1   1  /  1  页   跳转

求助!病毒反复查杀不能清除!

求助!病毒反复查杀不能清除!

下面是报告,TXT文件:

[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)

附件附件:

下载次数:3063
文件类型:application/octet-stream
文件大小:
上传时间:2008-4-20 22:44:58
描述:

最后编辑2008-04-21 10:22:41.950000000
分享到:
gototop
 

日志不完全 请重新粘贴
gototop
 

z
[CODE]

2008-04-18,14:29:12

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <swg><; C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
    <acdseemc.exe><; C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE>  [(Verified)ACD Systems International Inc]
    <MsnMsgr><"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background>  [(Verified)Microsoft Corporation]
    <H/PC Connection Agent><"C:\Program Files\Microsoft ActiveSync\wcescomm.exe">  [(Verified)Microsoft Corporation]
    <SpybotSD TeaTimer><C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe>  [(Verified)Safer Networking Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
    <MsmqIntCert><regsvr32 /s mqrt.dll>  [N/A]
    <SoundMAX><C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray>  [Analog Devices, Inc.]
    <PDF Complete><"C:\Program Files\PDF Complete\pdfsty.exe">  [(Verified)PDF Complete]
    <PTHOSTTR><C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start>  [(Verified)Hewlett-Packard Company]
    <SynTPEnh><C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>  [(Verified)Microsoft Windows Publisher]
    <hpWirelessAssistant><%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe>  [(Verified)Hewlett-Packard Company]
    <SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe">  [(Verified)"Sun Microsystems, Inc."]
    <QlbCtrl><%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start>  [ Hewlett-Packard Development Company, L.P.]
    <CognizanceTS><rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule>  [Cognizance Corporation]
    <Recguard><C:\WINDOWS\Sminst\Recguard.exe>  []
    <Reminder><C:\WINDOWS\Creator\Remind_XP.exe>  []
    <HP Software Update><; c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe>  [Hewlett-Packard Co.]
    <Cpqset><C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe>  []
    <WatchDog><C:\Program Files\InterVideo\DVD Check\DVDCheck.exe>  [InterVideo Inc.]
    <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>  [N/A]
    <OfficeScanNT Monitor><"C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow>  [Trend Micro Inc.]
    <SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <IgfxTray><; C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Persistence><C:\WINDOWS\system32\igfxpers.exe>  [(Verified)Microsoft Windows Pubdwarer]
    <NeroFilterCheck><; C:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <Device Detector><; DevDetect.exe -autorun>  [N/A]
    <fssui><"C:\Program Files\Windows Live\家庭安全设置\fssui.exe" -autorun>  [(Verified)Microsoft Corporation]
    <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
    <AccelerometerSysTrayApplet><"C:\WINDOWS\system32\AccelerometerSt.Exe" >  [Hewlett-Packard Corporation]
    <360Antiarp><C:\Program Files\360safe\antiarp\antiarp.exe /start>  [N/A]
    <msccrt><C:\WINDOWS\msccrt.exe>  [N/A]
    <tciocp32><C:\WINDOWS\tciocp32.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><ghjdtry.dll,kghk.dll,lfsjgf.dll,stehs.dll,fghshj.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,sperls.dll,>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{1ce220d3-84bb-446c-8a39-6ed491c8a601}><ttNNBNNB1049.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DeviceNP]
    <WinlogonNotify: DeviceNP><DeviceNP.dll>  [Hewlett-Packard Limited]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    <WinlogonNotify: igfxcui><igfxdev.dll>  [(Verified)Microsoft Windows Hardware Compati
gototop
 

怎么才算完全呢?我已经按照要求把那个SRENGLOG的内容考到TXT文档里了啊
gototop
 

<swg><; C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe> [(Verified)Google Inc]
<acdseemc.exe><; C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE> [(Verified)ACD Systems International Inc]
<MsnMsgr><"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background> [(Verified)Microsoft Corporation]
<H/PC Connection Agent><"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"> [(Verified)Microsoft Corporation]
不要让以上这些自运行。

<Recguard><C:\WINDOWS\Sminst\Recguard.exe> []
<Reminder><C:\WINDOWS\Creator\Remind_XP.exe> []
<Device Detector><; DevDetect.exe -autorun> [N/A]
<msccrt><C:\WINDOWS\msccrt.exe> [N/A]
<tciocp32><C:\WINDOWS\tciocp32.exe> [N/A]
<fssui><"C:\Program Files\Windows Live\家庭安全设置\fssui.exe" -autorun> [(Verified)Microsoft Corporatio
AppInit_DLLs><ghjdtry.dll,kghk.dll,lfsjgf.dll,stehs.dll,fghshj.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,sperls.dll,> [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1ce220d3-84bb-446c-8a39-6ed491c8a601}><ttNNBNNB1049.dll> [N/A]
删掉以上这些。

再重启计算机,重扫日志。以Txt附件形式发的日志看和回复操作复杂,懒得看,没看。
你的软件装的杂了点。
gototop
 

下载av专杀:http://dl.pconline.com.cn/html_2/1/66/id=49558&pn=0&linkPage=1.html

然后

下载arswp(Windows清理助手)清理下..
http://www.arswp.com/download/arswp/arswp.rar


再用360安全卫士清理恶意插件和查杀木马。

修复IE~~


如果还是不行

扫描完整的SRENG日志发上来
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT