中毒症状：

多个应用软件被破坏。
在c:\windows\及c:\windows\system32\ 下有2个 notepad.exe

请版主帮忙分析
2006-11-11,15:13:53

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <iDuba Personal FireWall><>  [N/A]
    <KavPFW><"D:\Program Files\KAV2005\KAVPFW.EXE">  [Kingsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)NVIDIA Corporation]
    <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
    <WINSCHEDULER><d:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE>  [InterVideo Inc.]
    <WinRemote><"d:\Program Files\InterVideo\WinDVR\WinRemote.exe">  [N/A]
    <SKYNET Personal FireWall><D:\Program Files\SkyNet\FireWall\PFW.exe>  [crsky[BCG]]
    <snpstd3><C:\WINDOWS\vsnpstd3.exe>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <Kavrun><>  [N/A]
    <iDuba Personal FireWall><>  [N/A]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <INET><C:\WINDOWS\System32\INETSRV\inetsync.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]

==================================
启动文件夹
[InterVideo WinCinema Manager]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\InterVideo WinCinema Manager.lnk --> D:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE []><N>

==================================
服务
[Application Layer Gateway Service / ALG]
  <C:\WINDOWS\System32\alg.exe><Microsoft Corporation>
[ASP.NET State Service / aspnet_state]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Indexing Service / CiSvc]
  <C:\WINDOWS\system32\cisvc.exe><Microsoft Corporation>
[ClipBook / ClipSrv]
  <C:\WINDOWS\system32\clipsrv.exe><Microsoft Corporation>
[COM+ System Application / COMSysApp]
  <C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}><Microsoft Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINDOWS\System32\dmadmin.exe /com><Microsoft Corp., Veritas Software>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService]
  <C:\WINDOWS\System32\imapi.exe><Microsoft Corporation>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"D:\Program Files\KAV2005\KPfwSvc.EXE"><Kingsoft Corporation>
[NetMeeting Remote Desktop Sharing / mnmsrvc]
  <C:\WINDOWS\System32\mnmsrvc.exe><Microsoft Corporation>
[Distributed Transaction Coordinator / MSDTC]
  <C:\WINDOWS\System32\msdtc.exe><Microsoft Corporation>
[Windows Installer / MSIServer]
  <C:\WINDOWS\System32\msiexec.exe /V><Microsoft Corporation>
[Network DDE / NetDDE]
  <C:\WINDOWS\system32\netdde.exe><Microsoft Corporation>
[Network DDE DSDM / NetDDEdsdm]
  <C:\WINDOWS\system32\netdde.exe><Microsoft Corporation>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Remote Desktop Help Session Manager / RDSessMgr]
  <C:\WINDOWS\system32\sessmgr.exe><Microsoft Corporation>
[Remote Procedure Call (RPC) Locator / RpcLocator]
  <C:\WINDOWS\System32\locator.exe><Microsoft Corporation>
[QoS RSVP / RSVP]
  <C:\WINDOWS\System32\rsvp.exe><Microsoft Corporation>
[Smart Card Helper / SCardDrv]
  <C:\WINDOWS\System32\SCardSvr.exe><Microsoft Corporation>
[Smart Card / SCardSvr]
  <C:\WINDOWS\System32\SCardSvr.exe><Microsoft Corporation>
[MS Software Shadow Copy Provider / SwPrv]
  <C:\WINDOWS\System32\dllhost.exe /Processid:{797A143B-2DD8-4776-9616-73FCE1D078F2}><Microsoft Corporation>
[Performance Logs and Alerts / SysmonLog]
  <C:\WINDOWS\system32\smlogsvc.exe><Microsoft Corporation>
[Telnet / TlntSvr]
  <C:\WINDOWS\System32\tlntsvr.exe><Microsoft Corporation>
[Uninterruptible Power Supply / UPS]
  <C:\WINDOWS\System32\ups.exe><Microsoft Corporation>
[Volume Shadow Copy / VSS]
  <C:\WINDOWS\System32\vssvc.exe><Microsoft Corporation>
[Portable Media Serial Number Service / WmdmPmSN]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>
[WMI Performance Adapter / WmiApSrv]
  <C:\WINDOWS\System32\wbem\wmiapsrv.exe><Microsoft Corporation>

==================================
驱动程序
[%Cap7134.DeviceDescProt% / Cap7134]
  <System32\DRIVERS\Cap7134.sys><Philips Semiconductors>
[Creative SBLive! Gameport / ctljystk]
  <System32\DRIVERS\ctljystk.sys><Creative Technology Ltd.>
[Creative SB Live! (WDM) / emu10k]
  <system32\drivers\emu10k1m.sys><Creative Technology Ltd.>
[Creative Interface Manager Driver (WDM) / emu10k1]
  <system32\drivers\ctlfacem.sys><Creative Technology Ltd.>
[KNetWch / KNetWch]
  <\??\D:\Program Files\KAV2005\KNetWch.SYS><金山电脑公司>
[npkcrypt / npkcrypt]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax]
  <system32\drivers\nvax.sys><NVIDIA Corporation>
[NVIDIA nForce MCP Networking Controller Driver / NVENET]
  <System32\DRIVERS\NVENET.sys><NVIDIA Corporation>
[Service for NVIDIA(R) nForce(TM) Audio / nvnforce]
  <system32\drivers\nvapu.sys><NVIDIA Corporation>
[Gadmei TV Belle WDM TVTuner / PhTvTune]
  <System32\DRIVERS\PhTvTune.sys><Philips Semiconductors>
[Direct Parallel Link Driver / Ptilink]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <System32\DRIVERS\secdrv.sys><N/A>
[Creative SoundFont Manager Driver (WDM) / sfman]
  <system32\drivers\sfmanm.sys><Creative Technology Ltd.>
[SKNFW / SKNFW]
  <\??\C:\WINDOWS\System32\Drivers\SKNFW.sys><N/A>
[USB PC Camera (SNPSTD3) / SNPSTD3]
  <System32\DRIVERS\snpstd3.sys><>

==================================
浏览器加载项
[QQBrowserHelperObject Class]
  {54EBD53A-9BC1-480B-966A-843A333CA162} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[IeCatch2 Class]
  {A5366673-E8CA-11D3-9CD9-0090271D075B} <D:\PROGRA~1\FLASHGET\jccatch.dll, Amaze Soft>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <d:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[FlashGet]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <d:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[卡卡安全助手]
  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\System32\KakaTool.dll, Beijing Rising Technology Co., Ltd.>
[Update Class]
  {9F1C11AA-197B-4942-BA54-47A8489BB47F} <C:\WINDOWS\System32\iuctl.dll, Microsoft Corporation>
[使用Kugoo下载]
  <D:\PROGRA~1\KUGOO2\KugooDownX.htm, N/A>
[使用网际快车下载]
  <D:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\Program Files\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <d:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <d:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <d:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

正在运行的进程
[PID: 384][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 452][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 476][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 520][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 532][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 684][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 824][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 836][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1212][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1572][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[PID: 1724][D:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE]  [InterVideo Inc., 2.0.34.297]
[PID: 1732][D:\Program Files\InterVideo\WinDVR\WinRemote.exe]  [, 1.0]
    [D:\Program Files\InterVideo\WinDVR\GadmeiRM.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\34com.dll]  [Philips Semiconductors, 2, 3, 0, 0]
    [C:\WINDOWS\System32\34api.dll]  [Philips Semiconductors, 2, 3, 0, 0]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
[PID: 1740][D:\Program Files\SkyNet\FireWall\PFW.exe]  [crsky[BCG], 2.6.0.123]
[PID: 1748][C:\WINDOWS\vsnpstd3.exe]  [, 1, 0, 1, 2]
[PID: 1772][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1796][D:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe]  [, 1.0]
[PID: 108][C:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.13.10.4113]
[PID: 196][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\Program Files\上海征途网络科技有限公司\征途\data\zhengtu.dat]  [上海征途网络科技有限公司, 1, 0, 0, 1065]
[PID: 1412][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1504][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1832][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [D:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
[PID: 1076][D:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE]  [InterVideo Inc., 2.0.34.297]
[PID: 1104][D:\Program Files\InterVideo\WinDVR\WinRemote.exe]  [, 1.0]
    [D:\Program Files\InterVideo\WinDVR\GadmeiRM.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\System32\34com.dll]  [Philips Semiconductors, 2, 3, 0, 0]
    [C:\WINDOWS\System32\34api.dll]  [Philips Semiconductors, 2, 3, 0, 0]
    [C:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
[PID: 1112][D:\Program Files\SkyNet\FireWall\PFW.exe]  [crsky[BCG], 2.6.0.123]
[PID: 1144][C:\WINDOWS\vsnpstd3.exe]  [, 1, 0, 1, 2]
[PID: 1268][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3292]
[PID: 2004][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1420][D:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe]  [, 1.0]
    [D:\Program Files\上海征途网络科技有限公司\征途\data\zhengtu.dat]  [上海征途网络科技有限公司, 1, 0, 0, 1065]
    [C:\WINDOWS\System32\UNISPIM.IME]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [C:\WINDOWS\System32\upengine.dll]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [D:\Program Files\上海征途网络科技有限公司\征途\data\zhengtu.dat]  [上海征途网络科技有限公司, 1, 0, 0, 1065]
    [D:\Program Files\上海征途网络科技有限公司\征途\data\zhengtu.dat]  [上海征途网络科技有限公司, 1, 0, 0, 1065]
    [C:\WINDOWS\System32\UNISPIM.IME]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [C:\WINDOWS\System32\upengine.dll]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
[PID: 2020][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1460][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\KakaTool.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 18]
    [d:\Program Files\Tencent\QQ\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [D:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINDOWS\System32\macromed\flash\swflash.ocx]  [Macromedia, Inc., 5,0,44,0]
[PID: 1136][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\KakaTool.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 18]
    [d:\Program Files\Tencent\QQ\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [D:\PROGRA~1\FLASHGET\jccatch.dll]  [Amaze Soft, 1, 1, 4, 0]
    [C:\WINDOWS\System32\UNISPIM.IME]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [C:\WINDOWS\System32\upengine.dll]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [C:\WINDOWS\System32\macromed\flash\swflash.ocx]  [Macromedia, Inc., 5,0,44,0]
[PID: 1652][E:\backup\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================


谢谢

没人理................    T_T

<INET><C:\WINDOWS\System32\INETSRV\inetsync.exe>


[Secdrv / Secdrv]
<System32\DRIVERS\secdrv.sys><N/A>
个人怀疑这个有问题，删除！ 第二个最好查看一下是否通过MS的签证！

依然不行!
有一个应用文件在压缩包里是456256字节，运行后变成了461.888字节。怀疑病毒嵌入到进程里去了。只有一运行应用程序都会给感染。