打印

恳请达人近来看下..超奇怪的问题！

本主题由 shoo 于 2008-7-14 13:41 关闭

江南傻瓜2

维修工人

Rank: 2

UID: 41367
帖子: 4
精华: 0
经验: 5 点
威望: 3 点
维修币: 3 ￥
魅力: 7
阅读权限: 10

1^# 大中小发表于 2008-7-13 19:47 只看该作者

恳请达人近来看下..超奇怪的问题！

今天晚上打开魔兽时出现了奇怪的问题..进去后闪了下便回到了桌面..并且无任何报错...进入E盘的 WAR3文件夹和浩方平台时WINDOWS的此窗口也会自己关掉..闪回桌面...但是把文件夹名改掉后..列如把文件夹WAR3 改成WAR2或者111 222的...就能进去了...估计里面的文件也是如此...但把WAR3.EXE改名后就无法使用了..所以没试过.....后来尝试过把文件夹移到别的盘..或者重新装都不能使用...好象是固定这一文件夹名及里面的所有文件名实行屏蔽一样.......求达人帮忙告知下如何解决.本人这台电脑是DELL笔记本..装的是WINDOWS XP.因为前段时间里面东西太多..所以重装了下....后来没怎么联过网..平时都是放在房间里打打字看看碟的...所以就没更新杀毒软件和防火墙....装的是05版的金山全套....怀疑是防火墙的问题..不过删掉后重启..依然是这样.....希望大家能帮忙分析下是何原因..该如何解决..谢谢..

TOP

shoo

超级版主

Rank: 8 Rank: 8

UID: 33692
帖子: 1221
精华: 1
经验: 11286 点
威望: 564 点
维修币: 20719 ￥
魅力: 2897
阅读权限: 250

2^# 大中小发表于 2008-7-14 08:55 只看该作者

你看下是不是你的电脑里别的EXE文件也有异常问题，比如图标改变、运行不正常等等

我怀疑是被映像劫持了

建议你到我签名档“SREng简单用法”下载SREng最新版本，然后扫个日志贴上来

有中病毒症状的进...（附SREng简要用法）

[原创]流行病*毒专杀以及一些系统优化小工具

如果有电脑维护、病毒清理、论坛管理方面的问题，都可以发消息给我：）

TOP

江南傻瓜2

维修工人

Rank: 2

UID: 41367
帖子: 4
精华: 0
经验: 5 点
威望: 3 点
维修币: 3 ￥
魅力: 7
阅读权限: 10

3^# 大中小发表于 2008-7-14 10:52 只看该作者

感谢斑竹关心..在此将日志贴上..望能告之如何解决..谢谢

复制内容到剪贴板

代码:

2008-07-14,10:47:55



System Repair Engineer 2.6.11.992

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Component Publisher]

    <wsctf.exe><wsctf.exe>  [N/A]

    <EXPLORER.EXE><EXPLORER.EXE>  [Microsoft Corporation]

[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <load><>  [N/A]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Component Publisher]

    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Component Publisher]

    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Component Publisher]

    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <nwiz><nwiz.exe /installquiet>  []

    <NVHotkey><rundll32.exe nvHotkey.dll,Start>  [NVIDIA Corporation]

    <SigmatelSysTrayApp><stsystra.exe>  [SigmaTel, Inc.]

    

<C:\WINDOWS\system32\WLTRAY.exe>  [Dell Inc.]

    <BIE><Rundll32 C:\WINDOWS\DOWNLO~1\BDPlugin.dll,Rundll32>  []

    <runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup>  [Beijing Rising Technology Co., Ltd.]

    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]

    <KuGoo3><D:\Program Files\KuGoo3\KuGoo.exe>  []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [Microsoft Corporation]

    <Userinit><userinit.exe,EXPLORER.EXE>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <AppInit_DLLs><ieprot.dll>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

    <{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><C:\WINDOWS\DOWNLO~1\BDPlugin.dll>  []

    <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]

    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]

    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]



==================================

启动文件夹

[腾讯QQ]

  <C:\Documents and Settings\zcd\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\安装\QQ.exe [TENCENT]><N>



==================================

服务

[Contrl Center of Storm Media / ccosm][Running/Auto Start]

  <D:\安装\stormliv.exe /asservice><北京暴风网际科技有限公司>

[Google Updater Service / gusvc][Stopped/Manual Start]

  <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]

  <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>

[Kingsoft Personal Firewall Service / KPfwSvc][Stopped/Auto Start]

  <"C:\KAV2005\KPfwSvc.EXE"><(File is missing)>

[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]

  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

[ODBC Administration Service / odbcasvc][Running/Auto Start]

  <C:\WINDOWS\SYSTEM32\odbcasvc.EXE><Microsoft Corporation>

[PnkBstrA / PnkBstrA][Running/Auto Start]

  <C:\WINDOWS\system32\PnkBstrA.exe><N/A>

[Dell Wireless WLAN Tray Service / wltrysvc][Running/Auto Start]

  <C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe><N/A>



==================================

驱动程序

[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]

  <system32\DRIVERS\b57xp32.sys>



[DELL 无线网卡驱动程序 / BCM43XX][Running/Manual Start]

  <system32\DRIVERS\bcmwl5.sys>



[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]

  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>

[HSF_DPV / HSF_DPV][Running/Manual Start]

  <system32\DRIVERS\HSX_DPV.sys><Conexant Systems, Inc.>

[HSXHWAZL / HSXHWAZL][Running/Manual Start]

  <system32\DRIVERS\HSXHWAZL.sys><Conexant Systems, Inc.>

[mdmxsdk / mdmxsdk][Running/Auto Start]

  <system32\DRIVERS\mdmxsdk.sys><Conexant>

[npkcrypt / npkcrypt][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\npkcrypt.sys><N/A>

[npkycryp / npkycryp][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\npkycryp.sys><N/A>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[NWADI Bus Enumerator / NWADI][Running/Manual Start]

  <system32\DRIVERS\NWADIenum.sys><Novatel Wireless Inc>

[OMCI / OMCI][Running/System Start]

  <\SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS><Dell Computer Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]

  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[SigmaTel High Definition Audio CODEC / STHDA][Running/Manual Start]

  <system32\drivers\sthda.sys><SigmaTel, Inc.>

[TesSafe / TesSafe][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>

[Conexant Setup API / UIUSys][Stopped/Manual Start]

  <system32\DRIVERS\UIUSYS.SYS><N/A>

[winachsf / winachsf][Running/Manual Start]

  <system32\DRIVERS\HSX_CNXT.sys><Conexant Systems, Inc.>



==================================

浏览器加载项

[ThunderAtOnce Class]

  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <E:\ciba\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[FG2CatchUrl]

  {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[RealPlayer Download and Record Plugin for Internet Explorer]

  {3049C3E9-B461-4BC5-8870-4C09146192CA} <C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll, RealPlayer>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\ciba\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[Google Toolbar Helper]

  {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[Google Toolbar Notifier BHO]

  {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

[BDHlprObj Class]

  {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >

[启动迅雷5]

  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <E:\ciba\Thunder.exe, Thunder Networking Technologies,LTD>

[浩方对战平台]

  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\ww\浩方对战平台\GameClient.exe, N/A>

[]

  {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>

[Messenger]

  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>

[卡卡上网安全助手]

  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>

[&Google]

  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <E:\ciba\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[FG2CatchUrl]

  {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[&Google]

  {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[RealPlayer Download and Record Plugin for Internet Explorer]

  {3049C3E9-B461-4BC5-8870-4C09146192CA} <C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll, RealPlayer>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <E:\ciba\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[XMP Class]

  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users.WINDOWS\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >

[XDRM]

  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users.WINDOWS\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >

[MediaComm Class]

  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <E:\ciba\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\ciba\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[Google Toolbar Helper]

  {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[DapCtrl Class]

  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(301).dll, ShenZhen Thunder Networking Technologies Ltd.>

[Google Toolbar Notifier BHO]

  {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

[BDHlprObj Class]

  {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[卡卡上网安全助手]

  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>

[Thunder DapPlayer]

  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <E:\ciba\Components\DownAndPlay\DapPlayer3.0.5712.71.301.dll, ShenZhen Thunder Networking Technologies Ltd.>

[XPPlayer Class]

  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.177.(301).dll, Thunder>

[FG2CatchUrl]

  {FB5DA724-162B-11D3-8B9B-AA70B4B0B525} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[&使用BitComet下载]

  <res://D:\zcd\BitComet.exe/AddLink.htm, N/A>

[&使用BitComet下载全部链接]

  <res://D:\zcd\BitComet.exe/AddAllLink.htm, N/A>

[&使用BitComet下载本页视频]

  <res://D:\zcd\BitComet.exe/AddVideo.htm, N/A>

[使用快车(Flas&hGet)下载]

  <E:\ciba\FlashGet\ComDlls\Bholink.htm, N/A>

[使用快车(Flash&Get)下载全部链接]

  <E:\ciba\FlashGet\ComDlls\Bhoall.htm, N/A>

[使用迅雷下载]

  <E:\ciba\Program\GetUrl.htm, N/A>

[使用迅雷下载全部链接]

  <E:\ciba\Program\GetAllUrl.htm, N/A>

[添加到QQ表情]

  <D:\安装\AddEmotion.htm, N/A>



==================================

正在运行的进程

[PID: 748 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 820 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 844 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\System32\BCMLogon.dll]  [Broadcom Corporation, 4.10.47.3]

    [C:\WINDOWS\System32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 892 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 904 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1076 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1148 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1192 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 1316 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1348 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1632 / SYSTEM][C:\WINDOWS\System32\WLTRYSVC.EXE]  [N/A, ]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1648 / SYSTEM][C:\WINDOWS\System32\bcmwltry.exe]  [Dell Inc., 4.10.47.3]

    [C:\WINDOWS\System32\bcm1xsup.dll]  [N/A, ]

    [C:\WINDOWS\System32\bcmwlpkt.dll]  [CACE Technologies, 3, 1, 0, 27]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\System32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\atl71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\wltrynt.dll]  [Broadcom Corporation, 4.10.47.3]

[PID: 1700 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1788 / LOCAL SERVICE][C:\WINDOWS\System32\SCardSvr.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1980 / zcd][C:\WINDOWS\system32\EXPLORER.EXE]  [Microsoft Corporation, 6.2900.2180]

    [C:\WINDOWS\system32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9802]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 2016 / zcd][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [E:\ciba\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [E:\ciba\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [E:\ciba\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 20]

    [E:\ciba\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

    [C:\WINDOWS\DOWNLO~1\BDHelper.dll]  [, 1, 0, 0, 5]

    [E:\ciba\rarext.dll]  [N/A, ]

    [C:\WINDOWS\system32\msdmo.dll]  [, ]

    [C:\WINDOWS\system32\l3codeca.acm]  [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]

    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.8313]

[PID: 144 / zcd][C:\WINDOWS\system32\Rundll32.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 468 / zcd][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\system32\nvHotkey.dll]  [NVIDIA Corporation, 6.14.10.8313]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 492 / zcd][C:\WINDOWS\stsystra.exe]  [SigmaTel, Inc., 1.0.4823.0  nd322 cp1]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\stacapi.dll]  [SigmaTel, Inc., 1.0.4823.0  nd322 cp1]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 528 / zcd][C:\WINDOWS\system32\WLTRAY.exe]  [Dell Inc., 4.10.47.3]

    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\atl71.dll]  [Microsoft Corporation, 7.10.3077.0]

[PID: 548 / zcd][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 5.0.0.16]

    [C:\Program Files\Rising\AntiSpyware\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\Program Files\Rising\AntiSpyware\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 568 / zcd][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.1.45]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 648 / zcd][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 908 / SYSTEM][D:\安装\stormliv.exe]  [北京暴风网际科技有限公司, 3, 8, 3, 15]

    [D:\安装\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]

    [D:\安装\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1256 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8313]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1276 / SYSTEM][C:\WINDOWS\SYSTEM32\odbcasvc.EXE]  [Microsoft Corporation, 3.608.0356]

    [C:\WINDOWS\SYSTEM32\MSVBVM60.DLL]  [Microsoft Corporation, 6.00.9802]

    [C:\WINDOWS\SYSTEM32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1404 / SYSTEM][C:\WINDOWS\system32\PnkBstrA.exe]  [N/A, ]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 688 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 2156 / zcd][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2108)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 2688 / NETWORK SERVICE][C:\WINDOWS\system32\wbem\wmiprvse.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2108)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 3032 / zcd][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 3760 / zcd][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 724 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 3352 / SYSTEM][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 3240 / zcd][C:\Documents and Settings\zcd\桌面\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.11.992]

[PID: 3336 / zcd][C:\Documents and Settings\zcd\桌面\SREf702ab16.EXE]  [Smallfrogs Studio, 2.6.11.992]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\Documents and Settings\zcd\桌面\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]



==================================

文件关联

.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  Error. ["hh.exe" %1]

.HLP  Error. [winhlp32.exe %1]

.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

[D:\]

[autorun]

open=.\recycled\info.exe

shell\1=浏览

shell\1\Command=.\recycled\info.exe

shellexecute=.\recycled\info.exe

[E:\]

[autorun]

open=.\recycled\info.exe

shell\1=浏览

shell\1\Command=.\recycled\info.exe

shellexecute=.\recycled\info.exe



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 1648, C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 492, C:\WINDOWS\STSYSTRA.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 528, C:\WINDOWS\SYSTEM32\WLTRAY.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 548, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 3240, C:\DOCUMENTS AND SETTINGS\ZCD\桌面\SRENGLDR.EXE]



==================================

API HOOK

N/A



==================================

隐藏进程

N/A



==================================

TOP

shoo

超级版主

Rank: 8 Rank: 8

UID: 33692
帖子: 1221
精华: 1
经验: 11286 点
威望: 564 点
维修币: 20719 ￥
魅力: 2897
阅读权限: 250

4^# 大中小发表于 2008-7-14 11:26 只看该作者

中了AUTO病毒，先用这里的USBcleaner扫描系统，里头有AUTO专杀，修复注册表，然后用ARSWP2扫描木马

http://bbs.dnwx.com/thread-34636-1-1.html

之后再扫日志上来，我看看查杀情况。

有中病毒症状的进...（附SREng简要用法）

[原创]流行病*毒专杀以及一些系统优化小工具

如果有电脑维护、病毒清理、论坛管理方面的问题，都可以发消息给我：）

TOP

江南傻瓜2

维修工人

Rank: 2

UID: 41367
帖子: 4
精华: 0
经验: 5 点
威望: 3 点
维修币: 3 ￥
魅力: 7
阅读权限: 10

5^# 大中小发表于 2008-7-14 12:39 只看该作者

电脑已恢复正常...正在装最新的杀毒软件...以后不敢大意了...十分感谢斑竹...RP太好了..呵呵

现在的代码...应该没问题了吧?

复制内容到剪贴板

代码:

2008-07-14,12:35:08



System Repair Engineer 2.6.11.992

Smallfrogs (http://www.KZTechs.com)



Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能



以下内容被选中：

    所有的启动项目（包括注册表、启动文件夹、服务等）

    浏览器加载项

    正在运行的进程（包括进程模块信息）

    文件关联

    Winsock 提供者

    Autorun.inf

    HOSTS 文件

    进程特权扫描





启动项目

注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Component Publisher]

    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Component Publisher]

    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Component Publisher]

    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]

    <nwiz><nwiz.exe /installquiet>  []

    <NVHotkey><rundll32.exe nvHotkey.dll,Start>  [NVIDIA Corporation]

    <SigmatelSysTrayApp><stsystra.exe>  [SigmaTel, Inc.]

    

<C:\WINDOWS\system32\WLTRAY.exe>  [Dell Inc.]

    <BIE><Rundll32 C:\WINDOWS\DOWNLO~1\BDPlugin.dll,Rundll32>  []

    <runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup>  [Beijing Rising Technology Co., Ltd.]

    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]

    <KuGoo3><D:\Program Files\KuGoo3\KuGoo.exe>  []

    <USBMON><C:\Documents and Settings\zcd\桌面\USBCleaner6.0\Usbmon.exe -s>  [ZJU S-Zone]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    <KKDelay><C:\Program Files\Rising\AntiSpyware\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]

    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

    <AppInit_DLLs><ieprot.dll>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

    <{BC207F7D-3E63-4ACA-99B5-FB5F8428200C}><C:\WINDOWS\DOWNLO~1\BDPlugin.dll>  []

    <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]

    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]

    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]

    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]



==================================

启动文件夹

[腾讯QQ]

  <C:\Documents and Settings\zcd\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\安装\QQ.exe [TENCENT]><N>



==================================

服务

[Contrl Center of Storm Media / ccosm][Running/Auto Start]

  <D:\安装\stormliv.exe /asservice><北京暴风网际科技有限公司>

[Google Updater Service / gusvc][Stopped/Manual Start]

  <"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>

[Human Interface Device Access / HidServ][Stopped/Disabled]

  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]

  <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>

[Kingsoft Personal Firewall Service / KPfwSvc][Stopped/Auto Start]

  <"C:\KAV2005\KPfwSvc.EXE"><(File is missing)>

[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]

  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>

[PnkBstrA / PnkBstrA][Running/Auto Start]

  <C:\WINDOWS\system32\PnkBstrA.exe><N/A>

[Dell Wireless WLAN Tray Service / wltrysvc][Running/Auto Start]

  <C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe><N/A>



==================================

驱动程序

[Broadcom NetXtreme Gigabit Ethernet / b57w2k][Running/Manual Start]

  <system32\DRIVERS\b57xp32.sys>



[DELL 无线网卡驱动程序 / BCM43XX][Running/Manual Start]

  <system32\DRIVERS\bcmwl5.sys>



[Microsoft 用于 High Definition Audio 的 UAA 总线驱动程序 / HDAudBus][Running/Manual Start]

  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>

[HSF_DPV / HSF_DPV][Running/Manual Start]

  <system32\DRIVERS\HSX_DPV.sys><Conexant Systems, Inc.>

[HSXHWAZL / HSXHWAZL][Running/Manual Start]

  <system32\DRIVERS\HSXHWAZL.sys><Conexant Systems, Inc.>

[mdmxsdk / mdmxsdk][Running/Auto Start]

  <system32\DRIVERS\mdmxsdk.sys><Conexant>

[npkcrypt / npkcrypt][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\npkcrypt.sys><N/A>

[npkycryp / npkycryp][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\npkycryp.sys><N/A>

[nv / nv][Running/Manual Start]

  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

[NWADI Bus Enumerator / NWADI][Running/Manual Start]

  <system32\DRIVERS\NWADIenum.sys><Novatel Wireless Inc>

[OMCI / OMCI][Running/System Start]

  <\SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS><Dell Computer Corporation>

[Direct Parallel Link Driver / Ptilink][Running/Manual Start]

  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]

  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>

[Secdrv / Secdrv][Stopped/Manual Start]

  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

[SigmaTel High Definition Audio CODEC / STHDA][Running/Manual Start]

  <system32\drivers\sthda.sys><SigmaTel, Inc.>

[TesSafe / TesSafe][Stopped/Manual Start]

  <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>

[Conexant Setup API / UIUSys][Stopped/Manual Start]

  <system32\DRIVERS\UIUSYS.SYS><N/A>

[winachsf / winachsf][Running/Manual Start]

  <system32\DRIVERS\HSX_CNXT.sys><Conexant Systems, Inc.>



==================================

浏览器加载项

[ThunderAtOnce Class]

  {01443AEC-0FD1-40fd-9C87-E93D1494C233} <E:\ciba\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[FG2CatchUrl]

  {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[RealPlayer Download and Record Plugin for Internet Explorer]

  {3049C3E9-B461-4BC5-8870-4C09146192CA} <C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll, RealPlayer>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\ciba\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[Google Toolbar Helper]

  {AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[Google Toolbar Notifier BHO]

  {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

[BDHlprObj Class]

  {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >

[启动迅雷5]

  {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <E:\ciba\Thunder.exe, Thunder Networking Technologies,LTD>

[浩方对战平台]

  {0A155D3C-68E2-4215-A47A-E800A446447A} <D:\ww\浩方对战平台\GameClient.exe, N/A>

[]

  {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>

[Messenger]

  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>

[卡卡上网安全助手]

  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>

[&Google]

  {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[ThunderAtOnce Class]

  {01443AEC-0FD1-40FD-9C87-E93D1494C233} <E:\ciba\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>

[FG2CatchUrl]

  {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[&Google]

  {2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[RealPlayer Download and Record Plugin for Internet Explorer]

  {3049C3E9-B461-4BC5-8870-4C09146192CA} <C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll, RealPlayer>

[Thunder Agent Class]

  {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <E:\ciba\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>

[XMP Class]

  {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users.WINDOWS\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >

[XDRM]

  {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users.WINDOWS\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >

[MediaComm Class]

  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <E:\ciba\Components\InMedia\MediaAddin17.dll, Thunder Networking Technologies,LTD>

[Thunder Browser Helper]

  {889D2FEB-5411-4565-8998-1DD2C5261283} <E:\ciba\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>

[Google Toolbar Helper]

  {AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

[DapCtrl Class]

  {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.1.5803.60.(301).dll, ShenZhen Thunder Networking Technologies Ltd.>

[Google Toolbar Notifier BHO]

  {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

[BDHlprObj Class]

  {CA92B524-BC8A-4610-BD2C-6BD3E28155D0} <C:\WINDOWS\DOWNLO~1\BDHelper.dll, >

[Shockwave Flash Object]

  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

[卡卡上网安全助手]

  {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} <C:\WINDOWS\system32\kakatool.dll, Beijing Rising Technology Co., Ltd.>

[Thunder DapPlayer]

  {EEDD6FF9-13DE-496B-9A1C-D78B3215E266} <E:\ciba\Components\DownAndPlay\DapPlayer3.0.5712.71.301.dll, ShenZhen Thunder Networking Technologies Ltd.>

[XPPlayer Class]

  {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.0.0.177.(301).dll, Thunder>

[FG2CatchUrl]

  {FB5DA724-162B-11D3-8B9B-AA70B4B0B525} <E:\ciba\FlashGet\ComDlls\bhoCATCH.dll, FlashGet>

[&使用BitComet下载]

  <res://D:\zcd\BitComet.exe/AddLink.htm, N/A>

[&使用BitComet下载全部链接]

  <res://D:\zcd\BitComet.exe/AddAllLink.htm, N/A>

[&使用BitComet下载本页视频]

  <res://D:\zcd\BitComet.exe/AddVideo.htm, N/A>

[使用快车(Flas&hGet)下载]

  <E:\ciba\FlashGet\ComDlls\Bholink.htm, N/A>

[使用快车(Flash&Get)下载全部链接]

  <E:\ciba\FlashGet\ComDlls\Bhoall.htm, N/A>

[使用迅雷下载]

  <E:\ciba\Program\GetUrl.htm, N/A>

[使用迅雷下载全部链接]

  <E:\ciba\Program\GetAllUrl.htm, N/A>

[添加到QQ表情]

  <D:\安装\AddEmotion.htm, N/A>



==================================

正在运行的进程

[PID: 748 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 820 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 844 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

    [C:\WINDOWS\System32\BCMLogon.dll]  [Broadcom Corporation, 4.10.47.3]

    [C:\WINDOWS\System32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 888 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\AppPatch\AcAdProc.dll]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

[PID: 900 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

[PID: 1068 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 1136 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 1176 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 1296 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 1328 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]

[PID: 1540 / SYSTEM][C:\WINDOWS\System32\WLTRYSVC.EXE]  [N/A, ]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

[PID: 1596 / SYSTEM][C:\WINDOWS\System32\bcmwltry.exe]  [Dell Inc., 4.10.47.3]

    [C:\WINDOWS\System32\bcm1xsup.dll]  [N/A, ]

    [C:\WINDOWS\System32\bcmwlpkt.dll]  [CACE Technologies, 3, 1, 0, 27]

    [C:\WINDOWS\System32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\System32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\atl71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\System32\wltrynt.dll]  [Broadcom Corporation, 4.10.47.3]

[PID: 1672 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]

[PID: 1748 / LOCAL SERVICE][C:\WINDOWS\System32\SCardSvr.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]

[PID: 1932 / zcd][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

    [E:\ciba\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.29]

    [E:\ciba\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 96]

    [E:\ciba\Components\ResWorker\DsBho_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 20]

    [E:\ciba\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 16]

    [C:\WINDOWS\DOWNLO~1\BDHelper.dll]  [, 1, 0, 0, 5]

[PID: 1980 / zcd][C:\WINDOWS\system32\Rundll32.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 276 / zcd][C:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\nvHotkey.dll]  [NVIDIA Corporation, 6.14.10.8313]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 320 / zcd][C:\WINDOWS\stsystra.exe]  [SigmaTel, Inc., 1.0.4823.0  nd322 cp1]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\stacapi.dll]  [SigmaTel, Inc., 1.0.4823.0  nd322 cp1]

    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]

[PID: 340 / zcd][C:\WINDOWS\system32\WLTRAY.exe]  [Dell Inc., 4.10.47.3]

    [C:\WINDOWS\system32\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\atl71.dll]  [Microsoft Corporation, 7.10.3077.0]

[PID: 360 / zcd][C:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 5.0.0.16]

    [C:\Program Files\Rising\AntiSpyware\MFC71.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\Program Files\Rising\AntiSpyware\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]

    [C:\WINDOWS\system32\MFC71CHS.DLL]  [Microsoft Corporation, 7.10.3077.0]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 368 / zcd][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.1.45]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 500 / zcd][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 684 / SYSTEM][D:\安装\stormliv.exe]  [北京暴风网际科技有限公司, 3, 8, 3, 15]

    [D:\安装\MSVCP60.dll]  [Microsoft Corporation, 6.02.3104.0]

    [D:\安装\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 732 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.8313]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 764 / SYSTEM][C:\WINDOWS\system32\PnkBstrA.exe]  [N/A, ]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 1832 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]

    [C:\WINDOWS\System32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

[PID: 2288 / zcd][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2108)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

[PID: 2716 / zcd][C:\Documents and Settings\zcd\桌面\USBCleaner6.0\Usbmon.exe]  [ZJU S-Zone, 4.00.0032]

    [C:\WINDOWS\system32\msvbvm60.dll]  [Microsoft Corporation, 6.00.9802]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\MSCOMCTL.OCX]  [Microsoft Corporation, 6.00.8498]

[PID: 2960 / zcd][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

    [C:\WINDOWS\system32\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 19]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]

[PID: 3652 / zcd][C:\Documents and Settings\zcd\桌面\system repair eng\SREngLdr.EXE]  [Smallfrogs Studio, 2.6.11.992]

[PID: 3660 / zcd][C:\Documents and Settings\zcd\桌面\system repair eng\SREf702ab16.EXE]  [Smallfrogs Studio, 2.6.11.992]

    [C:\WINDOWS\DOWNLO~1\BDPlugin.dll]  [, 1, 0, 1, 1]

    [C:\Documents and Settings\zcd\桌面\system repair eng\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]



==================================

文件关联

.TXT  Error. [C:\WINDOWS\notepad.exe %1]

.EXE  OK. ["%1" %*]

.COM  OK. ["%1" %*]

.PIF  OK. ["%1" %*]

.REG  OK. [regedit.exe "%1"]

.BAT  OK. ["%1" %*]

.SCR  OK. ["%1" /S]

.CHM  Error. ["hh.exe" %1]

.HLP  Error. [winhlp32.exe %1]

.INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]

.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]

.LNK  OK. [{00021401-0000-0000-C000-000000000046}]



==================================

Winsock 提供者

N/A



==================================

Autorun.inf

N/A



==================================

HOSTS 文件

127.0.0.1       localhost



==================================

进程特权扫描

特殊特权被允许： SeLoadDriverPrivilege [PID = 1596, C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 320, C:\WINDOWS\STSYSTRA.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 340, C:\WINDOWS\SYSTEM32\WLTRAY.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 360, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 2716, C:\DOCUMENTS AND SETTINGS\ZCD\桌面\USBCLEANER6.0\USBMON.EXE]

特殊特权被允许： SeLoadDriverPrivilege [PID = 3652, C:\DOCUMENTS AND SETTINGS\ZCD\桌面\SYSTEM REPAIR ENG\SRENGLDR.EXE]



==================================

API HOOK

N/A



==================================

隐藏进程

N/A



==================================

TOP

shoo

超级版主

Rank: 8 Rank: 8

UID: 33692
帖子: 1221
精华: 1
经验: 11286 点
威望: 564 点
维修币: 20719 ￥
魅力: 2897
阅读权限: 250

6^# 大中小发表于 2008-7-14 13:08 只看该作者

AUTO病毒已经删除，不过有个BDHelper.dll进驻了RUNDLL32进程，这个BDHelper.dll是百度搜吧相关的什么东东，你如果安装了百度相关的什么东西，尽量把它卸载了，这个也是个流氓软件。

按你说的，以前一定是在“裸奔”，这种做法不可取哦，如果不希望花钱买杀软，可以用那些免费的知名杀软，但对于对电脑没有十足把握了解的人来说，建议还是不要冒这个险。

PS:你说的那个“RP太好了”是指什么？

有中病毒症状的进...（附SREng简要用法）

[原创]流行病*毒专杀以及一些系统优化小工具

如果有电脑维护、病毒清理、论坛管理方面的问题，都可以发消息给我：）

TOP

江南傻瓜2

维修工人

Rank: 2

UID: 41367
帖子: 4
精华: 0
经验: 5 点
威望: 3 点
维修币: 3 ￥
魅力: 7
阅读权限: 10

7^# 大中小发表于 2008-7-14 13:30 只看该作者

..RP...人品...某样很神奇的东西......厄......想中500W彩票的话或许透支下10年的RP可以半到...恩..呵呵.家里有正版的杀毒软件....不过因为电脑很多....不缺这台...所以就干脆把他当作DVD和游戏机自用了...后台运行防火墙这种也需一定内存....本本太容易发烫...所以就一直没装了..厄...现在知道错了....病毒真是无处不在.....再次感谢斑竹.......

TOP

shoo

超级版主

Rank: 8 Rank: 8

UID: 33692
帖子: 1221
精华: 1
经验: 11286 点
威望: 564 点
维修币: 20719 ￥
魅力: 2897
阅读权限: 250

8^# 大中小发表于 2008-7-14 13:41 只看该作者

很多好的免费杀软都不怎么拖系统的，不过鉴于你的情况，资源那么丰富，愿意“裸奔”我也不反对，呵呵

只是最后再提醒你下，对于有重要文件、重要信息的电脑，装杀软和网墙是必须的，否则损失很大！

PS:这个帖子就此结贴吧，问题已经解决了。

有中病毒症状的进...（附SREng简要用法）

[原创]流行病*毒专杀以及一些系统优化小工具

如果有电脑维护、病毒清理、论坛管理方面的问题，都可以发消息给我：）

TOP