瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 紧急求助!!c:\windows.dll和c:\windowskey.dll杀不掉啊!!

1   1  /  1  页   跳转

紧急求助!!c:\windows.dll和c:\windowskey.dll杀不掉啊!!

紧急求助!!c:\windows.dll和c:\windowskey.dll杀不掉啊!!

紧急求教各位大侠:我的卡巴发现c:\windows.dll和c:\windowskey.dll,在安全模式下杀掉了,但是重启电脑又有了!!!!怎么都弄不掉啊!!!!
最后编辑2006-09-03 16:45:42
分享到:
gototop
 

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
    <KavPFW><"C:\KAV2006\KPFW32.EXE">  [Kingsoft Corporation]
    <e2bf698e3dd45f5e44365f33f80239c8><; "d:\勇芳软件\QQ游戏记牌器大集合\wpsdls.8824.42.exe" -t 8824.42>  []
    <MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>  [Microsoft Corporation]
    <SDO2005><; C:\Program Files\盛大圈圈\SDOLauncher.exe -s"-s 3">  [上海盛大网络发展有限公司]
    <Xplus><; "C:\Program Files\Xplus\Xplus_Wait.exe" /min>  []
    <Xplus_spy><; "C:\Program Files\Xplus\xvcclip.exe" /min>  []
    <xvcclip><; C:\Program Files\Xplus\xvcclip.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <KavStart><"C:\KAV2006\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <51高级上传组件><; C:\Program Files\51.com\51UpdateManager.exe>  []
    <AddrPlus3><; C:\PROGRA~1\TENCENT\AdPlus\Runner.exe C:\PROGRA~1\TENCENT\AdPlus\SSAddr.dll Rundll32>  []
    <ADShow><; >  []
    <BCUpdate><; >  []
    <BigDogPath><; C:\WINDOWS\VM_STI.EXE HYUNDAI PC Camera>  []
    <hp 1000 firmware><; d:\Program Files\hp LaserJet 1000\fwdl.exe>  [Zenographics]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [Microsoft Corporation]
    <KAVPersonal50><; "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize>  []
    <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>  []
    <KnightIII><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <mscfs><; RUNDLL32 C:\WINDOWS\system32\msibm\cfsys.dll,cfs>  []
    <MsmqIntCert><; regsvr32 /s mqrt.dll>  []
    <NTdhcp><; C:\WINDOWS\system32\NTdhcp.exe>  []
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <res><; C:\WINDOWS\system32\res.exe>  []
    <RichMedia><; C:\WINDOWS\system32\Rundll32.exe  "C:\WINDOWS\DOWNLO~1\hbhelper.dll",WaitWindows>  []
    <S3Hotkey><; s3hotkey.exe>  [S3 Graphics, Inc.]
    <S3TRAY2><; S3Tray2.exe>  [S3 Graphics, Inc.]
    <Sayhi><; >  []
    <seekmo><; "c:\program files\seekmo\seekmo.exe">  []
    <spoolsv><; >  []
    <SunJavaUpdateSched><; C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe>  [Sun Microsystems, Inc.]
    <Super Rabbit SRRestore><; D:\PROGRA~1\SUPERR~1\MAGICSET\SRRest.exe /FIRST>  [Super Rabbit Soft]
    <Thunder><; "D:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s>  [Thunder Networking Technologies,LTD]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <Update><; C:\Program Files\Common Files\UPDAT\Update.exe>  []
    <WebThunder><; D:\Program Files\Thunder Network\WebThunder\WebThunder.exe>  [深圳市迅雷网络技术有限公司]
    <YOKAssiant><; Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant>  []
    <迅雷4><; >  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
gototop
 

启动文件夹
服务
[Autodesk Licensing Service / Autodesk Licensing Service]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[C-DillaSrv / C-DillaSrv]
  <C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE><C-Dilla Ltd>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"C:\KAV2006\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
  <C:\KAV2006\KWatch.EXE><Kingsoft Corporation>
[Macromedia Licensing Service / Macromedia Licensing Service]
  <"C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe"><N/A>
[Routing and Remote Acces / RemoteAcces]
  <C:\WINDOWS\WMI><N/A>
gototop
 

正在运行的进程
[PID: 392][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 448][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 472][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
[PID: 516][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 528][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 688][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 748][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 840][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 948][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1000][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1156][C:\KAV2006\KWatch.EXE]  <Kingsoft Corporation><2005, 9, 27, 51>
    [C:\KAV2006\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\KAV2006\KAEPlat.DLL]  <Kingsoft Corp.><2006, 5, 30, 59>
    [C:\KAV2006\KAEMem.DAT]  <Kingsoft><2006, 5, 17, 14>
    [C:\KAV2006\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 7, 27, 59>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
[PID: 1216][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
    [C:\WINDOWS\system32\ZLMhp1.DLL]  <Zenographics><5, 51, 1203, 0>
    [C:\WINDOWS\system32\ZLM.dll]  <Zenographics, Inc.><5, 50, 1416, 0>
    [C:\WINDOWS\system32\ZPJL.dll]  <Zenographics, Inc.><1, 0, 1410, 1>
    [C:\WINDOWS\system32\ZSPOOL.dll]  <Zenographics, Inc.><5, 51, 709, 0>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\IMFPrint.DLL]  <Zenographics, Inc.><5, 50, 1606, 0>
    [C:\WINDOWS\system32\Imf32.dll]  <Zenographics, Inc.><5, 51, 405, 0>
    [C:\WINDOWS\system32\ZTAG32.dll]  <Zenographics, Inc.><5, 50, 1725, 0>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\ZPPPCL.DLL]  <Zenographics, Inc.><5, 51, 710, 0>
    [C:\WINDOWS\system32\ZPP.dll]  <Zenographics, Inc.><5, 51, 709, 0>
    [C:\WINDOWS\system32\ZGDI32.dll]  <Zenographics, Inc.><5, 51, 628, 0>
[PID: 1344][C:\WINDOWS\system32\msdtc.exe]  <Microsoft Corporation><2001.12.4414.258>
[PID: 1416][C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE]  <C-Dilla Ltd><3.24.010>
[PID: 1448][C:\WINDOWS\system32\inetsrv\inetinfo.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1464][C:\KAV2006\KPfwSvc.EXE]  <Kingsoft Corporation><2005, 9, 5, 28>
[PID: 1584][C:\WINDOWS\System32\snmp.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1600][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1636][C:\WINDOWS\system32\wdfmgr.exe]  <Microsoft Corporation><5.2.3790.1230 built by: dnsrv(bld4act)>
[PID: 1780][C:\WINDOWS\system32\mqsvc.exe]  <Microsoft Corporation><5.01.1108>
[PID: 220][C:\WINDOWS\system32\mqtgsvc.exe]  <Microsoft Corporation><5.01.1108>
[PID: 1100][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 352][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  <Autodesk><16.1.63.0>
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
    [C:\KAV2006\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\KAV2006\KMailOEBand.dll]  <N/A><2006, 5, 19, 118>
    [d:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_013.dll]  <Thunder Networking Technologies,LTD><6, 0, 0, 4>
[PID: 360][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
    [C:\KAV2006\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
[PID: 1544][C:\KAV2006\KAVStart.exe]  <Kingsoft Corporation><2006, 8, 28, 204>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
[PID: 980][C:\KAV2006\KPFW32.EXE]  <Kingsoft Corporation><2006, 8, 9, 615>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
[PID: 784][C:\KAV2006\KMailMon.EXE]  <Kingsoft Corporation><2006, 4, 12, 106>
    [C:\WINDOWSKey.DLL]  <N/A><N/A
[PID: 404][D:\Program Files\Tencent\qq\QQ.exe]  <TENCENT><0, 0, 0, 0>
    [C:\WINDOWSKey.DLL]  <N/A><N/A
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
    [C:\WINDOWS\system32\msdmo.dll]  <N/A><N/A>
    [C:\WINDOWS\system32\l3codeca.acm]  <Fraunhofer Institut Integrierte Schaltungen IIS><1, 9, 0, 0305>
[PID: 248][D:\Program Files\Tencent\qq\TIMPlatform.exe]  <tencent><0, 3, 1, 8>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
[PID: 3456][D:\MYIE2\MYIE2\MyIE.exe]  <MY Soft Technology><0, 9, 26, 30>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [D:\MYIE2\MYIE2\Plugin\ViewSource\ViewSrc.dll]  <><1, 0, 0, 1>
    [D:\MYIE2\MYIE2\Services\RealTime\real_time.dll]  <><1, 0, 0, 1>
    [C:\KAV2006\KAScript.DLL]  <Kingsoft Corporation><2006, 2, 10, 60>
    [C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx]  <Macromedia, Inc.><8,0,24,0>
[PID: 2376][D:\sreng2\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\WINDOWSKey.DLL]  <N/A><N/A>
    [C:\WINDOWS\system32\AcSignIcon.dll]  <Autodesk><16.1.63.0>
    [D:\sreng2\SREng2\Plugins\SREngPluginDemo.SRE]  <Smallfrogs Studio><1, 1, 1, 0>
gototop
 

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
gototop
 

删除了重启又会有啊!!!我的C盘是NTFS格式的,DOS命令不支持!!!
gototop
 

只能进带DOS命令的安全模式,不知道该删什么。另我的笔记本光驱坏了。。启动项里面除了杀毒软件和输入法以外其它都没选勾。
gototop
 

不行啊,删除了重启卡巴还是报那两个DLL病毒啊。另外在资源管理器下,显示所有文件,包括系统文件,只能在c盘根目录下看到windowskey.log,那两个dll都看不到。。。。。
gototop
 

高手快来啊!!!急!!!!
gototop
 

这么快就沉下去了啊,55555555555
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT