瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中了个无比强悍的病毒,求高手帮忙啊(附日志)

12   1  /  2  页   跳转页

中了个无比强悍的病毒,求高手帮忙啊(附日志)

收藏
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:15 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

中了个无比强悍的病毒,求高手帮忙啊(附日志)

这个病毒太强悍,强行篡改我的启动项,我的瑞星弹出警告是否同意,但鼠标无法动弹,直到他修改成功了鼠标才能用,然后又修改了我的系统时间,我进入安全模式删除启动项,结果就反复重启.我快崩溃了....请高手帮助.

[CODE]

2007-06-26,23:17:16

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional  (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><D:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <RavTask><"D:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>  [N/A]
    <NvCplDaemon><RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
    <Userinit><D:\WINDOWS\System32\userinit.exe,>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
    <WebCheck><%SystemRoot%\System32\webcheck.dll>  [(Verified)Microsoft Windows XP Publisher]
    <SysTray><D:\WINDOWS\System32\stobject.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\System32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\System32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
    <自定义浏览器><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\System32\ie4uinit.exe>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}]
    <Internet Explorer 访问><rundll32 iesetup.dll,IEAccessUserInst>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><D:\WINDOWS\System32\scrnsave.scr>  [(Verified)Microsoft Windows XP Publisher]

==================================
启动文件夹
N/A

==================================
服务
[78F2926A / 78F2926A][Stopped/Auto Start]
  <D:\WINDOWS\System32\9D4F7E45.EXE -k><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <D:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IMAPI CD-Burning COM Service / ImapiService][Stopped/Manual Start]
  <><N/A>
[Macromedia Licensing Service / Macromedia Licensing Service][Stopped/Manual Start]
  <"D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><>
[MySQL / MySQL][Stopped/Auto Start]
  <"E:\MySQL\MySQL Server 5.0\bin\mysqld-nt" --defaults-file="E:\MySQL\MySQL Server 5.0\my.ini" MySQL><N/A>
[NVIDIA Display Driver Service / NVSvc][Stopped/Auto Start]
  <D:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter][Stopped/Auto Start]
  <"D:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Stopped/Auto Start]
  <"D:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[A4Tech Mouse Filter Driver / Amfilter][Stopped/System Start]
  <System32\DRIVERS\Amfilter.sys><N/A>
[A4Tech Serial Port Mouse Driver / Amserprt][Stopped/Manual Start]
  <System32\DRIVERS\Amserprt.sys><N/A>
[Rising TDI Base Driver / BaseTDI][Stopped/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[cdawdm / cdawdm][Stopped/Disabled]
  <System32\DRIVERS\CDAWDM.sys><N/A>
[d347bus / d347bus][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
  <\SystemRoot\System32\Drivers\d347prt.sys><>
[ExpScaner / ExpScaner][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\ExpScan.sys><>
[fcdabus / fcdabus][Running/Manual Start]
  <System32\DRIVERS\fcdabus.sys><FarStone Inc.>
[FVDSCSI / FVDSCSI][Running/Manual Start]
  <System32\DRIVERS\fvdscsi.sys><FarStone Inc.>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
  <\??\D:\PROGRAM FILES\RISING\RAV\HookApi.Sys><瑞星软件有限公司>
[HookCont / HookCont][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\HookSys.sys><Rising>
[kmsinput / kmsinput][Stopped/Manual Start]
  <\??\D:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[KWATCH / KWATCH][Stopped/Manual Start]
  <\??\D:\KAV2003\KWATCH.SYS><N/A>
[KWatch3 / KWatch3][Stopped/System Start]
  <\??\D:\WINDOWS\System32\drivers\KWatch3.SYS><Kingsoft Corporation>
[MEMSCAN / MEMSCAN][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp][Stopped/Manual Start]
  <\??\D:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[NPPTNT2 / NPPTNT2][Stopped/System Start]
  <\??\D:\WINDOWS\System32\npptNT2.sys><INCA Internet Co., Ltd.>
[nv / nv][Stopped/Manual Start]
  <System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[StarForce Protection Environment Driver v6 / prodrv06][Stopped/System Start]
  <\SystemRoot\System32\drivers\prodrv06.sys><StarForce Technologies, Inc.>
[StarForce Protection Helper Driver v2 / prohlp02][Running/Boot Start]
  <\SystemRoot\System32\drivers\prohlp02.sys><StarForce Technologies, Inc.>
[StarForce Protection Synchronization Driver v1 / prosync1][Running/Boot Start]
  <\SystemRoot\System32\drivers\prosync1.sys><StarForce Technologies, Inc.>
[Direct Parallel Link Driver / Ptilink][Stopped/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Stopped/Auto Start]
  <\??\D:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Stopped/Manual Start]
  <System32\DRIVERS\RTL8029.SYS><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[StarForce Protection Helper Driver / sfhlp01][Running/Boot Start]
  <\SystemRoot\System32\drivers\sfhlp01.sys><StarForce Technologies, Inc.>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <System32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[STEC3 / STEC3][Stopped/Auto Start]
  <\??\D:\WINDOWS\System32\STEC3.sys><AntiCracking>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\viaidexp.sys><VIA Technologies, Inc.>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Stopped/Manual Start]
  <system32\drivers\viaudios.sys><VIA Technologies, Inc.>
[WINIO / WINIO][Stopped/Manual Start]
  <\??\D:\WINDOWS\Downloaded Program Files\CONFLICT.1\winio.sys><N/A>
最后编辑2007-06-27 09:38:28
分享到：
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:19 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

浏览器加载项
[启动迅雷]
  {0062C9BD-B349-40DE-91A0-755F37ACD559} <D:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
[新浪UC]
  {2253922F-1B26-4C74-8B57-E3AEE748DBB8} <D:\Program Files\sina\UC\uc.exe, 北京新浪信息技术有限公司>
[Yahoo 3.5G电邮]
  {507F9113-CD77-4866-BA92-0E86DA3D0B97} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A>
[寻宝乐趣多]
  {59BC54A2-56B3-44a0-93E5-432D58746E26} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao, N/A>
[雅虎助手]
  {5D73EE86-05F1-49ed-B850-E423120EC338} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A>
[JoyoCtrl Class]
  {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} <D:\PROGRA~1\Kingsoft\POWERW~1\IEPlugin.dll, >
[QQ]
  {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\Program Files\Tencent\QQ\QQIEHelper.dll, N/A>
[情景聊天]
  {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg, N/A>
[]
  {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair, N/A>
[]
  {FD00D911-7529-4084-9946-A29F1BDF4FE5} <http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <D:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[&IE修复专家]
  {123249EB-F891-44C4-946F-450064F9080E} <D:\PROGRA~1\IE修复~1\IERBar.dll, N/A>
[Kwyshell MidpX]
  {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} <C:\MidpX\JadInvoker\MidpInvoker.dll, Kwyshell G.Corp>
[MMCPlayer Class]
  {05C1004E-2596-48E5-8E26-39362985EEB9} <D:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[MeadCo ScriptX]
  {1663ed61-23eb-11d2-b92f-008048fdd814} <D:\WINDOWS\System32\MCScripX.dll, Mead & Co Limited>
[WebActivater Control]
  {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <D:\WINDOWS\System32\WEBACT~1.OCX, QQ>
[EditCtrl Class]
  {488A4255-3236-44B3-8F27-FA1AECAA8844} <D:\WINDOWS\System32\aliedit\aliedit.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <D:\WINDOWS\System32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
  <D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
[&使用迅雷下载全部链接]
  <D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
[Link to &MidpX]
  <C:\MidpX\JadInvoker\Extent\jad_wrap.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用影音传送带下载]
  <, N/A>
[使用影音传送带下载全部链接]
  <, N/A>
[导出到 Microsoft Excel(&x)]
  <res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 164][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.114 (xpclnt_qfe.021108-2107)]
[PID: 224][\??\D:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.114 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\CSRSRV.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\basesrv.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\winsrv.dll]  [Microsoft Corporation, 5.1.2600.104 (xpclnt_qfe.020823-2005)]
    [D:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.104 (xpclnt_qfe.020823-2005)]
    [D:\WINDOWS\system32\KERNEL32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.109 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USP10.dll]  [Microsoft Corporation, 1.0407.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\sxs.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 248][\??\D:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.114 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.109 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\AUTHZ.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.104 (xpclnt_qfe.020823-2005)]
    [D:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\NDdeApi.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\PROFMAP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\NETAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USERENV.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\PSAPI.DLL]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\REGAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SETUPAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:20 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

[D:\WINDOWS\system32\WINTRUST.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ole32.dll]  [Microsoft Corporation, 5.1.2600.115 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\IMAGEHLP.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WINSTA.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USP10.dll]  [Microsoft Corporation, 1.0407.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\MSGINA.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\system32\COMCTL32.dll]  [Microsoft Corporation, 5.82 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ODBC32.dll]  [Microsoft Corporation, 3.520.7713.0]
    [D:\WINDOWS\system32\comdlg32.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\odbcint.dll]  [Microsoft Corporation, 3.520.7713.0]
    [D:\WINDOWS\system32\SHSVCS.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\sfc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WINMM.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\cscdll.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WlNotify.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\WinSCard.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WTSAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WINSPOOL.DRV]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\MPR.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\rsaenh.dll]  [Microsoft Corporation, 5.1.2518.0 (main.010714-2114)]
    [D:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SAMLIB.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\cscui.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\NTMARTA.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WLDAP32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\COMRes.dll]  [Microsoft Corporation, 2001.12.4414.42]
    [D:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5014.0]
    [D:\WINDOWS\system32\CLBCATQ.DLL]  [Microsoft Corporation, 2001.12.4414.42]
[PID: 720][D:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.114 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.109 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.104 (xpclnt_qfe.020823-2005)]
    [D:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ole32.dll]  [Microsoft Corporation, 5.1.2600.115 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5014.0]
    [D:\WINDOWS\System32\BROWSEUI.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\SHDOCVW.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\USP10.dll]  [Microsoft Corporation, 1.0407.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\comctl32.dll]  [Microsoft Corporation, 5.82 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\appHelp.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\CLBCATQ.DLL]  [Microsoft Corporation, 2001.12.4414.42]
    [D:\WINDOWS\System32\COMRes.dll]  [Microsoft Corporation, 2001.12.4414.42]
    [D:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\cscui.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\CSCDLL.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\themeui.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\MSIMG32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USERENV.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\msutb.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\MSCTF.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\LINKINFO.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntshrui.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ATL.DLL]  [Microsoft Corporation, 3.00.9238]
    [D:\WINDOWS\System32\NETAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\SAMLIB.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\SETUPAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\NETSHELL.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\credui.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\iphlpapi.dll]  [Microsoft Corporation, 5.1.2600.2 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\netman.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\MPRAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ACTIVEDS.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\adsldpc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WLDAP32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\rtutils.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\RASAPI32.dll]  [Microsoft Corporation, 5.1.2600.28 (xpclnt_qfe.010827-1803)]
    [D:\WINDOWS\system32\rasman.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\TAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WINMM.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WZCSvc.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WMI.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\DHCPCSVC.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\DNSAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\WTSAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WINSTA.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\msi.dll]  [Microsoft Corporation, 2.0.2600.0]
    [D:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\browselc.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\urlmon.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [D:\WINDOWS\system32\MPR.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\drprov.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ntlanman.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\NETUI0.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\NETUI1.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\NETRAP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\davclnt.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\srclient.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\Wbem\framedyn.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 836][D:\Documents and Settings\xb\桌面\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:20 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

[D:\WINDOWS\System32\ntdll.dll]  [Microsoft Corporation, 5.1.2600.114 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\kernel32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USER32.dll]  [Microsoft Corporation, 5.1.2600.104 (xpclnt_qfe.020823-2005)]
    [D:\WINDOWS\system32\GDI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\ADVAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\RPCRT4.dll]  [Microsoft Corporation, 5.1.2600.109 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\comdlg32.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SHLWAPI.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\system32\msvcrt.dll]  [Microsoft Corporation, 7.0.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\SHELL32.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WINSPOOL.DRV]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\System32\oledlg.dll]  [Microsoft Corporation, 1.0 (XPClient.010817-1148)]
    [D:\WINDOWS\system32\ole32.dll]  [Microsoft Corporation, 5.1.2600.115 (xpclnt_qfe.021108-2107)]
    [D:\WINDOWS\system32\OLEAUT32.dll]  [Microsoft Corporation, 3.50.5014.0]
    [D:\WINDOWS\system32\VERSION.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\CRYPT32.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\MSASN1.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\System32\WINMM.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WS2_32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WS2HELP.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WININET.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\IMM32.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\LPK.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\USP10.dll]  [Microsoft Corporation, 1.0407.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\RICHED20.DLL]  [Microsoft Corporation, 5.30.23.1210]
    [D:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\sfc_os.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WINTRUST.dll]  [Microsoft Corporation, 5.131.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\IMAGEHLP.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\System32\Sensapi.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\System32\Secur32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\wsock32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\RASAPI32.DLL]  [Microsoft Corporation, 5.1.2600.28 (xpclnt_qfe.010827-1803)]
    [D:\WINDOWS\System32\rasman.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\NETAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\TAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\rtutils.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\USERENV.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\urlmon.dll]  [Microsoft Corporation, 6.00.2800.1106]
    [D:\WINDOWS\System32\mswsock.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\DNSAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\iphlpapi.dll]  [Microsoft Corporation, 5.1.2600.2 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\netman.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\MPRAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ACTIVEDS.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\adsldpc.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\system32\WLDAP32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\ATL.DLL]  [Microsoft Corporation, 3.00.9238]
    [D:\WINDOWS\System32\SAMLIB.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\SETUPAPI.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WZCSvc.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WMI.dll]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [D:\WINDOWS\System32\DHCPCSVC.DLL]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WTSAPI32.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\WINSTA.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\winrnr.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\rasadhlp.dll]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [D:\WINDOWS\System32\rsaenh.dll]  [Microsoft Corporation, 5.1.2518.0 (main.010714-2114)]
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:21 | 只看楼主 短消息 资料
字号： 小 中 大 5楼


==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["D:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[D:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[E:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[F:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[G:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe
[H:\]
[AutoRun]
open=auto.exe
shellexecute=auto.exe
shell\Auto\command=auto.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:22 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

我记得以前日志里扫描出来进程中没有那么多dll文件,所以在安全模式下尝试删除,但都受保护,没有办法....郁闷死了..高手请帮忙啊.
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:29 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

另外刚刚发现,每个盘根目录下面有auto.exe和autorun.inf
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 00:32 | 只看楼主 短消息 资料
字号： 小 中 大 8楼

另外刚刚发现,每个盘根目录下面有auto.exe和autorun.inf
gototop
 
agee
头像
飘泊而立狮
  • 帖子:543
  • 注册: 2007-01-26
  • 来自:
发表于： 2007-06-27 00:34 | 短消息 资料
字号： 小 中 大 9楼

删除以下服务
[78F2926A / 78F2926A][Stopped/Auto Start]
<D:\WINDOWS\System32\9D4F7E45.EXE -k><Microsoft Corporation>
删除以下驱动
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>
[WINIO / WINIO][Stopped/Manual Start]
<\??\D:\WINDOWS\Downloaded Program Files\CONFLICT.1\winio.sys><N/A>
删除autorun
并删除以上的相应文件
gototop
 
无毒丈夫
头像
初生襁褓狮
  • 帖子:44
  • 注册: 2007-03-24
  • 来自:
发表于： 2007-06-27 09:15 | 只看楼主 短消息 资料
字号： 小 中 大 10楼

请楼上大哥说得详细点好吗？我进入安全模式下也无法删除那些对应的dll，都说受系统保护．．．请问怎么办？
gototop
 
<<上一主题|下一主题>>
12   1  /  2  页   跳转页
页面顶部
Powered by Discuz!NT