻烦麻烦。。。帮忙请帮到底哦。。。现在公司要关门了。。偶被迫下线```明天早上`希望会有奇迹出现哦``顺便问问```中的这些病毒会影响偶办公软件的使用吗？555明天可能一大堆事要做啊````忙得快晕了```````

异族风剑 - 2007-3-17 0:45:00

应该不会，你的不是熊猫烧香

我是来来 - 2007-3-17 8:01:00

熊猫？？

气质妞妞 - 2007-3-17 8:04:00

不是？？那还好还好```为什么没有惊喜的```呜呜呜``难道对这病毒真的一点办法都没吗？郁闷啊```

水树雨下 - 2007-3-17 8:19:00

[Lenovo auto login helper / usblogon][Running/Auto Start]
<C:\WINDOWS\usblogon.exe><N/A>

气质妞妞 - 2007-3-17 8:28:00

- -！！！楼上的GG``你列出的那几个是什么意思啊？是病毒吗？要偶删掉？能否详细点````电脑方面偶是菜鸟``````

气质妞妞 - 2007-3-17 8:54:00

该诊断报告由360安全卫士提供 http://www.360safe.com
诊断时间: 2007-03-17 08:40:03
诊断平台: Microsoft Windows XP Service Pack 2
IE版本: Internet Explorer V6.0.2900.2180 Build:62900.2180
计算机物理内存:502MB - 当前可用内存:273MB

100 - 未知 - Process: fsp.exe [] - C:\WINDOWS\fsp.exe
100 - 未知 - Process: usblogon.exe [] - C:\WINDOWS\usblogon.exe
100 - 未知 - Process: spoclsv.exe [] - C:\WINDOWS\system32\drivers\spoclsv.exe
O4 - 未知 - HKLM\..\Run: [locker] [] C:\WINDOWS\locker.exe
O4 - 未知 - HKCU\..\Run: [svcshare] [] C:\WINDOWS\system32\drivers\spoclsv.exe
O8 - 未知 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - 未知 - Extra context menu item: 使用Web迅雷下载 - E:\新建文件夹\GetUrl.htm
O8 - 未知 - Extra context menu item: 使用Web迅雷下载全部链接 - E:\新建文件夹\GetAllUrl.htm
O8 - 未知 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - 未知 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - 未知 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - 未知 - Extra button: 启动Web迅雷(HKLM) - http://my.xunlei.com
O9 - 未知 - Extra button: 腾讯QQ(HKLM) - D:\Program Files\Tencent\QQ\QQ.EXE
O16 - 未知 - DPF: {9242BB35-0DB0-43AC-8DFC-8EA07E63B92A} (LiveMediaOcx Control) - http://dl_dir.qq.com/qqtv/QQLiveOcxSetup.exe
O23 - 未知 - Service: fsp [Lenovo file protect service] - C:\WINDOWS\fsp.exe - (running)
O23 - 未知 - Service: KDDelegateService [KDDelegateService] - C:\Program Files\Kingdee\KIS\Advance\KDDelegateService.exe - (not running)
O23 - 未知 - Service: usblogon [Lenovo auto login helper] - C:\WINDOWS\usblogon.exe - (running)

=======================================

100 - 安全 - Process: smss.exe [进程为会话管理子系统用以初始化系统变量，ms-dos驱动名称类似lpt1以及com，调用win32壳子系统和运行在windows登陆过程。] - C:\WINDOWS\System32\smss.exe
100 - 安全 - Process: csrss.exe [客户端服务子系统，用以控制windows图形相关子系统。] - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=base
100 - 安全 - Process: winlogon.exe [windows nt用户登陆程序。] - C:\WINDOWS\system32\winlogon.exe
100 - 安全 - Process: services.exe [用于管理windows服务系统进程。] - C:\WINDOWS\system32\services.exe
100 - 安全 - Process: lsass.exe [本地安全权限服务控制windows安全机制。] - C:\WINDOWS\system32\lsass.exe
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k DcomLaunch
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost -k rpcss
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\System32\svchost.exe -k netsvcs
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k NetworkService
100 - 安全 - Process: svchost.exe [service host process是一个标准的动态连接库主机处理服务。] - C:\WINDOWS\system32\svchost.exe -k LocalService
100 - 安全 - Process: spoolsv.exe [windows打印任务控制程序，用以打印机就绪。] - C:\WINDOWS\system32\spoolsv.exe
100 - 安全 - Process: wdfmgr.exe [windows media player播放器相关程序。] - C:\WINDOWS\system32\wdfmgr.exe
100 - 安全 - Process: explorer.exe [windows program manager或者windows explorer用于控制windows图形shell，包括开始菜单、任务栏，桌面和文件管理。] - C:\WINDOWS\Explorer.EXE
100 - 安全 - Process: ctfmon.exe [office xp输入法图标。] - C:\WINDOWS\system32\ctfmon.exe
100 - 安全 - Process: IEXPLORE.EXE [microsoft internet explorer浏览器用于浏览网页。] - C:\Program Files\Internet Explorer\iexplore.exe
100 - 安全 - Process: conime.exe [console ime ime输入法控制台软件。] - C:\WINDOWS\system32\conime.exe
100 - 安全 - Process: wuauclt.exe [windows操作系统后台程序，用于系统升级。] - C:\WINDOWS\system32\wuauclt.exe
100 - 安全 - Process: 360Safe.exe [360安全卫士] - D:\Program Files\360safe\360Safe.exe
R1 - 安全 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
O2 - 安全 - BHO: (WebThunder Browser Helper) - [Web迅雷，支持多资源超线程技术的下载工具。] - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - E:\新建文件夹\WebThunderBHO_016.dll
O3 - 安全 - Toolbar: (金山快译(&K)) - [金山快译工具条软件相关程序。] - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\PROGRA~1\Kingsoft\FASTAI~1\IEBand.dll
O3 - 安全 - Toolbar: (卡卡上网安全助手) - [卡卡安全助手工具条软件相关程序。] - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 安全 - HKLM\..\Run: [IMJPMIG8.1] [微软Microsoft输入法编辑器程序。] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 安全 - HKLM\..\Run: [PHIME2002ASync] [输入法软件相关程序。] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 安全 - HKLM\..\Run: [PHIME2002A] [输入法软件相关程序。] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 安全 - HKLM\..\Run: [igfxtray] [是Intel显卡配置和诊断程序，会同Intel 810芯片组的集成显卡安装。] ; C:\WINDOWS\system32\igfxtray.exe
O4 - 安全 - HKLM\..\Run: [igfxhkcmd] [intel热键命令模块相关程序。] ; C:\WINDOWS\system32\hkcmd.exe
O4 - 安全 - HKLM\..\Run: [igfxpers] [intel集成显卡相关文件。] ; C:\WINDOWS\system32\igfxpers.exe
O4 - 安全 - HKLM\..\Run: [FASTKEY] [联想键盘驱动相关程序。] ; C:\Program Files\Lenovo\功能键盘\HotKeyB.exe
O4 - 安全 - HKLM\..\Run: [OrderReminder] [惠普公司相关支持程序。] ; C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - 安全 - HKLM\..\Run: [WebThunder] [是迅雷公司推出的一款基于多资源超线程技术的下载工具。] ; E:\新建文件夹\WebThunder.exe
O4 - 安全 - HKLM\..\Run: [TkBellExe] [是Real Networks产品定时升级检测程序。] ; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 安全 - HKLM\..\Run: [runeip] [卡卡上网安全助手相关程序。] ; C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - 安全 - HKLM\..\RunOnce: [360Safe] [360安全卫士] Rundll32.exe D:\PROGRA~1\360safe\AntiAdwa.dll,KillAdware
O4 - 安全 - HKCU\..\Run: [ctfmon.exe] [office xp输入法图标。] C:\WINDOWS\system32\ctfmon.exe
O4 - 安全 - HKCU\..\Run: [MSMSGS] [是MSN Messenger网络聊天工具的主程序] ; "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - 安全 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://c:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - 安全 - Extra button: Windows Messenger(HKLM) - C:\Program Files\Messenger\msmsgs.exe
O18 - 安全 - Protocol: OFFICE 相关 - {807553E5-5146-11D5-A672-00B0D022E945} - c:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

疯狂夏日 - 2007-3-17 8:55:00

路过，同情一下！

气质妞妞 - 2007-3-17 8:55:00

=======================================

O40 - winlogon.exe - - C:\WINDOWS\system32\uklognf.dll - - e5bdac3f8393970dc111d839604299ad
O40 - winlogon.exe - - C:\WINDOWS\system32\mangdrive.dll - - f5a295db2c2fc61e176b5424e8248137
O40 - Explorer.EXE - Adobe Systems, Inc. - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll - PDF Shell Extension - 4b0991cd076b617a2231b19a6663c1c9
O40 - Explorer.EXE - Beijing Rising Technology Co., Ltd. - C:\WINDOWS\system32\RavExt.dll - Rising Shell Ext Module - fa20734a7acabcfe9d727fb343da4e8a

=======================================

O41 - BaseTDI - basetdi - C:\WINDOWS\system32\drivers\basetdi.sys - (running) - basetdi - Beijing Rising Technology Co., Ltd. - 0064810c1b03f2c889130b669a4ce937
O41 - ExpScaner - ExpScan.sys - C:\Program Files\Rising\Rav\ExpScan.sys - (running) - ExpScan.sys - - 5a690926c7181d5c0b2721016442c9c3
O41 - HookCont - HookCont - C:\Program Files\Rising\Rav\HookCont.sys - (running) - HookCont - Rising - 4447c53ba80df5d4a9b72e54a0ba71d8
O41 - HookReg - HookReg - C:\Program Files\Rising\Rav\HOOKREG.sys - (running) - - - 997c395147f8e5b3f714bdd112fe8945
O41 - HookSys - Hooksys - C:\Program Files\Rising\Rav\HookSys.sys - (running) - Hooksys - Rising - 265b67f85db6226f2439e13e7c1fa8bf
O41 - MEMSCAN - MemScan Driver - C:\Program Files\Rising\Rav\MemScan.sys - (running) - MemScan Driver - 瑞星软件有限公司 - 9811b256023dd985cbc5bad790e5bb84
O41 - npkcrypt - nProtect KeyCrypt Driver - D:\Program Files\Tencent\QQ\npkcrypt.sys - (running) - nProtect KeyCrypt Driver - INCA Internet Co., Ltd. - 8bcb281a2540e7aff0cd00f9878fe21f
O41 - RsAntiSpyware - RsBoot - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - RsBoot - Beijing Rising - ab32cdae04c24a612bf4dac356ce3354
O41 - RsNTGDI - RsNTGDI - C:\WINDOWS\system32\drivers\RsNTGdi.sys - (running) - RsNTGDI - Beijing Rising Technology Co., Ltd. - 17214e7b192cb93ff014fca1484b97ad
O41 - RSPPSYS - RSPPSYS - C:\Program Files\Rising\Rav\rsppsys.sys - (running) - RSPPSYS - Rising - 4197f8bb3251c22f806c1d7d8d6ca2e1
O41 - Sentinel - Sentinel System Driver (NT Parallel driver) - C:\WINDOWS\system32\drivers\sentinel.sys - (running) - Sentinel System Driver (NT Parallel driver) - Rainbow Technologies, Inc. - aebba7428a6c40cce3c5abde45190b24
O41 - EagleNT - EagleNT - C:\WINDOWS\system32\drivers\EagleNT.sys - (not running) - - -
O41 - kmsinput - kmsinput - C:\WINDOWS\system32\drivers\kmsinput.sys - (not running) - - - f8d6ebcb50c02b42c5ffd5393229c6b6
O41 - npkycryp - npkycryp - D:\Program Files\Tencent\QQ\npkycryp.sys - (not running) - - -

=======================================
360Safe.exe=3.2.0.1002
AntiAdwa.dll=3.2.0.1001
AntiEng.dll=3.0.2.2000
AntiActi.dll=2.0.0.3000
CleanHis.dll=3.0.2.1000
safelive.exe=1.0.0.2007
live.dll=1.0.0.1011

=======================================
操作历史报告：
----------查杀恶意软件历史----------

2006-11-24 13:26
查杀恶意软件 - 网络实名 - 危险 -
查杀恶意软件 - 雅虎助手&上网助手 - 危险 -

2007-03-16 20:20
查杀恶意软件 - clipsrv.exe - 危险 - E:\\GAMESE~1.EXE
查杀恶意软件 - 熊猫烧香 - 危险 - C:\WINDOWS\system32\drivers\spoclsv.exe

2007-03-16 20:22
查杀恶意软件 - 熊猫烧香 - 危险 -
2007-03-17 08:10
查杀恶意软件 - clipsrv.exe - 危险 - E:\\GAMESE~1.EXE
查杀恶意软件 - 熊猫烧香 - 危险 - C:\WINDOWS\system32\drivers\spoclsv.exe

2007-03-17 08:11
查杀恶意软件 - 熊猫烧香 - 危险 -
2007-03-17 08:39
查杀恶意软件 - 熊猫烧香 - 危险 - C:\WINDOWS\system32\drivers\spoclsv.exe

----------插件卸载操作历史----------

2006-11-24 13:26
插件管理 - 网际快车附带的工具栏 -
插件管理 - 迅雷下载组件 - C:\PROGRA~1\THUNDE~1\Thunder\ComDlls\XUNLEI~1.DLL
插件管理 - 腾讯QQ附带的QQIEHelper插件 - d:\PROGRA~1\Tencent\QQ\QQIEHE~1.DLL
插件管理 - Adobe Reader附带的BHO插件 - C:\PROGRA~1\Adobe\ACROBA~1.0\ActiveX\ACROIE~1.DLL
2006-12-11 15:20
插件管理 - Bad download blocker - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

----------修复IE浏览器操作历史----------

2006-11-24 13:26
O27 - 危险 - 登录提示框标题 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
O27 - 危险 - 登录提示框文字 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
O5 - 危险 - 隐藏控制面板 - HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

=======================================

气质妞妞 - 2007-3-17 8:56:00

24楼的```谢谢你的同情```只差没扑上去抱着你痛哭泥。。。。

疯狂夏日 - 2007-3-17 8:57:00

看到一只熊猫在你电脑里跳舞，阿弥陀佛！！
100 - 未知 - Process: spoclsv.exe [] - C:\WINDOWS\system32\drivers\spoclsv.exe

气质妞妞 - 2007-3-17 9:01:00

偶双手合十的发誓```偶是绝不会原谅这种病毒的```打死都不原谅`````

疯狂夏日 - 2007-3-17 9:02:00

你去下载一个熊猫专杀吧，要作者在看守所写的解毒程序最好！祝你早日脱离熊猫的骚扰！

瑞星卡卡安全论坛