机子开一会就卡住,,.卡到无反应,,要点机箱的按钮重启才恢复正常,,,上一会又来了.
    2006-03-05,17:29:06

System Repair Engineer 2.0.12.350 (2.0 RC 1)
  Windows Server 2003 Enterprise Edition Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
  所有的启动项目（包括注册表、启动文件夹、服务等）
  浏览器加载项
  正在运行的进程（包括进程模块信息）
  文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<nwiz><nwiz.exe /install>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Zone Labs Client><C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<vptray><C:\PROGRA~1\SYMANT~1\VPTray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<mscfs><RUNDLL32 C:\WINDOWS\system32\msibm\cfsys.dll,cfs>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[Adobe Gamma]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Adobe Gamma.lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[Symantec Event Manager / ccEvtMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation / ccPwdSvc]
<"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Symantec Settings Manager / ccSetMgr]
<"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"><Symantec Corporation>
[Symantec AntiVirus Definition Watcher / DefWatch]
<"C:\Program Files\Symantec AntiVirus\DefWatch.exe"><Symantec Corporation>
[NVIDIA Display Driver Service / NVSvc]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[SavRoam / SavRoam]
<"C:\Program Files\Symantec AntiVirus\SavRoam.exe"><symantec>
[Symantec Network Drivers Service / SNDSrvc]
<"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[Symantec AntiVirus / Symantec AntiVirus]
<"C:\Program Files\Symantec AntiVirus\Rtvscan.exe"><Symantec Corporation>
[TrueVector Internet Monitor / vsmon]
<C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service><Zone Labs, LLC>

==================================
浏览器加载项
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v13.dll, Thunder Networking Technologies,LTD>
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, N/A>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[CBHelper Object]
{8A4280AD-9B37-4922-A51D-73F3C3A32AF7} <C:\WINDOWS\system32\msibm\cfsbho.dll, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[Dr.eye WebPage Translation]
{92B255FE-94E2-4BCA-958D-3926CE38913F} <C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL, >
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v13.dll, Thunder Networking Technologies,LTD>
[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, N/A>
[Windows Media Player]
{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[QQBrowserHelperObject Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[CBHelper Object]
{8A4280AD-9B37-4922-A51D-73F3C3A32AF7} <C:\WINDOWS\system32\msibm\cfsbho.dll, N/A>
[Dr.eye WebPage Translation]
{92B255FE-94E2-4BCA-958D-3926CE38913F} <C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL, >

[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
[XML HTTP Request]
{ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 388][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 436][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 776][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
  [C:\WINDOWS\system32\NavLogon.dll] <Symantec Corporation><9.0.0.338>
[PID: 820][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 832][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1024][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1104][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1164][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1184][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1216][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1272][C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe] <Symantec Corporation><2.2.0.577>
  [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
[PID: 1296][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe] <Symantec Corporation><2.2.0.577>
  [C:\Program Files\Common Files\Symantec Shared\ccVrTrst.dll] <Symantec Corporation><2.2.0.577>
  [C:\PROGRA~1\COMMON~1\SYMANT~1\CCSETEVT.DLL] <Symantec Corporation><2.2.0.577>
[PID: 1472][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1512][C:\WINDOWS\system32\msdtc.exe] <Microsoft Corporation><2001.12.4720.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1612][C:\Program Files\Symantec AntiVirus\DefWatch.exe] <Symantec Corporation><9.0.0.338>
[PID: 1628][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1676][C:\WINDOWS\system32\inetsrv\inetinfo.exe] <Microsoft Corporation><6.0.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1708][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 1756][C:\WINDOWS\system32\tcpsvcs.exe] <Microsoft Corporation><5.2.3790.0 (srv03_rtm.030324-2048)>
[PID: 1804][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] <Symantec Corporation><9.0.0.338>
  [C:\WINDOWS\system32\CBA.DLL] <Intel? Corporation><6.12.0.112 E>
  [C:\WINDOWS\system32\MsgSys.dll] <Intel? Corporation><6.12.0.112 E>
  [C:\WINDOWS\system32\NTS.dll] <Intel? Corporation><6.12.0.112 E>
  [C:\WINDOWS\system32\PDS.DLL] <Intel? Corporation><6.12.0.112 E>
  [C:\Program Files\Symantec AntiVirus\NAVLU.dll] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] <Symantec Corp.><1.1.0.3>
  [C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
  [C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
  [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060301.006\ecmsvr32.dll] <Symantec Corporation><51.3.0.11>
  [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060301.006\NAVEX32a.DLL] <Symantec Corporation><20051.3.1.11>
  [C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060301.006\NAVENG32.DLL] <Symantec Corporation><20051.3.1.11>
  [C:\Program Files\Symantec AntiVirus\IMail.dll] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\NotesExt.dll] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\vpmsece.dll] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\DecSDK.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2ID.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2SS.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Symantec AntiVirus\Dec2Text.dll] <Symantec Corporation><3.02.11.32>
  [C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] <Symantec Corporation><9.0.0.338>
[PID: 2036][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 516][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 540][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2072][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2172][C:\WINDOWS\system32\wbem\wmiprvse.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
[PID: 2460][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.3790.1830 (srv03_sp1_rtm.050324-1447)>
  [C:\WINDOWS\system32\msicn\msibm.dll] <N/A><N/A>
  [C:\WINDOWS\system32\msibm\LINBAK.dll] <cfs><5, 0, 1, 2>
  [C:\WINDOWS\system32\msicn\plugins\as.dll] <N/A><N/A>
  [C:\WINDOWS\system32\msicn\plugins\bm.dll] <N/A><N/A>
  [C:\WINDOWS\system32\msicn\plugins\bse.dll] <N/A><N/A>
  [C:\WINDOWS\system32\msicn\plugins\lup.dll] <N/A><N/A>
  [C:\WINDOWS\system32\nvcpl.dll] <NVIDIA Corporation><6.14.10.5664>
[PID: 2592][C:\PROGRA~1\SYMANT~1\VPTray.exe] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] <Symantec Corporation><9.3.0.28>
  [C:\Program Files\Symantec AntiVirus\Cliproxy.dll] <Symantec Corporation><9.0.0.338>
  [C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] <Symantec Corporation><9.0.0.338>
  [C:\Program Files\Symantec AntiVirus\Cliscan.dll] <Symantec Corporation><9.0.0.338>
[PID: 2612][C:\WINDOWS\system32\RUNDLL32.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
  [C:\WINDOWS\system32\msibm\cfsys.dll] <N/A><N/A>
  [C:\WINDOWS\system32\msibm\cfs7zd.DLL] <N/A><N/A>
  [C:\WINDOWS\system32\msibm\lowlvl.dll] <cfs><5, 0, 1, 0>
[PID: 2624][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.2.3790.1830 (srv03_sp1_rtm.050324-1447)>
  [C:\WINDOWS\system32\msicn\msibm.dll] <N/A><N/A>
[PID: 3096][F:\tools\sreng\SREng.exe] <Smallfrogs Studio><2.0.12.350>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

日志不全
请导出全部日志

好了,你看下

进入注册表
删除如下几项：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer>

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<mscfs><RUNDLL32 C:\WINDOWS\system32\msibm\cfsys.dll,cfs>

[wmpdrm]
{0E674588-66B7-4E19-9D0E-2053B800F69F} <C:\WINDOWS\system32\wmpdrm.dll, N/A>

[CBHelper Object]
{8A4280AD-9B37-4922-A51D-73F3C3A32AF7} <C:\WINDOWS\system32\msibm\cfsbho.dll, N/A>
＝＝＝＝＝＝＝＝＝＝＝＝＝

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载IceSword
查看以下三个文件：
C:\WINDOWS\system32\msibm\cfsys.dll
C:\WINDOWS\system32\msibm\cfs7zd.DLL
C:\WINDOWS\system32\msibm\lowlvl.dll
到底插入到了哪个RUNDLL32.exe中
确定被插入的RUNDLL32.exe以后
然后进入如下操作：
双击打开IceSword
在菜单栏中点击文件－－设置－－勾选进线程创建
然后结束以下三个进程：
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
以及被上述文件插入的C:\WINDOWS\system32\RUNDLL32.exe
然后删除
C:\WINDOWS\system32\spoolsv\
C:\WINDOWS\system32\msicn\
C:\WINDOWS\system32\msibm\
C:\WINDOWS\system32\wmpdrm.dll

建议发送样本,查看:http://vir.ca-jc.com:8080/index.jsp