12   2  /  2  页   跳转

救命啊..U.EXE病毒啊

你的机器快成仙拉!
修复HOST表
我去看看61.141.31.11 和125.91.14.230这两个混蛋网站
gototop
 

拿啥修复HOST表...
手动吗?我手动删除了他们 还是回来了..
gototop
 

麻烦扫个SRENG日志
gototop
 

SRENG是什么? 唉..难道真没解决方法吗..各位
gototop
 

修复所有01项和06项
修复
O23 - NT 服务: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
并删除相应文件
运行LSPFix.exe删除
gamelink
w2pxdrv
删除c:\windows.0\system32\gamelink.dll


估计这样解决不了问题
按楼上说的做
gototop
 

w2pxdrv 这个好像是驱动程序吧>?

谁知道..我先清理?
gototop
 

启动项报告:      2006-11-23, 22:38:31
启动项扫描器版本: 1.52.2
开始于:      D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.EXE
系统检测:    Windows XP SP1 (WinNT 5.01.2600)
系统检测:    Internet Explorer v6.00 SP1 (6.00.2800.1106)
* 使用默认选项             
==================================================

当前运行的进程:         

D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.exe
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS.0\Explorer.EXE
C:\WINDOWS.0\System32\rundll32.exe
C:\WINDOWS.0\System32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS.0\System32\nvsvc32.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\Program Files\Winamp\Winamp.exe
D:\Program Files\Tencent\qq\QQ.exe
D:\Program Files\Tencent\qq\TIMPlatform.exe
C:\Documents and Settings\Rin\My Documents\杂货专用箱\HA-LeapFTP274602-yfy\HA-LeapFTP2.7.4.602-yfy\LeapFTP.exe
C:\Program Files\eMule\eMule.exe
D:\系统工具\HB_Hijackthis\HijackThis1991汉化版\HijackThis1991zww.exe

--------------------------------------------------

文件夹中的启动项                 

Shell folders Startup:
[C:\Documents and Settings\Rin\「开始」菜单\程序\启动]
ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS.0\system32\userinit.exe,

--------------------------------------------------

注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS.0\System32\NvCpl.dll,NvStartup

--------------------------------------------------

注册表中的启动项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS.0\System32\ctfmon.exe

--------------------------------------------------

文件打开方式关联 for    .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(黙认) =  C:\WINDOWS.0\NOTEPAD.EXE %1

--------------------------------------------------

Load/Run keys from C:\WINDOWS.0\WIN.INI:

load=* 未找到INI相关项目值 *       
run=* 未找到INI相关项目值 *       

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *           
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *           
HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *           
HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *           
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *           
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *           
HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *         
HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *         
HKCU\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *           
HKCU\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *           
HKLM\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *           
HKLM\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *           
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

外壳扩展和屏幕保护程序的键值  从            C:\WINDOWS.0\SYSTEM.INI:

Shell=* 未找到INI相关项目值 *       
SCRNSAVE.EXE=* 未找到INI相关项目值 *       
drivers=* 未找到INI相关项目值 *       

外壳扩展和屏幕保护程序的键值  从  注册表             

Shell=Explorer.exe
SCRNSAVE.EXE=* 未找到相关注册表键值 *           
drivers=* 未找到相关注册表键值 *           

Policies Shell key:

HKCU\..\Policies: Shell=* 未找到相关注册表键值 *           
HKLM\..\Policies: Shell=* 未找到相关注册表键值 *           

--------------------------------------------------


列举IE浏览器辅助对象(BHO模块):               

(no name) - D:\Program Files\Tencent\QQ\QQIEHelper.dll - {54EBD53A-9BC1-480B-966A-843A333CA162}
(no name) - C:\PROGRA~1\FLASHGET\jccatch.dll - {A5366673-E8CA-11D3-9CD9-0090271D075B}

--------------------------------------------------

列举下载的程序文件:                       

[NetmarbleStarter23 Class]
InProcServer32 = C:\WINDOWS.0\Downloaded Program Files\NMStarter23.dll
CODEBASE = http://download.netmarble.com/web/nmstarter/NMStarter23.cab

[ctl4RA Class]
InProcServer32 = C:\WINDOWS.0\System32\PRINTC~1.DLL
CODEBASE = http://www.95599.cn/ra/printCtl.cab

[Nexon Package Manager Control]
InProcServer32 = C:\WINDOWS.0\nxpm.ocx
CODEBASE = http://file.nx.com/activex/public_new/nxpm.cab

[CEditCtrl Object]
InProcServer32 = C:\WINDOWS.0\System32\aliedit\AliEdit.dll
CODEBASE = https://img.alipay.com/download/1007/aliedit.cab

[CCtInf Class]
InProcServer32 = C:\WINDOWS.0\System32\BANKCE~1.DLL
CODEBASE = http://www.95599.cn/BankControl.cab

[LiveMediaOcx Control]
InProcServer32 = D:\PROGRA~1\Tencent\QQLIVE~1\QQLive\QQLive.ocx
CODEBASE = http://dl_dir.qq.com/qqtv/QQLiveOcxSetup.exe

[NMTransX Module]
InProcServer32 = C:\WINDOWS.0\Downloaded Program Files\NMTransX.dll
CODEBASE = http://download.netmarble.com/NMChatX/NMTransX.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS.0\System32\Macromed\Flash\Flash9.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

列举 Winsock LSP 文件:           

Protocol #1: w2pxdrv.dll (file MISSING)
Protocol #2: w2pxdrv.dll (file MISSING)
Protocol #3: w2pxdrv.dll (file MISSING)
Protocol #4: w2pxdrv.dll (file MISSING)
Protocol #5: w2pxdrv.dll (file MISSING)
Protocol #21: w2pxdrv.dll (file MISSING)

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\Rin\LOCALS~1\Temp\__1.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__2.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__124.tmp||C:\DOCUME~1\Rin\LOCALS~1\Temp\__207.tmp


--------------------------------------------------

列举 ShellServiceObjectDelayLoad 项目:           

WebCheck: C:\WINDOWS.0\System32\webcheck.dll
SysTray: C:\WINDOWS.0\System32\stobject.dll
PostBootReminder: C:\WINDOWS.0\system32\SHELL32.dll
CDBurn: C:\WINDOWS.0\system32\SHELL32.dll

--------------------------------------------------
报告完毕,共 7,157 字节         
报告生成用时:1.125秒     

Command line options:
  /verbose  - to add additional info on each section
  /complete - to include empty sections and unsuspicious data
  /full    - to include several rarely-important sections
  /force9x  - to include Win9x-only startups even if running on WinNT
  /forcent  - to include WinNT-only startups even if running on Win9x
  /forceall - to include all Win9x and WinNT startups, regardless of platform
  /history  - to list version history only
gototop
 

我也出现这个了。。安全模式也进不去。。哎。。完了~~~
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT