【求助】这个毒删也删不掉 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】这个毒删也删不掉

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

【求助】这个毒删也删不掉

lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:	发表于： 2006-06-11 10:50 \| 只看楼主短消息资料字号：小中大 1楼【求助】这个毒删也删不掉 2006-06-11,10:38:12 用卡吧杀毒无效，手工改注册表的启动项也无济于事，运行msconfig无反映。以下是报告，请高人指点 System Repair Engineer 2.0.12.350 (2.0 RC 1) Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe 1> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <Userinit><C:\WINDOWS\system32\userinit.exe,> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><KB75976M.LOG> ================================== 启动文件夹服务 [EPSON Printer Status Agent2 / EPSONStatusAgent2] <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION> [kavsvc / kavsvc] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab> [MS Massacre / MSmassacre] <C:\WINDOWS\help\MSpass.exe><N/A> [SDAgent Service / SDAgentService] <C:\Program Files\Common Files\smartde\sde.exe><N/A> [ZT Massacre / ZTmassacre] <C:\WINDOWS\help\ZTpass.exe><N/A> ================================== 浏览器加载项 [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, > [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll, Thunder Networking Technologies,LTD> [kele8] {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [Fc2Boot Class] {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <C:\WINDOWS\Downloaded Program Files\fc2boot.dll, 北京线线通科技开发有限公司> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [上传到QQ网络硬盘] <D:\应用程序集\β2\AddToNetDisk.htm, N/A> [添加到QQ自定义面板] <D:\应用程序集\β2\AddPanel.htm, N/A> [添加到QQ表情] <D:\应用程序集\β2\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <D:\应用程序集\β2\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 472][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 528][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 560][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 612][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 624][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 804][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 876][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 960][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 976][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 1240][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\WINDOWS\system32\EBPMON2.DLL] <SEIKO EPSON CORPORATION><2, 20, 0, 0> [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620> [PID: 1528][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.rx] <N/A><N/A> [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] <><1, 0, 0, 1> [C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll] <Kaspersky Lab><5.0.388.1> [PID: 1884][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 1912][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] <SEIKO EPSON CORPORATION><2, 2, 0, 0> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\WINDOWS\System32\EBAPI2.DLL] <SEIKO EPSON CORPORATION><1, 4, 0, 0> [C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] <SEIKO EPSON CORPORATION><2, 20, 0, 0> [PID: 2036][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [PID: 372][C:\WINDOWS\WINLOGON.EXE] <XMZ><0.00.0072> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.rx] <N/A><N/A> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] <Kaspersky Lab><5.0.1.18> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] <Kaspersky Lab><5.0.388.2> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0> [PID: 408][C:\WINDOWS\System32\CTFMON.EXE] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.rx] <N/A><N/A> [PID: 1296][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.rx] <N/A><N/A> [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] <><1, 0, 0, 1> [C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] <Kaspersky Lab><5.0.1.18> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] <Kaspersky Lab><5.0.388.2> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [PID: 220][D:\应用程序集\SREng.exe] <Smallfrogs Studio><2.0.12.350> [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> [C:\Program Files\Common Files\Microsoft Shared\MSINFO\MsInfo.rx] <N/A><N/A> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE Error. [winfiles] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] 2006-07-26 02:22:19
lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:	分享到：

worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:	发表于： 2006-06-11 10:55 \| 短消息资料字号：小中大 2楼 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe 1> [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><KB75976M.LOG> .EXE Error. [winfiles] 修复，再删了那些文件，别忘了1的那个，应该是个1.com
worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:

worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:	发表于： 2006-06-11 10:58 \| 短消息资料字号：小中大 3楼 [C:\WINDOWS\KB75976M.LOG] <N/A><N/A> 这个很多进程里都有，比较麻烦，先删启动项，非法重起，再删文件吧
worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:

worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:	发表于： 2006-06-11 11:01 \| 短消息资料字号：小中大 4楼 [MS Massacre / MSmassacre] <C:\WINDOWS\help\MSpass.exe><N/A> [SDAgent Service / SDAgentService] <C:\Program Files\Common Files\smartde\sde.exe><N/A> [ZT Massacre / ZTmassacre] <C:\WINDOWS\help\ZTpass.exe><N/A> 这几个也不象好东西，没用就修复，删了
worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-06-11 11:04 \| 短消息资料字号：小中大 5楼楼主中病毒不小建议先解决以下问题另，请下载是新的扫描软件再按以下方式解决问题 http://www.kztechs.com/sreng/sreng2.zip 双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名运行System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务MS Massacre，ZT Massacre，SDAgent Service选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）重启后运行System Repair Engineer，使用“启动项目，注册表”选中要修复的项， [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><KB75976M.LOG> 点“编辑”在“值”里删除KB75976M.LOG 删除KB75976M.LOG （搜一下） C:\Program Files\Common Files\smartde C:\WINDOWS\help\ZTpass.exe C:\WINDOWS\help\MSpass.exe 修复后，请重启。烦再扫份日志粘上来。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:	发表于： 2006-06-11 11:36 \| 只看楼主短消息资料字号：小中大 6楼感谢诸位的热心帮助。以下是我按大家指示后处理的结果，烦劳指点启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [XMZ] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [XMZ] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe 1> [] <Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [Microsoft Corporation] ================================== 启动文件夹服务 [EPSON Printer Status Agent2 / EPSONStatusAgent2] <C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe><SEIKO EPSON CORPORATION> [kavsvc / kavsvc] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab> ================================== 浏览器加载项 [AcroIEHlprObj Class] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx, > [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll, Thunder Networking Technologies,LTD> [kele8] {84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation> [Fc2Boot Class] {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} <C:\WINDOWS\Downloaded Program Files\fc2boot.dll, 北京线线通科技开发有限公司> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.> [&使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [&使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [上传到QQ网络硬盘] <, N/A> [添加到QQ自定义面板] <D:\应用程序集\β2\AddPanel.htm, N/A> [添加到QQ表情] <D:\应用程序集\β2\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <, N/A> ================================== 正在运行的进程 [PID: 476][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 532][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 556][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 600][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 612][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 772][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 836][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 912][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 928][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1160][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)> [C:\WINDOWS\system32\EBPMON2.DLL] <SEIKO EPSON CORPORATION><2, 20, 0, 0> [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620> [PID: 1408][C:\WINDOWS\Explorer.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] <><1, 0, 0, 1> [C:\Program Files\WinRAR\rarext.dll] <N/A><N/A> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll] <Kaspersky Lab><5.0.388.1> [PID: 1680][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 1796][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] <SEIKO EPSON CORPORATION><2, 2, 0, 0> [C:\WINDOWS\System32\EBAPI2.DLL] <SEIKO EPSON CORPORATION><1, 4, 0, 0> [C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] <SEIKO EPSON CORPORATION><2, 20, 0, 0> [PID: 1812][C:\WINDOWS\WINLOGON.EXE] <XMZ><0.00.0072> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] <Kaspersky Lab><5.0.1.18> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] <Kaspersky Lab><5.0.388.2> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0> [PID: 180][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)> [PID: 1224][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)> [PID: 1860][C:\Program Files\Internet Explorer\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)> [C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx] <><1, 0, 0, 1> [C:\Program Files\Thunder Network\Thunder\ComDlls\XUNLEIBHO_001.dll] <Thunder Networking Technologies,LTD><5, 0, 0, 1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] <Kaspersky Lab><5.0.1.18> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] <Kaspersky Lab><5.0.388.2> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] <Kaspersky Lab><5.0.388.1> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] <Kaspersky Lab><5.0.388.0> [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] <Kaspersky Lab><5.0.388.0> [c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0> [C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0> [PID: 2020][D:\应用程序集\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505> ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE Error. [winfiles] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}]
lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:

worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:	发表于： 2006-06-11 11:47 \| 短消息资料字号：小中大 7楼 <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [XMZ] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices] <Torjan Program><C:\WINDOWS\WINLOGON.EXE> [XMZ] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe 1> [] 注册表启动项没删呀，
worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:

worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:	发表于： 2006-06-11 11:48 \| 短消息资料字号：小中大 8楼 [PID: 1812][C:\WINDOWS\WINLOGON.EXE] <XMZ><0.00.0072> 病毒还在
worldkiller 初生襁褓狮帖子:305 注册: 2006-04-10 来自:

lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:	发表于： 2006-06-11 11:50 \| 只看楼主短消息资料字号：小中大 9楼删了，重新启动还存在
lfus100 初生襁褓狮帖子:41 注册: 2006-01-15 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-06-11 11:53 \| 短消息资料字号：小中大 10楼运行System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。是解决C:\WINDOWS\WINLOGON.EXE的时候，请给版主baohe 发悄悄放在，他写有杀这个木马的手动查杀流程。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT