服务器原来装的是macfee，平时不连internet，有天连上网在线升级macfee发现升一半就停在那不会动了，后来重装macfee仍然不能升级，检查进程发现系统启动自动运行多个IEEXPLORE.EXE，网上查了下以为是灰鸽子，下载了一个瑞星专杀工具也检测不出来，不知道要怎么搞，请各位大哥指点一二，谢谢！

系统是2003server，头晕了

mizuki.ys168.com下载sreng2,关闭不必要的程序后扫个日志上来，一次贴不完分段贴，不要修改

日志来了，请帮看看, 谢谢！

[CODE]

2007-01-27,13:50:02

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition Service Pack 1 (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <SyrxMy><C:\WINDOWS\system32\iexp1ore.exe>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <IMEKRMIG6.1><C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>  [Network Associates, Inc.]
    <load><C:\WINDOWS\uninstall\rundl132.exe>  [N/A]
    <1e2><C:\WINDOWS\alga.exe>  [N/A]
    <mhs2><C:\WINDOWS\mhs2.exe>  [N/A]
    <wls3><C:\WINDOWS\wls3.exe>  [N/A]
    <mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe>  [N/A]
    <ShStatEXE><"C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE>  [Network Associates, Inc.]
    <Network Associates Error Reporting Service><"C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe">  [Network Associates, Inc.]
    <NiceMt><C:\WINDOWS\Systemt.exe>  [N/A]
    <rxs3><C:\WINDOWS\rxs3.exe>  [N/A]
    <nod32kui><"C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE>  [Eset ]
    <UserFaultCheck><%systemroot%\system32\dumprep 0 -u>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <twin><C:\WINDOWS\system32\twunk32.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[DameWare Mini Remote Control / DWMRCS][Running/Auto Start]
  <C:\WINDOWS\SYSTEM32\DWRCS.EXE -service><DameWare Development LLC>
[Cluster Monitor Service / HAMonitorService][Running/Auto Start]
  <C:\Program Files\Cluster Manager\MonitorService.exe><N/A>
[Cluster Service / HAService][Running/Auto Start]
  <C:\Program Files\Cluster Manager\Service.exe><N/A>
[Network Associates McShield / McShield][Stopped/Auto Start]
  <"C:\Program Files\Network Associates\VirusScan\Mcshield.exe"><Network Associates, Inc.>
[Network Associates Task Manager / McTaskManager][Stopped/Auto Start]
  <"C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe"><Network Associates, Inc.>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
  <"C:\Program Files\Eset\nod32krn.exe"><Eset>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
  <C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

==================================
驱动程序
[adpu320 / adpu320][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[AMON / AMON][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\drivers\amon.sys><Eset>
[ati2mpad / ati2mpad][Running/Manual Start]
  <system32\DRIVERS\ati2mpad.sys><ATI Technologies Inc.>
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
  <system32\DRIVERS\e1000325.sys><Intel Corporation>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[NaiAvFilter1 / NaiAvFilter1][Stopped/Manual Start]
  <system32\drivers\naiavf5x.sys><Network Associates, Inc.>
[NaiAvTdi1 / NaiAvTdi1][Running/System Start]
  <system32\drivers\mvstdi5x.sys><Network Associates, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

==================================
浏览器加载项
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[XML HTTP 4.0]
  {88D969C5-F192-11D4-A65F-0040963251E5} <C:\WINDOWS\system32\msxml4.dll, Microsoft Corporation>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>

==================================
正在运行的进程
[PID: 900][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 972][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1068][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1112][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1124][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 1316][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1396][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1512][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1620][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1632][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 668][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 704][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 868][C:\WINDOWS\SYSTEM32\DWRCS.EXE]  [DameWare Development LLC, 5, 0, 1, 5]
[PID: 920][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1448][C:\Program Files\Eset\nod32krn.exe]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\nod32krr.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\ps_amon.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_amon.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\ps_dmon.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_dmon.dll]  [N/A, N/A]
    [C:\Program Files\Eset\ps_emon.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_emon.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\imon.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_imon.dll]  [N/A, N/A]
    [C:\Program Files\Eset\ps_mirr.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_mirr.dll]  [N/A, N/A]
    [C:\Program Files\Eset\ps_nod32.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_nod32.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\ps_upd.dll]  [Eset , 2, 51, 26 ]
    [C:\Program Files\Eset\pr_upd.dll]  [N/A, N/A]
[PID: 348][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 620][C:\Program Files\Cluster Manager\MonitorService.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 640][C:\Program Files\Cluster Manager\Service.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1816][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1560][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1904][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\RichDll.dll]  [N/A, N/A]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\Program Files\Network Associates\VirusScan\shext.dll]  [Network Associates, Inc., 8.0.0.912]
    [C:\Program Files\UltraEdit\ue32ctmn.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Eset\nodshex.dll]  [N/A, N/A]
    [C:\WINDOWS\SYSTEM32\DWRCShell.DLL]  [DameWare Development LLC, 5, 0, 1, 5]
[PID: 204][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\nailog.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naCmnLib.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\Program Files\Network Associates\Common Framework\naXML.dll]  [Network Associates, Inc., 3.5.0.474]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\Program Files\Network Associates\Common Framework\0804\UpdRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\0804\AgentRes.dll]  [Network Associates, Inc., 3.5.0.412]
    [C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll]  [Network Associates, Inc., 3.5.0.412]
[PID: 2044][C:\WINDOWS\alga.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 316][C:\WINDOWS\SYSTEM32\DWRCST.exe]  [DameWare Development, 5, 0, 1, 5]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 520][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.dll]  [N/A, N/A]
[PID: 1276][C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe]  [Network Associates, Inc., 2.0.275.0]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]
[PID: 324][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 344][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 280][C:\WINDOWS\system32\iexp1ore.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
[PID: 1596][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 3956][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 2212][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 2876][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 3748][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 2120][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 2924][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 3896][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 2364][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 3312][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 300][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 12264][c:\zxin10\imp\impmoni.exe]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 10988][C:\WINDOWS\system32\cmd.exe]  [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 11096][C:\zxin10\imp\imp.exe]  [N/A, N/A]
    [C:\zxin10\imp\impfunc.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\zxin10\imp\IdfSyb.dll]  [N/A, N/A]
    [C:\Sybase\DLL\libsybdb.dll]  [N/A, N/A]
    [C:\Sybase\DLL\libtcl.dll]  [N/A, N/A]
    [C:\Sybase\DLL\libintl.dll]  [N/A, N/A]
    [C:\Sybase\DLL\libcomn.dll]  [N/A, N/A]
    [C:\Sybase\DLL\libcs.dll]  [N/A, N/A]
    [C:\zxin10\imp\service300.dll]  [N/A, N/A]
    [C:\zxin10\imp\service332.dll]  [N/A, N/A]
    [C:\zxin10\imp\service340.dll]  [N/A, N/A]
    [C:\zxin10\imp\service333.dll]  [N/A, N/A]
    [C:\Sybase\DLL\nlmsnmp.dll]  [N/A, N/A]
    [C:\Sybase\DLL\nlwnsck.dll]  [N/A, N/A]
[PID: 10600][D:\扫描日志sreng2\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSyzr.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\agtz.dll]  [N/A, N/A]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  Error. [UltraEdit.ini]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  Error. [UltraEdit.js]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

mizuki.ys168.com下载威金专杀，先更新，杀完重做系统去吧

引用:

【水树雨下的贴子】 mizuki.ys168.com下载威金专杀，先更新，杀完重做系统去吧 ………………

水哥，能不能说的稍微具体点，这个机器中的什么招，让我死个明白呀！必须重做系统吗，这可不太好弄，是台服务器

中的是威金，这两个已经插入所有进程
C:\WINDOWS\system32\windds32.dll
[C:\WINDOWS\system32\windhcp.ocx
以下都是病毒
SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A]
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
<1e2><C:\WINDOWS\alga.exe> [N/A]
<mhs2><C:\WINDOWS\mhs2.exe> [N/A]
<wls3><C:\WINDOWS\wls3.exe> [N/A]
<mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A]
NiceMt><C:\WINDOWS\Systemt.exe> [N/A]
<rxs3><C:\WINDOWS\rxs3.exe> [N/A]
<twin><C:\WINDOWS\system32\twunk32.exe> [N/A]
C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation>
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

引用:

【水树雨下的贴子】中的是威金，这两个已经插入所有进程 C:\WINDOWS\system32\windds32.dll [C:\WINDOWS\system32\windhcp.ocx 以下都是病毒 SyrxMy><C:\WINDOWS\system32\iexp1ore.exe> [N/A] <load><C:\WINDOWS\uninstall\rundl132.exe> [N/A] <1e2><C:\WINDOWS\alga.exe> [N/A] <mhs2><C:\WINDOWS\mhs2.exe> [N/A] <wls3><C:\WINDOWS\wls3.exe> [N/A] <mytsf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mytsf.exe> [N/A] NiceMt><C:\WINDOWS\Systemt.exe> [N/A] <rxs3><C:\WINDOWS\rxs3.exe> [N/A] <twin><C:\WINDOWS\system32\twunk32.exe> [N/A] C:\WINDOWS\system32\\rundll32.exe windds32.dll,input><Microsoft Corporation> <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation> ………………

非常感谢，俺这就杀毒去！