Board logo

标题: 作孽啊作孽......杀毒高手来啊 [打印本页]
作者: xiangjiaosa    时间: 2007-9-13 18:25     标题: 作孽啊作孽......杀毒高手来啊

......这几天.重装了好几次系统-.-病毒还是会在一段时间后滋生出来....
这是什么问题??有木马下载器在我电脑里?每天都会下些乱七八糟的毒....搞的头痛死
我就玩澄海3C..玩到一半也会中毒- -太郁闷了.谁能告诉下么?
病毒有:SOUNDMAN.EXE...8155.EXE....这2个最多..


谁能交下.除了格盘外的方法?
作者: fuland    时间: 2007-9-13 18:28

百毒搜索病毒型号
百毒知道还是很好用的

（虽然很多人说百毒不如Goole，但我觉得百毒快照很好用的说……）
作者: 流泪的稻草人    时间: 2007-9-13 18:31

用不惯google.......
作者: Lisa-K    时间: 2007-9-13 18:31

百毒快照确实很好用的说
作者: xiangjiaosa    时间: 2007-9-13 18:32

....这..百毒.上说是声卡程序...确实..如果是AC97声卡他就是声卡程序
但我显卡不是AC97.这个就是病毒啦.而且还会每次都进注册表.每次开机启动
讨厌死了.........
作者: 喵喵の狗狗    时间: 2007-9-13 18:33

这不是AV终结者么，重装系统的时候不要插网线，然后马上装杀毒软件就行了。
作者: xiangjiaosa    时间: 2007-9-13 18:37

......AV终结者?- - AV看多了就会中了?
LS的确定吗.
作者: 喵喵の狗狗    时间: 2007-9-13 18:39

别用专杀工具了，重装系统，在安装杀毒软件前不要插网线就行了，很容易杀的，记住一点，杀毒必须在安全模式下，不要插网线的杀
作者: xiangjiaosa    时间: 2007-9-13 18:42

...其他盘不会有毒么?
不会像威金那样把EXE边毒么?
作者: 神仙弟弟    时间: 2007-9-13 18:50

我都说了 让LZ 你把 SREng日志 放上来，帮你分析

LZ 自己都不愿意

好比，一个人病了，去医院，告诉医生自己有病，就不愿意去做化验！
帮不了你

[ 本帖最后由 神仙弟弟 于 2007-9-13 19:01 编辑 ]
作者: 淡淡ｄē烟草味    时间: 2007-9-13 19:04

如果是AV終結者病毒,那么安全模式是進不去的.

前天剛幫人處理過此病毒.
作者: xiangjiaosa    时间: 2007-9-13 19:14

啊啊9楼的神仙....再说次好嘛.我好几天么上啦.............
教下怎么发日志
作者: 神仙弟弟    时间: 2007-9-13 19:20

下载 SREng

http://www.kztechs.com/sreng/download.html


解压sreng2.ZIP-->打开SREngPS.exe-->智能扫描-->保存报告

把报告(也就是日志)里面的东西，全部放上来(自己不要修改)
作者: xiangjiaosa    时间: 2007-9-13 19:24

  1. 2007-01-01,19:29:25

  3. System Repair Engineer 2.5.16.900
  4. Smallfrogs ([url]http://www.KZTechs.com[/url])

  6. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

  8. 以下内容被选中：
  9.     所有的启动项目（包括注册表、启动文件夹、服务等）
  10.     浏览器加载项
  11.     正在运行的进程（包括进程模块信息）
  12.     文件关联
  13.     Winsock 提供者
  14.     Autorun.inf
  15.     HOSTS 文件
  16.     进程特权扫描


  19. 启动项目
  20. 注册表
  21. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  22.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  23. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  24.     <w><%SystemRoot%\WinRaR.exe>  [N/A]
  25.     <wm><%SystemRoot%\winlogor.exe>  [N/A]
  26.     <wl><%SystemRoot%\intent.exe>  [N/A]
  27.     <mm><%SystemRoot%\sourro.exe>  []
  28.     <zx><%SystemRoot%\winadr.exe>  [N/A]
  29.     <rx><%SystemRoot%\winnt.exe>  [N/A]
  30.     <aa><%SystemRoot%\SVchont.exe>  [N/A]
  31. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  32.     <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
  33.     <!AVG Anti-Spyware><"F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [(Verified)GRISOFT LTD]
  34.     <SoundMan><SoundMan.exe>  [1]
  35.     <ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe>  []
  36.     <ravgjmon><C:\Program Files\NetMeeting\ravgjmon.exe>  []
  37.     <avpzx><C:\Program Files\NetMeeting\avpzx.exe>  []
  38. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  39.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
  40.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
  41. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  42.     <AppInit_DLLs><kvmxcma.dll>  []
  43. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  44.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
  45. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  46.     <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
  47.     <{1960356A-458E-DE24-BD50-268F589A56A1}><C:\WINDOWS\system32\avwlamn.dll>  []
  48.     <{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}><C:\WINDOWS\system32\kvdxbma.dll>  []
  49.     <{1859245F-345D-BC13-AC4F-145D47DA34F1}><C:\WINDOWS\system32\avzxamn.dll>  [N/A]
  50.     <{E3F426F6-8634-42A5-A29E-BC694A88FB7D}><C:\WINDOWS\system32\xyupri0.dll>  []
  51.     <{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS\system32\rsmyapm.dll>  []
  52.     <{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\system32\rsjzapm.dll>  [N/A]
  53.     <{37D81718-1314-5200-2597-587901018073}><C:\WINDOWS\system32\kaqhczy.dll>  [N/A]
  54.     <{1D561258-45F3-A451-F908-A258458226D1}><C:\WINDOWS\system32\kvdxsama.dll>  [N/A]
  55.     <{D12BC423-3713-224D-3F55-32B35C62B11D}><C:\WINDOWS\system32\WinFormA9.dll>  []
  56.     <{3D47B341-43DF-4563-753F-345FFA3157D3}><C:\WINDOWS\system32\kvmxcma.dll>  []
  57.     <{4F12545B-1212-1314-5679-4512ACEF8904}><C:\WINDOWS\system32\wddpri.dll>  []
  58. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  59.     <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
  60. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  61.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  62. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  63.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  64. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  65.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  66. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  67.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  68. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  69.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  70. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  71.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
  72. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  73.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  74. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  75.     <avpms><; C:\Program Files\NetMeeting\avpms.exe>  []
  76. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  77.     <bgswitch><; C:\WINDOWS\system32\bgswitch.exe>  []
  78.     <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  79. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  80.     <KVMON><; "F:\江民\JiangMin\AntiVirus\KVMonXP.kxp">  [Jiangmin Co.Ltd]
  81.     <ravztmon><; C:\Program Files\NetMeeting\ravztmon.exe>  []
  82.     <SoundMan><; SoundMan.exe>  [1]
  83. ==================================
  84. 启动文件夹
  85. [QQ游戏启动加速程序]
  86.   <C:\Documents and Settings\jh1jcka\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> F:\QQGame\Accel.exe [深圳市腾讯计算机系统有限公司]><N>

  88. ==================================
  89. 服务
  90. [Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  91.   <C:\WINDOWS\system32\Ati2evxx.exe><>
  92. [ATI Smart / ATI Smart][Stopped/Auto Start]
  93.   <C:\WINDOWS\system32\ati2sgag.exe><>
  94. [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Stopped/Auto Start]
  95.   <F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
  96. [DCOM Server Process Launcher / DcomLaunch][Running/Auto Start]
  97.   <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
  98. [Help and Support / helpsvc][Stopped/Auto Start]
  99.   <C:\WINDOWS\system32\ineters.exe-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><Microsoft Corporation>
  100. [Human Interface Device Access / HidServ][Stopped/Disabled]
  101.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  102. [KVSrvXP / KVSrvXP][Running/Auto Start]
  103.   <F:\江民\JiangMin\AntiVirus\kvsrvxp.exe /Service><Jiangmin Co., Ltd.>
  104. [Remote Procedure Call (RPC) / RpcSs][Running/Auto Start]
  105.   <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><>
  106. [Terminal Services / TermService][Running/Manual Start]
  107.   <C:\WINDOWS\System32\svchost -k DComLaunch-->%SystemRoot%\System32\termsrv.dll><Microsoft Corporation>
  108. [VisPlug and Play Removable Storage / tmsscvl][Running/Auto Start]
  109.   <C:\WINDOWS\System32\svchost.exe -k tmsscvl-->c:\windows\system32\eventrep.dll><Microsoft Corporation>
  110. [Windows Media Connect Service / WMConnectCDS][Stopped/Manual Start]
  111.   <C:\Program Files\Windows Media Connect 2\wmccds.exe><Microsoft Corporation>
  112. [Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]
  113.   <C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup-->%SystemRoot%\System32\WUDFSvc.dll><Microsoft Corporation>

  115. ==================================
  116. 驱动程序
  117. [54609 / 54609][Stopped/Manual Start]
  118.   <\??\C:\WINDOWS\system32\Drivers\54578.sys><Driver>
  119. [Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
  120.   <system32\drivers\ac97intc.sys><Intel Corporation>
  121. [acpidisk / acpidisk][Stopped/Auto Start]
  122.   <\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
  123. [ati2mtag / ati2mtag][Running/Manual Start]
  124.   <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
  125. [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  126.   <\??\F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\guard.sys><N/A>
  127. [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  128.   <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
  129. [bipjjn6xu / bipjjn6xu][Running/Auto Start]
  130.   <\??\C:\WINDOWS\system32\drivers\bipjjn6xu.sys><N/A>
  131. [ BsDeamon Application - BsDeamon Application / BsDeamon][Running/System Start]
  132.   <\??\F:\江民\JiangMin\ANTIVI~1\BsDeamon.sys><Jiangmin Co., Ltd.>
  133. [clmkqpxo2 / clmkqpxo24][Running/Boot Start]
  134.   <\SystemRoot\System32\DRIVERS\clmkqpxo24.sys><N/A>
  135. [KRegEx / KRegEx][Running/Auto Start]
  136.   <\??\F:\江民\JiangMin\antivirus\KRegEx.sys><Jiangmin Co. Ltd.>
  137. [Jiangmin Antivirus Software - SysCall Services / KSysCall][Running/System Start]
  138.   <\??\F:\江民\JiangMin\common\KSysCall.sys><Jiangmin Co.,  Ltd.>
  139. [KVFileGuard From Jiangmin / KVFileGuard][Stopped/Manual Start]
  140.   <\??\F:\江民\JiangMin\AntiVirus\KVfg.sys><Jiangmin Co., Ltd.>
  141. [KVRedir From Jiangmin / KVRedir][Running/System Start]
  142.   <\??\F:\江民\JiangMin\AntiVirus\KVREDIR.SYS><Jiangmin Co., Ltd.>
  143. [napjod / napjod][Running/Boot Start]
  144.   <\SystemRoot\\SystemRoot\System32\drivers\napjod.sys><N/A>
  145. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  146.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  147. [Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Running/Manual Start]
  148.   <system32\DRIVERS\RTL8029.SYS><Realtek Semiconductor Corporation>
  149. [Secdrv / Secdrv][Stopped/Manual Start]
  150.   <system32\DRIVERS\secdrv.sys><N/A>
  151. [Jiangmin AntiVirus Software - System Guard / SysGuard][Running/Boot Start]
  152.   <\SystemRoot\system32\Drivers\SysGuard.sys><Jiangmin Co., Ltd.>
  153. [vkhz9n96uj / vkhz9n96uj][Stopped/Auto Start]
  154.   <\??\C:\WINDOWS\system32\drivers\vkhz9n96uj.sys><N/A>
  155. [Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start]
  156.   <system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
  157. [Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start]
  158.   <system32\DRIVERS\wudfrd.sys><Microsoft Corporation>

  160. ==================================
  161. 浏览器加载项
  162. [ThunderAtOnce Class]
  163.   {01443AEC-0FD1-40fd-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
  164. [Info cache]
  165.   {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
  166. [Thunder Browser Helper]
  167.   {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
  168. [BrowseHelper Class]
  169.   {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
  170. [RegisterHelper Class]
  171.   {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} <F:\江民\JiangMin\AntiVirus\UrlGuard.dll, Jiangmin Co., Ltd.>
  172. [启动迅雷5]
  173.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <F:\迅雷\Thunder.exe, Thunder Networking Technologies,LTD>
  174. [番茄花园]
  175.   {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <[url]http://www.tomatolei.com[/url], N/A>
  176. [江民杀毒工具栏]
  177.   {B5A34A93-D538-43A7-8371-864CB6148D12} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
  178. [ThunderAtOnce Class]
  179.   {01443AEC-0FD1-40FD-9C87-E93D1494C233} <F:\迅雷\ComDlls\TDAtOnce_Now.dll, Thunder Networking Technologies,LTD>
  180. [Info cache]
  181.   {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll, 金泰丰(广州)科技有限公司>
  182. [Thunder Agent Class]
  183.   {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <F:\迅雷\ComDlls\ThunderAgent_Now.dll, Thunder Networking Technologies,LTD>
  184. [Thunder Browser Helper]
  185.   {80BF4636-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
  186. [BrowseHelper Class]
  187.   {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
  188. [360SafeLive]
  189.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <F:\360\360safe\live.dll, 360safe.com>
  190. [Thunder Browser Helper]
  191.   {889D2FEB-5411-4565-8998-1DD2C5261283} <F:\迅雷\ComDlls\xunleiBHO_Now.dll, Thunder Networking Technologies,LTD>
  192. [江民杀毒工具栏]
  193.   {B5A34A93-D538-43A7-8371-864CB6148D12} <F:\江民\JiangMin\AntiVirus\KVshell.dll, Jiangmin Co.Ltd>
  194. [RegisterHelper Class]
  195.   {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} <F:\江民\JiangMin\AntiVirus\UrlGuard.dll, Jiangmin Co., Ltd.>
  196. [使用迅雷下载]
  197.   <F:\迅雷\Program\geturl.htm, N/A>
  198. [使用迅雷下载全部链接]
  199.   <F:\迅雷\Program\getallurl.htm, N/A>

  201. ==================================
  202. 正在运行的进程
  203. [PID: 440 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  204. [PID: 496 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  205. [PID: 520 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  206.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  207. [PID: 568 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  208. [PID: 580 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  209. [PID: 752 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  210. [PID: 828 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  211. [PID: 904 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  212.     [C:\WINDOWS\system32\wups2.dll]  [Microsoft Corporation, 7.0.6000.381 (winmain(wmbla).070730-1740)]
  213. [PID: 980 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  214. [PID: 1068 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  215. [PID: 1264 / jh1jcka][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  216.     [F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\shellexecutehook.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
  217.     [C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
  218.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  219.     [C:\WINDOWS\system32\aa0vbnfag.dll]  [N/A, ]
  220.     [C:\WINDOWS\system32\WPDShServiceObj.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
  221.     [C:\WINDOWS\system32\PortableDeviceTypes.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
  222.     [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
  223.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  224.     [F:\江民\JiangMin\AntiVirus\KVshell.dll]  [Jiangmin Co.Ltd, 2, 0, 7, 905]
  225.     [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
  226.     [C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
  227.     [F:\江民\JiangMin\AntiVirus\lang\kvxp0804.lng]  [N/A, ]
  228.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  229.     [C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
  230.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  231.     [C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
  232.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  233.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  234.     [C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
  235.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  236.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  237.     [F:\江民\JiangMin\common\GUIEXT.DLL]  [Jiangmin Co.Ltd, 2, 0, 7, 828]
  238.     [F:\江民\JiangMin\common\lang\guiext0804.lng]  [JiangMin Ltd., 7, 1, 0, 200]
  239.     [F:\迅雷\ComDlls\TDAtOnce_Now.dll]  [Thunder Networking Technologies,LTD, 1.0.5.15]
  240.     [F:\迅雷\ComDlls\xunleiBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 8, 18]
  241.     [F:\迅雷\Components\ResWorker\DsBho_00.dll]  [, 1, 0, 0, 11]
  242.     [F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
  243.     [F:\rar\rarext.dll]  [N/A, ]
  244.     [F:\AVG\新建文件夹\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
  245. [PID: 1308 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  246. [PID: 1696 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  247.     [C:\WINDOWS\System32\rsmyapm.dll]  [N/A, ]
  248.     [c:\windows\system32\eventrep.dll]  [Microsoft Corporation, 6.6.3791.1832]
  249. [PID: 1916 / jh1jcka][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5120]
  250.     [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
  251.     [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5120]
  252.     [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
  253.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  254.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  255.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  256.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  257.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  258.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  259.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  260. [PID: 1424 / jh1jcka][F:\TT\TTraveler.exe]  [Tencent, 3, 7, 305, 201]
  261.     [F:\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
  262.     [F:\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
  263.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  264.     [C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
  265.     [F:\TT\TTNetFavor.dll]  [N/A, ]
  266.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  267.     [F:\江民\JiangMin\AntiVirus\UrlGuard.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 901]
  268.     [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
  269.     [F:\江民\JiangMin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 831]
  270.     [C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
  271.     [F:\江民\JiangMin\Kernel\UNACE.dll]  [N/A, ]
  272.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  273.     [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
  274.     [C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
  275.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  276.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  277.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  278.     [C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
  279.     [C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
  280.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  281.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  282. [PID: 1760 / jh1jcka][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  283.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  284.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  285.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  286.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  287.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  288.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  289.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  290. [PID: 1904 / jh1jcka][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  291.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  292.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  293.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  294.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  295.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  296.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  297.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  298. [PID: 3968 / jh1jcka][F:\迅雷\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.7.2.368]
  299.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  300.     [C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
  301.     [F:\迅雷\Program\TaskManager.dll]  [Thunder Networking Technologies,LTD, 1, 2, 2, 33]
  302.     [F:\迅雷\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
  303.     [F:\迅雷\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
  304.     [F:\迅雷\Program\asyn_dns.dll]  [Thunder Networking Technologies,LTD, 2, 18, 2, 151]
  305.     [F:\迅雷\Program\streammedialib.dll]  [, 1, 1, 2, 49]
  306.     [F:\迅雷\Program\BHOStub.dll]  [Thunder Networking Technologies,LTD, 1, 1, 0, 8]
  307.     [F:\迅雷\Components\DownAndPlay\DownAndPlay.dll]  [, 1, 0, 3, 21]
  308.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  309.     [C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
  310.     [F:\迅雷\Program\iTargetAD.dll]  [Thunder Networking Technologies,LTD, 1, 0, 2, 33]
  311.     [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
  312.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  313.     [F:\迅雷\Program\XLNet.Dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 9]
  314.     [C:\WINDOWS\system32\PortableDeviceApi.dll]  [Microsoft Corporation, 5.2.5358.4827 (WMP_11.060509-2009)]
  315.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  316.     [C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
  317.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  318.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  319.     [C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
  320.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  321.     [F:\迅雷\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 21]
  322.     [F:\迅雷\Components\InMedia\iEmbed12.dll]  [Thunder Networking Technologies,LTD, 3, 4, 3, 93]
  323.     [F:\迅雷\Components\InMedia\PlayerHelper.dll]  [thunder, 1, 1, 0, 24]
  324.     [F:\迅雷\Components\InMedia\XLIPC.DLL]  [N/A, ]
  325.     [F:\迅雷\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 4, 69]
  326.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  327.     [F:\迅雷\Components\Community\XLCommunity.dll]  [Thunder Networking Technologies,LTD, 1, 3, 2, 8]
  328.     [F:\迅雷\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 16, 5, 59]
  329.     [F:\迅雷\Program\MSVCIRT.dll]  [Microsoft Corporation, 7.0.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  330.     [F:\江民\JiangMin\AntiVirus\UrlGuard.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 901]
  331.     [C:\WINDOWS\system32\HiveBase.dll]  [Jiangmin Co., Ltd., 1, 0, 7, 717]
  332.     [F:\江民\JiangMin\Kernel\EngFace.dll]  [Jiangmin Co., Ltd., 2, 0, 7, 831]
  333.     [C:\WINDOWS\system32\kvinstall.dll]  [Jiangmin Co.,Ltd, 2, 0, 7, 831]
  334.     [F:\江民\JiangMin\Kernel\UNACE.dll]  [N/A, ]
  335.     [F:\迅雷\Components\Security\ThunderSafe.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
  336.     [F:\迅雷\Program\ATL71.DLL]  [Microsoft Corporation, 7.10.3077.0]
  337.     [F:\迅雷\Components\Security\XLSafeUI.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
  338.     [F:\迅雷\Components\DownAndPlay\DapPlayer3.0.11.17.dll]  [ShenZhen Thunder Networking Technologies Ltd., 3, 0, 11, 17]
  339.     [F:\迅雷\Components\Search\XLSearch.dll]  [Thunder Networking Technologies,LTD, 1, 1, 5, 18]
  340.     [F:\迅雷\Program\LiveUpdate.dll]  [Thunder Networking Technologies,LTD, 1, 2, 1, 20]
  341.     [F:\迅雷\Plugins\XLSafeHost\XLSafeHost.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 6, 45]
  342.     [F:\迅雷\Plugins\BhoAdv\bho_adv.dll]  [深圳市迅雷网络技术有限公司, 1.0.1.0]
  343.     [F:\迅雷\Components\ExplorerHelper\ExplorerHelper.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 15]
  344.     [F:\迅雷\Components\Tips\TipsClient.dll]  [Thunder Networking Technologies,LTD, 2, 2, 6, 91]
  345.     [F:\迅雷\Components\VPSHELL\VPSHELL.dll]  [XunLei, 1, 3, 0, 18]
  346.     [F:\迅雷\Components\VPSHELL\VideoPicture.dll]  [XunLei, 1, 3, 0, 18]
  347.     [F:\迅雷\Components\UserExperience\UserExperience.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 1]
  348.     [F:\迅雷\Components\ResWorker\DsXlCom.dll]  [, 1, 0, 0, 23]
  349.     [F:\迅雷\Components\ResWorker\DataProcessor_00.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 12]
  350.     [F:\迅雷\Components\ResWorker\MediaWorker.dll]  [Thunder Networking Technologies,LTD, 1, 2, 0, 19]
  351.     [F:\迅雷\Components\Tips\XLIPC.DLL]  [N/A, ]
  352.     [F:\迅雷\Components\DownloadStat\DownloadStat.dll]  [深圳市迅雷网络技术有限公司, 1, 1, 0, 1]
  353. [PID: 368 / jh1jcka][C:\WINDOWS\system32\kvmxcis.exe]  [N/A, ]
  354.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  355.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  356. [PID: 816 / jh1jcka][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  357.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  358.     [C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
  359.     [C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
  360.     [C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
  361.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  362.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  363.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  364.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  365.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  366.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  367.     [C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
  368. [PID: 260 / jh1jcka][F:\日志\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
  369.     [C:\WINDOWS\system32\WinFormA9.dll]  [N/A, ]
  370.     [C:\Program Files\NetMeeting\avpzx.dat]  [N/A, ]
  371.     [C:\Program Files\NetMeeting\ravgjmon.dat]  [N/A, ]
  372.     [C:\Program Files\NetMeeting\ravmsmon.dat]  [N/A, ]
  373.     [C:\WINDOWS\system32\kvmxcma.dll]  [N/A, ]
  374.     [C:\WINDOWS\system32\avwlamn.dll]  [N/A, ]
  375.     [C:\WINDOWS\system32\wddpri.dll]  [N/A, ]
  376.     [C:\WINDOWS\system32\kvdxbma.dll]  [N/A, ]
  377.     [C:\WINDOWS\qiji.dll]  [N/A, ]
  378.     [C:\WINDOWS\system32\rsmyapm.dll]  [N/A, ]
  379.     [C:\WINDOWS\system32\xyupri0.dll]  [N/A, ]
  380.     [F:\日志\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

  382. ==================================
  383. 文件关联
  384. .TXT  Error. [C:\WINDOWS\system32\notep.exe %1]
  385. .EXE  OK. ["%1" %*]
  386. .COM  OK. ["%1" %*]
  387. .PIF  OK. ["%1" %*]
  388. .REG  OK. [regedit.exe "%1"]
  389. .BAT  OK. ["%1" %*]
  390. .SCR  OK. ["%1" /S]
  391. .CHM  Error. ["hh.exe" %1]
  392. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  393. .INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
  394. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  395. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  396. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  397. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  399. ==================================
  400. Winsock 提供者
  401. N/A

  403. ==================================
  404. Autorun.inf
  405. N/A

  407. ==================================
  408. HOSTS 文件
  409. N/A

  411. ==================================
  412. 进程特权扫描
  413. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1916, C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE]
  414. 特殊特权被允许： SeLoadDriverPrivilege [PID = 1424, F:\TT\TTRAVELER.EXE]
  415. 特殊特权被允许： SeLoadDriverPrivilege [PID = 3968, F:\迅雷\PROGRAM\THUNDER5.EXE]
  416. 特殊特权被允许： SeLoadDriverPrivilege [PID = 368, C:\WINDOWS\SYSTEM32\KVMXCIS.EXE]

  418. ==================================
  419. API HOOK
  420. N/A

  422. ==================================
  423. 隐藏进程
  424. N/A

  426. ==================================
复制代码
作者: xiangjiaosa    时间: 2007-9-13 19:25

全发了.神仙解解签...是否有得9
作者: xiangjiaosa    时间: 2007-9-13 19:39

神仙哥哥抛弃我啦
作者: xiangjiaosa    时间: 2007-9-13 20:17

神仙弟弟呢.........................................................................
作者: fuland    时间: 2007-9-13 20:45

飞升成仙了。
作者: xiangjiaosa    时间: 2007-9-13 21:31

那我电脑咋办..人道毁灭让他升天给他修?
作者: fuland    时间: 2007-9-13 21:32

只能怪你的电脑不是鸡或者狗……

(此冷笑话出自“一人得道，鸡犬升天”。)
作者: xiangjiaosa    时间: 2007-9-13 21:41

[m_吃惊] [m_吃惊] [m_吃惊]
请问施主知道神仙住在何地么.我要干到他家去[m_不好] 一路干过去
作者: jally    时间: 2007-9-13 21:57

SOUNDMAN.EXE不是毒吧
作者: xiangjiaosa    时间: 2007-9-13 21:59

[m_吃惊]
声卡AC97时..这是声卡驱动
.........若不是.则是毒
[m_吃惊] 反复测试.这是一只邪恶的毒.
作者: 神仙弟弟    时间: 2007-9-13 22:11

1.建议使用XDelBox删除以下文件：(XDelBox1.5beta下载 或者 Wsyscheck DOS删除Wsyscheck0830下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。 不存在的文件按确定跳过即可

c:\windows\system32\kvmxcis.exe
c:\program files\netmeeting\avpzx.dat
c:\program files\netmeeting\ravgjmon.dat
c:\program files\netmeeting\ravmsmon.dat
c:\windows\qiji.dll
c:\windows\system32\aa0vbnfag.dll
c:\windows\system32\avwlamn.dll
c:\windows\system32\kvdxbma.dll
c:\windows\system32\kvmxcma.dll
c:\windows\system32\rsmyapm.dll
c:\windows\system32\wddpri.dll
c:\windows\system32\winforma9.dll
c:\windows\system32\xyupri0.dll
c:\program files\netmeeting\ravztmon.exe
c:\program files\netmeeting\avpms.exe
c:\windows\system32\kvdxsama.dll
c:\windows\system32\kaqhczy.dll
c:\windows\system32\rsjzapm.dll
c:\windows\system32\avzxamn.dll
c:\program files\netmeeting\avpzx.exe
c:\program files\netmeeting\ravgjmon.exe
c:\program files\netmeeting\ravmsmon.exe
C:\WINDOWS\svchont.exe
C:\WINDOWS\winnt.exe
C:\WINDOWS\winadr.exe
C:\WINDOWS\sourro.exe
C:\WINDOWS\intent.exe
C:\WINDOWS\winlogor.exe
C:\WINDOWS\winrar.exe
C:\WINDOWS\SYSTEM32\soundman.exe
c:\windows\system32\drivers\vkhz9n96uj.sys
c:\windows\\systemroot\system32\drivers\napjod.sys
c:\windows\system32\drivers\clmkqpxo24.sys
c:\windows\system32\drivers\bipjjn6xu.sys
c:\windows\system32\drivers\acpidisk.sys
c:\documents and settings\all users\application data\microsoft\pctools\pctools.dll

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[ravztmon]    <; C:\Program Files\NetMeeting\ravztmon.exe>
[avpms]    <; C:\Program Files\NetMeeting\avpms.exe>
[{4F12545B-1212-1314-5679-4512ACEF8904}]    <C:\WINDOWS\system32\wddpri.dll>
[{3D47B341-43DF-4563-753F-345FFA3157D3}]    <C:\WINDOWS\system32\kvmxcma.dll>
[{D12BC423-3713-224D-3F55-32B35C62B11D}]    <C:\WINDOWS\system32\WinFormA9.dll>
[{1D561258-45F3-A451-F908-A258458226D1}]    <C:\WINDOWS\system32\kvdxsama.dll>
[{37D81718-1314-5200-2597-587901018073}]    <C:\WINDOWS\system32\kaqhczy.dll>
[{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}]    <C:\WINDOWS\system32\rsjzapm.dll>
[{1E32FA58-3453-FA2D-BC49-F340348ACCE1}]    <C:\WINDOWS\system32\rsmyapm.dll>
[{E3F426F6-8634-42A5-A29E-BC694A88FB7D}]    <C:\WINDOWS\system32\xyupri0.dll>
[{1859245F-345D-BC13-AC4F-145D47DA34F1}]    <C:\WINDOWS\system32\avzxamn.dll>
[{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}]    <C:\WINDOWS\system32\kvdxbma.dll>
[{1960356A-458E-DE24-BD50-268F589A56A1}]    <C:\WINDOWS\system32\avwlamn.dll>
注意该项[AppInit_DLLs]修改：把<kvmxcma.dll>修改为<>即清空
[avpzx]    <C:\Program Files\NetMeeting\avpzx.exe>
[ravgjmon]    <C:\Program Files\NetMeeting\ravgjmon.exe>
[ravmsmon]    <C:\Program Files\NetMeeting\ravmsmon.exe>
[aa]    <%SystemRoot%\SVchont.exe>
[rx]    <%SystemRoot%\winnt.exe>
[zx]    <%SystemRoot%\winadr.exe>
[mm]    <%SystemRoot%\sourro.exe>
[wl]    <%SystemRoot%\intent.exe>
[wm]    <%SystemRoot%\winlogor.exe>
[w]    <%SystemRoot%\WinRaR.exe>
[SoundMan]    <SoundMan.exe>

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
[vkhz9n96uj / vkhz9n96uj]    <\??\C:\WINDOWS\system32\drivers\vkhz9n96uj.sys>
[napjod / napjod]    <\SystemRoot\\SystemRoot\System32\drivers\napjod.sys>
[clmkqpxo2 / clmkqpxo24]    <\SystemRoot\System32\DRIVERS\clmkqpxo24.sys>
[bipjjn6xu / bipjjn6xu]    <\??\C:\WINDOWS\system32\drivers\bipjjn6xu.sys>
[acpidisk / acpidisk]    <\??\C:\WINDOWS\system32\drivers\acpidisk.sys>

    系统修复－－　浏览器加载项之如下项删除：
[Info cache]    <C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll>


作者: 神仙弟弟    时间: 2007-9-13 22:13

补充


系统时间修改回当前正确值

打开 SREng ，依次点击“启动项目”->“服务”，点击“Win32 服务应用程序”或“驱动程序”，弹出新窗口中显示“Win32 服务应用程序”或“驱动程序”的内容。
勾选“隐藏已认证的微软项目”，点击选择需要删除的服务或者驱动程序，点选“删除服务”，再点击“设置”按钮，弹出删除确认对话框，点击“否”确认

    系统修复－－ Windows Shell /IE－－全选－－修复

    系统修复－－高级修复－－自动修复

下载windows清理助手清理
http://www.arswp.com/download/arswp2/arswp2.zip

升级杀软扫描c盘一遍

建议:
1. 建议通过Windows Update或的漏洞扫描工具安装好系统补丁程序

[ 本帖最后由 神仙弟弟 于 2007-9-13 22:19 编辑 ]
作者: xiangjiaosa    时间: 2007-9-13 22:32

好强悍.我去试试



欢迎光临 浆糊论坛-RO小站 (http://bbs.rohome.cn/) Powered by Discuz! 7.2