[CODE]

2007-05-24,01:27:20

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><; internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <SsAAD.exe><; C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe>  []
    <3dtbc0evz><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
    <8kb0sgzsqkdimv0><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <IgfxTray><; C:\WINNT\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <HotKeysCmds><; C:\WINNT\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
    <NeroFilterCheck><; C:\WINNT\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <mdac_runonce><; C:\WINDOWS\SYSTEM\runonce.exe>  [N/A]
    <AVPSrv><; C:\WINNT\AVPSrv.exe>  []
    <cmdbcs><; C:\WINNT\cmdbcs.exe>  []
    <WSVBRS><; C:\WINNT\WSVBRS.exe>  []
    <runner1><; C:\WINNT\retadpu22.exe 61A847B5BBF72810308B2B27128065E9C084320161C4661227A755E9C2933154389A>  [N/A]
    <mppds><C:\WINNT\mppds.exe>  []
    <upxdnd><C:\WINNT\upxdnd.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <SchedulingAgent><; mstask.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <MSDEG32><LYLoader.exe>  []
    <MSDWG32><LYLoadbr.exe>  [N/A]
    <MSDCG32    ><LYLeador.exe>  [N/A]
    <MSDOG32><LYLoador.exe>  [N/A]
    <MSDSG32><LYLoadar.exe>  [N/A]
    <MSDMG32><LYLoadmr.exe>  [N/A]
    <MSDHG32><LYLoadhr.exe>  [N/A]
    <MSDQG32><LYLoadqr.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp>  []
    <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys>  []

==================================
启动文件夹
[AutoCAD 启动加速器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\AutoCAD 启动加速器.lnk --> C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [Autodesk, Inc]><N>

==================================
服务
[17B3AA5D / 17B3AA5D][Stopped/Auto Start]
  <C:\WINNT\system32\DAF5BEB7.EXE -k><Microsoft Corporation>
[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  <"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"><Macrovision Corporation>
[LiveUpdate / LiveUpdate][Stopped/Manual Start]
  <"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE"><Symantec Corporation>
[MSCSPTISRV / MSCSPTISRV][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe"><Sony Corporation>
[Fax 2Client / ms_2fax][Running/Auto Start]
  <C:\WINNT\system32\16861.exe><N/A>
[PACSPTISVR / PACSPTISVR][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe"><Sony Corporation>
[PPPoE Service / PPPoEService][Stopped/Auto Start]
  <e:\郑旭峰\ppo\app\pppoeservice.exe><N/A>
[Windows InstallService / Sever][Stopped/Auto Start]
  <C:\WINNT\system32\Sever.exe><N/A>
[spkrmon / spkrmon][Running/Auto Start]
  <C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe><>
[Sony SPTI Service / SPTISRV][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe"><Sony Corporation>
[SonicStage SCSI Service / SSScsiSV][Stopped/Manual Start]
  <C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe><Sony Corporation>
[Remote Acces / WindowsDown][Stopped/Auto Start]
  <C:\WINNT\system32\servet.exe><N/A>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]
  <system32\DRIVERS\b57w2k.sys><Broadcom Corporation>
[CelInDrv / CelInDrv][Stopped/Disabled]
  <\??\C:\WINNT\system32\Drivers\CelInDriver.sys><N/A>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\npkcrypt.sys><N/A>
[npkcusb / npkcusb][Stopped/Auto Start]
  <\??\E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\npkcusb.sys><N/A>
[Efficient Networks Enternet P.P.P.o.E LAN  Miniport Driver / NTSPPPOE][Running/Manual Start]
  <system32\DRIVERS\ntspppoe.sys><Microsoft Corporation>
[NTSTAP1 / NTSTAP1][Running/Manual Start]
  <\??\E:\郑旭峰\ppo\app\NTSTAP1.SYS><Network TeleSystems, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RAWESR / RAWESR][Stopped/Manual Start]
  <\??\E:\郑旭峰\ppo\app\RAWESR.SYS><Microsoft Corporation>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Sony USBSTOR.SYS Filter / SONYFILT][Stopped/Manual Start]
  <System32\Drivers\SonyUSBF.sys><Sony Corporation>
[TAPBIND / TAPBIND][Running/Manual Start]
  <\??\e:\郑旭峰\ppo\app\TAPBIND1.SYS><Network TeleSystems, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[ff Class]
  {FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINNT\system32\f161.dll, TODO: <公司名>>
[番茄花园]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.tomatolei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[AcDcToday 控件]
  {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} <C:\WINNT\DOWNLO~1\ACDCTO~1.OCX, Autodesk>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[WebBasedClientInstall Class]
  {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} <C:\WINNT\Downloaded Program Files\WebInst.Dll, Symantec Corporation>
[Rising Web Scan Object]
  {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINNT\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.>
[AcPreview 控件]
  {F281A59C-7B65-11D3-8617-0010830243BD} <C:\WINNT\DOWNLO~1\ACPREV~1.OCX, Autodesk>
[上传到QQ网络硬盘]
  <E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <E:\郑旭峰\新建文件夹\PPPOE\新建文件夹\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 144][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 168][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\system32\1ECDD84E.DLL]  [Microsoft Corporation, ]
[PID: 948][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\system32\1ECDD84E.DLL]  [Microsoft Corporation, ]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll]  [N/A, ]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
    [C:\WINNT\system32\dfshim.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
    [C:\WINNT\system32\mscoree.dll]  [Microsoft Corporation, 2.0.50727.42 (RTM.050727-4200)]
    [C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll]  [Nero AG, 1.1.1.1]
    [C:\Program Files\Common Files\Ahead\Lib\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Common Files\Ahead\Lib\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Common Files\Ahead\Lib\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINNT\system32\PPPoEService.cpl]  [, 1, 0, 0, 1]
    [C:\WINNT\system32\igfxcpl.cpl]  [Intel Corporation, 3.0.0.3889]
    [C:\WINNT\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.3889]
    [C:\WINNT\system32\igfxres.dll]  [Intel Corporation, 3.0.0.3889]
    [C:\WINNT\system32\igfxress.dll]  [Intel Corporation, 3.0.0.3889]
    [C:\WINNT\system32\plotman.cpl]  [Autodesk, Inc., 8.1.63.0]
    [C:\WINNT\system32\styleman.cpl]  [Autodesk, Inc., 8.1.63.0]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINNT\system32\LYMANGR.DLL]  [N/A, ]
    [C:\WINNT\system32\bmxlar.dll]  [N/A, ]
    [C:\WINNT\system32\ikgemw.dll]  [N/A, ]
    [C:\WINNT\system32\f161.dll]  [TODO: <公司名>, 1.0.0.1]
[PID: 1308][C:\WINNT\system32\rundll32.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\df1.dll]  [  , 1, 0, 0, 3]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINNT\system32\ikgemw.dll]  [N/A, ]
    [C:\WINNT\system32\bmxlar.dll]  [N/A, ]
[PID: 1332][C:\WINNT\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2607 built by: dnsrv(wmbla)]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
[PID: 272][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
    [C:\WINNT\system32\f161.dll]  [TODO: <公司名>, 1.0.0.1]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll]  [N/A, ]
    [C:\WINNT\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
    [C:\WINNT\system32\bmxlar.dll]  [N/A, ]
    [C:\WINNT\system32\ikgemw.dll]  [N/A, ]
[PID: 1348][E:\郑旭峰\ppo\app\EnterNet.exe]  [N/A, ]
    [E:\郑旭峰\ppo\app\PacketLog.dll]  [Efficient Networks, Inc., 1, 5, 0, 21]
    [E:\郑旭峰\ppo\app\DSLAPI32.dll]  [Efficient Networks Inc., 1, 5, 0, 19]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [E:\郑旭峰\ppo\app\ResMsgCHS.dll]  [Efficient Networks, Inc., 1, 5, 0, 18]
    [E:\郑旭峰\ppo\app\ResCHS.dll]  [Efficient Networks, Inc., 1, 5, 0, 18]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll]  [N/A, ]
    [C:\WINNT\system32\bmxlar.dll]  [N/A, ]
    [C:\WINNT\system32\ikgemw.dll]  [N/A, ]
[PID: 800][E:\郑旭峰\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINNT\system32\ikgemw.dll]  [N/A, ]
    [C:\WINNT\system32\bmxlar.dll]  [N/A, ]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll]  [N/A, ]
    [C:\WINNT\system32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe
[E:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe
[F:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

安全模式清空IE临时文件
然后下面的给K掉

<Internat.exe><; internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
<3dtbc0evz><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
<8kb0sgzsqkdimv0><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
<AVPSrv><; C:\WINNT\AVPSrv.exe> []
<cmdbcs><; C:\WINNT\cmdbcs.exe> []
<WSVBRS><; C:\WINNT\WSVBRS.exe> []
<runner1><; C:\WINNT\retadpu22.exe 61A847B5BBF72810308B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A]
<mppds><C:\WINNT\mppds.exe> []
<upxdnd><C:\WINNT\upxdnd.exe> []
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A
[17B3AA5D / 17B3AA5D][Stopped/Auto Start]
<C:\WINNT\system32\DAF5BEB7.EXE -k><Microsoft Corporation>
[Fax 2Client / ms_2fax][Running/Auto Start]
<C:\WINNT\system32\16861.exe><N/A>
[Windows InstallService / Sever][Stopped/Auto Start]
<C:\WINNT\system32\Sever.exe><N/A>
[Remote Acces / WindowsDown][Stopped/Auto Start]
<C:\WINNT\system32\servet.exe><N/A>

Autorun.inf
[D:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe
[E:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe
[F:\]
[AutoRun]
open=rising.exe
shellexecute=rising.exe
shell\Auto\command=rising.exe

[CelInDrv / CelInDrv][Stopped/Disabled]
<\??\C:\WINNT\system32\Drivers\CelInDriver.sys><N/A>
重装下QQ

请问用什么K？？？？

呵呵！！

等开除吧，！！

用扫日志的SRENG工具删除注册表项，用冰刃（1.2版本）删除对应文件。

用冰刃（1.2版本）禁止进程创建，强行卸除插入以下进程里的模块。
==================================
正在运行的进程
[PID: 168][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 948][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690]
[PID: 1308][C:\WINNT\system32\rundll32.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 1332][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2607 built by: dnsrv(wmbla)]
[PID: 272][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106]
[PID: 1348][E:\郑旭峰\ppo\app\EnterNet.exe] [N/A, ]
[PID: 800][E:\郑旭峰\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]

插入的模块

[C:\WINNT\system32\1ECDD84E.DLL] [Microsoft Corporation, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ]
[C:\WINNT\system32\LYMANGR.DLL] [N/A, ]
[C:\WINNT\system32\bmxlar.dll] [N/A, ]
[C:\WINNT\system32\ikgemw.dll] [N/A, ]
[C:\WINNT\system32\f161.dll] [TODO: <公司名>, 1.0.0.1]
[C:\WINNT\system32\df1.dll] [ , 1, 0, 0, 3]

用冰刃删除文件

C:\WINNT\system32\1ECDD84E.DLL
C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp
C:\Program Files\Internet Explorer\PLUGINS\System64.sys
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll
C:\WINNT\system32\LYMANGR.DLL
C:\WINNT\system32\bmxlar.dll
C:\WINNT\system32\ikgemw.dll
C:\WINNT\system32\f161.dll
C:\WINNT\system32\df1.dll

用冰刃删除各磁盘根目录下的文件文件
Autorun.inf
rising.exe
——————————————————————————————————————————————
因为用冰刃找注册表有点烦。

如果有耐心就再用冰刃继续删除以下注册表项和对应文件。

如果没耐心，就取消冰刃（1.2版本）的禁止进程创建，然后用扫日志的SRENG工具删除注册表项。

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<3dtbc0evz><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
<8kb0sgzsqkdimv0><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<mdac_runonce><; C:\WINDOWS\SYSTEM\runonce.exe> [N/A]
<AVPSrv><; C:\WINNT\AVPSrv.exe> []
<cmdbcs><; C:\WINNT\cmdbcs.exe> []
<WSVBRS><; C:\WINNT\WSVBRS.exe> []
<runner1><; C:\WINNT\retadpu22.exe 61A847B5BBF72810308B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A]
<mppds><C:\WINNT\mppds.exe> []
<upxdnd><C:\WINNT\upxdnd.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> []
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys> []
=================================
服务
[17B3AA5D / 17B3AA5D][Stopped/Auto Start]
<C:\WINNT\system32\DAF5BEB7.EXE -k><Microsoft Corporation>
[Fax 2Client / ms_2fax][Running/Auto Start]
<C:\WINNT\system32\16861.exe><N/A>
[Windows InstallService / Sever][Stopped/Auto Start]
<C:\WINNT\system32\Sever.exe><N/A>
[Remote Acces / WindowsDown][Stopped/Auto Start]
<C:\WINNT\system32\servet.exe><N/A>

==================================
驱动程序
[CelInDrv / CelInDrv][Stopped/Disabled]
<\??\C:\WINNT\system32\Drivers\CelInDriver.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>

==================================
浏览器加载项
Incorporated>
[ff Class]
{FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINNT\system32\f161.dll, TODO: <公司名>>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[WebBasedClientInstall Class]
{D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} <C:\WINNT\Downloaded Program Files\WebInst.Dll, Symantec Corporation>

用冰刃删除文件

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\WINDOWS\SYSTEM\runonce.exe
C:\WINNT\AVPSrv.exe
C:\WINNT\cmdbcs.exe
C:\WINNT\WSVBRS.exe
C:\WINNT\retadpu22.exe
C:\WINNT\mppds.exe
C:\WINNT\upxdnd.exe
C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp
C:\Program Files\Internet Explorer\PLUGINS\System64.sys

C:\WINNT\system32\DAF5BEB7.EXE
C:\WINNT\system32\16861.exe
C:\WINNT\system32\Sever.exe
C:\WINNT\system32\servet.exe
C:\WINNT\system32\Drivers\CelInDriver.sys
C:\WINNT\system32\DRIVERS\npf.sys
C:\WINNT\system32\f161.dll
C:\WINNT\Downloaded Program Files\WebInst.Dll

————————————————————————————
搜索以下文件，找到用冰刃删除文件
LYLoader.exe
LYLoadbr.exe
LYLeador.exe
LYLoador.exe
LYLoadar.exe
LYLoadmr.exe
LYLoadhr.exe
LYLoadqr.exe
——————————————————————————————
呵呵！！！

重启看看吧！！

还有异常，再扫日志。

引用:

【天月来了的贴子】 用冰刃（1.2版本）禁止进程创建，强行卸除插入以下进程里的模块。 ================================== 正在运行的进程 [PID: 168][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601] [PID: 948][C:\WINNT\Explorer.EXE] [Microsoft Corporation, 5.00.3700.6690] [PID: 1308][C:\WINNT\system32\rundll32.exe] [Microsoft Corporation, 5.00.2134.1] [PID: 1332][C:\WINNT\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2607 built by: dnsrv(wmbla)] [PID: 272][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106] [PID: 1348][E:\郑旭峰\ppo\app\EnterNet.exe] [N/A, ] [PID: 800][E:\郑旭峰\sreng2\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] 插入的模块 [C:\WINNT\system32\1ECDD84E.DLL] [Microsoft Corporation, ] [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp] [N/A, ] [C:\Program Files\Internet Explorer\PLUGINS\System64.sys] [N/A, ] [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ] [C:\WINNT\system32\LYMANGR.DLL] [N/A, ] [C:\WINNT\system32\bmxlar.dll] [N/A, ] [C:\WINNT\system32\ikgemw.dll] [N/A, ] [C:\WINNT\system32\f161.dll] [TODO: <公司名>, 1.0.0.1] [C:\WINNT\system32\df1.dll] [ , 1, 0, 0, 3] 用冰刃删除文件 C:\WINNT\system32\1ECDD84E.DLL C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp C:\Program Files\Internet Explorer\PLUGINS\System64.sys C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll C:\WINNT\system32\LYMANGR.DLL C:\WINNT\system32\bmxlar.dll C:\WINNT\system32\ikgemw.dll C:\WINNT\system32\f161.dll C:\WINNT\system32\df1.dll 用冰刃删除各磁盘根目录下的文件文件 Autorun.inf rising.exe —————————————————————————————————————————————— 因为用冰刃找注册表有点烦。 如果有耐心就再用冰刃继续删除以下注册表项和对应文件。 如果没耐心，就取消冰刃（1.2版本）的禁止进程创建，然后用扫日志的SRENG工具删除注册表项。 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <3dtbc0evz><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [] <8kb0sgzsqkdimv0><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <mdac_runonce><; C:\WINDOWS\SYSTEM\runonce.exe> [N/A] <AVPSrv><; C:\WINNT\AVPSrv.exe> [] <cmdbcs><; C:\WINNT\cmdbcs.exe> [] <WSVBRS><; C:\WINNT\WSVBRS.exe> [] <runner1><; C:\WINNT\retadpu22.exe 61A847B5BBF72810308B2B27128065E9C084320161C4661227A755E9C2933154389A> [N/A] <mppds><C:\WINNT\mppds.exe> [] <upxdnd><C:\WINNT\upxdnd.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <MSDEG32><LYLoader.exe> [] <MSDWG32><LYLoadbr.exe> [N/A] <MSDCG32 ><LYLeador.exe> [N/A] <MSDOG32><LYLoador.exe> [N/A] <MSDSG32><LYLoadar.exe> [N/A] <MSDMG32><LYLoadmr.exe> [N/A] <MSDHG32><LYLoadhr.exe> [N/A] <MSDQG32><LYLoadqr.exe> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp> [] <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys> [] ================================= 服务 [17B3AA5D / 17B3AA5D][Stopped/Auto Start] <C:\WINNT\system32\DAF5BEB7.EXE -k><Microsoft Corporation> [Fax 2Client / ms_2fax][Running/Auto Start] <C:\WINNT\system32\16861.exe><N/A> [Windows InstallService / Sever][Stopped/Auto Start] <C:\WINNT\system32\Sever.exe><N/A> [Remote Acces / WindowsDown][Stopped/Auto Start] <C:\WINNT\system32\servet.exe><N/A> ================================== 驱动程序 [CelInDrv / CelInDrv][Stopped/Disabled] <\??\C:\WINNT\system32\Drivers\CelInDriver.sys><N/A> [Netgroup Packet Filter / NPF][Stopped/Manual Start] <system32\DRIVERS\npf.sys><CACE Technologies> ================================== 浏览器加载项 Incorporated> [ff Class] {FAAAC0F6-94BE-4466-934B-7C53666A2F41} <C:\WINNT\system32\f161.dll, TODO: <公司名>> [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [WebBasedClientInstall Class] {D30CA0FD-1CA0-11D4-AC78-006008A9A8BC} <C:\WINNT\Downloaded Program Files\WebInst.Dll, Symantec Corporation> 用冰刃删除文件 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe C:\WINDOWS\SYSTEM\runonce.exe C:\WINNT\AVPSrv.exe C:\WINNT\cmdbcs.exe C:\WINNT\WSVBRS.exe C:\WINNT\retadpu22.exe C:\WINNT\mppds.exe C:\WINNT\upxdnd.exe C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmp C:\Program Files\Internet Explorer\PLUGINS\System64.sys C:\WINNT\system32\DAF5BEB7.EXE C:\WINNT\system32\16861.exe C:\WINNT\system32\Sever.exe C:\WINNT\system32\servet.exe C:\WINNT\system32\Drivers\CelInDriver.sys C:\WINNT\system32\DRIVERS\npf.sys C:\WINNT\system32\f161.dll C:\WINNT\Downloaded Program Files\WebInst.Dll ———————————————————————————— 搜索以下文件，找到用冰刃删除文件 LYLoader.exe LYLoadbr.exe LYLeador.exe LYLoador.exe LYLoadar.exe LYLoadmr.exe LYLoadhr.exe LYLoadqr.exe —————————————————————————————— 呵呵！！！ 重启看看吧！！ 还有异常，再扫日志。 ………………

太专业了,偶D偶像啊

干嘛哦！！

胡闹！！！

呵呵！！！！！！！

忘了说了，忙完以后，升级杀软至最新，狂杀啊。