电脑中了,无法删除,连中毒的文件C:\windows\system32\dllhost32.dll也找不到. 请各位高手帮帮忙.谢谢了! 我用的是Norton,下载了木马专杀可也还是杀不掉.

【回复“鸟儿天上飞”的帖子】

请帮忙分析一下,现在总是不停的跳出一些网页.没法上网了.

[CODE]

2007-01-12,20:14:54

System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <SlowDownCPU><C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe>  []
    <VTTrayp><VTtrayp.exe>  [(Verified)S3 Graphics Co., Ltd.]
    <VTTimer><VTTimer.exe>  [(Verified)S3 Graphics, Inc.]
    <RemoteControl><"C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe">  [Cyberlink Corp.]
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <ccApp><C:\Program Files\Common Files\Symantec Shared\ccApp.exe>  [(Verified)Symantec Corporation]
    <ccRegVfy><C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe>  [(Verified)Symantec Corporation]
    <Symantec NetDriver Monitor><C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer>  [(Verified)Symantec Corporation]
    <PCSuiteTrayApplication><C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup>  [Nokia]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
    <sdafdsafds><D;]XJOEPXT]ufnq]te264/fyf>  [N/A]
    <dfsf><RUNDLL32.EXE C:\WINDOWS\system\Mvvp.dll,DImmcv>  [N/A]
    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <CPushSetup><"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Common Files\CPUSH\cpush.dll">  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070109.dll start>  [N/A]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WebSecurity><C:\WINDOWS\system32\PvSec.dll>  [N/A]

==================================
启动文件夹
[Adobe Reader Speed Launch]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>

==================================
服务
[22B3A410 / 22B3A410][Stopped/Auto Start]
  <C:\WINDOWS\system32\22B3A410.EXE -service><Microsoft Corporation>
[Routing Protect Access / BRGNS][Stopped/Auto Start]
  <C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\BUXVS.DLL,Export 1087><N/A>
[C94C9114 / C94C9114][Stopped/Auto Start]
  <C:\WINDOWS\system32\C94C9114.EXE -service><Microsoft Corporation>
[Symantec Event Manager / ccEvtMgr][Running/Auto Start]
  <"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"><Symantec Corporation>
[Symantec Password Validation Service / ccPwdSvc][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"><Symantec Corporation>
[Event Service / ClipArt][Running/Auto Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\mdlvm.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Kodak Camera Connection Software / KodakCCS][Stopped/Manual Start]
  <C:\WINDOWS\system32\drivers\KodakCCS.exe><Eastman Kodak Company>
[Norton AntiVirus 自动防护服务 / navapsvc][Running/Auto Start]
  <C:\Program Files\Norton AntiVirus\navapsvc.exe><Symantec Corporation>
[RestoreServices / RestoreServices][Running/Auto Start]
  <C:\WINDOWS\system32\Svchost.exe -k RestoreServices-->C:\WINDOWS\system32\drivers\restore.dll><Microsoft Corporation All rights reserved>
[Remote Procedure Call System(11RPCS) / RpcS11][Running/Auto Start]
  <C:\WINDOWS\system32\Rpcs11.exe><Microsoft Corporation>
[ScriptBlocking Service / SBService][Stopped/Auto Start]
  <C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe><Symantec Corporation>
[ServiceLayer / ServiceLayer][Running/Manual Start]
  <"C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe"><Nokia.>
[Symantec Network Drivers Service / SNDSrvc][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"><Symantec Corporation>
[SymWMI Service / SymWSC][Running/Auto Start]
  <"C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe"><Symantec Corporation>
[uuu.eeewl.com / uuu.eeewl.com][Stopped/Auto Start]
  <C:\WINDOWS\system32\nsvce32.exe><N/A>

==================================
驱动程序
[5975656 / 5975656][Stopped/Boot Start]
  <\SystemRoot\System32\drivers\5975656.sys><N/A>
[AMD Processor Driver / AmdK8][Running/System Start]
  <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[bjbjfgfc / bjbjfgfc][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\bjbjfgfc.sys><N/A>
[Kodak Camera Proxy / DcCam][Running/System Start]
  <system32\DRIVERS\DcCam.sys><Eastman Kodak Company>
[DcFpoint / DcFpoint][Stopped/Manual Start]
  <system32\DRIVERS\DcFpoint.sys><Eastman Kodak Company>
[Kodak DCFS2K Driver / DCFS2K][Running/Auto Start]
  <system32\drivers\dcfs2k.sys><Eastman Kodak Company>
[Legacy Polling Service / DcLps][Stopped/Manual Start]
  <system32\DRIVERS\DcLps.sys><Eastman Kodak Company>
[DcPTP / DcPTP][Stopped/Manual Start]
  <system32\DRIVERS\DcPTP.sys><Eastman Kodak Company>
[eeoq / eeoqr][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\eeoqr.sys><N/A>
[Exportit / Exportit][Stopped/System Start]
  <system32\DRIVERS\exportit.sys><Eastman Kodak Company>
[VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS][Stopped/Manual Start]
  <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.>
[VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB][Running/Manual Start]
  <system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.>
[USB Serial Converter Driver / FTDIBUS][Stopped/Manual Start]
  <system32\drivers\ftdibus.sys><FTDI Ltd.>
[USB Serial Port Driver / FTSER2K][Stopped/Manual Start]
  <system32\drivers\ftser2k.sys><FTDI Ltd.>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\F:\INSTALL\GMSIPCI.SYS><N/A>
[msqmx / msqmx][Running/Boot Start]
  <\SystemRoot\system32\drivers\msqmx.sys><Microsoft Corporation>
[NAVENG / NAVENG][Running/Manual Start]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070110.032\NAVENG.Sys><Symantec Corporation>
[NAVEX15 / NAVEX15][Running/Manual Start]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070110.032\NavEx15.Sys><Symantec Corporation>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
  <system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
  <system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
  <system32\drivers\nmwcd.sys><Nokia>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Netac OnlyDisk Disk Driver / OD2kDsk][Stopped/Manual Start]
  <system32\DRIVERS\OD2kDsk.sys><Netac Technology Co., Ltd.>
[Netac OnlyDisk USB Driver / OD2kUSB][Stopped/Manual Start]
  <System32\Drivers\OD2kUSB.sys><Netac Technology Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[PxHelp20 / PxHelp20][Running/Boot Start]
  <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
[RushTopDevice / RushTopDevice][Running/Manual Start]
  <\??\C:\WINDOWS\INF\MSI\SlowDownCPU\RushTop.sys><Your Corporation>
[SAVRT / SAVRT][Running/Manual Start]
  <\??\C:\WINDOWS\system32\Drivers\SAVRT.SYS><Symantec Corporation>
[SAVRTPEL / SAVRTPEL][Running/Auto Start]
  <\??\C:\WINDOWS\system32\Drivers\SAVRTPEL.SYS><Symantec Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SlowDownCPU / SlowDownCPU][Running/Manual Start]
  <\??\C:\WINDOWS\INF\MSI\SlowDownCPU\NTGLM7X.sys><Your Corporation>
[SymEvent / SymEvent][Running/Manual Start]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[SYMREDRV / SYMREDRV][Running/Manual Start]
  <\SystemRoot\System32\Drivers\SYMREDRV.SYS><Symantec Corporation>
[SYMTDI / SYMTDI][Running/System Start]
  <\SystemRoot\System32\Drivers\SYMTDI.SYS><Symantec Corporation>
[VCD VNC Virtual Network Adapter / vcddev][Stopped/Manual Start]
  <system32\DRIVERS\vcdvnic.sys><VNN B.J.>
[viagfx / viagfx][Running/Manual Start]
  <system32\DRIVERS\vtmini.sys><Copyright (C) VIA/S3 Graphics Co, Ltd.>
[ViaIde / ViaIde][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viaide.sys><Microsoft Corporation>
[viamraid / viamraid][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\viamraid.sys><VIA Technologies inc,.ltd>
[Vinyl AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
  <system32\drivers\vinyl97.sys><VIA Technologies, Inc.>
[wfqwhw5 / wfqwhw57][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\wfqwhw57.sys><N/A>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[XBTP01627 Class]
  {4C666711-582C-485c-93BA-33F4DFC19981} <C:\PROGRA~1\soso\soso.dll, IE Toolbar>
[CNavExtBho Class]
  {BDF3E430-B101-42AD-A544-FADC6B084872} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\Msjava.dll, Microsoft Corporation>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Norton AntiVirus]
  {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[soso]
  {F5993947-3A35-4C47-8901-E7FD39C5D386} <C:\Program Files\soso\soso.dll, IE Toolbar>
[Microsoft Office Template and Media Control]
  {02BCC737-B171-4746-94C9-0D8A0B2C0089} <C:\PROGRA~1\MICROS~2\OFFICE11\IEAWSDC.DLL, N/A>
[MSTPlayerInstaller Control]
  {045ADB92-9635-45CE-B25B-F19F825B0E39} <C:\WINDOWS\DOWNLO~1\MSTPLA~1.OCX, Liztech Co., Ltd>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Office Update Installation Engine]
  {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[MSN Photo Upload Tool]
  {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation>
[Java Plug-in 1.4.1_01]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll, JavaSoft / Sun Microsystems, Inc.>
[AxSubmitControl Class]
  {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} <C:\WINDOWS\DOWNLO~1\SUBMIT~1.DLL, >
[Office Update Installation Engine]
  {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[Java Plug-in 1.4.1_01]
  {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} <C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll, JavaSoft / Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[Microsoft Office Template and Media Control]
  {02BCC737-B171-4746-94C9-0D8A0B2C0089} <C:\PROGRA~1\MICROS~2\OFFICE11\IEAWSDC.DLL, N/A>
[ActiveMovieControl Object]
  {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[Web Browser Applet Control]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\Msjava.dll, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[RealPlayer RAM Download Handler]
  {2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Norton AntiVirus]
  {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[Microsoft Office Control]
  {4453D895-F2A1-4A38-A285-1EF9BD3F6D5D} <C:\PROGRA~1\MICROS~2\OFFICE11\AUTHZAX.DLL, Microsoft Corporation>
[XBTP01627 Class]
  {4C666711-582C-485C-93BA-33F4DFC19981} <C:\PROGRA~1\soso\soso.dll, IE Toolbar>
[HHCtrl Object]
  {52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Qzone Media Tools]
  {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} <C:\PROGRA~1\Tencent\QQ\VQQPLA~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[]
  {B69003B3-C55E-4B48-836C-BC5946FC3B28} <C:\Program Files\Messenger\msgsc.dll, Microsoft Corporation>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[CNavExtBho Class]
  {BDF3E430-B101-42AD-A544-FADC6B084872} <C:\Program Files\Norton AntiVirus\NavShExt.dll, Symantec Corporation>
[Office Update Installation Engine]
  {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[Adobe Acrobat Control for ActiveX]
  {CA8A9780-280D-11CF-A24D-444553540000} <C:\PROGRA~1\Adobe\ACROBA~1.0\Acrobat\ActiveX\pdf.ocx, Adobe Systems Incorporated>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
  {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
[soso]
  {F5993947-3A35-4C47-8901-E7FD39C5D386} <C:\Program Files\soso\soso.dll, IE Toolbar>
[IEDown Class]
  {F917534D-535B-416B-8E8F-0C04756C31A8} <C:\WINDOWS\system32\GLIEDown2.dll, 联众公司>
[上传到QQ网络硬盘]
  <C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[导出当前页到超星阅览器(&A)]
  <C:\Program Files\SSREADER36\ss_all.htm, N/A>
[导出选中部分到超星阅览器(&S)]
  <C:\Program Files\SSREADER36\ss_select.htm, N/A>

==================================
正在运行的进程
[PID: 556][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 620][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 644][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 696][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 708][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 872][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\dllhost32.dll]  [N/A, N/A]
[PID: 940][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1032][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1080][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1132][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1392][C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe]  [Symantec Corporation, 1.00.37]
    [C:\WINDOWS\system32\ccTrust.dll]  [Symantec Corporation, 1.00.22]
    [C:\WINDOWS\system32\SYMSTORE.dll]  [Symantec Corporation, 4.7.2.15]
    [C:\PROGRA~1\NORTON~1\NAVEvent.dll]  [Symantec Corporation, 9.00.1106]
    [C:\PROGRA~1\COMMON~1\SYMANT~1\ccEvt.dll]  [Symantec Corporation, 1.00.106]
[PID: 1548][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\AdobePDF.dll]  [Adobe Systems Incorporated., 6.0.000]
    [C:\Program Files\Adobe\Acrobat 6.0\Distillr\adistres.dll]  [Adobe Systems Incorporated., 6.0.0.2003040700]
[PID: 1160][C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe]  [, 1, 1, 0, 1]
    [C:\WINDOWS\INF\MSI\SlowDownCPU\GLM7X.dll]  [MICRO-STAR INT'L CO., LTD., 3, 0, 0, 0]
    [C:\WINDOWS\INF\MSI\SlowDownCPU\RushTop.dll]  [N/A, N/A]
[PID: 1176][C:\WINDOWS\system32\VTtrayp.exe]  [S3 Graphics Co., Ltd., 2.00.24-0621]
    [C:\WINDOWS\system32\VTDisply.dll]  [S3 Graphics Co., Ltd., 2.00.40-0923B]
    [C:\WINDOWS\system32\VTGamma2.dll]  [S3 Graphics Co., Ltd., 2.00.14-0706]
    [C:\WINDOWS\system32\VTInfo2.dll]  [S3 Graphics Co., Ltd., 2.00.16-0729B]
    [C:\WINDOWS\system32\VTOvrlay.dll]  [S3 Graphics Co., Ltd., 2.00.14-0706]
[PID: 1200][C:\WINDOWS\system32\VTTimer.exe]  [S3 Graphics, Inc., 1.04.05-0929]
[PID: 1240][C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe]  [Cyberlink Corp., 5.00.0000]
    [C:\Program Files\CyberLink\Shared Files\CLRCEngine2.dll]  [CyberLink Corp., 3.20.0000]
[PID: 1252][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
[PID: 1072][C:\Program Files\Common Files\Symantec Shared\ccApp.exe]  [Symantec Corporation, 1.00.106]
    [C:\WINDOWS\system32\SYMSTORE.dll]  [Symantec Corporation, 4.7.2.15]
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCEMLPXY.DLL]  [Symantec Corporation, 1.00.106]
    [C:\WINDOWS\system32\SYMREDIR.dll]  [Symantec Corporation, 5.5.1.6]
    [C:\PROGRA~1\COMMON~1\SYMANT~1\ccErrDsp.DLL]  [Symantec Corporation, 1.00.106]
    [C:\PROGRA~1\COMMON~1\SYMANT~1\CCREGMON.DLL]  [Symantec Corporation, 1.00.106]
    [C:\PROGRA~1\COMMON~1\SYMANT~1\ccEvt.DLL]  [Symantec Corporation, 1.00.106]
    [C:\WINDOWS\system32\ccTrust.dll]  [Symantec Corporation, 1.00.22]
    [C:\PROGRA~1\NORTON~1\CCIMSCAN.DLL]  [Symantec Corporation, 9.00.1106]
    [C:\PROGRA~1\NORTON~1\DEFALERT.DLL]  [Symantec Corporation, 9.00.02]
    [C:\PROGRA~1\NORTON~1\NAVAPW32.DLL]  [Symantec Corporation, 9.00.1106]
    [C:\WINDOWS\system32\ccPasswd.DLL]  [Symantec Corporation, 1.00.106]
    [C:\PROGRA~1\NORTON~1\apwutil.dll]  [Symantec Corporation, 9.00.1106]
    [C:\PROGRA~1\NORTON~1\SavRT32.dll]  [Symantec Corporation, 9.0.1.36]
    [C:\Program Files\Norton AntiVirus\apwcmdnt.dll]  [Symantec Corporation, 9.00.1106]
    [C:\Program Files\Norton AntiVirus\NavEmail.dll]  [Symantec Corporation, 9.00.1106]
[PID: 1316][C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE]  [Nokia, 6, 81, 61, 4]
    [C:\WINDOWS\system32\ConnAPI.DLL]  [Nokia., 6, 81, 62, 0]
    [C:\PROGRA~1\Nokia\NOKIAP~1\PCSCM.dll]  [Nokia, 6, 81, 68, 0]
    [C:\Program Files\Common Files\PCSuite\ConfServer\ConfServer.dll]  [Nokia, 6, 81, 26, 0]
    [C:\PROGRA~1\Nokia\NOKIAP~1\Lang\LaunchApplication_chi-sc.NLR]  [Nokia, 6, 81, 60, 0]
[PID: 1488][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1892][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1984][C:\Program Files\Norton AntiVirus\navapsvc.exe]  [Symantec Corporation, 9.00.1106]
    [C:\Program Files\Norton AntiVirus\SavRT32.dll]  [Symantec Corporation, 9.0.1.36]
[PID: 276][C:\WINDOWS\system32C94C9114.EXEA.exe]  [N/A, N/A]
[PID: 1188][C:\WINDOWS\system32\Svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\windows\system32\drivers\restore.dll]  [Microsoft Corporation All rights reserved, 1, 0, 0, 1]
[PID: 368][C:\WINDOWS\system32\Rpcs11.exe]  [Microsoft Corporation, 5.2.3790.1830]
[PID: 624][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: DNSRV(bld4act)]
[PID: 2096][C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe]  [Symantec Corporation, 2005.1.2.20]
    [C:\Program Files\Common Files\Symantec Shared\Security Center\WSCHlpr.dll]  [Symantec Corporation, 2005.1.2.20]
    [C:\Program Files\Common Files\Symantec Shared\Security Center\sscnav.dll]  [Symantec Corporation, 2005.1.2.20]
    [C:\Program Files\Common Files\Symantec Shared\Security Center\sscnis7.dll]  [Symantec Corporation, 2005.1.2.20]
    [C:\Program Files\Common Files\Symantec Shared\Security Center\sscnis56.dll]  [Symantec Corporation, 2005.1.2.20]
    [C:\Program Files\Norton AntiVirus\navapscr.dll]  [Symantec Corporation, 9.00.1106]
    [C:\WINDOWS\system32\ccTrust.dll]  [Symantec Corporation, 1.00.22]
    [C:\Program Files\Norton AntiVirus\NAVError.dll]  [, 1, 0, 0, 1]
    [C:\PROGRA~1\NORTON~1\NAVOpts.dll]  [Symantec Corporation, 9.00.02]
    [C:\PROGRA~1\NORTON~1\N32Exclu.dll]  [Symantec Corporation, 9.00.1106]
    [C:\PROGRA~1\NORTON~1\S32NAVO.DLL]  [Symantec Corporation, 5.3.0.182]
    [C:\PROGRA~1\NORTON~1\SavRT32.dll]  [Symantec Corporation, 9.0.1.36]
    [C:\Program Files\Symantec\LiveUpdate\NetDetectController.DLL]  [Symantec Corporation, 1.80.19.0]
[PID: 2332][C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe]  [Nokia., 6, 81, 60, 0]
    [C:\WINDOWS\system32\NclTools.dll]  [Nokia., 6, 81, 21, 1]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLIrDAMM.dll]  [Nokia Corp., 6, 81, 27, 0]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLRSMM.dll]  [Nokia, 6, 81, 34, 1]
    [C:\Program Files\Common Files\PCSuite\Transports\NCLUSBMM.dll]  [Nokia, 6, 81, 39, 1]
    [C:\Program Files\Common Files\PCSuite\Transports\NclMSBTMM.dll]  [Nokia., 6, 81, 40, 2]
[PID: 2948][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3112][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3636][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 3832][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3852][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 252][C:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\Rp11cs.dll]  [N/A, N/A]
[PID: 464][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.0.2003040700]
    [C:\Program Files\Norton AntiVirus\NavShExt.dll]  [Symantec Corporation, 9.00.02]
    [C:\WINDOWS\system32\ccTrust.dll]  [Symantec Corporation, 1.00.22]
    [C:\WINDOWS\system32\winsys32_070109.dll]  [N/A, N/A]
    [C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll]  [Symantec Corporation, 1, 1, 0, 126]
    [C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll]  [Symantec Corporation, 1, 1, 0, 126]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
[PID: 2060][C:\WINDOWS\system32C94C9114.EXEA.exe]  [N/A, N/A]
    [C:\Program Files\MSN Messenger\msncore32.dll]  [, 1, 0, 0, 1]
[PID: 2800][C:\Documents and Settings\cui jian\桌面\新建文件夹 (2)\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[autorun]
open=d:\mplay.com

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================


[/CODE]

【回复“鸟儿天上飞”的帖子】

多谢帮忙!先去试试.病毒真太多了,实在不行只有重新装系统了.

谢谢!