独恋伊影 发表于 2008-5-22 20:53:41

在这里


2008-05-22,20:37:43
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描

启动项目
注册表

    <ctfmon.exe><C:\WINDOWS\system32\CTFMON.EXE>[(Verified)Microsoft Windows Publisher]

    <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r>[(Verified)Qizhi Software (beijing) Co. Ltd]
    <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start>[(Verified)Qizhi Software (beijing) Co. Ltd]
    <360Antiarp><C:\Program Files\360safe\AntiArp\AntiArp.exe /start>[(Verified)Qizhi Software (beijing) Co. Ltd]
    <KavStart><"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KAVStart.exe" -startup>[(Verified)KINGSOFT CORPORATION]
    <IMJPMIG8.1><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>
    <PHIME2002A><; >
    <PHIME2002ASync><; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32>

    <shell><Explorer.exe>[(Verified)Microsoft Windows Component Publisher]
    <Userinit><C:\WINDOWS\system32\UserInit.exe,>[(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>[(Verified)Microsoft Windows Publisher]

    <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll>

    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>

    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>

    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>

    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>

    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>[(Verified)Microsoft Windows Publisher]

    <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>[(Verified)Microsoft Windows Publisher]

    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>[(Verified)Microsoft Windows Publisher]

    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>
==================================
启动文件夹
N/A
==================================
服务

<C:\WINDOWS\System32\3wareSrv.exe><N/A>

<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>

<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>

<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>

<C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KISSvc.EXE><Kingsoft Corporation>

<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KPfwSvc.EXE"><Kingsoft Corporation>

<"C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KWatch.EXE"><Kingsoft Corporation>

<><N/A>

<C:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd>
==================================
驱动程序

<\SystemRoot\System32\DRIVERS\22jn.sys><N/A>

<\??\C:\WINDOWS\system32\drivers\360AntiArp.sys><360安全中心>

<\SystemRoot\System32\DRIVERS\43ecu.sys><N/A>

<system32\drivers\ac97intc.sys><Intel Corporation>

<\SystemRoot\system32\DRIVERS\bb-run.sys><Promise Technology, Inc.>

<\SystemRoot\system32\DRIVERS\DontGo.sys><Promise Technology, Inc.>

<\??\C:\WINDOWS\system32\Drivers\KAVBase.sys><Kingsoft Corporation>

<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>

<\??\C:\WINDOWS\system32\Drivers\KAVSafe.sys><Kingsoft Corporation>

<\??\C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KNetWch.SYS><Kingsoft Corporation>

<\??\C:\WINDOWS\system32\drivers\KWatch3.SYS><Kingsoft Corporation>

<\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys><N/A>

<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>

<\SystemRoot\system32\DRIVERS\nvrd32.sys><NVIDIA Corporation>

<system32\DRIVERS\ProtoDrv.sys><360安全中心>

<\SystemRoot\system32\drivers\pnduojtwbt.sys><N/A>

<system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>

<\SystemRoot\system32\drivers\RsBoot.sys><N/A>

<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>

<\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心>

<system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>

<\SystemRoot\system32\DRIVERS\SiRemFil.sys><Silicon Image, Inc.>

<system32\DRIVERS\sr.sys><N/A>

<\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT>

<\SystemRoot\system32\drivers\unzxzsrs.sys><N/A>

<\SystemRoot\system32\DRIVERS\ViBus.sys><N/A>

<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

<\SystemRoot\system32\DRIVERS\xfilt.sys><VIA Technologies,Inc>

<\SystemRoot\system32\drivers\zhibmaso.sys><N/A>

<System32\Drivers\usbVM31b.sys><Vimicro Corporation>
==================================
浏览器加载项

{AA58ED58-01DD-4d91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>

{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>

{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>

{4045D313-1D5E-4fe4-93A0-A34630B6A00B} <C:\Zcom\E-Space.exe, N/A>
[&Google]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>

{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>

{00EF2092-6AC5-47C0-BD25-CF2D5D657FEB} <c:\program files\google\googletoolbar2.dll, Google Inc.>

{18226BF8-DC0B-4D81-80E9-A41AE37BB73A} <C:\PROGRA~1\PPLive\SYNACA~2.OCX, Synacast>

{22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[&Google]
{2318C2B1-4965-11D4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, Google Inc.>

{25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>

{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>

{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>

{3AECD3C1-7085-4731-96DC-47B6CF7EF749} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\IEBuddyExt.DLL, Kingsoft Corporation>

{48123BC4-99D9-11D1-A6B3-00C04FD91555} <C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation>

{52A2AAAE-085D-4187-97EA-8C30DB990436} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>

{6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

{72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>

{87515F61-A66C-4319-A0E0-D416CB8059E3} <C:\Program Files\360safe\live.dll, 360.cn>

{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>

{986488AF-13D5-9DDF-4FEF-9FB88698CFC1} <C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\USERDATA\webbrowser_2011.dll, N/A>

{AA58ED58-01DD-4D91-8333-CF10577473F7} <c:\program files\google\googletoolbar2.dll, Google Inc.>

{AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} <C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll, Google Inc.>

{B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>

{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, 360.CN>

{BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>

{C728DAB8-FDF5-4CD7-89DD-879D25794C77} <C:\WINDOWS\system32\CCTVKO~1.OCX, Koos>

{CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

{CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

{CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>

{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.>

{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx, Adobe Systems, Inc.>

{D82303B7-A754-4DCB-8AFC-8CF99435AACE} <C:\WINDOWS\system32\KingSoft\KOS\UpdateOcx2.dll, Kingsoft Corporation>

{D963BE1A-6B35-47DB-B002-49FAE71D85CC} <C:\Program Files\Kingsoft\Kingsoft Internet Security 2008\KASBrowserShield.DLL, Kingsoft Corporation>

{E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司>

{F3D0D36F-23F8-4682-A195-74C92B03D4AF} <C:\Program Files\QvodPlayer\QvodInsert.dll, Shenzhen QVOD Technology Co.,Ltd>
[&使用超级旋风下载]
<C:\Program Files\Tencent\QQDownload\geturl.htm, N/A>
[&使用超级旋风下载全部链接]
<C:\Program Files\Tencent\QQDownload\getAllurl.htm, N/A>
[使用迅雷下载]
<, N/A>
[使用迅雷下载全部链接]
<, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
==================================
正在运行的进程
[\SystemRoot\System32\smss.exe]
[\??\C:\WINDOWS\system32\csrss.exe]
[\??\C:\WINDOWS\system32\winlogon.exe]
   








   
   
   
   
   
    [, 1, 0, 101, 20]
   
   
   
   
   

   
   

   
   
   
   

   
   
   

   
   
   
   
   
   
   






   
   
   
   
   
   
   
   
   
   
   
   
    [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
    [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
    [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
    [深圳世强软件开发部 www.wn51.com, 2008, 3, 20, 1]
   
   
   
   
   

   
   
   
   
[任软工作室, 2.2.5.201]
   
   
   
   
    [任软工作室, 2, 2, 1, 94]
[任软工作室, 2.2.5.201]
   
   
   
   

   
   
   
   
   
==================================
文件关联
.TXTOK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXEOK. ["%1" %*]
.COMOK. ["%1" %*]
.PIFOK. ["%1" %*]
.REGOK.
.BATOK. ["%1" %*]
.SCROK. ["%1" /S]
.CHMOK. ["C:\WINDOWS\hh.exe" %1]
.HLPOK. [%SystemRoot%\System32\winhlp32.exe %1]
.INIOK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INFOK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBSOK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNKOK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
N/A
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege
特殊特权被允许： SeDebugPrivilege
特殊特权被允许： SeLoadDriverPrivilege
特殊特权被允许： SeDebugPrivilege
特殊特权被允许： SeLoadDriverPrivilege
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================

傲天♂扬帆 发表于 2008-5-22 21:40:31

跟原始说了，不知道能不能看明白。。。

傲天♂元始 发表于 2008-5-22 22:23:55



2008-05-22,22:24:21

SREngLOG智能分析专家 V1.2.0.125
Tored (http://hi.baidu.com/peaset)

======================================================
以下过程将用到SREng、PowerRmv，如果您不熟悉这两款工具的使用方法，请参考下列链接：
SREng详细操作方法： http://hi.baidu.com/peaset/blog/item/3114a7fb17dd19224e4aeadf.html
PowerRmv详细操作方法： http://hi.baidu.com/peaset/blog/item/e1daf0dd126fb5eb77c63816.html
======================================================

以下是病毒清除步骤：

1、用PowerRmv删除以下文件(没有则跳过)：

; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
;
; C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
C:\WINDOWS\System32\3wareSrv.exe
\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll

\SystemRoot\System32\DRIVERS\22jn.sys
\SystemRoot\System32\DRIVERS\43ecu.sys
\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\ntptdb.sys
\SystemRoot\system32\drivers\pnduojtwbt.sys
\SystemRoot\system32\drivers\RsBoot.sys
system32\DRIVERS\sr.sys
\SystemRoot\system32\drivers\unzxzsrs.sys
\SystemRoot\system32\DRIVERS\ViBus.sys
\SystemRoot\system32\drivers\zhibmaso.sys

2、用SREng删除以下【注册表】项(没有则跳过)：

<IMJPMIG8.1>
<PHIME2002A>
<PHIME2002ASync>

3、用SREng删除【所有启动文件夹】内容(没有则跳过)

4、用SREng删除以下【服务】项(没有则跳过)：




5、用SREng删除以下【驱动程序】项(没有则跳过)：











6、用SREng删除以下【浏览器加载项】项(没有则跳过)：




最后,重新启动计算机.Tored祝您好运!
======================================================

傲天♂元始 发表于 2008-5-22 22:24:30

你就这样弄，不行我也没办法

傲天♂扬帆 发表于 2008-5-23 13:18:44

独恋有按原始说的重新操作一次吗？

独恋伊影 发表于 2008-5-24 20:09:59

找不到要删的文件。。。。

傲天♂元始 发表于 2008-5-25 08:54:35

有些都是隐藏起来的

傲天♂风云 发表于 2008-6-5 03:36:36

yct75fan yct75fan

我对代码 一点都不懂

傲天♂元始 发表于 2008-6-5 14:21:26

。。。这不是代码只是系统的扫描日志而已

傲天♂冷漠 发表于 2008-6-5 18:19:32

我汗~~~
这么多代码~~~
页: [1] 2
查看完整版本: 在这里