之前几天感染过广告和些木马,杀完后今天电脑突然中毒,进程中多了2sy.exe  5sy.exe
6sy.exe  8sy.exe  9sy.exe 并且出现svchost32的进程,不能显示隐藏文件和系统文件,无法打开卡巴斯基,不知道该怎么办了, 请各位大虾帮忙啊!!~~~~

2006-10-23,14:00:57

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><C:\PROGRA~1\svhost32.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [N/A]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)NVIDIA Corporation]
    <rzt><C:\WINDOWS\Intel\rundll32.exe>  [N/A]
    <Tray><C:\WINDOWS\command\rundll32.exe>  [N/A]
    <ms><C:\Program Files\Microsoft\svhost32.exe>  [N/A]
    <xy><C:\WINDOWS\Download\svhost32.exe>  [N/A]
    <Ljx><C:\WINDOWS\inf\rundll32.exe>  [N/A]
    <wl><C:\WINDOWS\Download\svhost32.exe>  [N/A]
    <SoundMam><C:\WINDOWS\system32\svohost.exe>  [N/A]
    <kav><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe">  [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <avp6_post_uninstall><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [Kaspersky Lab]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

==================================
驱动程序
[nv / nv]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[Web Anti-Virus]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll, Kaspersky Lab>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash.ocx, Macromedia, Inc.>

==================================

正在运行的进程
[PID: 424][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 476][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 544][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 556][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 764][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 832][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 864][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1116][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1216][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1304][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.8198]
[PID: 1404][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
[PID: 1088][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
[PID: 3236][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
[PID: 3460][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 3092][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 1596][C:\Program Files\Microsoft\svhost32.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 2556][C:\WINDOWS\6Sy.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 2580][C:\Program Files\svhost32.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 2488][C:\WINDOWS\8Sy.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
[PID: 1372][C:\WINDOWS\9Sy.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
[PID: 956][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\Macromed\Flash\Flash.ocx]  [Macromedia, Inc., 6,0,84,0]
[PID: 3200][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 2184][F:\downloads\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\WINDOWS\system32\winscok.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\wldll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\jxdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\xydll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

首先有流氓软件在作怪，用360安全卫士和超级兔子来清理一下，，

这个仿佛瑞星升完级 可以搞定的 谢谢

<load><C:\PROGRA~1\svhost32.exe> [N/A]
<rzt><C:\WINDOWS\Intel\rundll32.exe> [N/A]
<Tray><C:\WINDOWS\command\rundll32.exe> [N/A]
<ms><C:\Program Files\Microsoft\svhost32.exe> [N/A]
<xy><C:\WINDOWS\Download\svhost32.exe> [N/A]
<Ljx><C:\WINDOWS\inf\rundll32.exe> [N/A]
<wl><C:\WINDOWS\Download\svhost32.exe> [N/A]
[C:\WINDOWS\system32\winscok.dll] [N/A, N/A]
[C:\WINDOWS\system32\xydll.dll] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]
[C:\WINDOWS\system32\jxdll.dll] [N/A, N/A]
[C:\WINDOWS\system32\wldll.dll] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A, N/A]

现在进程里还有2个RUNDLL32,这是不是病毒啊