瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 高手帮帮忙啊，，杀不干净的毒啊
想当白客 - 2008-1-30 15:26:00
瑞星卡卡打不开，，，木马清倒夫的防火墙也打不开．．．精细扫描也打不开，．只好用高速扫描了








-------高速扫描硬盘[2008-01-30|08:43:14]--------
本次扫描到64个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\21.exe
e:\AutoRun.exe
e:\AutoRun.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\11.EXE
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\3.exe
------------------------------------------------

-------高速扫描硬盘[2008-01-30|08:44:28]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|08:49:17]--------
本次扫描到6个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
C:\Program Files\Tencent\SSPlus\SAddr.dll
C:\Program Files\tencent\ssplus\SPlus.dll
C:\WINDOWS\system32\scrax.dll
C:\WINDOWS\system32\ssup.dll
------------------------------------------------

-------高速扫描硬盘[2008-01-30|08:54:18]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|09:05:25]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|09:07:55]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------扫描进程[2008-01-30|09:27:31]--------
本次扫描到0个木马病毒或广告间谍进程
------------------------------------------------

-------高速扫描硬盘[2008-01-30|09:50:40]--------
本次扫描到6个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
C:\Program Files\Tencent\SSPlus\SData.dat
C:\Program Files\Tencent\SSPlus\Update\mi.ini
C:\Program Files\Tencent\SSPlus\Update\file0.dat
C:\Program Files\Tencent\SSPlus\Update\file1.dat
------------------------------------------------

-------高速扫描硬盘[2008-01-30|09:58:12]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:04:35]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:16:01]--------
本次扫描到63个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\Program Files\kaspersky lab\kaspersky anti-virus 7.0\dnsq.dll
C:\WINDOWS\system32\msepion.sys
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\11.EXE
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\3.exe
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:20:10]--------
本次扫描到63个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\Program Files\kaspersky lab\kaspersky anti-virus 7.0\dnsq.dll
C:\WINDOWS\system32\msepion.sys
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\11.EXE
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\3.exe
------------------------------------------------




[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
想当白客 - 2008-1-30 15:27:00

-------高速扫描硬盘[2008-01-30|11:26:44]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:30:28]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:32:06]--------
本次扫描到1个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:33:14]--------
本次扫描到1个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:35:30]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:42:18]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:44:47]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:53:25]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|11:54:41]--------
本次扫描到62个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\11.EXE
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\3.exe
------------------------------------------------

-------高速扫描硬盘[2008-01-30|12:50:28]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:12:25]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:16:07]--------
本次扫描到0个木马病毒或广告间谍
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:17:14]--------
本次扫描到62个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\11.exe
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\16.exe
C:\WINDOWS\system32\17.exe
C:\WINDOWS\system32\18.exe
C:\WINDOWS\system32\19.exe
C:\WINDOWS\system32\20.exe
C:\WINDOWS\system32\11.EXE
C:\WINDOWS\system32\12.exe
C:\WINDOWS\system32\13.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\14.exe
C:\WINDOWS\system32\21.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\3.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\8.exe
C:\WINDOWS\system32\9.exe
C:\WINDOWS\system32\10.exe
C:\WINDOWS\system32\15.exe
C:\WINDOWS\system32\5.exe
C:\WINDOWS\system32\4.exe
C:\WINDOWS\system32\7.exe
C:\WINDOWS\system32\6.exe
C:\WINDOWS\system32\2.exe
C:\WINDOWS\system32\1.exe
C:\WINDOWS\system32\3.exe
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:21:36]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:33:56]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------

-------高速扫描硬盘[2008-01-30|13:58:31]--------
本次扫描到2个木马病毒或广告间谍
C:\WINDOWS\system32\drivers\msaclue.sys
C:\WINDOWS\system32\msepion.sys
------------------------------------------------
lqqk7 - 2008-1-30 15:27:00
建议先使用卡卡助手或windows清理助手清理一下恶意程序。
卡卡助手下载页面：http://tool.ikaka.com
windows清理助手下载页面：http://www.arswp.com/download.html
————————————————————————————————————————
然后使用System Repair Engineer扫描日志，将日志作为附件上传上来。
下载页面：http://kztechs.com/sreng/download.html
操作方法：
1、下载后解压缩sreng2.zip；
2、运行SREngPS.EXE；
3、依次点击【智能扫描】-【扫描】；
4、耐心等待，扫描结束后点击【保存报告】；
5、选择保存路径，文件名保持默认，直接点击【保存】；
6、打开保存的日志文件SREngLOG.log，完整复制全部内容，新建一个文本文档，将日志中的全部内容粘贴到“新建文本文档.txt”中；
7、将“新建文本文档.txt”作为附件上传，同时务必详细描述问题现象，如果有查杀不净的病毒务必提供病毒名和路径。
注意：扫描前请尽量关闭QQ、游戏、下载工具、媒体播放器等应用程序。
想当白客 - 2008-1-30 16:03:00
扫描完毕．．．
具体问题：我的电脑只要一连网　　C:\WINDOWS\system32\11.exe　　这个就运行（是ＩＥ防漏者提示我的），，共有２０多个，，都是C:\WINDOWS\system32\....着样的，，而且只要不阻止，，我的电脑过会就什么都弄不了．，．．右键点开只有删除和属性....什么都打不开，，而且回收站没名字了．．重起后不连网．．．右键可以打开东西．．．但卡卡打不开，．，监控中心全部关闭．．




[CODE]

2008-01-30,15:37:39

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <ApabiAgent><"C:\Program Files\Founder\Apabi Reader 3.0\ApabiAgent.exe">  []
    <Super Rabbit IEPro><E:\MagicSet\SRIECLI.EXE /LOAD>  [Super Rabbit Soft]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Publisher]
    <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Publisher]
    <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Persistence><C:\WINDOWS\system32\igfxpers.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Windows木马防火墙><E:\新建文件夹\Trojanwall.exe>  [风云谷科技]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  []
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DfLogon]
    <WinlogonNotify: DfLogon><LogonDll.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
    <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
想当白客 - 2008-1-30 16:04:00
服务
[Application Management / AppMgmt][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[DFServEx / DFServEx][Running/Auto Start]
  <C:\Program Files\HyperTechnologies\Deep Freeze\DfServEx.exe><Hyper Technologies Inc.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[Apaidi / Apaidi][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\Apaidi.sys><N/A>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek 10/100/1000 NIC Family all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[FTCProtect / FTCProtect][Running/Manual Start]
  <System32\Drivers\FTCProtect.sys><N/A>
[ATI2HDDSRV / ATI2HDDSRV][Running/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\ati32srv.sys><N/A>
[FTCProTime / FTCProTime][Running/Manual Start]
  <System32\Drivers\FTCProTime.sys><N/A>
[Basetdi / Basetdi][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[msskye / msskye][Running/Auto Start]
  <system32\DRIVERS\msaclue.sys><N/A>
[FTCkillfile / FTCkillfile][Stopped/]
  <2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <E:\MagicSet\haokanbar.dll, Xiang Feng Technology>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\MagicSet\haokanbar.dll, Xiang Feng Technology>
[超级兔子上网精灵]
  {43869BB3-22FD-4F15-9B46-238106BA2F4E} <E:\MagicSet\haokanbar.dll, Xiang Feng Technology>
[超级兔子上网精灵]
  {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} <E:\MagicSet\haokanbar.dll, Xiang Feng Technology>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 688 / 太慈][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\HDDGuard.dll]  [N/A, ]
[PID: 2512 / 太慈][C:\WINDOWS\system32\dllcache\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 2284 / 太慈][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\HDDGuard.dll]  [N/A, ]
[PID: 3292 / 太慈][C:\WINDOWS\system32\igfxpers.exe]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\HDDGuard.dll]  [N/A, ]
[PID: 2408 / 太慈][C:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
[PID: 3516 / 太慈][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3808 / 太慈][C:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 28]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 6]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 292 / 太慈][E:\新建文件夹\FTCleaner.exe]  [风.云.谷, 11.00.0725]
    [E:\新建文件夹\msvbvm60.dll]  [Microsoft Corporation, 6.00.9237]
    [E:\新建文件夹\vb6chs.dll]  [Microsoft Corporation, 6.00.8988]
    [E:\新建文件夹\TABCTL32.OCX]  [Microsoft Corporation, 6.00.9043]
    [E:\新建文件夹\ftcapi.dll]  [fygsoft, 1.3.0.94]
    [E:\新建文件夹\psapi.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [E:\新建文件夹\RICHTX32.OCX]  [Microsoft Corporation, 6.00.8877]
    [E:\新建文件夹\RichEd32.DLL]  [Microsoft Corporation, 5.00.2134.1]
    [E:\新建文件夹\RICHED20.dll]  [Microsoft Corporation, 5.31.23.1218]
[PID: 1340 / 太慈][E:\MagicSet\srms.exe]  [Super Rabbit Soft, 8.50]
    [C:\WINDOWS\system32\vb6chs.dll]  [Microsoft Corporation, 6.00.8988]
[PID: 3908 / 太慈][E:\MagicSet\SRIECLI.EXE]  [Super Rabbit Soft, 8.20]
    [C:\WINDOWS\system32\vb6chs.dll]  [Microsoft Corporation, 6.00.8988]
    [E:\MagicSet\shlobj71.ocx]  [Sky Software (http://www.ssware.com), 7, 1, 0, 0]
[PID: 3964 / 太慈][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\HDDGuard.dll]  [N/A, ]
[PID: 1520 / 太慈][C:\WINDOWS\system32\igfxsrvc.exe]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4308]
    [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.4308]
[PID: 1748 / 太慈][E:\新建文件夹\FygAnalyze.exe]  [风云谷科技, 2.0.0.220]
    [C:\WINDOWS\system32\HDDGuard.dll]  [N/A, ]
    [E:\新建文件夹\PSAPI.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1700 / 太慈][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 3, 0, 1658]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\macromed\flash\flash.ocx]  [Macromedia, Inc., 6,0,79,0]
[PID: 1940 / 太慈][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 3, 0, 1658]
    [C:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 3628 / 太慈][C:\Program Files\arswp\ArSwp.exe]  [ArSwp.com, 2, 6, 1, 126]
    [C:\Program Files\arswp\plugin\ArFix.dll]  [ArSwp.Com, 2, 5, 0, 0]
[PID: 3684 / 太慈][C:\DOCUME~1\太慈\LOCALS~1\Temp\Rar$EX00.172\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\DOCUME~1\太慈\LOCALS~1\Temp\Rar$EX00.172\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  Error. [C:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 292, E:\新建文件夹\FTCLEANER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1340, E:\MAGICSET\SRMS.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3908, E:\MAGICSET\SRIECLI.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1748, E:\新建文件夹\FYGANALYZE.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 3628, C:\PROGRAM FILES\ARSWP\ARSWP.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
想当白客 - 2008-1-30 16:17:00
刚看了下你说的windows清里器里说有劫持帐号的木马和特络衣木等１０多个木马．．我已经删了，，卡卡能启动了...谢谢，，不过有个高风险的对象，，说系统重要文件被替换，，不能强行删除，该怎么办？
流星陨落 - 2008-1-30 16:41:00
日志用附件发，晕死
1
查看完整版本: 高手帮帮忙啊，，杀不干净的毒啊
© 2000 - 2026 Rising Corp. Ltd.