瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 似乎中了金威，怎么也杀不了，请高手帮帮忙了～～～谢谢

1   1  /  1  页   跳转页

似乎中了金威，怎么也杀不了，请高手帮帮忙了～～～谢谢

收藏
vera00
头像
初生襁褓狮
  • 帖子:21
  • 注册: 2006-04-28
  • 来自:
发表于： 2007-06-11 12:02 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

似乎中了金威，怎么也杀不了，请高手帮帮忙了～～～谢谢

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <svc><C:\DOCUME~1\ten\LOCALS~1\Temp\expseny.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Publisher]
    <StormCodec_Helper><"d:\暴风影音\StormSet.exe" /S /opti>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <RavMon><C:\DOCUME~1\ten\LOCALS~1\Temp\RavMonD.exe>  []
    <visin><C:\WINDOWS\system32\visin.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><C:\WINDOWS\system32\ir32_64.dll,p?>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt>  []
    <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.sys>  []
    <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll>  []

==================================
启动文件夹
N/A

==================================
服务
[局域网通讯协议 / Hello World][Stopped/Auto Start]
  <C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.EXE><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe windhcp.ocx,input><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe xpdhcp.dll,input><Microsoft Corporation>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe windds32.dll,input><Microsoft Corporation>
[Wireless Service / WZCSRVC][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Running/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[Netgroup Packet Filter / NPF][Running/Manual Start]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[Bluesky / Bluesky][Running/Manual Start]
  <2 - 系统找不到指定的文件。
><N/A>

==================================
浏览器加载项
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[ThunderIEHelper Class]
  {0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\system32\xunleibho_v14.dll, Thunder Networking Technologies,LTD>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[&使用迅雷下载]
  <d:\迅雷\geturl.htm, N/A>
[&使用迅雷下载全部链接]
  <d:\迅雷\getallurl.htm, N/A>
[上传到QQ网络硬盘]
  <D:\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\QQ\SendMMS.htm, N/A>

==================================
最后编辑2007-06-11 12:01:23
分享到：
gototop
 
vera00
头像
初生襁褓狮
  • 帖子:21
  • 注册: 2006-04-28
  • 来自:
发表于： 2007-06-11 12:07 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

正在运行的进程
[PID: 540][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 612][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 636][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 680][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 692][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 844][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
[PID: 908][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\Winhttps.dll]  [N/A, ]
[PID: 1012][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1060][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1156][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1524][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1552][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.bmt]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\wscsv.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\nwiztlbb.dll]  [N/A, ]
    [C:\WINDOWS\system32\Ravasktao.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [d:\WinRAR\rarext.dll]  [N/A, ]
    [C:\WINDOWS\System32\Winhttps.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizqjsj.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizAsktao.dll]  [N/A, ]
    [C:\WINDOWS\system32\dh2103.dll]  [N/A, ]
    [C:\WINDOWS\system32\nwizhx2.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacn.dll]  [N/A, ]
[PID: 1744][C:\DOCUME~1\ten\LOCALS~1\Temp\RavMonD.exe]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
[PID: 1788][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.30]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 1808][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3018]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 1816][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
[PID: 1824][C:\DOCUME~1\ten\LOCALS~1\Temp\expseny.exe]  [N/A, ]
    [C:\DOCUME~1\ten\LOCALS~1\Temp\wcuj8.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\DOCUME~1\ten\LOCALS~1\Temp\packet.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\DOCUME~1\ten\LOCALS~1\Temp\WanPacket.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\DOCUME~1\ten\LOCALS~1\Temp\NPPTools.dll]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 1932][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1704][C:\WINDOWS\System32\alg32.exe]  [N/A, ]
    [C:\WINDOWS\System32\Winhttps.dll]  [N/A, ]
gototop
 
vera00
头像
初生襁褓狮
  • 帖子:21
  • 注册: 2006-04-28
  • 来自:
发表于： 2007-06-11 12:08 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

[PID: 1944][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 2624][C:\WINDOWS\system32\systemm.exe]  [N/A, ]
    [C:\WINDOWS\system32\WPCAP.DLL]  [CACE Technologies, 3, 1, 0, 27]
    [C:\WINDOWS\system32\packet.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\WINDOWS\system32\WanPacket.dll]  [CACE Technologies, 3, 1, 0, 27]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
[PID: 2408][C:\WINDOWS\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 2532][D:\TT\TTraveler.exe]  [Tencent, 3, 5, 299, 201]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [D:\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [D:\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\TT\TTNetFavor.dll]  [N/A, ]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
    [C:\WINDOWS\system32\WBJJU.IME]  [北京六合源软件技术有限公司, 2, 5, 0, 0]
    [C:\WINDOWS\system32\WbCodeU.dll]  [, 2, 5, 0, 0]
    [C:\WINDOWS\system32\wbjju.dll]  [N/A, ]
[PID: 2572][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 2524][C:\WINDOWS\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 1764][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 5280][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 5328][C:\WINDOWS\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 5384][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 5432][C:\WINDOWS\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
[PID: 2460][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
    [C:\WINDOWS\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 2136][C:\program files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
    [C:\WINDOWS\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\xunleibho_v14.dll]  [Thunder Networking Technologies,LTD, 4, 6, 0, 62]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [D:\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 4964][D:\软件盘\sreng24\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\WINDOWS\system32\msdebug.dll]  [N/A, ]
    [C:\WINDOWS\system32\RemoteDbg.dll]  [N/A, ]
    [C:\WINDOWS\system32\windds32.dll]  [N/A, ]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, ]
    [C:\WINDOWS\system32\xpdhcp.dll]  [N/A, ]
    [C:\WINDOWS\system32\WMIApiSrv.dll]  [N/A, ]
    [C:\WINDOWS\system32\netsrvcs.dll]  [N/A, ]
    [C:\WINDOWS\system32\ztinetzt.dll]  [N/A, ]
    [C:\Program Files\Internet Explorer\PLUGINS\System64.sys]  [N/A, ]
    [C:\WINDOWS\system32\zkjjx.dll]  [N/A, ]
    [C:\WINDOWS\system32\wfdrd.dll]  [N/A, ]
    [C:\WINDOWS\system32\hreax.dll]  [N/A, ]
    [C:\WINDOWS\system32\wtrmm.dll]  [N/A, ]
    [C:\WINDOWS\system32\wgptl.dll]  [N/A, ]
    [C:\WINDOWS\system32\fksdy.dll]  [N/A, ]
    [C:\WINDOWS\System32\Winhttps.dll]  [N/A, ]
    [D:\软件盘\sreng24\Plugins\NWMON.SRE]  [Smallfrogs Studio, 1, 0, 0, 8]
gototop
 
vera00
头像
初生襁褓狮
  • 帖子:21
  • 注册: 2006-04-28
  • 来自:
发表于： 2007-06-11 12:08 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
    C:\WINDOWS\System32\Winhttps.dll(, N/A)
MSAFD Tcpip [UDP/IP]
    C:\WINDOWS\System32\Winhttps.dll(, N/A)
MSAFD Tcpip [RAW/IP]
    C:\WINDOWS\System32\Winhttps.dll(, N/A)

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
127.0.0.1      mmm.caifu18.net
127.0.0.1      www.18dmm.com
127.0.0.1      d.qbbd.com
127.0.0.1      www.5117music.com
127.0.0.1      www.union123.com
127.0.0.1      www.wu7x.cn
127.0.0.1      www.54699.com
127.0.0.1      www1.6tan.com
127.0.0.1      www2.6tan.com
127.0.0.1      www.97725.com
127.0.0.1      down.97725.com
127.0.0.1      ip.315hack.com
127.0.0.1      ip.54liumang.com
127.0.0.1      www.41ip.com
127.0.0.1      xulao.com
127.0.0.1      www.heixiou.com
127.0.0.1      www.9cyy.com
127.0.0.1      www.hunll.com
127.0.0.1      www.down.hunll.com
127.0.0.1      do.77276.com
127.0.0.1      www.baidulink.com
127.0.0.1      adnx.yygou.cn
127.0.0.1      222.73.220.45
127.0.0.1      www.f5game.com
127.0.0.1      www.guazhan.cn
127.0.0.1      wm,103715.com
127.0.0.1      www.my6688.cn
127.0.0.1      i.96981.com
127.0.0.1      d.77276.com
127.0.0.1      www.tie2bu.com
127.0.0.1      www.byip.cn
127.0.0.1      178.shen9.net
127.0.0.1      www.h-t1.com
127.0.0.1      www.puma164.com
127.0.0.1      www.56jb.com
127.0.0.1      jxdoe.com
127.0.0.1      www.08325.cn
127.0.0.1      www1.cw988.cn
127.0.0.1      cool.47555.com
127.0.0.1      www.asdwc.com
127.0.0.1      55880.cn
127.0.0.1      61.152.169.234
127.0.0.1      cc.wzxqy.com
127.0.0.1      www.54699.com
127.0.0.1      t.gcuj.com
127.0.0.1      www.puma163.com
127.0.0.1      ceoww.com
127.0.0.1      boolom.com
127.0.0.1      adult-novel.cn
127.0.0.1      ll.chinasese.net
127.0.0.1      www.tellumore.com
127.0.0.1      www.o1wg.com
127.0.0.1      www.qq756.com
127.0.0.1      ll.chinasese.net
127.0.0.1      cool.47555.com

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 
newcenturymoon
头像
社区嘉宾
  • 帖子:15158
  • 注册: 2005-08-03
  • 来自:
论坛8周年活动礼物幸运草
发表于： 2007-06-11 12:11 | 短消息 资料
字号： 小 中 大 5楼

中了艾尼  ....
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT