[CODE]

2007-03-08,19:40:27

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <18v><C:\WINDOWS\iexp1ora.exe>  [N/A]
    <qzxddb><C:\WINDOWS\winlog0a.exe>  [N/A]
    <i4sqj><C:\WINDOWS\iexpl0ra.exe>  [N/A]
    <4iy><C:\WINDOWS\Servera.exe>  [N/A]
    <7usbvvycjrxg1f><C:\WINDOWS\crasos.exe>  [N/A]
    <9j8tswyq2r7ucd7><C:\WINDOWS\rundl13a.exe>  [N/A]
    <2r8m6j6t8><C:\WINDOWS\c0nima.exe>  [N/A]
    <yv9u2g841fr5vv><C:\WINDOWS\cftmoa.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <wxClient><C:\WINDOWS\System32\Clsmn.exe>  []
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [N/A]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit>  [(Verified)NVIDIA Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <GinaDLL><C:\WINDOWS\system32\LogUser.dll>  [N/A]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Corporation]
    <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk>  [N/A]
    <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Corporation]
    <WebCheck><%SystemRoot%\System32\webcheck.dll>  [(Verified)Microsoft Corporation]
    <SysTray><C:\WINDOWS\System32\stobject.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\System32\browseui.dll>  [(Verified)Microsoft Corporation]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\System32\browseui.dll>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================

正在运行的进程
[PID: 492][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 544][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 584][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\LogUser.dll]  [N/A, N/A]
[PID: 628][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 640][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 808][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 992][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1028][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1192][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.9131]
    [C:\WINDOWS\System32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.9131]
    [C:\WINDOWS\System32\nvshell.dll]  [N/A, N/A]
    [D:\网络游戏\qq2007b1\qdshm.dll]  [, 1, 0, 101, 20]
    [D:\网络游戏\qq2007b1\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
[PID: 1312][C:\WINDOWS\System32\Clsmn.exe]  [, 16.3.12.602]
    [C:\WINDOWS\System32\RegCode.dll]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 1360][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 1432][C:\Program Files\Richtech\Dlxp\CltSrv.exe]  [N/A, N/A]
[PID: 1472][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.9131]
[PID: 1492][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1900][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  [Macromedia, Inc., 8,0,24,0]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
[PID: 328][C:\WINDOWS\iexp1ore.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
[PID: 372][C:\WINDOWS\iexpl0re.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
[PID: 144][C:\WINDOWS\winlog0n.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
[PID: 1080][C:\WINDOWS\Servere.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
[PID: 864][C:\WINDOWS\crasos.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
[PID: 204][C:\WINDOWS\c0nime.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
[PID: 1256][C:\WINDOWS\cftmon.exe]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
[PID: 1188][C:\WINDOWS\System32\conime.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1828][d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5, 5, 6, 274]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\ThunderEx.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 14]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 12, 2, 56]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 12, 2, 56]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\iTargetAD.dll]  [N/A, N/A]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 8]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Components\DiagnoseHelper\DiagnoseHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 10]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Components\PortVerify\PortVerify.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\LiveUpdate.dll]  [, 1, 0, 1, 17]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 2, 1, 43]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Plugins\TingTing\TingTing.dll]  [Thunder Networking Technologies,LTD, 1, 1, 1, 12]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\Program\FloatBar.dll]  [Giganology Inc., 1, 0, 0, 2]
[PID: 2392][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx]  [Macromedia, Inc., 8,0,24,0]
    [d:\系统文件\桌面\Thunder.v5.5.6.274.NoAD-Ayu\Thunder\ComDlls\ThunderAgent_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 14]
[PID: 3024][C:\Program Files\Windows NT\Accessories\WORDPAD.EXE]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]
[PID: 3184][d:\系统文件\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
    [C:\WINDOWS\System32\Wmzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Gjzos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Msxos.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\Rav32.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyl.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSym.dll]  [N/A, N/A]
    [C:\WINDOWS\System32\LgSyzr.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]

以上就是那个病毒的日志。症状是中之后就马上静音。连文件名都更改不了。郁闷。