廣告廣告
  加入我的最愛 設為首頁 風格修改
首頁 首尾
 手機版   訂閱   地圖  簡體 
您是第 7052 個閱讀者
 
發表文章 發表投票 回覆文章
  可列印版   加為IE收藏   收藏主題   上一主題 | 下一主題   
amejapan
數位造型
個人文章 個人相簿 個人日記 個人地圖
路人甲
級別: 路人甲 該用戶目前不上站
推文 x0 鮮花 x0
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片
推文 x0
[問題討論] 無法開啟應用程式~

圖 1.



我的電腦中毒了,用線上防毒軟體掃描掃出一百多隻病毒...
我把看起來像是源頭的程式砍掉了,但是我的電腦還是沒辦法開啟某些EXE檔,
光碟機還會發生讀不到CD和DVD的狀況,以下是開啟程式時出現的狀況圖片和SREngLOG.log,
請知道怎麼處理的大大們幫幫我>"<謝謝.




[CODE]
2007-08-11,06:52:18
System Repair Engineer 2.5.16.900
Smallfrogs ([url=http://www.KZTechs.com]http://www.KZTechs.com[/url])
Windows XP Home Edition Service Pack 1 (Build 2600) - 管理許可權用戶 - 完整功能
以下內容被選中:
  所有的啟動項目(包括註冊表、開機檔案夾、服務等)
  流覽器載入項
  正在運行的進程(包括進程模組資訊)
  文件關聯
  Winsock 提供者
  Autorun.inf
  HOSTS 文件
  進程特權掃描

啟動專案
註冊表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
  <MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
  <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
  <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
  <rxsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso.exe> []
  <wgsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso.exe> []
  <zxsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\zxso.exe> [N/A]
  <TIMHost><C:\WINDOWS\TIMHost.exe> [N/A]
  <mhsa><C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso.exe> []
  <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe> []
  <Smapp><C:\Program Files\Analog Devices\SoundMAX\SMTray.exe> [Analog Devices, Inc.]
  <WinDCP32><C:\WINDOWS\WinDCP32.exe> [N/A]
  <KVP><C:\WINDOWS\System32\drivers\svchost.exe> []
  <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
  <upxdnd><C:\WINDOWS\upxdnd.exe> []
  <AVPSrv><C:\WINDOWS\AVPSrv.exe> []
  <load><C:\WINDOWS\uninstall\rundl132.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
  <MSDEG32><LYLoader.exe> [N/A]
  <MSDWG32><LYLoadbr.exe> [N/A]
  <MSDCG32   ><LYLeador.exe> [N/A]
  <MSDOG32><LYLoador.exe> [N/A]
  <MSDSG32><LYLoadar.exe> [N/A]
  <MSDMG32><LYLoadmr.exe> []
  <MSDHG32><LYLoadhr.exe> [N/A]
  <MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
  <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><ztmpri.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  <{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
  <{22311A42-AC1B-158F-FD32-5674345F23A2}><C:\WINDOWS\System32\dhbpri.dll> [N/A]
  <{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\System32\qhbpri.dll> [N/A]
  <{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll> [N/A]
  <{813AF41A-21B1-131B-1BFC-D2A90DF4A2B8}><C:\WINDOWS\System32\xygpri.dll> [N/A]
  <{C51C4AFB-8A3A-6C1E-BA41-C10F02940731}><C:\WINDOWS\System32\sys15.dll> []
  <{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\System32\zxgpri.dll> [N/A]
  <{4562452F-FA36-BA4F-892A-FF5FBBAC5314}><C:\WINDOWS\System32\mydpri.dll> []
  <{32311A42-AC1B-158F-FD32-5674345F23A3}><C:\WINDOWS\System32\dhcpri.dll> [N/A]
  <{2F12545B-1212-1314-5679-4512ACEF8902}><C:\WINDOWS\System32\wdbpri.dll> [N/A]
  <{759AFD5B-159F-ACD8-954C-ACD545FA6587}><C:\WINDOWS\System32\jzgpri.dll> []
  <{D1351752-5628-1547-FFAB-BADC13512AFD}><C:\WINDOWS\System32\ztmpri.dll> []
  <{913AF41A-21B1-131B-1BFC-D2A90DF4A2B9}><C:\WINDOWS\System32\xyhpri.dll> []
  <{36368135-64FA-BC34-DA32-DCF4FD431C93}><C:\WINDOWS\System32\qhcpri.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  <Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
  <N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
  <Windows Messenger><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  <Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
==================================
開機檔案夾
[OpenOffice.org 2.2]
<C:\Documents and Settings\black devil\「開始」功能表\程式集\啟動\OpenOffice.org 2.2.lnk --> C:\PROGRA~1\OPENOF~1.2\program\QUICKS~1.EXE [N/A]><N>
==================================
服務
[Application Management / AppMgmt][Stopped/Manual Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A>
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\System32\Ati2evxx.exe><>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[F0C22735 / F0C22735][Stopped/Auto Start]
<C:\WINDOWS\System32\8AFE9A98.EXE -d><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Remote Help Session Manager / Rasautol][Stopped/Auto Start]
<C:\WINDOWS\System32\ntsokele.exe><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[NetworSVA / Visual Windows][Stopped/Auto Start]
<C:\WINDOWS\System32\wnipsvr.exe -Run><Microsoft Corporation>
==================================
驅動程式
[avast! Asynchronous Virus Monitor / Aavmker4][Running/]
<2 - 系統找不到指定的檔案。
><N/A>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[avast! Standard Shield Support / aswMon2][Running/]
<2 - 系統找不到指定的檔案。
><N/A>
[aswRdr / aswRdr][Stopped/]
<2 - 系統找不到指定的檔案。
><N/A>
[avast! Network Shield Support / aswTdi][Running/]
<2 - 系統找不到指定的檔案。
><N/A>
[ati2mtag / ati2mtag][Running/Manual Start]
<System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Netgroup Packet Filter / NPF][Running/Manual Start]
<System32\DRIVERS\npf.sys><CACE Technologies>
[直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SIS AGP Bus Filter / sisagp][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\sisagp.sys><Silicon Integrated Systems Corporation>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Running/Manual Start]
<System32\DRIVERS\sisnic.sys><SiS Corporation>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
==================================
流覽器載入項
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[收音機(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[ActiveScan Installer Class]
{9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
[a-squared Scanner]
{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
==================================
正在運行的進程
[PID: 452 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 516 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 540 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\system32\Ati2evxx.dll] [, ]
  [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 584 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 596 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 752 / SYSTEM][C:\WINDOWS\System32\Ati2evxx.exe] [, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 796 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 872 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 952 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1056 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
[PID: 1484 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1620 / black devil][C:\WINDOWS\system32\Ati2evxx.exe] [, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1672 / black devil][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\mydpri.dll] [N/A, ]
  [C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
  [C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
  [C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
  [C:\WINDOWS\System32\SHQMANGR.DLL] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
  [C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
  [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\Documents and Settings\black devil\桌面\Avast4\ashShell.dll] [ALWIL Software, 4, 7, 1029, 0]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
  [C:\WINDOWS\System32\tssoft32.acm] [DSP GROUP, INC., 1.01]
  [C:\WINDOWS\System32\tsd32.dll] [, ]
  [C:\WINDOWS\System32\msadp32.acm] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
  [C:\Program Files\WinRAR\rarext.dll] [N/A, ]
  [C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll] [Sun Microsystems, Inc., 8.0.0.9118]
  [C:\Program Files\OpenOffice.org 2.2\program\uwinapi.dll] [Sun Microsystems, Inc., 8.0.0.9107]
  [C:\Program Files\OpenOffice.org 2.2\program\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
  [C:\Program Files\OpenOffice.org 2.2\program\stlport_vc7145.dll] [STLport Consulting, Inc., 4.5.2003.0120]
  [C:\Program Files\OpenOffice.org 2.2\program\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
  [C:\PROGRA~1\ATS2\contmenu.dll] [N/A, ]
[PID: 1936 / black devil][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 1948 / black devil][C:\Program Files\Analog Devices\SoundMAX\SMTray.exe] [Analog Devices, Inc., 3, 2, 12, 0]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 168 / black devil][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
[PID: 216 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
  [C:\WINDOWS\System32\77715F28.DLL] [Microsoft Corporation, ]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
[PID: 1460 / SYSTEM][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 6, 0]
  [C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[PID: 1120 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\system32\jzgpri.dll] [N/A, ]
[PID: 2804 / black devil][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
[PID: 2252 / black devil][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
  [C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
  [C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
  [C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
  [C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
  [C:\WINDOWS\System32\mydpri.dll] [N/A, ]
  [C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
  [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
  [C:\WINDOWS\System32\msdmo.dll] [, ]
  [C:\WINDOWS\System32\l3codeca.acm] [Fraunhofer Institut Integrierte Schaltungen IIS, 1, 9, 0, 0305]
  [C:\WINDOWS\System32\rmoc3260.dll] [RealNetworks, Inc., 6.0.9.2049]
  [C:\WINDOWS\System32\PNCRT.dll] [Real Networks, Inc, 6.0.0.0]
  [C:\Program Files\Common Files\Real\Common\pnrs3260.dll] [RealNetworks, Inc., 6.0.9.3775]
[PID: 2808 / black devil][C:\Program Files\Internet Explorer\IEXPLORE.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
  [C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
  [C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
  [C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
  [C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
  [C:\WINDOWS\System32\mydpri.dll] [N/A, ]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
  [C:\WINDOWS\System32\Macromed\Flash\Flash9d.ocx] [Adobe Systems, Inc., 9,0,47,0]
  [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
  [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3540 / black devil][C:\Documents and Settings\black devil\桌面\SRENG\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
  [C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.3]
  [C:\Documents and Settings\black devil\桌面\SRENG\Lang\1028.DLL] [System Repair Engineer, 2.5.16.900]
  [C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
  [C:\WINDOWS\System32\sys15.dll] [N/A, ]
  [C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
  [C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
  [C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
  [C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
  [C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
  [C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
  [C:\WINDOWS\System32\mydpri.dll] [N/A, ]
  [C:\Documents and Settings\black devil\桌面\SRENG\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
  [C:\WINDOWS\System32\isapir.dll] [N/A, ]
==================================
文件關聯
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
MSAFD ICMP
  C:\WINDOWS\System32\isapir.dll(, N/A)
MSAFD ICMP
  C:\WINDOWS\System32\isapir.dll(, N/A)
MSAPI Tcpip [TCP/IP]
  C:\WINDOWS\System32\mscomm.dll(, N/A)
MSAPI Tcpip [UDP/IP]
  C:\WINDOWS\System32\mscomm.dll(, N/A)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1     localhost
==================================
進程特權掃描
特殊特權被允許: SeLoadDriverPrivilege [PID = 2804, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE]
==================================
API HOOK
N/A
==================================
隱藏進程
N/A
==================================

[/CODE]



獻花 x0 回到頂端 [樓 主] From:臺灣中華電信HINET | Posted:2007-08-11 07:08 |
upside 手機 葫蘆墩家族
個人頭像
個人文章 個人相簿 個人日記 個人地圖
特殊貢獻獎 社區建設獎 優秀管理員勳章
頭銜:反病毒 反詐騙 反虐犬   反病毒 反詐騙 反虐犬  
版主
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片

嗯 被注入了相當多的生成物檔案 看來大都是木馬之類的
要全部清除 可能需要花一些時間

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
<{22311A42-AC1B-158F-FD32-5674345F23A2}><C:\WINDOWS\System32\dhbpri.dll> [N/A]
<{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\System32\qhbpri.dll> [N/A]
<{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll> [N/A]
<{813AF41A-21B1-131B-1BFC-D2A90DF4A2B8}><C:\WINDOWS\System32\xygpri.dll> [N/A]
<{C51C4AFB-8A3A-6C1E-BA41-C10F02940731}><C:\WINDOWS\System32\sys15.dll> []
<{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\System32\zxgpri.dll> [N/A]
<{4562452F-FA36-BA4F-892A-FF5FBBAC5314}><C:\WINDOWS\System32\mydpri.dll> []
<{32311A42-AC1B-158F-FD32-5674345F23A3}><C:\WINDOWS\System32\dhcpri.dll> [N/A]
<{2F12545B-1212-1314-5679-4512ACEF8902}><C:\WINDOWS\System32\wdbpri.dll> [N/A]
<{759AFD5B-159F-ACD8-954C-ACD545FA6587}><C:\WINDOWS\System32\jzgpri.dll> []
<{D1351752-5628-1547-FFAB-BADC13512AFD}><C:\WINDOWS\System32\ztmpri.dll> []
<{913AF41A-21B1-131B-1BFC-D2A90DF4A2B9}><C:\WINDOWS\System32\xyhpri.dll> []
<{36368135-64FA-BC34-DA32-DCF4FD431C93}><C:\WINDOWS\System32\qhcpri.dll> []


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> [N/A]
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32   ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> []
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]


  [C:\WINDOWS\System32\qhcpri.dll] [N/A, ]
[C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys] [N/A, ]
[C:\WINDOWS\System32\sys15.dll] [N/A, ]
[C:\WINDOWS\System32\AVPSrv.dll] [N/A, ]
[C:\WINDOWS\System32\upxdnd.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\rxso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\mhso0.dll] [N/A, ]
[C:\DOCUME~1\BLACKD~1\LOCALS~1\Temp\wgso0.dll] [N/A, ]
[C:\WINDOWS\System32\xyhpri.dll] [N/A, ]
[C:\WINDOWS\System32\jzgpri.dll] [N/A, ]
[C:\WINDOWS\System32\ztmpri.dll] [N/A, ]
[C:\WINDOWS\System32\mydpri.dll] [N/A, ]
[C:\WINDOWS\System32\isapir.dll] [N/A, ]


爸爸 你一路好走
獻花 x0 回到頂端 [1 樓] From:臺灣 | Posted:2007-08-11 10:44 |
amejapan
數位造型
個人文章 個人相簿 個人日記 個人地圖
路人甲
級別: 路人甲 該用戶目前不上站
推文 x0 鮮花 x0
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片

下面是引用upside於2007-08-11 10:44發表的 :
嗯 被注入了相當多的生成物檔案 看來大都是木馬之類的
要全部清除 可能需要花一些時間

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys> []
.......


請問大大ˊˋ
那我現在該做的是把您列舉出來的東西一一殺掉嗎?


獻花 x0 回到頂端 [2 樓] From:臺灣中華電信HINET | Posted:2007-08-11 22:47 |
御用神醫 手機
數位造型
個人文章 個人相簿 個人日記 個人地圖
小人物
級別: 小人物 該用戶目前不上站
推文 x3 鮮花 x27
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片

試試看跑修復是否能修復成功

建議重新安裝系統吧

因為中毒太多 系統不知道

被引進多少病毒 且修改了多少

地方 系統容易不穩


獻花 x0 回到頂端 [3 樓] From:APNIC | Posted:2007-08-23 10:51 |
frank81825 手機
個人文章 個人相簿 個人日記 個人地圖
初露鋒芒
級別: 初露鋒芒 該用戶目前不上站
推文 x37 鮮花 x255
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片

有一招啦
應急的話可以
你能用"命令提示字元"
開啟喔 表情


獻花 x0 回到頂端 [4 樓] From:臺灣 | Posted:2007-08-23 11:02 |

首頁  發表文章 發表投票 回覆文章
Powered by PHPWind v1.3.6
Copyright © 2003-04 PHPWind
Processed in 0.046606 second(s),query:16 Gzip disabled
本站由 瀛睿律師事務所 擔任常年法律顧問 | 免責聲明 | 本網站已依台灣網站內容分級規定處理 | 連絡我們 | 訪客留言