瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

1   1  /  1  页   跳转

[求助] 我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

vg7.5和卡巴2009都找不到这个病毒,但是病毒在杀毒软件更新时,破坏病毒库,avg7.5扫描时scan systemareas before the test starts不能选,还报svchost.exe ox7ffaoeb8 指令引导的0x7ffaoeb8内存,该内存不能为written, 有时报windows虚拟内存最小值太小,macfee扫描时遇到无法恢复的问题,以下是问题详细信息error starting on demand scanner
[CODE]
2009-03-26,15:58:38
System Repair Engineer 2.7.1.1261
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描
    计划任务
    API HOOK
    隐藏进程

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <ATIModeChange><Ati2mdxx.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Vistadrv><C:\WINDOWS\Vistadrive\vsdrv.exe>  []
    <OnlineTimer><C:\Program Files\GrassSoft\OnlineTimer\OnlineTimer.exe>  []
    <360Safebox><"C:\Program Files\360\360safebox\safeboxTray.exe" /r>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    <360Safetray><C:\Program Files\360\360Safe\safemon\360tray.exe /start>  [(Verified)Qizhi Software (beijing) Co. Ltd]
    <SiteAdvisor><C:\Program Files\SiteAdvisor\6009\SiteAdv.exe>  [(Verified)"McAfee, Inc."]
    <mcagent_exe><C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey>  [(Verified)"McAfee, Inc."]
    <AVG7_CC><C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP>  [GRISOFT, s.r.o.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Publisher]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Publisher]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
    <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
    <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
    <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\system32\ssmypics.scr>  [(Verified)Microsoft Windows Publisher]
==================================
启动文件夹
[Stardock ObjectDock]
  <C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\Stardock ObjectDock.lnk --> C:\WINDOWS\OBJECT~1\OBJECT~1.EXE [Stardock]><N>
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[AVG7 Alert Manager Server / Avg7Alrt][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe><GRISOFT, s.r.o.>
[AVG7 Update Service / Avg7UpdSvc][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe><GRISOFT, s.r.o.>
[AVG E-mail Scanner / AVGEMS][Running/Auto Start]
  <C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe><GRISOFT, s.r.o.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[McAfee Services / mcmscsvc][Running/Auto Start]
  <C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe><McAfee, Inc.>
[McAfee Network Agent / McNASvc][Running/Auto Start]
  <"c:\program files\common files\mcafee\mna\mcnasvc.exe"><McAfee, Inc.>
[McAfee Scanner / McODS][Stopped/Manual Start]
  <C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe><McAfee, Inc.>
[McAfee Proxy Service / McProxy][Running/Auto Start]
  <c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe><McAfee, Inc.>
[McAfee Real-time Scanner / McShield][Running/Auto Start]
  <C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe><McAfee, Inc.>
[McAfee SystemGuards / McSysmon][Stopped/Manual Start]
  <C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe><McAfee, Inc.>
[McAfee Personal Firewall Service / MpfService][Running/Auto Start]
  <"C:\Program Files\McAfee\MPF\MPFSrv.exe"><McAfee, Inc.>
[SiteAdvisor Service / SiteAdvisor Service][Running/Auto Start]
  <C:\Program Files\SiteAdvisor\6009\SAService.exe><McAfee, Inc.>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AMD K8 Processor Driver / AmdK8][Stopped/Manual Start]
  <System32\DRIVERS\amdk8.sys><Advanced Micro Devices>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[AVG7 Kernel / Avg7Core][Stopped/System Start]
  <\SystemRoot\System32\Drivers\avg7core.sys><GRISOFT, s.r.o.>
[AVG7 Wrap Driver / Avg7RsW][Running/System Start]
  <\SystemRoot\System32\Drivers\avg7rsw.sys><GRISOFT, s.r.o.>
[AVG7 Resident Driver XP / Avg7RsXP][Stopped/System Start]
  <\SystemRoot\System32\Drivers\avg7rsxp.sys><GRISOFT, s.r.o.>
[AVG7 Clean Driver / AvgClean][Running/System Start]
  <\SystemRoot\System32\Drivers\avgclean.sys><GRISOFT, s.r.o.>
[AVG Network Redirector / AvgTdi][Running/Auto Start]
  <\SystemRoot\System32\Drivers\avgtdi.sys><GRISOFT, s.r.o.>
[VIA Rhine-Family Fast Ethernet Adapter Driver Service / FETND5BV][Running/Manual Start]
  <system32\DRIVERS\fetnd5bv.sys><VIA Technologies, Inc.>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[Intel(R) Ham 5628 V.92 Modem / Intels51][Running/Manual Start]
  <system32\DRIVERS\Intels51.sys><Intel Corporation>
[McAfee Inc. mfeavfk / mfeavfk][Running/Manual Start]
  <system32\drivers\mfeavfk.sys><McAfee, Inc.>
[McAfee Inc. mfebopk / mfebopk][Running/Manual Start]
  <system32\drivers\mfebopk.sys><McAfee, Inc.>
[McAfee Inc. mfehidk / mfehidk][Running/System Start]
  <system32\drivers\mfehidk.sys><McAfee, Inc.>
[McAfee Inc. mferkdk / mferkdk][Running/Manual Start]
  <system32\drivers\mferkdk.sys><McAfee, Inc.>
[McAfee Inc. mfesmfk / mfesmfk][Stopped/Manual Start]
  <system32\drivers\mfesmfk.sys><McAfee, Inc.>
[MPFP / MPFP][Running/System Start]
  <System32\Drivers\Mpfp.sys><McAfee, Inc.>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  <\??\C:\Program Files\QQ2006\npkcrypt.sys><N/A>
[nv / nv][Stopped/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
  <\??\C:\WINDOWS\system32\Drivers\safeboxkrnl.sys><360安全中心>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[senfilt / senfilt][Running/Manual Start]
  <system32\drivers\senfilt.sys><Sensaura>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
  <system32\DRIVERS\tcpip.sys><N/A>
[VIA AGP Filter / viaagp1][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaagp1.sys><VIA Technologies, Inc.>
[viamraid / viamraid][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
==================================
浏览器加载项
[]
  {089FD14D-132B-48FC-8861-0048AE113215} <C:\Program Files\SiteAdvisor\6009\SiteAdv.dll, (Signed) McAfee, Inc.>
[scriptproxy]
  {7DB2D5A0-7241-4E79-B68D-6309F01C5231} <C:\Program Files\McAfee\VirusScan\scriptsn.dll, (Signed) McAfee, Inc.>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360\360Safe\safemon\safemon.dll, (Signed) 360.CN>
[McAfee SiteAdvisor]
  {0BF43445-2F28-4351-9252-17FE6E806AA0} <C:\Program Files\SiteAdvisor\6009\SiteAdv.dll, (Signed) McAfee, Inc.>
[]
  {089FD14D-132B-48FC-8861-0048AE113215} <C:\Program Files\SiteAdvisor\6009\SiteAdv.dll, (Signed) McAfee, Inc.>
[McAfee SiteAdvisor]
  {0BF43445-2F28-4351-9252-17FE6E806AA0} <C:\Program Files\SiteAdvisor\6009\SiteAdv.dll, (Signed) McAfee, Inc.>
[scriptproxy]
  {7DB2D5A0-7241-4E79-B68D-6309F01C5231} <C:\Program Files\McAfee\VirusScan\scriptsn.dll, (Signed) McAfee, Inc.>
[360SafeLive]
  {87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360\360Safe\live.dll, (Signed) 360.cn>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, (Signed) Microsoft Corporation>
[SafeMon Class]
  {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360\360Safe\safemon\safemon.dll, (Signed) 360.CN>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, (Signed) Adobe Systems, Inc.>
[]
  {FB5F1910-F110-11D2-BB9E-00C04F795683} <, >
[使用迅雷下载]
  <C:\Program Files\Thunder\Program\geturl.htm, N/A>
[使用迅雷下载全部链接]
  <C:\Program Files\Thunder\Program\getallurl.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

附件: SREngLOG.log (2009-3-27 10:47:53, 40.48 K)
该附件被下载次数 155


==================================

用户系统信息:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
分享到:
gototop
 

回复:我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

上传病毒样本到:
(1).论坛的可疑文件交流区  http://bbs.ikaka.com/showforum-20002.aspx
(2).官网的邮件服务中心/病毒样本上报。http://mailcenter.rising.com.cn/uploadnew.aspx
gototop
 

我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

正在运行的进程
[PID: 612 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 700 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 732 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4162]
[PID: 776 / SYSTEM][C:\WINDOWS\system32\services.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 788 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 928 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4162]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2511]
    [C:\WINDOWS\system32\atipdlxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2516]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 948 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1044 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1084 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\McAfee\VirusScan\scriptsn.dll]  [McAfee, Inc., VSCORE.14.0.0.366.x86]
[PID: 1128 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1196 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1256 / SYSTEM][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4162]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2511]
    [C:\WINDOWS\system32\atipdlxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2516]
    [C:\WINDOWS\system32\ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4162]
[PID: 1536 / Administrator][C:\WINDOWS\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\360\360Safe\safemon\safemon.dll]  [360.CN, 5, 0, 0, 1007]
    [C:\WINDOWS\ObjectDock\DockShellHook.dll]  [N/A, ]
[PID: 1564 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1724 / SYSTEM][C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe]  [GRISOFT, s.r.o., 7.5.0.420]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\PROGRA~1\Grisoft\AVGFRE~1\avglog.dll]  [GRISOFT, s.r.o., 7.5.0.429]
    [C:\Program Files\Grisoft\AVG Free\avgupsvc.dll]  [GRISOFT, s.r.o., 7.5.0.420]
    [C:\Program Files\Grisoft\AVG Free\avgcore.dll]  [GRISOFT, s.r.o., 7.5.0.498]
    [C:\Program Files\Grisoft\AVG Free\avgupd.dll]  [GRISOFT, s.r.o., 7.5.0.529]
    [C:\Program Files\Grisoft\AVG Free\avgklib.dll]  [GRISOFT, s.r.o., 7.5.0.458]
    [C:\Program Files\Grisoft\AVG Free\avgcfg.dll]  [GRISOFT, s.r.o., 7.5.0.504]
    [C:\Program Files\Grisoft\AVG Free\avgamsps.dll]  [GRISOFT, s.r.o., 7.5.0.407]
[PID: 1840 / SYSTEM][C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe]  [McAfee, Inc., 8,1,159,0]
    [c:\PROGRA~1\COMMON~1\mcafee\msc\mcutil\8_1_11~1\McUtil.dll]  [McAfee, Inc., 8,1,114,0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\McAfee\MSC\McRes.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McLocRes.dll]  [McAfee, Inc., 8,1,153,0]
    [C:\Program Files\McAfee\MSC\oem\550-2\Mccobres.dll]  [McAfee, Inc., 7,2,142,0]
    [C:\PROGRA~1\McAfee\MSC\Mccobres.dll]  [McAfee, Inc., 8,1,165,0]
    [C:\PROGRA~1\COMMON~1\McAfee\MSC\sqlite3.dll]  [McAfee, Inc., 8,1,125,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\msc\mcshllps.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\mcafee\msc\mcmispps.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\msc\mcsubmgr\8_1_13~1\mcsubmgr.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\mcafee\msc\mcmscver.dll]  [McAfee, Inc., 8,1,136,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvsap.dll]  [McAfee, Inc., 12,0,172,0]
    [c:\PROGRA~1\mcafee\mpf\mc\mpfmisp.dll]  [McAfee, Inc., 9.0.136.0]
    [C:\Program Files\McAfee\MPF\L10N.DLL]  [McAfee, Inc., 9.1.108.0]
    [C:\Program Files\SiteAdvisor\6009\SiteAdv.dll]  [McAfee, Inc., 2.3.0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mcvspp.dll]  [McAfee, Inc., 12,1,109,0]
    [c:\PROGRA~1\mcafee\msc\mcprotpv.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\msc\mcnmcprv.dll]  [McAfee, Inc., 2,1,151,0]
    [c:\PROGRA~1\mcafee\msc\mcdbmgr.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McNmcRes.dll]  [McAfee, Inc., 2,1,151,0]
    [C:\PROGRA~1\McAfee\MSC\McNmcLoR.dll]  [McAfee, Inc., 2,1,151,0]
    [C:\PROGRA~1\McAfee\MSC\McNmcCoR.dll]  [McAfee, Inc., 2,1,151,0]
    [c:\PROGRA~1\COMMON~1\mcafee\mna\MCNASV~1.DLL]  [McAfee, Inc., 2,1,143,0]
    [c:\PROGRA~1\mcafee\msc\mcnmcsps.dll]  [McAfee, Inc., 2,0,115,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll]  [McAfee, Inc., 12,1,118,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\naiannps.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\mcafee\msc\mcregobj\8_0_22~1\mcregobj.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\mpf\mc\mpfp.dll]  [McAfee, Inc., 9.0.136.0]
    [c:\PROGRA~1\mcafee\msc\mcdemenu.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvscp.dll]  [McAfee, Inc., 12,0,172,0]
    [c:\PROGRA~1\mcafee\msc\mcuicfg.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\msc\mccfgpv.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvsver.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\COMMON~1\mcafee\mcproxy\proxyver.dll]  [McAfee, Inc., 2,0,150,0]
    [c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapi.dll]  [McAfee, Inc., 9.0.119.0]
    [c:\PROGRA~1\mcafee\msc\mcnmcver.dll]  [McAfee, Inc., 2,0,115,0]
    [c:\PROGRA~1\mcafee\mqc\qcmisp.dll]  [McAfee, Inc., 8,1,106,0]
    [c:\PROGRA~1\mcafee\mqc\QcLite.dll]  [McAfee, Inc., 8,1,106,0]
[PID: 1908 / SYSTEM][c:\program files\common files\mcafee\mna\mcnasvc.exe]  [McAfee, Inc., 2,1,143,0]
    [c:\PROGRA~1\COMMON~1\mcafee\msc\mcutil\8_1_11~1\McUtil.dll]  [McAfee, Inc., 8,1,114,0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\PROGRA~1\mcafee\msc\mcnmcsrv.dll]  [McAfee, Inc., 2,1,151,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\msc\mcshllps.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\COMMON~1\mcafee\mna\MCNASV~1.DLL]  [McAfee, Inc., 2,1,143,0]
    [c:\PROGRA~1\mcafee\msc\mcnmcsps.dll]  [McAfee, Inc., 2,0,115,0]
    [c:\PROGRA~1\mcafee\mpf\mc\mpfp.dll]  [McAfee, Inc., 9.0.136.0]
    [c:\PROGRA~1\mcafee\msc\mcregobj\8_0_22~1\mcregobj.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\msc\mcmismgr.dll]  [McAfee, Inc., 8,1,149,0]
    [C:\PROGRA~1\McAfee\MSC\McRes.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McLocRes.dll]  [McAfee, Inc., 8,1,153,0]
    [C:\Program Files\McAfee\MSC\oem\550-2\Mccobres.dll]  [McAfee, Inc., 7,2,142,0]
    [C:\PROGRA~1\McAfee\MSC\Mccobres.dll]  [McAfee, Inc., 8,1,165,0]
    [c:\PROGRA~1\mcafee\msc\mcsubmgr\8_1_13~1\mcsubmgr.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\COMMON~1\mcafee\mna\mcuj.dll]  [McAfee, Inc., 2,1,143,0]
    [C:\PROGRA~1\McAfee\MSC\McNmcRes.dll]  [McAfee, Inc., 2,1,151,0]
[PID: 1960 / Administrator][C:\Program Files\GrassSoft\OnlineTimer\OnlineTimer.exe]  [, 1, 1, 0, 1]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\GrassSoft\OnlineTimer\gslib_ui_defres.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\360\360Safe\safemon\safemon.dll]  [360.CN, 5, 0, 0, 1007]
    [C:\WINDOWS\ObjectDock\DockShellHook.dll]  [N/A, ]
[PID: 2008 / Administrator][C:\Program Files\SiteAdvisor\6009\SiteAdv.exe]  [McAfee, Inc., 2.3.0]
    [C:\Program Files\SiteAdvisor\6009\SiteAdv.dll]  [McAfee, Inc., 2.3.0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\SiteAdvisor\6009\SASubMgr.dll]  [McAfee, Inc., 2,3,6009,0]
    [C:\Program Files\360\360Safe\safemon\safemon.dll]  [360.CN, 5, 0, 0, 1007]
    [C:\Program Files\SiteAdvisor\6009\saLang.dll]  [McAfee, Inc., 2.1.1.43]
[PID: 2040 / Administrator][C:\Program Files\McAfee.com\Agent\mcagent.exe]  [McAfee, Inc., 8,0,237,0]
    [C:\PROGRA~1\McAfee\MSC\McRes.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McLocRes.dll]  [McAfee, Inc., 8,1,153,0]
    [C:\Program Files\McAfee\MSC\oem\550-2\Mccobres.dll]  [McAfee, Inc., 7,2,142,0]
    [C:\PROGRA~1\McAfee\MSC\Mccobres.dll]  [McAfee, Inc., 8,1,165,0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\PROGRA~1\mcafee\msc\mcsubmgr\8_1_13~1\mcsubmgr.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\mcafee\msc\mcregobj\8_0_22~1\mcregobj.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\msc\mcmispps.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee.com\agent\mcagntps.dll]  [McAfee, Inc., 8,0,226,0]
    [c:\PROGRA~1\mcafee\msc\mccfgpv.dll]  [McAfee, Inc., 8,1,133,0]
    [C:\WINDOWS\ObjectDock\DockShellHook.dll]  [N/A, ]
    [C:\Program Files\360\360Safe\safemon\safemon.dll]  [360.CN, 5, 0, 0, 1007]
    [c:\PROGRA~1\mcafee\msc\mcuicfg.dll]  [McAfee, Inc., 8,0,226,0]
[PID: 164 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 200 / SYSTEM][c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe]  [McAfee, Inc., 2,0,150,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\escnplug.dll]  [McAfee, Inc., 12,1,109,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\EsPlgRes.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll]  [McAfee, Inc., 12,1,118,0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\PROGRA~1\mcafee\msc\mcsubmgr\8_1_13~1\mcsubmgr.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [C:\Program Files\McAfee\VirusScan\mvslog.dll]  [McAfee, Inc., 12,0,172,0]
[PID: 232 / Administrator][C:\WINDOWS\ObjectDock\objectdock.exe]  [Stardock, v1.90.534u]
    [C:\WINDOWS\ObjectDock\CrashRpt.dll]  [, 3.0.2.2]
    [C:\WINDOWS\ObjectDock\dbghelp.dll]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\ObjectDock\zlib.dll]  [, 1.1.3]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\ObjectDock\ODImg.dll]  [N/A, ]
    [C:\Program Files\360\360Safe\safemon\safemon.dll]  [360.CN, 5, 0, 0, 1007]
    [C:\WINDOWS\ObjectDock\DockShellHook.dll]  [N/A, ]
[PID: 328 / SYSTEM][C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\LockDown.dll]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mytilus3.dll]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mytilus3_worker.dll]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mytilus3_server.dll]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\RES00\McShield.dll]  [McAfee, Inc., VSCORE.14.0.0.349]
    [C:\PROGRA~1\McAfee\VIRUSS~1\FTL.Dll]  [McAfee, Inc., VSCORE.14.0.0.349.x86]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\McAfee\VIRUSS~1\naiann.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mcvsps.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\naiannps.dll]  [McAfee, Inc., 12,0,188,0]
    [c:\PROGRA~1\mcafee\VIRUSS~1\mvscfg.dll]  [McAfee, Inc., 12,1,118,0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll]  [McAfee, Inc., 3,0,115,0]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mvslog.dll]  [McAfee, Inc., 12,0,172,0]
    [C:\Program Files\McAfee\VirusScan\Engine\5301.4018\mcscan32.dll]  [McAfee, Inc., 5.3.00]
    [C:\Program Files\McAfee\VirusScan\Engine\5301.4018\mc5300up.001]  [McAfee, Inc., 5.3.00]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mfebopa.dll]  [McAfee, Inc., SYSCORE.14.0.0.291.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mfehida.dll]  [McAfee, Inc., SYSCORE.14.0.0.291.x86]
    [C:\PROGRA~1\McAfee\VIRUSS~1\mfeavfa.dll]  [McAfee, Inc., SYSCORE.14.0.0.291.x86]
    [c:\PROGRA~1\mcafee\msc\mcmispps.dll]  [McAfee, Inc., 8,0,226,0]
[PID: 528 / SYSTEM][C:\Program Files\McAfee\MPF\MPFSrv.exe]  [McAfee, Inc., 9.0.136.0]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\PROGRA~1\COMMON~1\mcafee\HACKER~1\hwapi.dll]  [McAfee, Inc., 9.0.119.0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mcevtbrk.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\mpf\mc\mpfmisp.dll]  [McAfee, Inc., 9.0.136.0]
    [c:\PROGRA~1\mcafee\msc\mcmispps.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McRes.dll]  [McAfee, Inc., 8,0,226,0]
    [C:\PROGRA~1\McAfee\MSC\McLocRes.dll]  [McAfee, Inc., 8,1,153,0]
    [C:\Program Files\McAfee\MSC\oem\550-2\Mccobres.dll]  [McAfee, Inc., 7,2,142,0]
    [C:\PROGRA~1\McAfee\MSC\Mccobres.dll]  [McAfee, Inc., 8,1,165,0]
    [C:\Program Files\McAfee\MPF\L10N.DLL]  [McAfee, Inc., 9.1.108.0]
    [c:\PROGRA~1\COMMON~1\mcafee\core\mccoreps.dll]  [McAfee, Inc., 3,0,115,0]
    [c:\PROGRA~1\mcafee\msc\mccfgpv.dll]  [McAfee, Inc., 8,1,133,0]
    [c:\PROGRA~1\mcafee\mpf\mc\mpfaltps.dll]  [McAfee, Inc., 9.0.136.0]
[PID: 984 / SYSTEM][C:\Program Files\SiteAdvisor\6009\SAService.exe]  [McAfee, Inc., 1, 0, 0, 1]
    [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
gototop
 

回复:我中病毒了,请求帮助谢谢!瑞星 avg7.5 卡巴斯基2009都杀不了的病毒用什么软件杀

从日志看装的是麦咖啡啊,

把杀不掉的病毒样本以附件上传。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT