System Information Collect Tool - Designed By Smallfrogs


20050911-10:02
Windows XP Service Pack 1
Internet Explorer: 6.0.2800.1106


*****************************************************************
      Runing Processes information
*****************************************************************
=====================================================
PROCESS NAME:  System
-----------------------------------------------------
  Process ID  = 0x00000004
  Thread count= 52
  Parent process ID = 0
  Priority Class    = 32


Modules:
------------------------------------


=====================================================
PROCESS NAME:  SMSS.EXE
-----------------------------------------------------
  Process ID  = 0x000001a8
  Thread count= 3
  Parent process ID = 4
  Priority Class    = 32


Modules:
------------------------------------
\SystemRoot\System32\smss.exe (0x48580000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)



=====================================================
PROCESS NAME:  CSRSS.EXE
-----------------------------------------------------
  Process ID  = 0x000001e4
  Thread count= 13
  Parent process ID = 424
  Priority Class    = 32


Modules:
------------------------------------
\??\C:\WINDOWS\system32\csrss.exe (0x4A680000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)

C:\WINDOWS\system32\CSRSRV.dll (0x75AA0000)

C:\WINDOWS\system32\basesrv.dll (0x75AB0000)

C:\WINDOWS\system32\winsrv.dll (0x75AC0000)

C:\WINDOWS\system32\USER32.dll (0x77D10000)

C:\WINDOWS\system32\KERNEL32.dll (0x77E40000)

C:\WINDOWS\system32\GDI32.dll (0x77C40000)

C:\WINDOWS\system32\ADVAPI32.dll (0x77DA0000)

C:\WINDOWS\system32\RPCRT4.dll (0x78000000)

C:\WINDOWS\System32\LPK.DLL (0x62C20000)

C:\WINDOWS\System32\USP10.dll (0x72F10000)

C:\WINDOWS\System32\sxs.dll (0x75E00000)



=====================================================
PROCESS NAME:  WINLOGON.EXE
-----------------------------------------------------
  Process ID  = 0x000001fc
  Thread count= 19
  Parent process ID = 424
  Priority Class    = 128


Modules:
------------------------------------
\??\C:\WINDOWS\system32\winlogon.exe (0x01000000)

C:\WINDOWS\System32\ntdll.dll (0x77F50000)

C:\WINDOWS\system32\kernel32.dll (0x77E40000)

C:\WINDOWS\system32\msvcrt.dll (0x77BE0000)

C:\WINDOWS\system32\ADVAPI32.dll (0x77DA0000)

C:\WINDOWS\system32\RPCRT4.dll (0x78000000)

C:\WINDOWS\system32\GDI32.dll (0x77C40000)

C:\WINDOWS\system32\USER32.dll (0x77D10000)

C:\WINDOWS\system32\USERENV.dll (0x759D0000)

C:\WINDOWS\system32\NDdeApi.dll (0x758A0000)

C:\WINDOWS\system32\CRYPT32.dll (0x76230000)

C:\WINDOWS\system32\MSASN1.dll (0x76210000)

C:\WINDOWS\system32\Secur32.dll (0x76F60000)

C:\WINDOWS\system32\WINSTA.dll (0x762D0000)

C:\WINDOWS\system32\PROFMAP.dll (0x75890000)

C:\WINDOWS\system32\NETAPI32.dll (0x71BA0000)

C:\WINDOWS\system32\REGAPI.dll (0x76B90000)

C:\WINDOWS\system32\WS2_32.dll (0x71A20000)

C:\WINDOWS\system32\WS2HELP.dll (0x71A10000)

C:\WINDOWS\system32\AUTHZ.dll (0x76C90000)

C:\WINDOWS\system32\PSAPI.DLL (0x76BC0000)

C:\WINDOWS\system32\VERSION.dll (0x77BD0000)

C:\WINDOWS\system32\SETUPAPI.dll (0x765E0000)

C:\WINDOWS\System32\IMM32.DLL (0x76300000)

C:\WINDOWS\System32\LPK.DLL (0x62C20000)

C:\WINDOWS\System32\USP10.dll (0x72F10000)

C:\WINDOWS\System32\MSGINA.dll (0x758D0000)

C:\WINDOWS\system32\SHELL32.dll (0x773A0000)

C:\WINDOWS\system32\SHLWAPI.dll (0x772A0000)

C:\WINDOWS\system32\COMCTL32.dll (0x77310000)

C:\WINDOWS\System32\ODBC32.dll (0x1F7B0000)

C:\WINDOWS\system32\comdlg32.dll (0x76320000)

C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll (0x78090000)

C:\WINDOWS\System32\odbcint.dll (0x1F850000)

C:\WINDOWS\System32\SHSVCS.dll (0x76BA0000)

C:\WINDOWS\system32\sfc.dll (0x76B80000)

C:\WINDOWS\System32\sfc_os.dll (0x76C30000)

C:\WINDOWS\System32\WINTRUST.dll (0x76C00000)

C:\WINDOWS\system32\ole32.dll (0x00A30000)

C:\WINDOWS\system32\IMAGEHLP.dll (0x76C60000)

C:\WINDOWS\System32\msctfime.ime (0x00E70000)

C:\WINDOWS\System32\WINSCARD.DLL (0x72360000)

C:\WINDOWS\System32\WTSAPI32.dll (0x76F20000)

C:\WINDOWS\System32\uxtheme.dll (0x5ADC0000)

C:\WINDOWS\System32\WINMM.dll (0x76B10000)

C:\WINDOWS\System32\SYNCOR11.DLL (0x6BD00000)

C:\WINDOWS\system32\cscdll.dll (0x76570000)

C:\WINDOWS\system32\WlNotify.dll (0x758B0000)

C:\WINDOWS\System32\WINSPOOL.DRV (0x72F70000)

C:\WINDOWS\system32\MPR.dll (0x71A90000)

C:\WINDOWS\System32\rsaenh.dll (0x0FFD0000)

C:\WINDOWS\System32\SAMLIB.dll (0x71B70000)

C:\WINDOWS\system32\msv1_0.dll (0x76CE0000)

C:\WINDOWS\System32\cscui.dll (0x76590000)

C:\WINDOWS\System32\wdmaud.drv (0x72C90000)

C:\WINDOWS\System32\NTMARTA.DLL (0x76CB0000)

C:\WINDOWS\system32\WLDAP32.dll (0x76F30000)

C:\WINDOWS\System32\msacm32.drv (0x72C80000)

C:\WINDOWS\System32\MSACM32.dll (0x77BB0000)

C:\WINDOWS\System32\midimap.dll (0x77BA0000)

C:\WINDOWS\System32\sxs.dll (0x75E00000)

C:\WINDOWS\etb\nt_hide66.dll (0x10000000)

C:\WINDOWS\System32\COMRes.dll (0x77020000)

C:\WINDOWS\system32\OLEAUT32.dll (0x770F0000)

C:\WINDOWS\System32\CLBCATQ.DLL (0x76FA0000)

C:\WINDOWS\System32\Cabinet.dll (0x750B0000)



=====================================================
PROCESS NAME:  SERVICES.EXE
-----------------------------------------------------
  Process ID  = 0x00000230
  Thread count= 18
  Parent process ID = 508
  Priority Class    = 32

*****************************************************************
      File association information
*****************************************************************
------------------------------------------------------------
0：HKEY_CLASSES_ROOT\.exe
------------------------------------------------------------
<DEFAULT> = exefile, 正常！
------------------------------------------------------------
1：HKEY_CLASSES_ROOT\exefile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
2：HKEY_CLASSES_ROOT\exefile\shell\runas\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
3：HKEY_CLASSES_ROOT\.txt
------------------------------------------------------------
<DEFAULT> = txtfile, 正常！
------------------------------------------------------------
4：HKEY_CLASSES_ROOT\txtfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = %SystemRoot%\system32\NOTEPAD.EXE %1, 正常！
------------------------------------------------------------
5：HKEY_CLASSES_ROOT\.reg
------------------------------------------------------------
<DEFAULT> = regfile, 正常！
------------------------------------------------------------
6：HKEY_CLASSES_ROOT\regfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = regedit.exe "%1", 正常！
------------------------------------------------------------
7：HKEY_CLASSES_ROOT\.bat
------------------------------------------------------------
<DEFAULT> = batfile, 正常！
------------------------------------------------------------
8：HKEY_CLASSES_ROOT\batfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
9：HKEY_CLASSES_ROOT\.com
------------------------------------------------------------
<DEFAULT> = comfile, 正常！
------------------------------------------------------------
10：HKEY_CLASSES_ROOT\comfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！
------------------------------------------------------------
11：HKEY_CLASSES_ROOT\.scr
------------------------------------------------------------
<DEFAULT> = scrfile, 正常！
------------------------------------------------------------
12：HKEY_CLASSES_ROOT\scrfile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" /S, 正常！
------------------------------------------------------------
13：HKEY_CLASSES_ROOT\.pif
------------------------------------------------------------
<DEFAULT> = piffile, 正常！
------------------------------------------------------------
14：HKEY_CLASSES_ROOT\piffile\shell\open\command
------------------------------------------------------------
<DEFAULT> = "%1" %*, 正常！

引用:

【命运里の金色的贴子】最好能到sp2,不然可能会反复感染 ...........................

不能升级到SP2 的~!

两位老大
赶紧看啊

安全模式能正常运行吗?(指不反复重启)
如果可以,偶就能帮你手工清除.
根据楼主述说道特征,应该是恶性的病毒.能自动更改程序名.相信还有隐藏保护程序.不外乎以下几点:
1 启动项(最常见)
2 服务项(目前比较流行)
3 dll文件加载
4 驱动加载(比较毒的系统级后门)
5 感染exe文件(最麻烦的,一个杀不干净又卷土重来)
如能在安全模式稳定运行,请继续看下去
我们根据以上顺序 一次检查
xpsp1的系统 有系统配置实用程序
请在开始 运行里输入msconfig 回车 或者 按win+r 组合键调出运行对话框
1 检查启动项  去除所有可疑程序(不懂?那只能抓个图帖上来了)
2 检查服务 先把下面的 隐藏所有microsoft服务 勾选,检查剩下的自动启动服务 把可疑的禁用(还是不懂?抓图)
3 至此可以尝试重启进入正常模式,能否正常运行?如能,请继续下面的清除工作.(驱动级的查杀,由于在安全模式下不知能否使用icesword,手工检查对系统熟悉程度的要求很高,估计楼主也没这个水准,所以放后面)
4 能正常进入系统,请一定断网.运行icesword,再次检查进程,服务,SSDT等选项.注意红色显示的(瑞星子SSDT里也显示红色,请抓图帖出来)
5 根据以上来查找病毒运行的程序及关联文件
6 鉴于有些后门可能会替换正常系统服务来隐藏运行,我们还要进行最好一次安全检查(据估计楼主所中的病毒应该没这么变态).
这次 在"我的电脑"点 "右键" 选择 "管理",在弹出的mmc里,选择"服务和应用程序" 接着选择"服务",这样右边窗口会列出所有服务.咱们只要注意 启动类型 为 自动的,挨个检查.(怕怕了?不用紧张,昨天一个电脑白痴子在我的指导下也能顺利铲除病毒,所以楼主一定行,嘻嘻)
  也许你要问:我哪知道哪个服务是不正常的?没关系,有两个办法,一是根贴告诉我,我把系统服务的表贴出来,自己对照看.二是请人帮你看.请谁?我吗?这会在上班,所以如果你愿意等.可以加我:383353523,请说明来意.否则一概不加