1   1  /  1  页   跳转

求助:系统无法进入桌面!

求助:系统无法进入桌面!

输入用户名密码后,不能进入桌面,状态栏眼看着闪了一下,之后就是只显示墙纸。无桌面图标。
怀疑是病毒,杀了,不知道杀没杀完,还是不行。
冰刃不能启动,提示不能打开空白文档。英文的。

日志太大,发部分
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NvMediaCenter><; RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <SoundMan><SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <HWT Socket Server><C:\Program Files\HWT\RIS\Network\Server\ScktSvr\HWT Socket Server.exe>  [Borland Software Corporation]
    <StatusClient><; rem C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto>  [N/A]
    <TomcatStartup><; C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe>  [Hewlett-Packard]
    <SerUp><; C:\Program Files\HWT\RIS\Network\Server\SerUp.exe>  [北京瀚潍特科技有限公司]
    <MSConfig><; C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)]
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <helper.dll><; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>  []
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)]
    <KVMON><; "D:\Jiangmin\AntiVirus\KVMonXP.kxp">  [Jiangmin Co.Ltd]
    <KvMonXP><; "D:\KV2006\KVMonXP.kxp" /auto>  [N/A]
    <NeroFilterCheck><; C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe>  [Nero AG]
    <NetService><; rem C:\WINDOWS\system32\ntsvc.exe>  [N/A]
    <nwiz><; nwiz.exe /install>  []
    <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [N/A]
    <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [N/A]
    <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
    <stup.exe><; C:\PROGRA~1\TENCENT\Adplus\stup.exe>  [Tencent]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <yassistse><; C:\Program Files\Yahoo!\Assistant\yAssistSe.exe>  [Yahoo! China]
    <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [Yahoo! China]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)]
    <Userinit><c:\windows\system32\userinit.exe,>  [(Verified)]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [(Verified)]

==================================
启动文件夹
N/A

==================================
服务
[COM+ System Application / COMSysApp][Stopped/Manual Start]
  <C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[IIS Admin / IISADMIN][Stopped/Auto Start]
  <C:\WINDOWS\system32\inetsrv\inetinfo.exe><N/A>
[MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
  <C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
[Windows User Mode Driver Framework / UMWdf][Stopped/Auto Start]
  <C:\WINDOWS\system32\wdfmgr.exe><Microsoft Corporation>

==================================
驱动程序
[a320raid / a320raid][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\a320raid.sys><Adaptec, Inc.>
[AAC / AAC][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AAC.SYS><Adaptec, Inc.>
[aar1210 / aar1210][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aar1210.sys><Adaptec, Inc.>
[abp480n5 / abp480n5][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\abp480n5.sys><Microsoft Corporation>
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Stopped/Manual Start]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[ADProt / ADProt][Stopped/System Start]
  <\SystemRoot\system32\drivers\ADProt.sys><腾讯科技(深圳)有限公司>
[adpu160m / adpu160m][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\adpu160m.sys><Microsoft Corporation>
[adpu320 / adpu320][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\adpu320.sys><Adaptec, Inc.>
[ACARD AEC6210UF UltraDMA33 Controller / aec6210][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6210.sys><ACARD Technology Corp.>
[ACARD AEC6260 UltraDMA-66 Controller / aec6260][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6260.sys><ACARD Technology Corp.>
[aec6280 / aec6280][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec6280.sys><ACARD Technology Corp.>
[AEC6290 / AEC6290][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6290.SYS><ACARD Technology Corp.>
[AEC67160 / AEC67160][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC67160.SYS><ACARD Technology Corp.>
[AEC671X / AEC671X][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC671X.SYS><ACARD Technology Corp.>
[AEC6880 / AEC6880][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6880.SYS><ACARD Technology Corp.>
[AEC6890 / AEC6890][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\AEC6890.sys><ACARD Technology Corp.>
[aec68x5 / aec68x5][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aec68x5.sys><ACARD Technology Corp.>
[Aha154x / Aha154x][Stopped/Boot Start]
  <\SystemRoot\System32\DRIVERS\aha154x.sys><Microsoft Corporation>
[aic78u2 / aic78u2][Stopped/Boot Start]
最后编辑2007-05-22 08:47:21
分享到:
gototop
 

==================================
API HOOK
入口点错误:NtCreateFile (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x7FF922F2)
入口点错误:NtCreateProcess (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x7FF92346)
入口点错误:NtCreateProcessEx (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x7FF92353)
入口点错误:ZwCreateFile (危险等级: 高,  被下面模块所HOOK: Dest Addr: 0x7FF922F2)
入口点错误:ZwCreateProcess (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x7FF92346)
入口点错误:ZwCreateProcessEx (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x7FF92353)
入口点错误:ZwOpenFile (危险等级: 一般,  被下面模块所HOOK: Dest Addr: 0x7FF9233F)

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

大家都来看看,怎么回事哦。谢谢各位了。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT