1   1  /  1  页   跳转页

【求助】我电脑中了未知病毒

收藏
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 00:23 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

【求助】我电脑中了未知病毒

我电脑最近突然出现一种很奇怪的现象：开机正常使用呢，过一会，

突然整个屏幕变的很亮，鼠标变成了红色，跟随鼠标的还有两个重叠

的红色或蓝色的透明方框，出现这一现象后，整个电脑只能移动鼠标

（过一会鼠标也不能移动了）其他比如键盘、鼠标点击没有任何反映

了，整个电脑处于瘫痪状态，没办法只好重启电脑，但重启后不久电

脑问题依旧。但在安全模式下运行一切正常，不出现此类现象，我升

级了我的正版瑞星后在安全模式下全盘杀毒，没发现任何病毒和异常
如果电脑不上网，也不会出现类似现象
我已经重装系统了，问题依旧。
最后编辑2007-07-07 21:46:54.467000000
分享到：
gototop
 
agee
头像
飘泊而立狮
  • 帖子:543
  • 注册: 2007-01-26
  • 来自:
发表于： 2007-07-06 00:27 | 短消息 资料
字号： 小 中 大 2楼

下载 System Repair Engineer系统扫描工具软件，下载地址如下：
http://www.kztechs.com/sreng/download.html
扫描和上传日志的方法：
1、解压缩所下载的sreng2.zip压缩包；
2、打开已经解压缩的SRENG文件夹，双击运行其中的SREng.exe（如果不能运行，请删除已经解压的SRENG文件夹和其包含的所有文件，重新下载新的压缩包或用已下载的压缩包重新解压，解压时请将解压后的文件夹名改为111，解压后，进入111文件夹，不要运行其中的SREng.exe这个可执行文件，先将其直接改名为111.bat、111.scr、111.com或111.pif，或者改为111.exe，然后再双击运行）；
3、依次按“智能扫描”、“扫描”、“保存报告”，将日志保存到硬盘上；
4、找到并打开日志，把日志中的内容用“复制”--“粘贴”命令拷贝到帖子上，不要修改地传上来（日志很长，一个帖子搞不完，请手动将全部内容分多个回复帖子传上来）。
友情提示：
扫描日志前关闭所有手工打开的软件和窗口。
注意在没有进一步提示前，请勿用SRENG工具胡乱修复，否则系统可能变的情况更糟。
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:17 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

以下是我保存的日志

[CODE]

2007-07-06,15:59:30

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Standard Edition Service Pack 2 (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe>  [Analog Devices, Inc.]
    <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
    <BigDogPath><C:\WINDOWS\VM_STI.EXE AVSTAR AC-630>  [N/A]
    <ASUS Probe><C:\Program Files\ASUS\Probe\AsusProb.exe>  [N/A]
    <RavTask><"C:\Program Files\rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:18 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart][Stopped/Disabled]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[RadClock / RadClock][Stopped/Disabled]
  <C:\Program Files\RadLinker\RadClock.exe><>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[aslm75 / aslm75][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\aslm75.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[3Com 3C2000x EtherLink XL Adapter / EL2000][Running/Manual Start]
  <system32\DRIVERS\EL2K_XP.sys><3Com Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HookSys.sys><Rising>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[MidiSyn / MidiSyn][Stopped/Manual Start]
  <system32\drivers\MidiSyn.sys><Analog Devices Inc>
[New0 / New0][Stopped/Disabled]
  <\??\C:\WINDOWS\system32\new.sys><N/A>
[npkcrypt / npkcrypt][Stopped/Disabled]
  <\??\E:\QQ2007\npkcrypt.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Radeon Probe Driver / RadProbe][Running/Manual Start]
  <system32\DRIVERS\RadProbe.sys><>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[tcaicchg / tcaicchg][Running/Auto Start]
  <\??\C:\WINDOWS\system32\tcaicchg.sys><3Com Corporation>
[TCAITDI Protocol / TCAITDI][Running/Auto Start]
  <system32\DRIVERS\TCAITDI.sys><3Com Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[AVSTAR AC-630 / ZSMC301b][Running/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:18 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart][Stopped/Disabled]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[RadClock / RadClock][Stopped/Disabled]
  <C:\Program Files\RadLinker\RadClock.exe><>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
  <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[aslm75 / aslm75][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\aslm75.sys><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[3Com 3C2000x EtherLink XL Adapter / EL2000][Running/Manual Start]
  <system32\DRIVERS\EL2K_XP.sys><3Com Corporation>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\ExpScan.sys><>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\HookSys.sys><Rising>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[MidiSyn / MidiSyn][Stopped/Manual Start]
  <system32\drivers\MidiSyn.sys><Analog Devices Inc>
[New0 / New0][Stopped/Disabled]
  <\??\C:\WINDOWS\system32\new.sys><N/A>
[npkcrypt / npkcrypt][Stopped/Disabled]
  <\??\E:\QQ2007\npkcrypt.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Radeon Probe Driver / RadProbe][Running/Manual Start]
  <system32\DRIVERS\RadProbe.sys><>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\rising\Rav\RSPPSYS.sys><Rising>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[tcaicchg / tcaicchg][Running/Auto Start]
  <\??\C:\WINDOWS\system32\tcaicchg.sys><3Com Corporation>
[TCAITDI Protocol / TCAITDI][Running/Auto Start]
  <system32\DRIVERS\TCAITDI.sys><3Com Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[AVSTAR AC-630 / ZSMC301b][Running/Manual Start]
  <System32\Drivers\usbVM31b.sys><VM>
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:18 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

浏览器加载项
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[IEDown Class]
  {D0A29C6C-AA71-4423-8C4A-5998B774C448} <C:\WINDOWS\system32\GLIEDown2.dll, 联众公司>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[ProductIDGatherer.WindowsGatherer]
  {E2F9D054-D2B5-4CE8-9BDF-8BF3A81DB7E9} <C:\WINDOWS\Downloaded Program Files\ProductIDGatherer.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[FlashGet GetFlash Class]
  {F156768E-81EF-470C-9057-481BA8380DBA} <C:\Program Files\FlashGet\getflash.dll, www.flashget.com>
[XML DOM Document 3.0]
  {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[Free Threaded XML DOM Document 3.0]
  {F5078F33-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP 3.0]
  {F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XSL Template 3.0]
  {F5078F36-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[FGAutoLive]
  {F90D830D-C175-4bbe-82C7-FF94669A4C42} <C:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
[FGCatchUrl]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <C:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
  <C:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm, N/A>
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:18 | 只看楼主 短消息 资料
字号： 小 中 大 7楼

正在运行的进程
[PID: 300][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 364][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 388][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [N/A, N/A]
[PID: 436][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 448][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 600][C:\WINDOWS\system32\Ati2evxx.exe]  [N/A, N/A]
[PID: 616][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 712][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 780][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 828][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 852][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1132][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1176][C:\WINDOWS\system32\msdtc.exe]  [Microsoft Corporation, 2001.12.4720.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1340][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1412][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1432][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe]  [Analog Devices, Inc., 3, 2, 6, 0]
[PID: 1452][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1876][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1980][C:\WINDOWS\system32\Ati2evxx.exe]  [N/A, N/A]
[PID: 2044][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.3790.3959 (srv03_sp2_rtm.070216-1710)]
    [C:\Program Files\rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.7]
[PID: 368][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe]  [Analog Devices, Inc., 4, 0, 4, 11]
    [C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll]  [Analog Device, Inc., 1, 0, 22, 26]
[PID: 412][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe]  [Analog Devices, Inc., 4, 0, 4, 25]
[PID: 672][C:\WINDOWS\VM_STI.EXE]  [VM., 4.2.610.4]
    [C:\WINDOWS\system32\msdmo.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\VM31bPrp.Ax]  [VM, 4.2.711.31]
[PID: 452][C:\Program Files\ASUS\Probe\AsusProb.exe]  [N/A, N/A]
    [C:\WINDOWS\system\VCL35.bpl]  [Borland International, 3.0.3.70]
    [C:\WINDOWS\system\cp3240mt.dll]  [Borland International, 4.0]
    [C:\WINDOWS\system\borlndmm.dll]  [Borland International, 3.0.3.70]
    [C:\Program Files\ASUS\Probe\CODISK.DLL]  [N/A, N/A]
    [C:\Program Files\ASUS\Probe\DiskIco.dll]  [N/A, N/A]
    [C:\Program Files\ASUS\Probe\COLM7578.DLL]  [N/A, N/A]
    [C:\WINDOWS\system\bcbsmp35.bpl]  [, 1.0.0.0]
    [C:\WINDOWS\system\vclx35.bpl]  [Borland International, 3.0.3.70]
    [C:\Program Files\ASUS\Probe\Asus.dll]  [ASUS, 3, 0, 0, 2]
    [C:\Program Files\ASUS\Probe\ASMIAHD.dll]  [ASUS, 3, 0, 0, 1]
    [C:\Program Files\ASUS\Probe\AsmiCtrl.dll]  [ASUS, 3, 0, 0, 1]
    [C:\Program Files\ASUS\Probe\ASMIDMI.dll]  [ASUS, 3, 1, 0, 1]
    [C:\Program Files\ASUS\Probe\AsmiEnum.dll]  [ASUS, 3, 0, 0, 1]
    [C:\Program Files\ASUS\Probe\AsmiHwIo.dll]  [ASUS, 3, 1, 0, 1]
    [C:\Program Files\ASUS\Probe\AsmiIntl.dll]  [ASUS, 4, 0, 0, 1]
    [C:\Program Files\ASUS\Probe\Asmi627h.dll]  [N/A, N/A]
    [C:\Program Files\ASUS\Probe\COLMIco.dll]  [N/A, N/A]
    [C:\Program Files\ASUS\Probe\CODMI.DLL]  [N/A, N/A]
[PID: 824][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1356][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 1988][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 2368][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)]
[PID: 2912][C:\Documents and Settings\Administrator\My Documents\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-06 16:19 | 只看楼主 短消息 资料
字号： 小 中 大 8楼

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]
gototop
 
agee
头像
飘泊而立狮
  • 帖子:543
  • 注册: 2007-01-26
  • 来自:
发表于： 2007-07-07 21:21 | 短消息 资料
字号： 小 中 大 9楼

可疑驱动
[aslm75 / aslm75][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\aslm75.sys><N/A>
删除以下驱动　并删除new.sys文件
[New0 / New0][Stopped/Disabled]
<\??\C:\WINDOWS\system32\new.sys><N/A>
gototop
 
独孤求生
头像
初生襁褓狮
  • 帖子:412
  • 注册: 2004-01-15
  • 来自:
发表于： 2007-07-07 21:46 | 只看楼主 短消息 资料
字号： 小 中 大 10楼

谢谢楼上,我按楼上的提示做了,结果还是出现屏幕突然很亮,但鼠标变成白色了,而不是红色了,其他症状一样,还是死机
请问瑞星杀毒软件能杀掉这个病毒吗?
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT