图 1.
我的电脑中毒了,用线上防毒软体扫描扫出一百多只病毒...
我把看起来像是源头的程式砍掉了,但是我的电脑还是没办法开启某些EXE档,
光碟机还会发生读不到CD和DVD的状况,以下是开启程式时出现的状况图片和SREngLOG.log,
请知道怎么处理的大大们帮帮我>"<谢谢.
[CODE]
2007-08-11,06:52:18
System Repair Engineer 2.5.16.900
Smallfrogs ([url=http://www.KZTechs.com]http://www.KZTechs.com[/url])
Windows XP Home Edition Service Pack 1 (Build 2600) - 管理许可权用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、开机档案夹、服务等）
流览器载入项
正在运行的进程（包括进程模组资讯）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动专案
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<rxsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso.exe> []
<wgsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso.exe> []
<zxsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\zxso.exe> [N/A]
<TIMHost><C:\WINDOWS\TIMHost.exe> [N/A]
<mhsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso.exe> []
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> []
<Smapp><C:\Program Files\Analog Devices\SoundMAX\SMTray.exe> [Analog Devices, Inc.]
<WinDCP32><C:\WINDOWS\WinDCP32.exe> [N/A]
<KVP><C:\WINDOWS\System32\drivers\svchost.exe> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<AVPSrv><C:\WINDOWS\AVPSrv.exe> []
<load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> [N/A]
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> []
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><ztmpri.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
<{22311A42-AC1B-158F-FD32-5674345F23A2}><C:\WINDOWS\System32\dhbpri.dll> [N/A]
<{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\System32\qhbpri.dll> [N/A]
<{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll> [N/A]
<{813AF41A-21B1-131B-1BFC-D2A90DF4A2B8}><C:\WINDOWS\System32\xygpri.dll> [N/A]
<{C51C4AFB-8A3A-6C1E-BA41-C10F02940731}><C:\WINDOWS\System32\sys15.dll> []
<{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\System32\zxgpri.dll> [N/A]
<{4562452F-FA36-BA4F-892A-FF5FBBAC5314}><C:\WINDOWS\System32\mydpri.dll> []
<{32311A42-AC1B-158F-FD32-5674345F23A3}><C:\WINDOWS\System32\dhcpri.dll> [N/A]
<{2F12545B-1212-1314-5679-4512ACEF8902}><C:\WINDOWS\System32\wdbpri.dll> [N/A]
<{759AFD5B-159F-ACD8-954C-ACD545FA6587}><C:\WINDOWS\System32\jzgpri.dll> []
<{D1351752-5628-1547-FFAB-BADC13512AFD}><C:\WINDOWS\System32\ztmpri.dll> []
<{913AF41A-21B1-131B-1BFC-D2A90DF4A2B9}><C:\WINDOWS\System32\xyhpri.dll> []
<{36368135-64FA-BC34-DA32-DCF4FD431C93}><C:\WINDOWS\System32\qhcpri.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
==================================
开机档案夹
[OpenOffice.org 2.2]
<C:\Documents and Settings\black devil\「开始」功能表\程式集\启动\OpenOffice.org 2.2.lnk --> C:\PROGRA~1\OPENOF~1.2\program\QUICKS~1.EXE [N/A]><N>
==================================
服务
[Application Management / AppMgmt][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\System32\Ati2evxx.exe><>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[F0C22735 / F0C22735][Stopped/Auto Start]
<C:\WINDOWS\System32\8AFE9A98.EXE -d><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Remote Help Session Manager / Rasautol][Stopped/Auto Start]
<C:\WINDOWS\System32\ntsokele.exe><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[NetworSVA / Visual Windows][Stopped/Auto Start]
<C:\WINDOWS\System32\wnipsvr.exe -Run><Microsoft Corporation>
==================================
驱动程式
[avast! Asynchronous Virus Monitor / Aavmker4][Running/]
<2 - 系统找不到指定的档案。
><N/A>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[avast! Standard Shield Support / aswMon2][Running/]
<2 - 系统找不到指定的档案。
><N/A>
[aswRdr / aswRdr][Stopped/]
<2 - 系统找不到指定的档案。
><N/A>
[avast! Network Shield Support / aswTdi][Running/]
<2 - 系统找不到指定的档案。
><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
<System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Netgroup Packet Filter / NPF][Running/Manual Start]
<System32\DRIVERS\npf.sys><CACE Technologies>
[直接平行连接埠连结驱动程式 / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SIS AGP Bus Filter / sisagp][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Running/Manual Start]
<System32\DRIVERS\sisnic.sys><SiS Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
==================================
流览器载入项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[收音机(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[ActiveScan Installer Class]
{9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
[a-squared Scanner]
{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
==================================
正在运行的进程
[PID: 452 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 516 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 540 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\system32\Ati2evxx.dll] [, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 584 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 596 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 752 / SYSTEM][C:\WINDOWS\System32\Ati2evxx.exe] [, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 796 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 872 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 952 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1056 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[PID: 1484 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1620 / black devil][C:\WINDOWS\system32\Ati2evxx.exe] [, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1672 / black devil][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\mydpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
[C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\WINDOWS\System32\SHQMANGR.DLL] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Documents and Settings\black devil\桌面\Avast4\ashShell.dll] [ALWIL Software, 4, 7, 1029, 0]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[C:\WINDOWS\System32\tssoft32.acm] [DSP GROUP, INC., 1.01]
[C:\WINDOWS\System32\tsd32.dll] [, ]
[C:\WINDOWS\System32\msadp32.acm] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll] [Sun Microsystems, Inc., 8.0.0.9118]
[C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll] [Sun Microsystems, Inc., 8.0.0.9107]
[C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll] [STLport Consulting, Inc., 4.5.2003.0120]
[C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[C:\PROGRA~1\ATS2\contmenu.dll] [N/A, ]
[PID: 1936 / black devil][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1948 / black devil][C:\Program Files\Analog Devices\SoundMAX\SMTray.exe] [Analog Devices, Inc., 3, 2, 12, 0]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 168 / black devil][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 216 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[PID: 1460 / SYSTEM][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[PID: 1120 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\jzgpri.dll] [N/A, ]
[PID: 2804 / black devil][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[PID: 2252 / black devil][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
[C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[C:\WINDOWS\System32\mydpri.dll] [N/A, ]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\msdmo.dll] [, ]
[C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
[C:\WINDOWS\System32\rmoc3260.dll] [RealNetworks, Inc., 6.0.9.2049]
[C:\WINDOWS\System32\PNCRT.dll] [Real Networks, Inc, 6.0.0.0]
[C:\Program Files\Common Files\Real\Common\pnrs3260.dll] [RealNetworks, Inc., 6.0.9.3775]
[PID: 2808 / black devil][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
[C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\WINDOWS\System32\mydpri.dll] [N/A, ]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
[C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3540 / black devil][C:\Documents and Settings\black devil\桌面\SRENG\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
[C:\Documents and Settings\black devil\桌面\SRENG\Lang\1028.DLL] [System Repair Engineer, 2.5.16.900]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
[C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\WINDOWS\System32\mydpri.dll] [N/A, ]
[C:\Documents and Settings\black devil\桌面\SRENG\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
MSAFD ICMP
C:\WINDOWS\System32\isapir.dll(, N/A)
MSAFD ICMP
C:\WINDOWS\System32\isapir.dll(, N/A)
MSAPI Tcpip [TCP/IP]
C:\WINDOWS\System32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
C:\WINDOWS\System32\mscomm.dll(, N/A)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 2804, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
==================================
API HOOK
N/A
==================================
隐藏进程
N/A
==================================
[/CODE]
