(请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 (请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

[已解决] (请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作

lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	发表于： 2008-07-20 11:23 \| 只看楼主短消息资料字号：小中大 1楼 (请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作谢谢! 用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/2008052906 Firefox/3.0 附件: 文件名:SREngLOG.log 下载次数:206 文件类型:application/octet-stream 文件大小: 上传时间:2008-7-20 11:22:50 描述:log lrenwox 最后编辑于 2008-07-20 14:38:23
lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	分享到：

开心101 卡卡反病毒小组帖子:1210 注册: 2008-07-05 来自:梦开始的地方	发表于： 2008-07-20 11:37 \| 短消息资料字号：小中大 2楼回复：中了Trojan.DL.Win32.Undef.zg病毒,日志上传了,请指教菜鸟操作 1.建议使用XDelBox删除以下文件(附件就是）使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。 c:\windows\system32\rasdlgcq.dll c:\windows\system32\showad.dll c:\windows\system32\fkpqwugpargzgok.dll c:\windows\system32\cryptuiwlqx.dll %systemroot%\system32\syschk.exe c:\windows\system32\wyhesm.dll c:\windows\system32\mtewdh.dll c:\windows\system32\pedadt.dll c:\windows\system32\sgdewg.dll c:\windows\system32\mfdesy.dll c:\windows\system32\cliconfgzx.dll c:\windows\system32\udxduzdk.dll c:\windows\system32\imgutilhx2.dll c:\windows\system32\wyrsdj.dll c:\windows\system32\rfdswc.dll c:\windows\system32\jfdses.dll c:\windows\system32\hhrdxd.dll c:\windows\system32\wrqszl.dll c:\windows\system32\jdsaex.dll c:\windows\system32\tdfhex.dll c:\windows\system32\zycdex.dll c:\windows\system32\ddserh.dll c:\windows\system32\jbgyer.dll c:\windows\system32\wfrdvq.dll c:\windows\system32\mttwfh.dll c:\windows\system32\zgtwfx.dll c:\windows\system32\fsrgeb.dll c:\windows\system32\wklsdd.dll c:\windows\system32\cdwqfs.dll c:\windows\system32\jfrwdh.dll c:\windows\system32\tdggrz.dll c:\windows\system32\cedafb.dll c:\windows\system32\dndsaf.dll c:\windows\usnsvc.exe c:\progra~1\zvtx\jfdh.dll c:\windows\system32\config\sam6.log %systemroot%\avtapit.dll c:\windows\system32\fkpqwugpargzgok.dll c:\windows\system32\drivers\29bhyo.sys c:\windows\system32\drivers\828457eb.sys c:\windows\system32\drivers\acpidisk.sys c:\windows\system32\drivers\wtfxhomy.sys c:\windows\system32\drivers\uysrfwrn.sys c:\windows\system32\drivers\saerddtr.sys c:\windows\system32\drivers\swlsgmgy.sys c:\0026bc23\0026bc2b c:\windows\system32\drivers\qzhendmc.sys c:\windows\system32\drivers\rmjyzycw.sys c:\windows\system32\drivers\saerddtr.sys c:\windows\system32\drivers\mswd64.sys c:\windows\system32\drivers\lrw38.sys c:\docume~1\12\locals~1\temp\1.tmp c:\windows\system32\d32dx9.sys c:\windows\system32\drivers\eeapokbj.sys c:\windows\system32\drivers\by30zqp.sys c:\windows\system32\drivers\beep.sys c:\windows\system32\drivers\bdmwmhck.sys c:\windows\system32\drivers\b15e5a79.sys 2.删除重启后使用SREng修复下面各项：启动项目－－注册表之如下项删除： [cryptuiwlqx.dll] <C:\WINDOWS\system32\cryptuiwlqx.dll> [rasdlgcq.dll] <C:\WINDOWS\system32\rasdlgcq.dll> [{00310031-0031-0031-0031-00310031BB15}] <C:\WINDOWS\system32\cryptuiwlqx.dll> [{ACADABAE-1102-0010-8000-00AA006D2EA8}] <C:\WINDOWS\system32\ShowAD.dll> [{00230023-0023-0023-0023-00230023BB15}] <C:\WINDOWS\system32\rasdlgcq.dll> 注意该项[AppInit_DLLs]修改：把<SysWoWCvC.dll,ezcron.dll myasemt.dll caotxb.dll longasus.dll comremo.dll sctzxy.dll googleons.dll welycz.dll raesony.dll joasuse.dll pcibexl.dll cbplus.dll joliom.dll jsnoer.dll woasick.dll tmdkco.dll qoemsl.dll offeceo.dll>修改为<>即清空 [SystemCheck] <%SystemRoot%\system32\syschk.exe> [{EB71E0B3-E97D-4D30-8733-E28266467617}] <C:\WINDOWS\system32\wyhesm.dll> [{189F087F-4378-405F-85FA-37D955AD7A8C}] <C:\WINDOWS\system32\mtewdh.dll> [{5E907A48-400E-4EA8-9792-FFAE052D59E9}] <C:\WINDOWS\system32\pedadt.dll> [{8C41B7F7-3168-400D-A702-0E7EFE0BA304}] <C:\WINDOWS\system32\sgdewg.dll> [{DC3D30AE-0380-4151-8934-EE98A34B0370}] <C:\WINDOWS\system32\mfdesy.dll> [{00050005-0005-0005-0005-00050005BB15}] <C:\WINDOWS\system32\cliconfgzx.dll> [{00150015-0015-0015-0015-00150015BB15}] <C:\WINDOWS\system32\udxduzdk.dll> [{00300030-0030-0030-0030-00300030BB15}] <C:\WINDOWS\system32\imgutilhx2.dll> [{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}] <C:\WINDOWS\system32\wyrsdj.dll> [{461D2AB4-29A5-45C2-9134-D52272D3DE38}] <C:\WINDOWS\system32\rfdswc.dll> [{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}] <C:\WINDOWS\system32\jfdses.dll> [{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}] <C:\WINDOWS\system32\hhrdxd.dll> [{F99DEFDD-200B-4410-B572-E90883D527D2}] <C:\WINDOWS\system32\wrqszl.dll> [{B29583D8-033A-4B9F-8553-7C5458F3FB8E}] <C:\WINDOWS\system32\jdsaex.dll> [{0B846B26-BFE6-4E8E-A948-1DB17B77B483}] <C:\WINDOWS\system32\tdfhex.dll> [{45AADFAA-DD36-42AB-83AD-0521BBF58C24}] <C:\WINDOWS\system32\zycdex.dll> [{A9895933-6636-4281-BC58-EE6DE2AF96E3}] <C:\WINDOWS\system32\ddserh.dll> [{00ED0F3B-D53B-4DBF-BB20-8DFBC3176068}] <C:\WINDOWS\system32\jbgyer.dll> [{6BBAA1E6-CF54-4139-AB9C-8491A9F909D7}] <C:\WINDOWS\system32\wfrdvq.dll> [{000F087F-4378-545F-74FA-37D345AD7A8C}] <C:\WINDOWS\system32\mttwfh.dll> [{006CA8A1-61BC-4774-A54C-F49034270BAD}] <C:\WINDOWS\system32\zgtwfx.dll> [{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}] <C:\WINDOWS\system32\fsrgeb.dll> [{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}] <C:\WINDOWS\system32\wklsdd.dll> [{011DB9B9-44B4-44D9-B17E-BC7608F2E549}] <C:\WINDOWS\system32\cdwqfs.dll> [{841529CB-7F77-4B99-A895-B5441E0D302F}] <C:\WINDOWS\system32\jfrwdh.dll> [{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}] <C:\WINDOWS\system32\tdggrz.dll> [{84143967-B645-4BFF-B873-DA1DC886E9A7}] <C:\WINDOWS\system32\cedafb.dll> [{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}] <C:\WINDOWS\system32\dndsaf.dll> [cliconfgzx.dll] <C:\WINDOWS\system32\cliconfgzx.dll> [fhruujot.dll] <C:\WINDOWS\system32\udxduzdk.dll> [luzeuvsn.dll] <C:\WINDOWS\system32\udxduzdk.dll> [imgutilhx2.dll] <C:\WINDOWS\system32\imgutilhx2.dll> [cvipzjyr.dll] <C:\WINDOWS\system32\udxduzdk.dll> [kuiwoice.dll] <C:\WINDOWS\system32\udxduzdk.dll> [ylhuivpx.dll] <C:\WINDOWS\system32\udxduzdk.dll> [tklyoidp.dll] <C:\WINDOWS\system32\udxduzdk.dll> [udxduzdk.dll] <C:\WINDOWS\system32\udxduzdk.dll> 启动项目－－服务－－ Win32服务应用程序之如下项删除： [Remote Procedure Call Locator / RpcUsnsvc] <C:\WINDOWS\usnsvc.exe> [Windows eayc RunThem / eayc] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\zvtx\jfdh.dll> [Protected Storage Manager / ProtectedStorager5] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->c:\windows\system32\config\sam6.log> [WbWin / WbWin] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\avtapit.dll> [Windows Presentation Foundation (WPF) / application] <C:\WINDOWS\System32\svchost.exe -k application-->C:\WINDOWS\system32\FKpqwUGPArgZGoK.dll> 启动项目－－服务－－驱动程序之如下项删除： [29bhyo / 29bhyo] <\SystemRoot\system32\drivers\29bhyo.sys> [828457eb / 828457eb] <\SystemRoot\System32\drivers\828457eb.sys> [acpidisk / acpidisk] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys> [wtfxhomy / wtfxhomy] <\SystemRoot\system32\drivers\wtfxhomy.sys> [uysrfwrn / uysrfwrn] <\SystemRoot\system32\drivers\uysrfwrn.sys> [saerddtr / saerddtr] <\SystemRoot\system32\drivers\saerddtr.sys> [swlsgmgy / swlsgmgy] <\SystemRoot\system32\drivers\swlsgmgy.sys> [NBA_SOFT / NBA_SOFT] <\??\C:\0026BC23\0026BC2B> [qzhendmc / qzhendmc] <\SystemRoot\system32\drivers\qzhendmc.sys> [rmjyzycw / rmjyzycw] <\SystemRoot\system32\drivers\rmjyzycw.sys> [saerddtr / saerddtr] <\SystemRoot\system32\drivers\saerddtr.sys> [mswd64 / mswd64] <\??\C:\WINDOWS\system32\drivers\mswd64.sys> [Lrw38 / Lrw38] <\SystemRoot\System32\Drivers\Lrw38.sys> [IIS Manager / IIS Manager ] <\??\C:\DOCUME~1\12\LOCALS~1\Temp\1.tmp> [HiddFldy / HiddFldy] <\??\C:\WINDOWS\system32\d32dx9.sys> [eeapokbj / eeapokbj] <\SystemRoot\system32\drivers\eeapokbj.sys> [by30zq / by30zqp] <\SystemRoot\System32\DRIVERS\by30zqp.sys> [Beep / Beep] <\??\C:\WINDOWS\system32\Drivers\Beep.sys> [bdmwmhck / bdmwmhck] <\SystemRoot\system32\drivers\bdmwmhck.sys> [b15e5a79 / b15e5a79] <\SystemRoot\System32\drivers\b15e5a79.sys> 附件: 文件名:XDelBox_1.7支持奥运版.rar 下载次数:143 文件类型:application/octet-stream 文件大小: 上传时间:2008-7-20 11:38:11 描述:rar 开心101 最后编辑于 2008-07-20 11:40:11 好久没来了嘻嘻
开心101 卡卡反病毒小组帖子:1210 注册: 2008-07-05 来自:梦开始的地方

lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	发表于： 2008-07-20 11:39 \| 只看楼主短消息资料字号：小中大 3楼回复：进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作谢谢,我尝试一下
lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:

豪斯登堡新郎社区嘉宾帖子:4234 注册: 2007-11-09 来自:	发表于： 2008-07-20 11:39 \| 短消息资料字号：小中大 4楼回复：中了Trojan.DL.Win32.Undef.zg病毒,日志上传了,请指教菜鸟操作复制c:\windows\system32\dllcache\beep.sys文件粘贴到c:\windows\system32\drivers\文件夹内，提示替换时选“是”。 1.用XDelBox勾选抑制再生后删除以下文件：(XDelBox1.7支持奥运版下载) 使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。 c:\windows\usnsvc.exe c:\windows\avtapit.dll c:\windows\icpb.dll c:\windows\system32\1957e.dll c:\windows\system32\cryptuiwlqx.dll c:\windows\system32\rasdlgcq.dll c:\windows\system32\ruspivdabw.dll c:\windows\system32\showad.dll c:\windows\system32\fkpqwugpargzgok.dll c:\windows\system\mspmsnsv.dll c:\windows\player.exe c:\windows\system32\syschk.exe c:\windows\system32\wyhesm.dll c:\windows\system32\mtewdh.dll c:\windows\system32\pedadt.dll c:\windows\system32\sgdewg.dll c:\windows\system32\mfdesy.dll c:\windows\system32\cliconfgzx.dll c:\windows\system32\udxduzdk.dll c:\windows\system32\imgutilhx2.dll c:\windows\system32\wyrsdj.dll c:\windows\system32\rfdswc.dll c:\windows\system32\jfdses.dll c:\windows\system32\hhrdxd.dll c:\windows\system32\wrqszl.dll c:\windows\system32\jdsaex.dll c:\windows\system32\tdfhex.dll c:\windows\system32\zycdex.dll c:\windows\system32\ddserh.dll c:\windows\system32\jbgyer.dll c:\windows\system32\wfrdvq.dll c:\windows\system32\mttwfh.dll c:\windows\system32\zgtwfx.dll c:\windows\system32\fsrgeb.dll c:\windows\system32\wklsdd.dll c:\windows\system32\cdwqfs.dll c:\windows\system32\jfrwdh.dll c:\windows\system32\tdggrz.dll c:\windows\system32\cedafb.dll c:\windows\system32\dndsaf.dll c:\windows\system32\sichost.exe c:\windows\system\mspmsnsv.dll c:\windows\system32\avtapit.dll c:\windows\system32\config\sam6.log c:\windows\icpb.dll c:\progra~1\zvtx\jfdh.dll c:\windows\system32\fkpqwugpargzgok.dll c:\windows\mayababy\mayababymain.exe c:\windows\system32\4c3da.exe c:\windows\system32\tcpip.exe c:\windows\system32\drivers\29bhyo.sys c:\windows\system32\drivers\828457eb.sys c:\windows\system32\drivers\acpidisk.sys c:\windows\system32\drivers\wtfxhomy.sys c:\windows\system32\drivers\uysrfwrn.sys c:\windows\system32\drivers\tcpsr.sys c:\windows\system32\drivers\swlsgmgy.sys c:\windows\system32\drivers\saerddtr.sys c:\windows\system32\drivers\rmjyzycw.sys c:\windows\system32\ssdtti.sys c:\windows\system32\drivers\qzhendmc.sys c:\windows\system32\drivers\nty52.sys c:\windows\system32\nessery.sys c:\0026bc23\0026bc2b c:\windows\system32\drivers\mswd64.sys c:\windows\system32\drivers\lrw38.sys c:\docume~1\12\locals~1\temp\1.tmp c:\windows\system32\d32dx9.sys c:\windows\system32\drivers\eeapokbj.sys c:\windows\system32\drivers\by30zqp.sys c:\windows\system32\drivers\bdmwmhck.sys c:\windows\system32\drivers\b15e5a79.sys c:\program files\microsoft office\system\apcdli.sys c:\windows\system32\agrvjsvpjltha.dll c:\windows\system32\c4ca.dll d:\autorun.inf d:\MSDOS.bat 2.删除重启后使用SREng修复下面各项：启动项目－－注册表之如下项删除： [N/A] <C:\WINDOWS\Player.exe> [cryptuiwlqx.dll] [rasdlgcq.dll] [{00310031-0031-0031-0031-00310031BB15}] [{ACADABAE-1102-0010-8000-00AA006D2EA8}] [{00230023-0023-0023-0023-00230023BB15}] 注意该项[AppInit_DLLs]修改：把<SysWoWCvC.dll,ezcron.dll myasemt.dll caotxb.dll longasus.dll comremo.dll sctzxy.dll googleons.dll welycz.dll raesony.dll joasuse.dll pcibexl.dll cbplus.dll joliom.dll jsnoer.dll woasick.dll tmdkco.dll qoemsl.dll offeceo.dll>修改为<>即清空 [SystemCheck] [{EB71E0B3-E97D-4D30-8733-E28266467617}] [{189F087F-4378-405F-85FA-37D955AD7A8C}] [{5E907A48-400E-4EA8-9792-FFAE052D59E9}] [{8C41B7F7-3168-400D-A702-0E7EFE0BA304}] [{DC3D30AE-0380-4151-8934-EE98A34B0370}] [{00050005-0005-0005-0005-00050005BB15}] [{00150015-0015-0015-0015-00150015BB15}] [{00300030-0030-0030-0030-00300030BB15}] [{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}] [{461D2AB4-29A5-45C2-9134-D52272D3DE38}] [{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}] [{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}] [{F99DEFDD-200B-4410-B572-E90883D527D2}] [{B29583D8-033A-4B9F-8553-7C5458F3FB8E}] [{0B846B26-BFE6-4E8E-A948-1DB17B77B483}] [{45AADFAA-DD36-42AB-83AD-0521BBF58C24}] [{A9895933-6636-4281-BC58-EE6DE2AF96E3}] [{00ED0F3B-D53B-4DBF-BB20-8DFBC3176068}] [{6BBAA1E6-CF54-4139-AB9C-8491A9F909D7}] [{000F087F-4378-545F-74FA-37D345AD7A8C}] [{006CA8A1-61BC-4774-A54C-F49034270BAD}] [{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}] [{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}] [{011DB9B9-44B4-44D9-B17E-BC7608F2E549}] [{841529CB-7F77-4B99-A895-B5441E0D302F}] [{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}] [{84143967-B645-4BFF-B873-DA1DC886E9A7}] [{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}] 注意该项[shell]修改：把<Explorer.exe,>修改为<Explorer.exe>即清除Explorer.exe后面的内容 [cliconfgzx.dll] [fhruujot.dll] [luzeuvsn.dll] [imgutilhx2.dll] [cvipzjyr.dll] [kuiwoice.dll] [ylhuivpx.dll] [tklyoidp.dll] [udxduzdk.dll] 注意该项[Userinit]修改：把<C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sichost.exe>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略启动项目－－服务－－ Win32服务应用程序之如下项删除： [Portable Media Serial Number Service / WmdmPmSN] [WbWin / WbWin] [Remote Procedure Call Locator / RpcUsnsvc] [Protected Storage Manager / ProtectedStorager5] [iprip / iprip] [Windows eayc RunThem / eayc] [Windows Presentation Foundation (WPF) / application] [网络服务 / network services] [WinntServ / WinntServ] [wwinsystem / wwinsystem] 启动项目－－服务－－驱动程序之如下项删除： [29bhyo / 29bhyo] [828457eb / 828457eb] [acpidisk / acpidisk] [wtfxhomy / wtfxhomy] [uysrfwrn / uysrfwrn] [tcpsr / tcpsr] [swlsgmgy / swlsgmgy] [saerddtr / saerddtr] [rmjyzycw / rmjyzycw] [RESSDT / RESSDT] [qzhendmc / qzhendmc] [Profos / Profos] [nty52 / nty52] [nessery / nessery] [NBA_SOFT / NBA_SOFT] [mswd64 / mswd64] [Lrw38 / Lrw38] [IIS Manager / IIS Manager ] [HiddFldy / HiddFldy] [eeapokbj / eeapokbj] [by30zq / by30zqp] [bdmwmhck / bdmwmhck] [b15e5a79 / b15e5a79] [apcdli / apcdli] 系统修复－－　浏览器加载项之如下项删除： [] <C:\WINDOWS\system32\agrvjsvpjltha.dll> [] <C:\WINDOWS\system32\agrvjsvpjltha.dll> [Invoke Class] <C:\WINDOWS\system32\c4ca.dll> [] <C:\WINDOWS\system32\ruspivdabw.dll> [] <C:\WINDOWS\system32\ruspivdabw.dll> 点击下载大蜘蛛直接保存到系统文件夹内运行，更新后在首次默认的快速扫描之后进行一次完全扫描做完下载以下工具清理一次并更新杀毒软件至最新进行全盘杀毒清理系统临时文件和IE临时文件夹 http://www.atribune.org/public-beta/ATF-Cleaner.exe 用金山清理专家清理恶意软件 http://www.duba.net/zt/ksc/down.shtml 下载 windows清理助手清理一遍 http://www.arswp.com/download/arswp2/arswp2.zip 豪斯登堡新郎最后编辑于 2008-07-20 11:53:47 不认识我没关系，因为我也不认识你。
豪斯登堡新郎社区嘉宾帖子:4234 注册: 2007-11-09 来自:

aaccbbdd 卡卡巡查帖子:45933 注册: 2007-11-17 来自:蜀山仙剑派	发表于： 2008-07-20 11:39 \| 短消息资料字号：小中大 5楼回复：中了Trojan.DL.Win32.Undef.zg病毒,日志上传了,请指教菜鸟操作操作方法看我签名 <SystemCheck><%SystemRoot%\system32\syschk.exe> [] <360><C:\WINDOWS\360safe.exe> [奇虎网]C:\WINDOWS\Player.exe> <N/A><C:\WINDOWS\Player.exe> [] 不正常，意思病毒，建议删除先自己先测下http://www.virscan.org/ 改注册表 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe,> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sichost.exe> [File is missing] 为 <shell><Explorer.exe,> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [File is missing] 删除文件C:\WINDOWS\system32\sichost.exe 修改注册表[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><SysWoWCvC.dll,ezcron.dll myasemt.dll caotxb.dll longasus.dll comremo.dll sctzxy.dll googleons.dll welycz.dll raesony.dll joasuse.dll pcibexl.dll cbplus.dll joliom.dll jsnoer.dll woasick.dll tmdkco.dll qoemsl.dll offeceo.dll> [N/A] 为<AppInit_DLLs><> 删除启动项 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]下注册表项目及<>内DLL文件 <{EB71E0B3-E97D-4D30-8733-E28266467617}><C:\WINDOWS\system32\wyhesm.dll> [File is missing] <{189F087F-4378-405F-85FA-37D955AD7A8C}><C:\WINDOWS\system32\mtewdh.dll> [File is missing] <{5E907A48-400E-4EA8-9792-FFAE052D59E9}><C:\WINDOWS\system32\pedadt.dll> [File is missing] <{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgdewg.dll> [File is missing] <{DC3D30AE-0380-4151-8934-EE98A34B0370}><C:\WINDOWS\system32\mfdesy.dll> [File is missing] <{00230023-0023-0023-0023-00230023BB15}><C:\WINDOWS\system32\rasdlgcq.dll> [] <{00050005-0005-0005-0005-00050005BB15}><C:\WINDOWS\system32\cliconfgzx.dll> [File is missing] <{00150015-0015-0015-0015-00150015BB15}><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <{00300030-0030-0030-0030-00300030BB15}><C:\WINDOWS\system32\imgutilhx2.dll> [File is missing] <{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll> [File is missing] <{461D2AB4-29A5-45C2-9134-D52272D3DE38}><C:\WINDOWS\system32\rfdswc.dll> [File is missing] <{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}><C:\WINDOWS\system32\jfdses.dll> [File is missing] <{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> [File is missing] <{F99DEFDD-200B-4410-B572-E90883D527D2}><C:\WINDOWS\system32\wrqszl.dll> [File is missing] <{B29583D8-033A-4B9F-8553-7C5458F3FB8E}><C:\WINDOWS\system32\jdsaex.dll> [File is missing] <{0B846B26-BFE6-4E8E-A948-1DB17B77B483}><C:\WINDOWS\system32\tdfhex.dll> [File is missing] <{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zycdex.dll> [File is missing] <{A9895933-6636-4281-BC58-EE6DE2AF96E3}><C:\WINDOWS\system32\ddserh.dll> [File is missing] <{00ED0F3B-D53B-4DBF-BB20-8DFBC3176068}><C:\WINDOWS\system32\jbgyer.dll> [File is missing] <{6BBAA1E6-CF54-4139-AB9C-8491A9F909D7}><C:\WINDOWS\system32\wfrdvq.dll> [File is missing] <{000F087F-4378-545F-74FA-37D345AD7A8C}><C:\WINDOWS\system32\mttwfh.dll> [File is missing] <{006CA8A1-61BC-4774-A54C-F49034270BAD}><C:\WINDOWS\system32\zgtwfx.dll> [File is missing] <{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}><C:\WINDOWS\system32\fsrgeb.dll> [File is missing] <{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}><C:\WINDOWS\system32\wklsdd.dll> [File is missing] <{011DB9B9-44B4-44D9-B17E-BC7608F2E549}><C:\WINDOWS\system32\cdwqfs.dll> [File is missing] <{841529CB-7F77-4B99-A895-B5441E0D302F}><C:\WINDOWS\system32\jfrwdh.dll> [File is missing] <{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}><C:\WINDOWS\system32\tdggrz.dll> [File is missing] <{84143967-B645-4BFF-B873-DA1DC886E9A7}><C:\WINDOWS\system32\cedafb.dll> [File is missing] <{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}><C:\WINDOWS\system32\dndsaf.dll> [File is missing] <{ACADABAE-1102-0010-8000-00AA006D2EA8}><C:\WINDOWS\system32\ShowAD.dll> [] <{00310031-0031-0031-0031-00310031BB15}><C:\WINDOWS\system32\cryptuiwlqx.dll> [] 删除启动项 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]下注册表项目及<>内文件 <rasdlgcq.dll><C:\WINDOWS\system32\rasdlgcq.dll> [] <cliconfgzx.dll><C:\WINDOWS\system32\cliconfgzx.dll> [File is missing] <fhruujot.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <luzeuvsn.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <imgutilhx2.dll><C:\WINDOWS\system32\imgutilhx2.dll> [File is missing] <cvipzjyr.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <kuiwoice.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <ylhuivpx.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <tklyoidp.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <udxduzdk.dll><C:\WINDOWS\system32\udxduzdk.dll> [File is missing] <cryptuiwlqx.dll><C:\WINDOWS\system32\cryptuiwlqx.dll> [] 删除服务 [Windows Presentation Foundation (WPF) / application][Running/Auto Start] <C:\WINDOWS\System32\svchost.exe -k application-->C:\WINDOWS\system32\FKpqwUGPArgZGoK.dll><N/A> [Windows eayc RunThem / eayc][Stopped/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\zvtx\jfdh.dll><N/A> [iprip / iprip][Running/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\icpb.dll><N/A> [WbWin / WbWin][Others/Auto Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\avtapit.dll><N/A> 删除驱动 [29bhyo / 29bhyo][Stopped/Boot Start] <\SystemRoot\system32\drivers\29bhyo.sys><N/A> [828457eb / 828457eb][Stopped/System Start] <\SystemRoot\System32\drivers\828457eb.sys><N/A> [acpidisk / acpidisk][Stopped/Auto Start] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A> [b15e5a79 / b15e5a79][Stopped/System Start] <\SystemRoot\System32\drivers\b15e5a79.sys><N/A> [Beep / Beep][Stopped/Manual Start] <\??\C:\WINDOWS\system32\Drivers\Beep.sys><N/A> [by30zq / by30zqp][Running/Boot Start] <\SystemRoot\System32\DRIVERS\by30zqp.sys><> [eeapokbj / eeapokbj][Stopped/Boot Start] <\SystemRoot\system32\drivers\eeapokbj.sys><N/A> [HiddFldy / HiddFldy][Stopped/Auto Start] <\??\C:\WINDOWS\system32\d32dx9.sys><N/A> [IIS Manager / IIS Manager ][Stopped/Manual Start] <\??\C:\DOCUME~1\12\LOCALS~1\Temp\1.tmp><N/A> [Lrw38 / Lrw38][Stopped/Boot Start] <\SystemRoot\System32\Drivers\Lrw38.sys><N/A> [mswd64 / mswd64][Stopped/Auto Start] <\??\C:\WINDOWS\system32\drivers\mswd64.sys><N/A> [NBA_SOFT / NBA_SOFT][Stopped/Manual Start] <\??\C:\0026BC23\0026BC2B><N/A> [nessery / nessery][Stopped/Manual Start] <\??\C:\WINDOWS\system32\Nessery.sys><N/A>
aaccbbdd 卡卡巡查帖子:45933 注册: 2007-11-17 来自:蜀山仙剑派

lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	发表于： 2008-07-20 13:37 \| 只看楼主短消息资料字号：小中大 6楼回复：进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作谢谢达人帮忙!能进安全模式了,但还是有些问题请教: 1.网络连通后,svchost有时候占了50%以上,有问题么? 2.有什么好的防火强与杀毒软件推荐 2.帮忙看看新的log 启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <BitDefender Antiphishing Helper><"C:\Program Files\360safe\360sd\IEShow.exe"> [BitDefender] <BDAgent><"C:\Program Files\360safe\360sd\bdagent.exe"> [BitDefender S.R.L.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\UserInit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] ================================== 启动文件夹 N/A ==================================
lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:

lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	发表于： 2008-07-20 13:39 \| 只看楼主短消息资料字号：小中大 7楼回复：进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作 ================================== 服务 [Adobe LM Service / Adobe LM Service][Stopped/Manual Start] <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems> [Google Updater Service / gusvc][Stopped/Manual Start] <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [BitDefender Desktop Update Service / LIVESRV][Running/Auto Start] <"C:\Program Files\Common Files\360safe\BitDefender Update Service\livesrv.exe" /service><BitDefender SRL> [MrobeService / MrobeService][Stopped/Manual Start] <"C:\WINDOWS\system32\MRobeService.exe"><OLYMPUS IMAGING CORP.> [BitDefender Threat Scanner / scan][Running/Manual Start] <C:\WINDOWS\System32\svchost.exe -kbdx-->C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\scan.dll><S.C. BitDefender S.R.L> [BitDefender Virus Shield / VSSERV][Running/Auto Start] <"C:\Program Files\360safe\360sd\vsserv.exe" /service><BitDefender S.R.L.> [BitDefender Communicator / XCOMM][Running/Auto Start] <"C:\Program Files\Common Files\360safe\BitDefender Communicator\xcommsvr.exe" /service><BitDefender> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [bdfsfltr / bdfsfltr][Running/Manual Start] <system32\drivers\bdfsfltr.sys><BitDefender S.R.L. Bucharest, ROMANIA> [bdftdif / bdftdif][Running/System Start] <\??\C:\Program Files\Common Files\360safe\BitDefender Firewall\bdftdif.sys><BitDefender SRL> [BDSelfPr / BDSelfPr][Running/Manual Start] <\??\C:\Program Files\360safe\360sd\bdselfpr.sys><BitDefender S.R.L.> [Beep / Beep][Stopped/Manual Start] <\??\C:\WINDOWS\system32\Drivers\Beep.sys><N/A> [Bus Hound Analyzer / bhound5][Running/Boot Start] <\SystemRoot\System32\DRIVERS\bhound5.sys><Perisoft> [ialm / ialm][Running/Manual Start] <system32\DRIVERS\ialmnt5.sys><Intel Corporation> [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp][Stopped/Manual Start] <\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions> [Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Stopped/Manual Start] <system32\DRIVERS\Rtlnic5.sys><Realtek Semiconductor Corporation> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [SCI USB Camera / SciCamD][Stopped/Manual Start] <system32\DRIVERS\SciCamD.sys><Spreadtrum> [Spreadtrum USB to Serial port driver for dl / SciU2S][Stopped/Manual Start] <system32\DRIVERS\SciU2S.sys><Spreadtrum Communication Inc.> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [Trufos / Trufos][Running/Manual Start] <\??\C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\trufos.sys><N/A> [Profos / Profos][Running/Manual Start] <\??\C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\profos.sys><N/A> ================================== 浏览器加载项 [AcroIEHlprObj Class] {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet> [AcroIEToolbarHelper Class] {AE7CD045-E861-484f-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [PPLive] {95B3F550-91C4-4627-BCC4-521288C52977} <C:\Program Files\PPLive\PPLive.exe, N/A> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [FlashGet] {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\flashget.exe, FlashGet.com> [Messenger] {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation> [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [360杀毒反钓鱼工具] {381FFDE8-2394-4f90-B10D-FC6124A40F8C} <C:\Program Files\360safe\360sd\IEToolbar.dll, Bitdefender> [InputPassWd Class] {3A4C8311-C151-4462-BDE9-F777ABEE0063} <C:\WINDOWS\DOWNLO~1\WebDll.dll, > [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, > [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, > [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.> [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [Web Browser Applet Control] {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation> [iTrusPTA Class] {1E0DFFCF-27FF-4574-849B-55007349FEDA} <C:\WINDOWS\system32\aliedit\pta.dll, > [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FLASHGET\jccatch.dll, FlashGet> [RealPlayer RAM Download Handler] {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [360杀毒反钓鱼工具] {381FFDE8-2394-4F90-B10D-FC6124A40F8C} <C:\Program Files\360safe\360sd\IEToolbar.dll, Bitdefender> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [InputPassWd Class] {3A4C8311-C151-4462-BDE9-F777ABEE0063} <C:\WINDOWS\DOWNLO~1\WebDll.dll, > [Adobe PDF] {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A> [EditCtrl Class] {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\aliedit.dll, > [HHCtrl Object] {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Active Desktop Mover] {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A> [AxInputControl Class] {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL, > [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [AxSubmitControl Class] {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, > [RealPlayer Stream Handler] {A1A41E11-91DB-4461-95CD-0C02327FD934} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [AcroIEToolbarHelper Class] {AE7CD045-E861-484F-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [Messenger Object] {B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\system\msadc\msadco.dll, Microsoft Corporation> [OWSClientMiscApis Class] {BDEADE3F-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation> [OWSBrowserUI Class] {BDEADE43-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation> [Tencent Safety Online Base Module] {C09B522F-8AED-4E21-A65C-DC1AB652BAEE} <C:\WINDOWS\system32\TSOBase\TSOBase.ocx, Tencent Corporation> [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__WAV Moniker Class] {CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_WVX Moniker Class] {CD3AFA95-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx, Adobe Systems, Inc.> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [PasswordEditCtrl Class] {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> [添加到QQ表情] <C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A> [添加到反广告条] <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm, N/A> [转换为 Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [转换为现有 PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A> [转换选定的链接为 Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A> [转换选定的链接为现有 PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A> [转换选项为 Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [转换选项为现有 PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A> [转换链接目标为 Adobe PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A> [转换链接目标为现有 PDF] <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:

lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:	发表于： 2008-07-20 13:39 \| 只看楼主短消息资料字号：小中大 8楼回复：进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作 ================================== 正在运行的进程 [PID: 440 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 508 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 532 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 576 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 588 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 728 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 788 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 828 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 916 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 952 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1120 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\AdobePDF.dll] [Adobe Systems Incorporated., 7.0.0.00] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [D:\Program Files\Adobe\Acrobat 7.0\Distillr\AdistRes.CHS] [, ] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620] [PID: 1340 / 12][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0] [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.CHS] [Adobe Systems, Inc., 7.0.0.0] [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.0.2004121400] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\PROGRA~1\FLASHGET\jccatch.dll] [FlashGet, 1, 1, 5, 0] [PID: 1428 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\2052\mdmui.dll] [Microsoft Corporation, 7.00.9466] [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\msdbg2.dll] [Microsoft Corporation, 7.00.9466] [PID: 1476 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1968 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1732 / 12][C:\Program Files\360safe\360sd\bdagent.exe] [BitDefender S.R.L., 11, 0, 0, 174] [C:\Program Files\360safe\360sd\npcomm.dll] [BitDefender SRL, 1, 0, 0, 15] [C:\Program Files\360safe\360sd\bdch.dll] [BitDefender S.R.L, 11,0,0,7] [C:\Program Files\360safe\360sd\bdsubmit.dll] [BitDefender S.R.L., 11,0,0,7] [C:\WINDOWS\system32\XCOMM.dll] [BitDefender, 1, 8, 16, 0] [C:\Program Files\360safe\360sd\bdguictl.dll] [BitDefender S.R.L., 11, 0, 0, 68] [C:\Program Files\360safe\360sd\bdutils.dll] [SOFTWIN S.R.L., 11, 0, 0, 12] [C:\Program Files\360safe\360sd\txmlx.dll] [SOFTWIN S.R.L., 11, 0, 0, 1] [C:\Program Files\360safe\360sd\WSLib.dll] [BitDefender S.R.L. http://www.bitdefender.com, 1, 0, 31, 0] [C:\Program Files\360safe\360sd\NAG.dll] [BITDEFENDER S.R.L., 11, 0, 0, 9] [C:\Program Files\360safe\360sd\popup.dll] [BitDefender S.R.L., 11, 0, 0, 72] [C:\Program Files\360safe\360sd\libexpatw.dll] [N/A, ] [C:\Program Files\360safe\360sd\excmgr.dll] [BitDefender S.R.L., 11, 0, 0, 10] [PID: 1760 / 12][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1228 / 12][D:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.9] [D:\Program Files\Mozilla Firefox\xul.dll] [Mozilla Foundation, 1.9] [D:\Program Files\Mozilla Firefox\sqlite3.dll] [sqlite.org, 3.5.4.1] [D:\Program Files\Mozilla Firefox\MOZCRT19.dll] [Mozilla Foundation, 8.00.0000] [D:\Program Files\Mozilla Firefox\js3250.dll] [Netscape Communications Corporation, 4.0] [D:\Program Files\Mozilla Firefox\nspr4.dll] [Mozilla Foundation, 4.7.1] [D:\Program Files\Mozilla Firefox\smime3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\nss3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\nssutil3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\plc4.dll] [Mozilla Foundation, 4.7.1] [D:\Program Files\Mozilla Firefox\plds4.dll] [Mozilla Foundation, 4.7.1] [D:\Program Files\Mozilla Firefox\ssl3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\xpcom.dll] [Mozilla Foundation, 1.9] [D:\Program Files\Mozilla Firefox\components\browserdirprovider.dll] [Mozilla Foundation, 1.9] [D:\Program Files\Mozilla Firefox\softokn3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\nssdbm3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\freebl3.dll] [Mozilla Foundation, 3.12.0.3 Basic ECC] [D:\Program Files\Mozilla Firefox\nssckbi.dll] [Mozilla Foundation, 1.70] [D:\Program Files\Mozilla Firefox\components\brwsrcmp.dll] [Mozilla Foundation, 1.9] [D:\Program Files\Mozilla Firefox\plugins\npnul32.dll] [mozilla.org, 1, 0, 0, 15] [PID: 2248 / 12][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 2808 / 12][C:\WINDOWS\system32\taskmgr.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 3060 / 12][C:\Program Files\360safe\360sd\seccenter.exe] [BitDefender, 11,0,0,43] [C:\WINDOWS\system32\XCOMM.dll] [BitDefender, 1, 8, 16, 0] [C:\Program Files\360safe\360sd\bdguictl.dll] [BitDefender S.R.L., 11, 0, 0, 68] [C:\Program Files\360safe\360sd\bdutils.dll] [SOFTWIN S.R.L., 11, 0, 0, 12] [C:\Program Files\360safe\360sd\txmlx.dll] [SOFTWIN S.R.L., 11, 0, 0, 1] [C:\Program Files\360safe\360sd\bdch.dll] [BitDefender S.R.L, 11,0,0,7] [C:\Program Files\360safe\360sd\bdsubmit.dll] [BitDefender S.R.L., 11,0,0,7] [C:\Program Files\360safe\360sd\bdusers.dll] [BitDefender S.R.L, 11, 0, 0, 10] [C:\Program Files\360safe\360sd\CHS\seccenter.ui] [BitDefender, 11,0,0,64] [C:\Program Files\360safe\360sd\bdmcon.dll] [S.C. BitDefender S.R.L, 11, 0, 0, 65] [C:\Program Files\360safe\360sd\security.dll] [BitDefender S.R.L, 11, 0, 0, 53] [C:\Program Files\360safe\360sd\CHS\security.ui] [BitDefender S.R.L, 11, 0, 0, 53] [C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL] [Microsoft Corporation, 1.0.1038.0] [PID: 3624 / 12][C:\Program Files\360safe\360sd\uiscan.exe] [BitDefender S.R.L, 11, 0, 1, 67] [C:\Program Files\360safe\360sd\bdch.dll] [BitDefender S.R.L, 11,0,0,7] [C:\Program Files\360safe\360sd\bdsubmit.dll] [BitDefender S.R.L., 11,0,0,7] [C:\Program Files\360safe\360sd\bdutils.dll] [SOFTWIN S.R.L., 11, 0, 0, 12] [C:\Program Files\360safe\360sd\WSLib.dll] [BitDefender S.R.L. http://www.bitdefender.com, 1, 0, 31, 0] [C:\Program Files\360safe\360sd\CHS\uiscan.ui] [BitDefender S.R.L, 11, 0, 1, 67] [C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\scan.dll] [S.C. BitDefender S.R.L, 11.0.19.0] [C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\bdardrv.dll] [SOFTWIN S.R.L, 11, 0, 0, 5] [C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\profos.dll] [N/A, ] [C:\Program Files\Common Files\360safe\BitDefender Threat Scanner\trufos.dll] [N/A, ] [C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL] [Microsoft Corporation, 1.0.1038.0] [PID: 3476 / 12][G:\pub\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.6.11.992] [PID: 3484 / 12][G:\pub\sreng2\SRE78a7479e.EXE] [Smallfrogs Studio, 2.6.11.992] [G:\pub\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI Error. [UltraEdit.ini] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS Error. [UltraEdit.js] .LNK OK. [{00021401-0000-0000-C000-000000000046}]
lrenwox 初生襁褓狮帖子:5 注册: 2008-07-20 来自:

太阳花984042752 初生襁褓狮帖子:3 注册: 2008-07-20 来自:	发表于： 2008-07-20 14:56 \| 短消息资料字号：小中大 9楼回复：(请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作 360safe.exe是360的主程序
太阳花984042752 初生襁褓狮帖子:3 注册: 2008-07-20 来自:

超级游戏迷卡卡技术团队帖子:25779 注册: 2007-01-14 来自:	发表于： 2008-07-20 15:17 \| 短消息资料字号：小中大 10楼回复: (请再看看整理后的log)进入不了安全模式,自己手动删除不了,日志上传了,请指教菜鸟操作 [Beep / Beep][Stopped/Manual Start] <\??\C:\WINDOWS\system32\Drivers\Beep.sys><N/A> 看来beep.sys病毒文件的替换操作未进行，对应驱动程序的删除也被忽略…… 打酱油的……
超级游戏迷卡卡技术团队帖子:25779 注册: 2007-01-14 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT