7月8日日志分析练习2 bbs.ikaka.com

lqqk7 - 2009-7-8 10:14:00

即日起每日会给大家提供一些染毒环境的SREng日志，因为部分实习生是第一次接触SREng这个工具，对日志分析不熟悉，如果冒然跑去反病毒区回帖，一旦出现误判，可能对求助者不利，因此采用这种“内部”交流的方式，希望大家能够多练习，真正分析日志的方法是靠自己实践摸索出来的！

注：日志分析练习情况与大家的实习期总成绩没有关联，请大家不要有顾虑，放心大胆的练习！

附件: 您所在的用户组无法下载或查看附件

========以下为参考分析结果========
异常项见附件（仅保留日志中可疑度较高的项）

注意：
1、很对瑞星相关的项显示为File is missing，可能是卸载不干净，也可能是被病毒所破坏
2、userinit.exe文件的版本信息丢失，被病毒修改或替换的可能性极大
3、BDGuard.SYS是百度工具条相关文件，虽不是病毒，但用户不大，可以建议用户手动写在百度搜霸
4、%SystemRoot%\System32\appmgmts.dll文件的版本信息丢失，被病毒修改或替换的可能性极大

附件: 您所在的用户组无法下载或查看附件

gtyre2 - 2009-7-8 11:15:00

qu48 - 2009-7-8 12:28:00

<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{25BC5491-68B6-4416-BC69-6E8442312604}><C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{EBFD50DA-1206-4381-860D-77F92A2905D9}><C:\WINDOWS\system32\P2xnxaS5acXpS95.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A9BCD26B-9EFB-4718-A9DB-67A61DB76C77}><C:\WINDOWS\fonts\vgUGf6VF2E.fon> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{EC2B07DD-0051-405D-9C98-C8BBF9F27B9A}><C:\WINDOWS\system32\QsbvDcwq7umu.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{480F828B-3E98-426A-AEBC-B4307DF4771D}><C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []

这些都是病毒？？

handle - 2009-7-8 13:21:00

<Explorer><C:\WINDOWS\system32\drivers\TXP1atform.exe> [ ] 有问题
<Userinit><C:\WINDOWS\system32\userinit.exe,> [ ] 系统文件userinit.exe被替换。

在system32和font下产生的随机数字字母文件名的病毒文件。而且进入了很多系统进程的模块里。

还有镜像劫持 ntsd-d 非常常见，很多安全软件都被劫持了，360~卡巴~瑞星.........
劫持应该会导致这些安全软件无法打开吧。

merrk_chuan - 2009-7-8 13:33:00

未眠人 - 2009-7-8 13:57:00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Explorer><C:\WINDOWS\system32\drivers\TXP1atform.exe> []
--------------------------------------------------------------------------------------------------
<Userinit><C:\WINDOWS\system32\userinit.exe,> []
--------------------------------------------------------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{25BC5491-68B6-4416-BC69-6E8442312604}><C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{EBFD50DA-1206-4381-860D-77F92A2905D9}><C:\WINDOWS\system32\P2xnxaS5acXpS95.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A9BCD26B-9EFB-4718-A9DB-67A61DB76C77}><C:\WINDOWS\fonts\vgUGf6VF2E.fon> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{EC2B07DD-0051-405D-9C98-C8BBF9F27B9A}><C:\WINDOWS\system32\QsbvDcwq7umu.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{480F828B-3E98-426A-AEBC-B4307DF4771D}><C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []

--------------------------------------------------------------------------------------------------

镜像劫持

--------------------------------------------------------------------------------------------------
服务
[Application Management / AppMgmt][Stopped/Auto Start]

--------------------------------
浏览器

百度流氓插件
[百度工具栏]
{B580CF65-E151-49C3-B73F-70B13FCA8E86} <C:\PROGRA~1\baidu\bar\baidubar.dll, Baidu.com, Inc.>
[BdSearchHook Class]
{02496EBD-8455-48DB-B3C7-5DAC97D9F5A7} <C:\Program Files\Baidu\iexp\BDSrHook.dll, N/A>

<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Rising Online Antivirus scanner control]

{9FAFB576-6933-4CCC-AB3D-B988EC43D04E} <%ProgramFiles%\Rising\RavOL\RavOLCtl.dll, (Signed) N/A>看上去像是瑞星的文件，请老师解答该文件

------------------------------------
进程问题项太多了...列举几个
[c:\windows\system32\appmgmts.dll] [N/A, ]

[C:\WINDOWS\system32\EN7hzSreCat8.dll] [N/A, ]
[C:\WINDOWS\system32\P2xnxaS5acXpS95.dll] [N/A, ]
[C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll] [N/A, ]
[C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon] [N/A, ]
[C:\WINDOWS\system32\dktXFYbT3G.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\A0C86020.dll] [N/A, ]
[C:\WINDOWS\system32\xg4hAPNygs29.dll] [N/A, ]
[C:\WINDOWS\system32\GsfMwDWD3.dll] [N/A, ]
[C:\WINDOWS\system32\76B9BA7A.dll] [N/A, ]
[C:\WINDOWS\system32\JPccCJnKygDdp3.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\taNjsFa2tT2Dh.dll] [N/A, ]
[C:\WINDOWS\system32\dhDhwS7fFW.dll] [N/A, ]
[C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon] [N/A, ]
[C:\WINDOWS\system32\qB5BKZy7vR5m.dll] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\ndxq9awMc.dll] [N/A, ]
[C:\WINDOWS\fonts\uXUsF2RrQy.fon] [N/A, ]
[C:\WINDOWS\system32\QsbvDcwq7umu.dll] [N/A, ]
[C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon] [N/A, ]
[C:\WINDOWS\system32\CDuAUVkGy9.dll] [N/A, ]
[C:\WINDOWS\system32\VnTU2WAqUcZA6.dll] [N/A, ]
[C:\WINDOWS\system32\cRsAQd4hw.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\ed78ab9.dll] [N/A, ]
[C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll] [N/A, ]
[C:\WINDOWS\fonts\vgUGf6VF2E.fon] [N/A, ]
[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]

[C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll] [N/A, ]
[C:\WINDOWS\system32\VnTU2WAqUcZA6.dll] [N/A, ]
[C:\WINDOWS\system32\qB5BKZy7vR5m.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\A0C86020.dll] [N/A, ]
[C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon] [N/A, ]
[C:\WINDOWS\system32\dhDhwS7fFW.dll] [N/A, ]
[C:\WINDOWS\system32\ed78ab9.dll] [N/A, ]
[C:\WINDOWS\system32\QsbvDcwq7umu.dll] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\CDuAUVkGy9.dll] [N/A, ]
[C:\WINDOWS\system32\ndxq9awMc.dll] [N/A, ]
[C:\WINDOWS\system32\EN7hzSreCat8.dll] [N/A, ]
[C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon] [N/A, ]
[C:\WINDOWS\fonts\MbsV2QQJe.fon] [N/A, ]
[C:\WINDOWS\fonts\MqppW9KYn.fon] [N/A, ]

[C:\WINDOWS\system32\ybM7kf9heVHDx.dll] [N/A, ]
[C:\WINDOWS\fonts\MbsV2QQJe.fon] [N/A, ]
[C:\WINDOWS\fonts\MqppW9KYn.fon] [N/A, ]

[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]
[C:\WINDOWS\fonts\vgUGf6VF2E.fon] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\cRsAQd4hw.dll] [N/A, ]
[C:\WINDOWS\fonts\uXUsF2RrQy.fon] [N/A, ]
[C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon] [N/A, ]
[C:\WINDOWS\system32\taNjsFa2tT2Dh.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JPccCJnKygDdp3.dll] [N/A, ]
[C:\WINDOWS\system32\76B9BA7A.dll] [N/A, ]
[C:\WINDOWS\system32\GsfMwDWD3.dll] [N/A, ]
[C:\WINDOWS\system32\xg4hAPNygs29.dll] [N/A, ]
[C:\WINDOWS\system32\dktXFYbT3G.dll] [N/A, ]
[C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll] [N/A, ]
[C:\WINDOWS\system32\P2xnxaS5acXpS95.dll] [N/A, ]
[C:\WINDOWS\system32\ybM7kf9heVHDx.dll] [N/A, ]

-----------稍后发出解决方法

幽灵楠 - 2009-7-8 14:21:00

<Explorer><C:\WINDOWS\system32\drivers\TXP1atform.exe> []
<updater><; C:\WINDOWS\system32\updater.exe> [File is missing]
<updater><; C:\WINDOWS\system32\updater.exe> [File is missing]
<Userinit><C:\WINDOWS\system32\userinit.exe,> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{25BC5491-68B6-4416-BC69-6E8442312604}><C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{EBFD50DA-1206-4381-860D-77F92A2905D9}><C:\WINDOWS\system32\P2xnxaS5acXpS95.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A9BCD26B-9EFB-4718-A9DB-67A61DB76C77}><C:\WINDOWS\fonts\vgUGf6VF2E.fon> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{EC2B07DD-0051-405D-9C98-C8BBF9F27B9A}><C:\WINDOWS\system32\QsbvDcwq7umu.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{480F828B-3E98-426A-AEBC-B4307DF4771D}><C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []

镜像劫持 ntsd-d
浏览器加载项.
[百度首页]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <http://baidu.com/index.php?tn=LordFoxdg, N/A>
[CdnForIE Class]
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} <C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll, N/A>

{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A
等N多浏览器加载项....
Winsock 提供者这也有问题.
特殊特权被允许： SeDebugPrivilege [PID = 1732, C:\WINDOWS\SYSTEM32\DRIVERS\TXP1ATFORM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1732, C:\WINDOWS\SYSTEM32\DRIVERS\TXP1ATFORM.EXE]
上面均有问题!

gtyre2 - 2009-7-8 14:35:00

<Userinit><C:\WINDOWS\system32\userinit.exe,> []

要替换。。。补上了
在我的分析助手1.3里尽然扫不出来:kaka6:
偷懒了。。不好意思
下次裸看

凡尘之沙 - 2009-7-8 14:47:00

daemonz - 2009-7-8 14:58:00

可疑文件：

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\drivers\TXP1atform.exe

进程加载的可疑的模块：

<C:\WINDOWS\system32\76B9BA7A.dll>
<C:\WINDOWS\fonts\uXUsF2RrQy.fon>
<C:\WINDOWS\system32\704C3595.dll>
<C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll>
<C:\WINDOWS\system32\VnTU2WAqUcZA6.dll>
<C:\WINDOWS\system32\Va7SpUWgCA5f.dll>
<C:\WINDOWS\system32\cRsAQd4hw.dll>
<C:\WINDOWS\system32\P2xnxaS5acXpS95.dll>
<C:\WINDOWS\system32\qB5BKZy7vR5m.dll>
<C:\WINDOWS\system32\122B901E.dll>
<C:\WINDOWS\fonts\vgUGf6VF2E.fon>
<C:\WINDOWS\system32\taNjsFa2tT2Dh.dll>
<C:\WINDOWS\system32\JBn2ypqY23vWX.dll>
<C:\WINDOWS\system32\dktXFYbT3G.dll>
<C:\WINDOWS\system32\A0C86020.dll>
<C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon>
<C:\WINDOWS\system32\dhDhwS7fFW.dll>
<C:\WINDOWS\system32\JPccCJnKygDdp3.dll>
<C:\WINDOWS\system32\ed78ab9.dll>
<C:\WINDOWS\system32\QsbvDcwq7umu.dll>
<C:\WINDOWS\system32\E4814792.dll>
<C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon>
<C:\WINDOWS\system32\xg4hAPNygs29.dll>
><C:\WINDOWS\system32\CDuAUVkGy9.dll>
<C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll>
<C:\WINDOWS\system32\08223B03.dll>
<C:\WINDOWS\system32\ndxq9awMc.dll>
<C:\WINDOWS\system32\GsfMwDWD3.dll>
<C:\WINDOWS\system32\ybM7kf9heVHDx.dll>
<C:\WINDOWS\system32\EN7hzSreCat8.dll>
<C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon>
<C:\WINDOWS\fonts\MbsV2QQJe.fon>
<C:\WINDOWS\fonts\MqppW9KYn.fon>

而且360之类的很多常用杀毒软件或修复工具被劫持，需要更改文件名才能使用

这两个我不太确定

C:\WINDOWS\system32\UxTheme.dll
C:\WINDOWS\system32\GameLink.dll

331878347 - 2009-7-8 17:13:00

一点一点看，一点一点挑错，嘿嘿……

<Explorer><C:\WINDOWS\system32\drivers\TXP1atform.exe> []
这一行，TXP1atform，搜索了一下，貌似这病毒挺著名挺顽强的。

<RisTray><"D:\工具\Rising\Ris\RsTray.exe" -system> [File is missing]
再次发现“文件不存在”，奇怪？？……

<updater><; C:\WINDOWS\system32\updater.exe> [File is missing]
这个就是毒了，updater.exe是一种agobot-ot蠕虫病毒（百度百科）。也是missing了……？

<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{25BC5491-68B6-4416-BC69-6E8442312604}><C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{EBFD50DA-1206-4381-860D-77F92A2905D9}><C:\WINDOWS\system32\P2xnxaS5acXpS95.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A9BCD26B-9EFB-4718-A9DB-67A61DB76C77}><C:\WINDOWS\fonts\vgUGf6VF2E.fon> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{EC2B07DD-0051-405D-9C98-C8BBF9F27B9A}><C:\WINDOWS\system32\QsbvDcwq7umu.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{480F828B-3E98-426A-AEBC-B4307DF4771D}><C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []
好小子，这是大户啊！！那些dll文件太不顺眼了……（字体几个，貌似也有问题）

[]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, >
[]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <, >
[]
{0A155D3C-68E2-4215-A47A-E800A446447A} <, >
这几行，前面后面都有类似的，没整懂是啥玩意儿，应该是有问题滴。。

[C:\WINDOWS\system32\EN7hzSreCat8.dll] [N/A, ]
[C:\WINDOWS\system32\P2xnxaS5acXpS95.dll] [N/A, ]
[C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll] [N/A, ]
[C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon] [N/A, ]
[C:\WINDOWS\system32\dktXFYbT3G.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\A0C86020.dll] [N/A, ]
[C:\WINDOWS\system32\xg4hAPNygs29.dll] [N/A, ]
[C:\WINDOWS\system32\GsfMwDWD3.dll] [N/A, ]
[C:\WINDOWS\system32\76B9BA7A.dll] [N/A, ]
[C:\WINDOWS\system32\JPccCJnKygDdp3.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\taNjsFa2tT2Dh.dll] [N/A, ]
[C:\WINDOWS\system32\dhDhwS7fFW.dll] [N/A, ]
[C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon] [N/A, ]
[C:\WINDOWS\system32\qB5BKZy7vR5m.dll] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\ndxq9awMc.dll] [N/A, ]
[C:\WINDOWS\fonts\uXUsF2RrQy.fon] [N/A, ]
[C:\WINDOWS\system32\QsbvDcwq7umu.dll] [N/A, ]
[C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon] [N/A, ]
[C:\WINDOWS\system32\CDuAUVkGy9.dll] [N/A, ]
[C:\WINDOWS\system32\VnTU2WAqUcZA6.dll] [N/A, ]
[C:\WINDOWS\system32\cRsAQd4hw.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\ed78ab9.dll] [N/A, ]
[C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll] [N/A, ]
[C:\WINDOWS\fonts\vgUGf6VF2E.fon] [N/A, ]
[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]
……
[C:\WINDOWS\system32\ybM7kf9heVHDx.dll] [N/A, ]
[C:\WINDOWS\fonts\MbsV2QQJe.fon] [N/A, ]
[C:\WINDOWS\fonts\MqppW9KYn.fon] [N/A, ]
又是一个大户，估计是跟上面遥相呼应。

[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]
[C:\WINDOWS\fonts\vgUGf6VF2E.fon] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\cRsAQd4hw.dll] [N/A, ]
[C:\WINDOWS\fonts\uXUsF2RrQy.fon] [N/A, ]
[C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon] [N/A, ]
[C:\WINDOWS\system32\taNjsFa2tT2Dh.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\JPccCJnKygDdp3.dll] [N/A, ]
[C:\WINDOWS\system32\76B9BA7A.dll] [N/A, ]
[C:\WINDOWS\system32\GsfMwDWD3.dll] [N/A, ]
[C:\WINDOWS\system32\xg4hAPNygs29.dll] [N/A, ]
[C:\WINDOWS\system32\dktXFYbT3G.dll] [N/A, ]
[C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll] [N/A, ]
[C:\WINDOWS\system32\P2xnxaS5acXpS95.dll] [N/A, ]
继续……（后面还有很多，大同小异，略去）

有遗漏的地方，希望老师同学批评指点，大家共同进步！谢谢

零度的穷浪漫 - 2009-7-9 6:15:00

好多 [N/A, ]是什么问题？

精神病院看门的 - 2009-7-9 10:35:00

该用户帖子内容已被屏蔽

still刀刀 - 2009-7-14 12:11:00

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Explorer><C:\WINDOWS\system32\drivers\TXP1atform.exe> []

<ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup> [InstallShield Software Corporation]

<Grid Service><; "C:\Program Files\GridService\peer.exe" -n Grid> [FS2YOU]

<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe]
<IFEO[360hotfix.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
<IFEO[360rpt.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe]
<IFEO[360safe.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe]
<IFEO[360safebox.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><ntsd -d> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe]
<IFEO[agentsvr.exe]><ntsd -d> [N/A]

==================================
启动文件夹
N/A

==================================
服务

==================================
驱动程序

<2 - 系统找不到指定的文件。
><N/A>

[klan / klan][Running/]
<2 - 系统找不到指定的文件。
><N/A>

[SafeMon2 / SafeMon2][Running/]
<2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项

[百度首页]
{02496EBD-8455-48db-B3C7-5DAC97D9F5A7} <http://baidu.com/index.php?tn=LordFoxdg, N/A>

[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>

[]
{03507A1A-E0C5-4404-AA26-205385C0892D} <, >

[访问通用网址]
<, >

==================================
正在运行的进程

[C:\WINDOWS\system32\GameLink.dll] [www.Easy2Game.com, 17, 2, 6, 8]
[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]
[C:\Program Files\Kingsoft\KSWebShieldSVC\KSWBC.dll] [N/A, ]
==================================
文件关联

.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
Easy2Game-TCPChain
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-UDPChain
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-UDPChain
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-TCPChain
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-TCPFilter
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-UDPFilter
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-UDPFilter
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)
Easy2Game-TCPFilter
C:\WINDOWS\system32\GameLink.dll(www.Easy2Game.com, Easy2Game Service Provider)

零度的穷浪漫 - 2009-7-27 15:36:00

<2 - 系统找不到指定的文件。
><N/A>
出现这种情况怎么解决？

乐陶猪 - 2009-8-4 9:27:00

1. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,> []

2.. [EagleNT / EagleNT][Stopped/Manual Start]
<2 - 系统找不到指定的文件。
><N/A> //找不到指定文件，是什么意思？

3. <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{25BC5491-68B6-4416-BC69-6E8442312604}><C:\WINDOWS\system32\aEUzzDyN4fVnJ.dll> []
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{EBFD50DA-1206-4381-860D-77F92A2905D9}><C:\WINDOWS\system32\P2xnxaS5acXpS95.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A9BCD26B-9EFB-4718-A9DB-67A61DB76C77}><C:\WINDOWS\fonts\vgUGf6VF2E.fon> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{EC2B07DD-0051-405D-9C98-C8BBF9F27B9A}><C:\WINDOWS\system32\QsbvDcwq7umu.dll> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{480F828B-3E98-426A-AEBC-B4307DF4771D}><C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []

防潮生生世世 - 2010-3-1 22:23:00

我来看看大家的答案

瑞星卡卡安全论坛