未知病毒，请帮忙看看。附日志 bbs.ikaka.com

liq1211 - 2007-9-3 11:45:00

[CODE]

2007-09-03,08:31:18

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 5><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Trend ServerProtect / SpntSvc][Others/Auto Start]
<"C:\Program Files\Trend\SProtect\SpntSvc.exe"><Trend Micro Inc.>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[Automatic Updates / wuauserv][Others/Auto Start]
<C:\WINNT\system32\svchost.exe -k wugroup-->c:\winnt\system32\wins\bot.dll><N/A>
[NOTEPAD / NOTEPAD][Running/Auto Start]
<"C:\WINNT\system\NOTEPAD.exe"><N/A>

==================================
驱动程序
[Legend DFE-530TX PCI Fast Ethernet Adapter / dlkfet][Running/Manual Start]
<system32\DRIVERS\dlkfet.sys><Fast Ethernet PCI Adapter Manufacturer>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[BDA MPE Filter / MPE][Stopped/Manual Start]
<system32\DRIVERS\MPE.sys><Microsoft Corporation>
[NABTS/FEC VBI Codec / NABTSFEC][Stopped/Manual Start]
<system32\DRIVERS\NABTSFEC.sys><Microsoft Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[S3Inc / S3Inc][Running/Manual Start]
<system32\DRIVERS\s3mt3d.sys><S3 Incorporated>
[BDA Slip De-Framer / SLIP][Stopped/Manual Start]
<system32\DRIVERS\SLIP.sys><Microsoft Corporation>
[BDA IPSink / streamip][Stopped/Manual Start]
<system32\DRIVERS\StreamIP.sys><Microsoft Corporation>
[symc8xx / symc8xx][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\symc8xx.sys><LSI Logic>
[Trend ServerProtect Filter / TMFilter][Running/Auto Start]
<\??\C:\Program Files\Trend\SProtect\TMFilter.sys><Trend Micro Inc.>
[Trend ServerProtect Scan Engine / VsapiNT][Running/Auto Start]
<\??\C:\Program Files\Trend\SProtect\VsapiNT.sys><Trend Micro Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[CKAVWebScan Object]
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} <C:\WINNT\system32\Kaspersky Lab\Kaspersky Online Scanner Pro\kavwebscan.dll, Kaspersky Lab>
[Symantec AntiVirus scanner]
{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} <C:\WINNT\Downloaded Program Files\avsniff.dll, Symantec Corporation>
[Symantec RuFSI Utility Class]
{644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINNT\Downloaded Program Files\rufsi.dll, Symantec Corporation>

==================================

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

liq1211 - 2007-9-3 11:47:00

正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 184][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 204][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6997]
[PID: 232][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2195.7035]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2195.6605.297.3]
[PID: 244][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2195.7011]
[PID: 468][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 504][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2195.7059]
[PID: 760][C:\Program Files\Trend\SProtect\StWatchDog.exe] [Trend Micro Inc., 5.58.0.1060]
[C:\Program Files\Trend\SProtect\TmRpcSrv.dll] [Trend Micro Inc., 5.58.0.1060]
[PID: 792][C:\Program Files\Trend\SProtect\StOPP.exe] [Trend Micro Inc., 5.58.0.1119]
[C:\Program Files\Trend\SProtect\LogMaster.dll] [Trend Micro Inc., 5.58.0.1119]
[C:\Program Files\Trend\SProtect\SpTrace.dll] [Trend Micro Inc., 5.58.0.1060]
[C:\Program Files\Trend\SProtect\LogDb.dll] [Trend Micro Inc., 5.58.0.1119]
[C:\Program Files\Trend\SProtect\StCommon.dll] [Trend Micro Inc., 5.58.0.1119]
[C:\Program Files\Trend\SProtect\GENKEY32.dll] [Trend Micro Inc., 1, 0, 0, 0]
[C:\Program Files\Trend\SProtect\GetRemoteVer.dll] [Trend Micro Inc., 5.58.0.1060]
[C:\Program Files\Trend\SProtect\CheckEVC.dll] [Trend Micro Inc., 5.58.0.1060]
[C:\Program Files\Trend\SProtect\MFC42u.DLL] [Microsoft Corporation, 6.00.8665.0]
[PID: 816][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 836][C:\WINNT\System32\llssrv.exe] [Microsoft Corporation, 5.00.2195.7021]
[PID: 924][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2195.6972]
[PID: 936][C:\WINNT\System32\WBEM\WinMgmt.exe] [Microsoft Corporation, 1.50.1085.0100]
[PID: 976][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 984][C:\WINNT\system32\inetsrv\inetinfo.exe] [Microsoft Corporation, 5.00.0984]
[PID: 996][C:\WINNT\system32\msdtc.exe] [Microsoft Corporation, 1999.9.3421.3]
[PID: 1168][C:\WINNT\system32\Dfssvc.exe] [Microsoft Corporation, 5.00.2195.6664]
[PID: 1288][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[PID: 1388][C:\WINNT\system32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[PID: 572][C:\WINNT\system32\dllhost.exe] [Microsoft Corporation, 5.00.2195.6692]
[C:\WINNT\system32\pdm.dll] [Microsoft Corporation, 6.00.8424]
[C:\WINNT\system32\msdbg.dll] [Microsoft Corporation, 6.00.8424]
[C:\WINNT\system32\SQLWOA.dll] [Microsoft Corporation, 1999.10.20]
[PID: 1520][C:\WINNT\system32\dllhost.exe] [Microsoft Corporation, 5.00.2195.6692]
[PID: 1648][C:\WINNT\system32\mdm.exe] [Microsoft Corporation, 6.00.8424]
[C:\WINNT\system32\msdbg.dll] [Microsoft Corporation, 6.00.8424]
[PID: 1392][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\System32\unimdm.tsp] [Microsoft Corporation, 5.00.2195.6601]
[C:\WINNT\System32\kmddsp.tsp] [Microsoft Corporation, 5.00.2150.1]
[C:\WINNT\System32\ndptsp.tsp] [Microsoft Corporation, 5.00.2143.1]
[C:\WINNT\System32\ipconf.tsp] [Microsoft Corporation, 5.00.2143.1]
[PID: 9744][C:\Documents and Settings\Administrator\桌面\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\Documents and Settings\Administrator\桌面\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 816, C:\WINNT\SYSTEM32\SVCHOST.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 936, C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 976, C:\WINNT\SYSTEM32\SVCHOST.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 984, C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 996, C:\WINNT\SYSTEM32\MSDTC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1168, C:\WINNT\SYSTEM32\DFSSVC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1288, C:\WINNT\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1388, C:\WINNT\SYSTEM32\INTERNAT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1392, C:\WINNT\SYSTEM32\SVCHOST.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]
要病毒文件的流邮箱

瑞星卡卡安全论坛