十个 - 2007-10-30 0:26:00
[AutoRun]
Shellexecute=WScript.exe usr.vbs "AutoRun"
shell\AutoRun=打开(&O)
shell\AutoRun\command=WScript.exe usr.vbs "AutoRun"
shell\AutoRun1=资源管理器(&X)
shell\AutoRun1\command=WScript.exe usr.vbs "AutoRun"
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; TencentTraveler )
超级游戏迷 - 2007-10-30 0:32:00
开始--程序--WINRAR--WINRAR，用WINRAR压缩工具找到和删除各驱动器根目录下的AUTORUN.INF、WScript.exe、usr.vbs，不要用任何方式直接访问任何驱动器！
GUNDAMDX - 2007-10-30 0:32:00
“我的电脑”点击右键，打开“资源管理器”，然后全部通过 资源管理器 的左边树状目录来访问文件夹，删除每个盘下的autorun.inf
不怕不怕狼 - 2007-10-30 1:02:00
建议最好是在安全模式进行手动删除！
日不懂啊 - 2007-10-30 10:10:00
下载 System Repair Engineer，
http://download.kztechs.com/files/sreng2.zip
1 解压缩sreng2.zip
2 运行SREngPS.EXE
3 智能扫描=》扫描=》保存报告
4 把日志中的报告完整拷贝贴上来，不要修改
十个 - 2007-10-30 11:43:00
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 448 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 504 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 528 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 572 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 584 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 860 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 924 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1084 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1268 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[C:\WINDOWS\system32\ZLhp1020.DLL] [Zenographics, Inc., 5, 53, 3723, 0]
[C:\WINDOWS\system32\ZLM.dll] [Zenographics, Inc., 5, 50, 1416, 0]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL] [Zenographics, Inc., 5, 54, 330, 0]
[C:\WINDOWS\system32\Imf32.dll] [Zenographics, Inc., 5, 60, 1204, 0]
[C:\WINDOWS\system32\ZTAG32.dll] [Zenographics, Inc., 5, 60, 1210, 0]
[C:\WINDOWS\system32\ZSPOOL.dll] [Zenographics, Inc., 5, 51, 709, 0]
[PID: 1372 / Administrator][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
[C:\Program Files\360safe\safemon\safemon.dll] [奇虎网, 3, 6, 4, 1001]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[PID: 1512 / Administrator][C:\WINDOWS\System32\WScript.exe] [Microsoft Corporation, 5.6.0.8820]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
十个 - 2007-10-30 11:43:00
[PID: 1528 / Administrator][C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\ntmonres.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[PID: 1540 / Administrator][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3510]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[PID: 1556 / Administrator][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe] [Hewlett-Packard, 2, 0, 1, 26]
[PID: 1584 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[PID: 1592 / Administrator][C:\Program Files\jj4\jiajiasr.exe] [加加工作组, 4, 1, 0, 47]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[PID: 1736 / SYSTEM][C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe] [Trend Micro Inc., 7.0.0.1286]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\TimeString.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[PID: 1780 / SYSTEM][C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\TMSOCK.dll] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\loadhttp.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInAPI.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\libTmCAV.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\Pwd.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcDog.dll] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInMain.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPlugInTray.dll] [Trend Micro Inc., 7.0.0.1116]
[C:\Program Files\Trend Micro\OfficeScan Client\TmUpdate.dll] [Trend Micro Inc., 2,6,0,1367]
[PID: 1992 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 200 / SYSTEM][C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe] [Trend Micro Inc., 7.0.0.1206]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwCommon.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\ZLib.dll] [Trend Micro Inc., 1.31.0.1708]
[C:\Program Files\Trend Micro\OfficeScan Client\OfcPIPC.dll] [N/A, ]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg20.dll] [trend_company_name, 1, 0, 0, 1]
[C:\Program Files\Trend Micro\OfficeScan Client\tmCfwApi.dll] [Trend Micro Inc., 1.2.0.1020]
[PID: 1036 / SYSTEM][C:\WINDOWS\TEMP\PHFA61.EXE] [N/A, ]
[PID: 1832 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2664 / Administrator][C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe] [Trend Micro Incorporated., 10.0.5.1165]
[C:\Program Files\Trend Micro\OfficeScan Client\POP3UTIL.dll] [Trend Micro Incorporated., 10.0.5.1165]
[C:\Program Files\Trend Micro\OfficeScan Client\tmdbg.dll] [N/A, ]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[C:\Program Files\Trend Micro\OfficeScan Client\tmCfwApi.dll] [Trend Micro Inc., 1.2.0.1020]
[PID: 3000 / NETWORK SERVICE][C:\WINDOWS\system32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2144 / Administrator][G:\安全\System Repair Engineer\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\system32\PYJJ4.IME] [加加工作组, 4, 1, 0, 47]
[G:\安全\System Repair Engineer\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\Administrator.vbs" %1 %* ]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\Administrator.vbs" %1 %* ]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\Administrator.vbs" %1 %* ]
.HLP Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\Administrator.vbs" %1 %* ]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[E:\]
[AutoRun]
Shellexecute=WScript.exe Administrator.vbs "AutoRun"
shell\AutoRun=打开(&O)
shell\AutoRun\command=WScript.exe Administrator.vbs "AutoRun"
shell\AutoRun1=资源管理器(&X)
shell\AutoRun1\command=WScript.exe Administrator.vbs "AutoRun"
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 1540, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
火影忍者 - 2007-10-30 12:14:00
日志不全啊.
© 2000 - 2026 Rising Corp. Ltd.